[major snippage]

> The only strange interaction I could think of would be with Sun DVMA...
> In those cases, I think the buffer would just have to be mapped into
> kva space, but the caller doesn't have to know that... (Maybe someone
> who knows more of the intracacies of Sun DVMA can clear this up?)

At least on the Sun4m's, all DVMA goes through an IOMMU, which is a 
separate MMU used entirely for I/O. The IOMMU's page tables map a
user-configurable amount of virtual address space, from the *top down*.
Any DVMA buffers *must* be mapped by the IOMMU for DMA to work at all.
Thus, the buffer must be mapped into the top of the VA space, which
turns out to be the kernel address space. On NetBSD/Sparc, the 
valid KVA mapping region runs from 0xfd000000 to 0xfffffff, so all
DMA transfer buffers must get mapped into this chunk of kernel VA. Note
that this can require, in effect, triple-mapping a buffer: once via the
CPU's MMU into the DVMA region, once via the IOMMU into the DVMA
region (you need both of these for consistency in some cases), and
the original CPU-MMU mapping for the object (either elsewhere in 
the kernel (like the buffer cache) or user space).

--Aaron