/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */
/*
 * SCSI (SCSA) midlayer interface for PMC drier.
 */

#include <sys/scsi/adapters/pmcs/pmcs.h>

extern scsi_lun_t scsi_lun64_to_lun(scsi_lun64_t lun64);

static int pmcs_scsa_tran_tgt_init(dev_info_t *, dev_info_t *,
    scsi_hba_tran_t *, struct scsi_device *);
static void pmcs_scsa_tran_tgt_free(dev_info_t *, dev_info_t *,
    scsi_hba_tran_t *, struct scsi_device *);
static int pmcs_scsa_start(struct scsi_address *, struct scsi_pkt *);
static int pmcs_scsa_abort(struct scsi_address *, struct scsi_pkt *);
static int pmcs_scsa_reset(struct scsi_address *, int);
static int pmcs_scsi_reset_notify(struct scsi_address *, int,
    void (*)(caddr_t), caddr_t);
static int pmcs_scsa_getcap(struct scsi_address *, char *, int);
static int pmcs_scsa_setcap(struct scsi_address *, char *, int, int);
static int pmcs_scsa_setup_pkt(struct scsi_pkt *, int (*)(caddr_t), caddr_t);
static void pmcs_scsa_teardown_pkt(struct scsi_pkt *);

static int pmcs_smp_init(dev_info_t *, dev_info_t *, smp_hba_tran_t *,
    smp_device_t *);
static void pmcs_smp_free(dev_info_t *, dev_info_t *, smp_hba_tran_t *,
    smp_device_t *);
static int pmcs_smp_start(struct smp_pkt *);

static int pmcs_scsi_quiesce(dev_info_t *);
static int pmcs_scsi_unquiesce(dev_info_t *);

static int pmcs_cap(struct scsi_address *, char *, int, int, int);
static pmcs_xscsi_t *
    pmcs_addr2xp(struct scsi_address *, uint64_t *, pmcs_cmd_t *);
static int pmcs_SAS_run(pmcs_cmd_t *, pmcwork_t *);
static void pmcs_SAS_done(pmcs_hw_t *, pmcwork_t *, uint32_t *);

static int pmcs_SATA_run(pmcs_cmd_t *, pmcwork_t *);
static void pmcs_SATA_done(pmcs_hw_t *, pmcwork_t *, uint32_t *);
static uint8_t pmcs_SATA_rwparm(uint8_t *, uint32_t *, uint64_t *, uint64_t);

static void pmcs_ioerror(pmcs_hw_t *, pmcs_dtype_t pmcs_dtype,
    pmcwork_t *, uint32_t *, uint32_t);


int
pmcs_scsa_init(pmcs_hw_t *pwp, const ddi_dma_attr_t *ap)
{
        scsi_hba_tran_t *tran;
        ddi_dma_attr_t pmcs_scsa_dattr;
        int flags;

        (void) memcpy(&pmcs_scsa_dattr, ap, sizeof (ddi_dma_attr_t));
        pmcs_scsa_dattr.dma_attr_sgllen =
            ((PMCS_SGL_NCHUNKS - 1) * (PMCS_MAX_CHUNKS - 1)) + PMCS_SGL_NCHUNKS;
        pmcs_scsa_dattr.dma_attr_flags = DDI_DMA_RELAXED_ORDERING;
        pmcs_scsa_dattr.dma_attr_flags |= DDI_DMA_FLAGERR;

        /*
         * Allocate a transport structure
         */
        tran = scsi_hba_tran_alloc(pwp->dip, SCSI_HBA_CANSLEEP);
        if (tran == NULL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "scsi_hba_tran_alloc failed");
                return (DDI_FAILURE);
        }

        tran->tran_hba_private          = pwp;
        tran->tran_tgt_init             = pmcs_scsa_tran_tgt_init;
        tran->tran_tgt_free             = pmcs_scsa_tran_tgt_free;
        tran->tran_start                = pmcs_scsa_start;
        tran->tran_abort                = pmcs_scsa_abort;
        tran->tran_reset                = pmcs_scsa_reset;
        tran->tran_reset_notify         = pmcs_scsi_reset_notify;
        tran->tran_getcap               = pmcs_scsa_getcap;
        tran->tran_setcap               = pmcs_scsa_setcap;
        tran->tran_setup_pkt            = pmcs_scsa_setup_pkt;
        tran->tran_teardown_pkt         = pmcs_scsa_teardown_pkt;
        tran->tran_quiesce              = pmcs_scsi_quiesce;
        tran->tran_unquiesce            = pmcs_scsi_unquiesce;
        tran->tran_interconnect_type    = INTERCONNECT_SAS;
        tran->tran_hba_len              = sizeof (pmcs_cmd_t);

        /*
         * Attach this instance of the hba
         */

        flags = SCSI_HBA_TRAN_SCB | SCSI_HBA_TRAN_CDB | SCSI_HBA_ADDR_COMPLEX |
            SCSI_HBA_TRAN_PHCI | SCSI_HBA_HBA;

        if (scsi_hba_attach_setup(pwp->dip, &pmcs_scsa_dattr, tran, flags)) {
                scsi_hba_tran_free(tran);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "scsi_hba_attach failed");
                return (DDI_FAILURE);
        }
        pwp->tran = tran;

        /*
         * Attach the SMP part of this hba
         */
        pwp->smp_tran = smp_hba_tran_alloc(pwp->dip);
        ASSERT(pwp->smp_tran != NULL);
        pwp->smp_tran->smp_tran_hba_private = pwp;
        pwp->smp_tran->smp_tran_init = pmcs_smp_init;
        pwp->smp_tran->smp_tran_free = pmcs_smp_free;
        pwp->smp_tran->smp_tran_start = pmcs_smp_start;

        if (smp_hba_attach_setup(pwp->dip, pwp->smp_tran) != DDI_SUCCESS) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "smp_hba_attach failed");
                smp_hba_tran_free(pwp->smp_tran);
                pwp->smp_tran = NULL;
                scsi_hba_tran_free(tran);
                return (DDI_FAILURE);
        }

        return (DDI_SUCCESS);
}

/*
 * SCSA entry points
 */

static int
pmcs_scsa_tran_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
    scsi_hba_tran_t *tran, struct scsi_device *sd)
{
        pmcs_hw_t       *pwp = NULL;
        int             rval;
        char            *variant_prop = "sata";
        char            *tgt_port = NULL, *ua = NULL;
        pmcs_xscsi_t    *tgt = NULL;
        pmcs_iport_t    *iport;
        pmcs_lun_t      *lun = NULL;
        pmcs_phy_t      *phyp = NULL;
        uint64_t        lun_num;
        boolean_t       got_scratch = B_FALSE;

        /*
         * First, make sure we're an iport and get the pointer to the HBA
         * node's softstate
         */
        if (scsi_hba_iport_unit_address(hba_dip) == NULL) {
                pmcs_prt(TRAN2PMC(tran), PMCS_PRT_DEBUG_CONFIG, NULL, NULL,
                    "%s: We don't enumerate devices on the HBA node", __func__);
                goto tgt_init_fail;
        }

        pwp = ITRAN2PMC(tran);
        iport = ITRAN2IPORT(tran);

        /*
         * Get the unit-address
         */
        ua = scsi_device_unit_address(sd);
        if (ua == NULL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, NULL, NULL,
                    "%s: Couldn't get UA", __func__);
                pwp = NULL;
                goto tgt_init_fail;
        }
        pmcs_prt(pwp, PMCS_PRT_DEBUG3, NULL, NULL,
            "got ua '%s'", ua);

        /*
         * Get the target address
         */
        rval = scsi_device_prop_lookup_string(sd, SCSI_DEVICE_PROP_PATH,
            SCSI_ADDR_PROP_TARGET_PORT, &tgt_port);
        if (rval != DDI_PROP_SUCCESS) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, NULL, NULL,
                    "Couldn't get target UA");
                pwp = NULL;
                goto tgt_init_fail;
        }
        pmcs_prt(pwp, PMCS_PRT_DEBUG3, NULL, NULL,
            "got tgt_port '%s'", tgt_port);

        /*
         * Validate that this tran_tgt_init is for an active iport.
         */
        if (iport->ua_state == UA_INACTIVE) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: Got tran_tgt_init on inactive iport for '%s'",
                    __func__, tgt_port);
                pwp = NULL;
                goto tgt_init_fail;
        }

        /*
         * Since we're going to wait for scratch, be sure to acquire it while
         * we're not holding any other locks
         */
        (void) pmcs_acquire_scratch(pwp, B_TRUE);
        got_scratch = B_TRUE;

        mutex_enter(&pwp->lock);

        /*
         * See if there's already a target softstate.  If not, allocate one.
         */
        tgt = pmcs_get_target(iport, tgt_port, B_TRUE);

        if (tgt == NULL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG2, NULL, NULL, "%s: "
                    "No tgt for tgt_port (%s)", __func__, tgt_port);
                goto tgt_init_fail;
        }

        phyp = tgt->phy;
        if (!IS_ROOT_PHY(phyp)) {
                pmcs_inc_phy_ref_count(phyp);
        }
        ASSERT(mutex_owned(&phyp->phy_lock));

        pmcs_prt(pwp, PMCS_PRT_DEBUG2, phyp, tgt, "@%s tgt = 0x%p, dip = 0x%p",
            ua, (void *)tgt, (void *)tgt_dip);

        /* Now get the lun */
        lun_num = scsi_device_prop_get_int64(sd, SCSI_DEVICE_PROP_PATH,
            SCSI_ADDR_PROP_LUN64, SCSI_LUN64_ILLEGAL);
        if (lun_num == SCSI_LUN64_ILLEGAL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                    "No LUN for tgt %p", (void *)tgt);
                goto tgt_init_fail;
        }

        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt, "%s: @%s tgt 0x%p phy "
            "0x%p (%s)", __func__, ua, (void *)tgt, (void *)phyp, phyp->path);

        mutex_enter(&tgt->statlock);
        tgt->dtype = phyp->dtype;
        if (tgt->dtype != SAS && tgt->dtype != SATA) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                    "PHY 0x%p went away?", (void *)phyp);
                goto tgt_init_fail;
        }

        /* We don't support SATA devices at LUN > 0. */
        if ((tgt->dtype == SATA) && (lun_num > 0)) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                    "%s: No support for SATA devices at LUN > 0 "
                    "(target = 0x%p)", __func__, (void *)tgt);
                goto tgt_init_fail;
        }

        /*
         * Allocate LU soft state. We use ddi_soft_state_bystr_zalloc instead
         * of kmem_alloc because ddi_soft_state_bystr_zalloc allows us to
         * verify that the framework never tries to initialize two scsi_device
         * structures with the same unit-address at the same time.
         */
        if (ddi_soft_state_bystr_zalloc(tgt->lun_sstate, ua) != DDI_SUCCESS) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG2, phyp, tgt,
                    "Couldn't allocate LU soft state");
                goto tgt_init_fail;
        }

        lun = ddi_soft_state_bystr_get(tgt->lun_sstate, ua);
        if (lun == NULL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG2, phyp, tgt,
                    "Couldn't get LU soft state");
                goto tgt_init_fail;
        }
        scsi_device_hba_private_set(sd, lun);
        lun->lun_num = lun_num;

        /* convert the scsi_lun64_t value to SCSI standard form */
        lun->scsi_lun = scsi_lun64_to_lun(lun_num);

        ASSERT(strlen(ua) < (PMCS_MAX_UA_SIZE - 1));
        bcopy(ua, lun->unit_address, strnlen(ua, PMCS_MAX_UA_SIZE - 1));

        lun->target = tgt;

        /*
         * If this is the first tran_tgt_init, add this target to our list
         */
        if (tgt->target_num == PMCS_INVALID_TARGET_NUM) {
                int target;
                for (target = 0; target < pwp->max_dev; target++) {
                        if (pwp->targets[target] != NULL) {
                                continue;
                        }

                        pwp->targets[target] = tgt;
                        tgt->target_num = (uint16_t)target;
                        break;
                }

                if (target == pwp->max_dev) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                            "Target list full.");
                        goto tgt_init_fail;
                }
        }

        tgt->dip = sd->sd_dev;
        lun->sd = sd;
        list_insert_tail(&tgt->lun_list, lun);

        if (!pmcs_assign_device(pwp, tgt)) {
                pmcs_release_scratch(pwp);
                pwp->targets[tgt->target_num] = NULL;
                tgt->target_num = PMCS_INVALID_TARGET_NUM;
                tgt->phy = NULL;
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                    "%s: pmcs_assign_device failed for target 0x%p",
                    __func__, (void *)tgt);
                goto tgt_init_fail;
        }

        pmcs_release_scratch(pwp);
        tgt->ref_count++;

        (void) scsi_device_prop_update_int(sd, SCSI_DEVICE_PROP_PATH,
            SCSI_ADDR_PROP_TARGET, (uint32_t)(tgt->target_num));

        /* SM-HBA */
        if (tgt->dtype == SATA) {
                /* TCR in PSARC/1997/281 opinion */
                (void) scsi_device_prop_update_string(sd,
                    SCSI_DEVICE_PROP_PATH, "variant", variant_prop);
        }

        tgt->phy_addressable = PMCS_PHY_ADDRESSABLE(phyp);

        if (tgt->phy_addressable) {
                (void) scsi_device_prop_update_int(sd, SCSI_DEVICE_PROP_PATH,
                    SCSI_ADDR_PROP_SATA_PHY, phyp->phynum);
        }

        /* SM-HBA */
        (void) pmcs_smhba_set_scsi_device_props(pwp, phyp, sd);
        /*
         * Make sure attached port and target port pm props are updated
         * By passing in 0s, we're not actually updating any values, but
         * the properties should now get updated on the node.
         */

        mutex_exit(&tgt->statlock);
        pmcs_update_phy_pm_props(phyp, 0, 0, B_TRUE);
        pmcs_unlock_phy(phyp);
        mutex_exit(&pwp->lock);
        scsi_device_prop_free(sd, SCSI_DEVICE_PROP_PATH, tgt_port);
        return (DDI_SUCCESS);

tgt_init_fail:
        scsi_device_hba_private_set(sd, NULL);
        if (got_scratch) {
                pmcs_release_scratch(pwp);
        }
        if (lun) {
                list_remove(&tgt->lun_list, lun);
                ddi_soft_state_bystr_free(tgt->lun_sstate, ua);
        }
        if (phyp) {
                mutex_exit(&tgt->statlock);
                pmcs_unlock_phy(phyp);
                /*
                 * phyp's ref count was incremented in pmcs_new_tport.
                 * We're failing configuration, we now need to decrement it.
                 */
                if (!IS_ROOT_PHY(phyp)) {
                        pmcs_dec_phy_ref_count(phyp);
                }
                phyp->target = NULL;
        }
        if (tgt && tgt->ref_count == 0) {
                ddi_soft_state_bystr_free(iport->tgt_sstate, tgt_port);
        }
        if (pwp) {
                mutex_exit(&pwp->lock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                    "%s: failed for @%s tgt 0x%p phy 0x%p", __func__, ua,
                    (void *)tgt, (void *)phyp);
        }
        if (tgt_port) {
                scsi_device_prop_free(sd, SCSI_DEVICE_PROP_PATH, tgt_port);
        }
        return (DDI_FAILURE);
}

static void
pmcs_scsa_tran_tgt_free(dev_info_t *hba_dip, dev_info_t *tgt_dip,
    scsi_hba_tran_t *tran, struct scsi_device *sd)
{
        _NOTE(ARGUNUSED(hba_dip, tgt_dip));
        pmcs_hw_t       *pwp;
        pmcs_lun_t      *lun;
        pmcs_xscsi_t    *target;
        char            *unit_address;
        pmcs_phy_t      *phyp;

        if (scsi_hba_iport_unit_address(hba_dip) == NULL) {
                pwp = TRAN2PMC(tran);
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, NULL, NULL,
                    "%s: We don't enumerate devices on the HBA node", __func__);
                return;
        }

        lun = (pmcs_lun_t *)scsi_device_hba_private_get(sd);

        ASSERT((lun != NULL) && (lun->target != NULL));
        ASSERT(lun->target->ref_count > 0);

        target = lun->target;
        unit_address = lun->unit_address;
        list_remove(&target->lun_list, lun);

        pwp = ITRAN2PMC(tran);
        mutex_enter(&pwp->lock);
        phyp = target->phy;
        if (phyp) {
                mutex_enter(&phyp->phy_lock);
        }
        mutex_enter(&target->statlock);

        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, target,
            "%s: for @%s tgt 0x%p phy 0x%p", __func__, unit_address,
            (void *)target, (void *)phyp);
        ddi_soft_state_bystr_free(lun->target->lun_sstate, unit_address);

        if (target->recover_wait) {
                mutex_exit(&target->statlock);
                if (phyp) {
                        mutex_exit(&phyp->phy_lock);
                }
                mutex_exit(&pwp->lock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, target, "%s: "
                    "Target 0x%p in device state recovery, fail tran_tgt_free",
                    __func__, (void *)target);
                return;
        }

        /*
         * If this target still has a PHY pointer and that PHY's target pointer
         * has been cleared, then that PHY has been reaped. In that case, there
         * would be no need to decrement the reference count
         */
        if (phyp && !IS_ROOT_PHY(phyp) && phyp->target) {
                pmcs_dec_phy_ref_count(phyp);
        }

        if (--target->ref_count == 0) {
                /*
                 * Remove this target from our list.  The target soft
                 * state will remain, and the device will remain registered
                 * with the hardware unless/until we're told the device
                 * physically went away.
                 */
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, target,
                    "%s: Free target 0x%p (vtgt %d)", __func__, (void *)target,
                    target->target_num);
                pwp->targets[target->target_num] = NULL;
                target->target_num = PMCS_INVALID_TARGET_NUM;
                /* If the PHY has a pointer to this target, clear it */
                if (phyp && (phyp->target == target)) {
                        phyp->target = NULL;
                }
                target->phy = NULL;
                if (phyp) {
                        mutex_exit(&phyp->phy_lock);
                }
                pmcs_destroy_target(target);
        } else {
                mutex_exit(&target->statlock);
                if (phyp) {
                        mutex_exit(&phyp->phy_lock);
                }
        }

        mutex_exit(&pwp->lock);
}

static int
pmcs_scsa_start(struct scsi_address *ap, struct scsi_pkt *pkt)
{
        pmcs_cmd_t *sp = PKT2CMD(pkt);
        pmcs_hw_t *pwp = ADDR2PMC(ap);
        pmcs_xscsi_t *xp;
        boolean_t blocked;
        uint32_t hba_state;

        pmcs_prt(pwp, PMCS_PRT_DEBUG2, NULL, NULL,
            "%s: pkt %p sd %p cdb0=0x%02x dl=%lu", __func__, (void *)pkt,
            (void *)scsi_address_device(&pkt->pkt_address),
            pkt->pkt_cdbp[0] & 0xff, pkt->pkt_dma_len);

        if (pkt->pkt_flags & FLAG_NOINTR) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG3, NULL, NULL,
                    "%s: nointr pkt", __func__);
                return (TRAN_BADPKT);
        }

        sp->cmd_tag = 0;
        pkt->pkt_state = pkt->pkt_statistics = 0;
        pkt->pkt_reason = CMD_INCOMPLETE;

        mutex_enter(&pwp->lock);
        hba_state = pwp->state;
        blocked = pwp->blocked;
        mutex_exit(&pwp->lock);

        if (hba_state != STATE_RUNNING) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: hba dead", __func__);
                return (TRAN_FATAL_ERROR);
        }

        xp = pmcs_addr2xp(ap, NULL, sp);
        if (xp == NULL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG2, NULL, NULL,
                    "%s: dropping due to null target", __func__);
                goto dead_target;
        }
        ASSERT(mutex_owned(&xp->statlock));

        /*
         * First, check to see if the device is gone.
         */
        if (xp->dev_gone) {
                xp->actv_pkts++;
                mutex_exit(&xp->statlock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG3, NULL, xp,
                    "%s: dropping due to dead target 0x%p",
                    __func__, (void *)xp);
                goto dead_target;
        }

        /*
         * If we're blocked (quiesced) just return.
         */
        if (blocked) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: hba blocked", __func__);
                xp->actv_pkts++;
                mutex_exit(&xp->statlock);
                mutex_enter(&xp->wqlock);
                STAILQ_INSERT_TAIL(&xp->wq, sp, cmd_next);
                mutex_exit(&xp->wqlock);
                return (TRAN_ACCEPT);
        }

        /*
         * If we're draining or resetting, queue and return.
         */
        if (xp->draining || xp->resetting || xp->recover_wait) {
                xp->actv_pkts++;
                mutex_exit(&xp->statlock);
                mutex_enter(&xp->wqlock);
                STAILQ_INSERT_TAIL(&xp->wq, sp, cmd_next);
                mutex_exit(&xp->wqlock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG1, NULL, xp,
                    "%s: draining/resetting/recovering (cnt %u)",
                    __func__, xp->actv_cnt);
                /*
                 * By the time we get here, draining or
                 * resetting may have come and gone, not
                 * yet noticing that we had put something
                 * on the wait queue, so schedule a worker
                 * to look at this later.
                 */
                SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                return (TRAN_ACCEPT);
        }

        xp->actv_pkts++;
        mutex_exit(&xp->statlock);

        /*
         * Queue this command to the tail of the wait queue.
         * This keeps us getting commands out of order.
         */
        mutex_enter(&xp->wqlock);
        STAILQ_INSERT_TAIL(&xp->wq, sp, cmd_next);
        mutex_exit(&xp->wqlock);

        /*
         * Now run the queue for this device.
         */
        (void) pmcs_scsa_wq_run_one(pwp, xp);

        return (TRAN_ACCEPT);

dead_target:
        pkt->pkt_state = STATE_GOT_BUS;
        pkt->pkt_reason = CMD_DEV_GONE;
        mutex_enter(&pwp->cq_lock);
        STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
        PMCS_CQ_RUN_LOCKED(pwp);
        mutex_exit(&pwp->cq_lock);
        return (TRAN_ACCEPT);
}

/* Return code 1 = Success */
static int
pmcs_scsa_abort(struct scsi_address *ap, struct scsi_pkt *pkt)
{
        pmcs_hw_t *pwp = ADDR2PMC(ap);
        pmcs_cmd_t *sp = NULL;
        pmcs_xscsi_t *xp = NULL;
        pmcs_phy_t *pptr = NULL;
        pmcs_lun_t *pmcs_lun = (pmcs_lun_t *)
            scsi_device_hba_private_get(scsi_address_device(ap));
        uint32_t tag;
        uint64_t lun;
        pmcwork_t *pwrk;

        mutex_enter(&pwp->lock);
        if (pwp->state != STATE_RUNNING) {
                mutex_exit(&pwp->lock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: hba dead", __func__);
                return (0);
        }
        mutex_exit(&pwp->lock);

        if (pkt == NULL) {
                if (pmcs_lun == NULL) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL, "%s: "
                            "No pmcs_lun_t struct to do ABORT_ALL", __func__);
                        return (0);
                }
                xp = pmcs_lun->target;
                if (xp != NULL) {
                        pptr = xp->phy;
                }
                if (pptr == NULL) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, xp, "%s: pkt is "
                            "NULL. No tgt/phy to do ABORT_ALL", __func__);
                        return (0);
                }
                pmcs_lock_phy(pptr);
                if (pmcs_abort(pwp, pptr, 0, 1, 0)) {
                        pptr->abort_pending = 1;
                        SCHEDULE_WORK(pwp, PMCS_WORK_ABORT_HANDLE);
                }
                pmcs_unlock_phy(pptr);
                return (1);
        }

        sp = PKT2CMD(pkt);
        xp = sp->cmd_target;

        if (sp->cmd_lun) {
                lun = sp->cmd_lun->lun_num;
        } else {
                lun = 0;
        }
        if (xp == NULL) {
                return (0);
        }

        /*
         * See if we have a real work structure associated with this cmd.
         */
        pwrk = pmcs_tag2wp(pwp, sp->cmd_tag, B_FALSE);
        if (pwrk && pwrk->arg == sp) {
                tag = pwrk->htag;
                pptr = pwrk->phy;
                pwrk->timer = 0;        /* we don't time this here */
                ASSERT(pwrk->state == PMCS_WORK_STATE_ONCHIP);
                mutex_exit(&pwrk->lock);
                pmcs_lock_phy(pptr);
                if (pptr->dtype == SAS) {
                        if (pmcs_ssp_tmf(pwp, pptr, SAS_ABORT_TASK, tag, lun,
                            NULL)) {
                                pptr->abort_pending = 1;
                                pmcs_unlock_phy(pptr);
                                SCHEDULE_WORK(pwp, PMCS_WORK_ABORT_HANDLE);
                                return (0);
                        }
                } else {
                        /*
                         * XXX: Was the command that was active an
                         * NCQ I/O command?
                         */
                        pptr->need_rl_ext = 1;
                        if (pmcs_sata_abort_ncq(pwp, pptr)) {
                                pptr->abort_pending = 1;
                                pmcs_unlock_phy(pptr);
                                SCHEDULE_WORK(pwp, PMCS_WORK_ABORT_HANDLE);
                                return (0);
                        }
                }
                pptr->abort_pending = 1;
                pmcs_unlock_phy(pptr);
                SCHEDULE_WORK(pwp, PMCS_WORK_ABORT_HANDLE);
                return (1);
        }
        if (pwrk) {
                mutex_exit(&pwrk->lock);
        }
        /*
         * Okay, those weren't the droids we were looking for.
         * See if the command is on any of the wait queues.
         */
        mutex_enter(&xp->wqlock);
        sp = NULL;
        STAILQ_FOREACH(sp, &xp->wq, cmd_next) {
                if (sp == PKT2CMD(pkt)) {
                        STAILQ_REMOVE(&xp->wq, sp, pmcs_cmd, cmd_next);
                        break;
                }
        }
        mutex_exit(&xp->wqlock);
        if (sp) {
                pkt->pkt_reason = CMD_ABORTED;
                pkt->pkt_statistics |= STAT_ABORTED;
                mutex_enter(&pwp->cq_lock);
                STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
                PMCS_CQ_RUN_LOCKED(pwp);
                mutex_exit(&pwp->cq_lock);
                return (1);
        }
        return (0);
}

/*
 * SCSA reset functions
 */
static int
pmcs_scsa_reset(struct scsi_address *ap, int level)
{
        pmcs_hw_t *pwp = ADDR2PMC(ap);
        pmcs_phy_t *pptr;
        pmcs_xscsi_t *xp;
        uint64_t lun = (uint64_t)-1, *lp = NULL;
        int rval;

        mutex_enter(&pwp->lock);
        if (pwp->state != STATE_RUNNING) {
                mutex_exit(&pwp->lock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: hba dead", __func__);
                return (0);
        }
        mutex_exit(&pwp->lock);

        switch (level)  {
        case RESET_ALL:
                rval = 0;
                break;
        case RESET_LUN:
                /*
                 * Point lp at lun so that pmcs_addr2xp
                 * will fill out the 64 bit lun number.
                 */
                lp = &lun;
                /* FALLTHROUGH */
        case RESET_TARGET:
                xp = pmcs_addr2xp(ap, lp, NULL);
                if (xp == NULL) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                            "%s: no xp found for this scsi address", __func__);
                        return (0);
                }

                if (xp->dev_gone) {
                        mutex_exit(&xp->statlock);
                        pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, xp,
                            "%s: Target 0x%p has gone away", __func__,
                            (void *)xp);
                        return (0);
                }

                /*
                 * If we're already performing this action, or if device
                 * state recovery is already running, just return failure.
                 */
                if (xp->resetting || xp->recover_wait) {
                        mutex_exit(&xp->statlock);
                        return (0);
                }
                xp->reset_wait = 0;
                xp->reset_success = 0;
                xp->resetting = 1;
                pptr = xp->phy;
                mutex_exit(&xp->statlock);

                if (pmcs_reset_dev(pwp, pptr, lun)) {
                        rval = 0;
                } else {
                        rval = 1;
                }

                mutex_enter(&xp->statlock);
                if (rval == 1) {
                        xp->reset_success = 1;
                }
                if (xp->reset_wait) {
                        xp->reset_wait = 0;
                        cv_signal(&xp->reset_cv);
                }
                xp->resetting = 0;
                mutex_exit(&xp->statlock);
                SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                break;
        default:
                rval = 0;
                break;
        }

        return (rval);
}

static int
pmcs_scsi_reset_notify(struct scsi_address *ap, int flag,
    void (*callback)(caddr_t), caddr_t arg)
{
        pmcs_hw_t *pwp = ADDR2PMC(ap);
        return (scsi_hba_reset_notify_setup(ap, flag, callback, arg,
            &pwp->lock, &pwp->reset_notify_listf));
}


static int
pmcs_cap(struct scsi_address *ap, char *cap, int val, int tonly, int set)
{
        _NOTE(ARGUNUSED(val, tonly));
        int cidx, rval = 0;
        pmcs_xscsi_t *xp;

        cidx = scsi_hba_lookup_capstr(cap);
        if (cidx == -1) {
                return (-1);
        }

        xp = pmcs_addr2xp(ap, NULL, NULL);
        if (xp == NULL) {
                return (-1);
        }

        switch (cidx) {
        case SCSI_CAP_DMA_MAX:
        case SCSI_CAP_INITIATOR_ID:
                if (set == 0) {
                        rval = INT_MAX; /* argh */
                }
                break;
        case SCSI_CAP_DISCONNECT:
        case SCSI_CAP_SYNCHRONOUS:
        case SCSI_CAP_WIDE_XFER:
        case SCSI_CAP_PARITY:
        case SCSI_CAP_ARQ:
        case SCSI_CAP_UNTAGGED_QING:
                if (set == 0) {
                        rval = 1;
                }
                break;

        case SCSI_CAP_TAGGED_QING:
                rval = 1;
                break;

        case SCSI_CAP_MSG_OUT:
        case SCSI_CAP_RESET_NOTIFICATION:
        case SCSI_CAP_QFULL_RETRIES:
        case SCSI_CAP_QFULL_RETRY_INTERVAL:
                break;
        case SCSI_CAP_SCSI_VERSION:
                if (set == 0) {
                        rval = SCSI_VERSION_3;
                }
                break;
        case SCSI_CAP_INTERCONNECT_TYPE:
                if (set) {
                        break;
                }
                if (xp->phy_addressable) {
                        rval = INTERCONNECT_SATA;
                } else {
                        rval = INTERCONNECT_SAS;
                }
                break;
        case SCSI_CAP_CDB_LEN:
                if (set == 0) {
                        rval = 16;
                }
                break;
        case SCSI_CAP_LUN_RESET:
                if (set) {
                        break;
                }
                if (xp->dtype == SATA) {
                        rval = 0;
                } else {
                        rval = 1;
                }
                break;
        default:
                rval = -1;
                break;
        }
        mutex_exit(&xp->statlock);
        pmcs_prt(ADDR2PMC(ap), PMCS_PRT_DEBUG3, NULL, NULL,
            "%s: cap %s val %d set %d rval %d",
            __func__, cap, val, set, rval);
        return (rval);
}

/*
 * Returns with statlock held if the xp is found.
 * Fills in pmcs_cmd_t with values if pmcs_cmd_t pointer non-NULL.
 */
static pmcs_xscsi_t *
pmcs_addr2xp(struct scsi_address *ap, uint64_t *lp, pmcs_cmd_t *sp)
{
        pmcs_xscsi_t *xp;
        pmcs_lun_t *lun = (pmcs_lun_t *)
            scsi_device_hba_private_get(scsi_address_device(ap));

        if ((lun == NULL) || (lun->target == NULL)) {
                return (NULL);
        }
        xp = lun->target;
        mutex_enter(&xp->statlock);

        if (xp->dev_gone || (xp->phy == NULL)) {
                /*
                 * This may be a retried packet, so it's possible cmd_target
                 * and cmd_lun may still be populated.  Clear them.
                 */
                if (sp != NULL) {
                        sp->cmd_target = NULL;
                        sp->cmd_lun = NULL;
                }
                mutex_exit(&xp->statlock);
                return (NULL);
        }

        if (sp != NULL) {
                sp->cmd_target = xp;
                sp->cmd_lun = lun;
        }
        if (lp) {
                *lp = lun->lun_num;
        }
        return (xp);
}

static int
pmcs_scsa_getcap(struct scsi_address *ap, char *cap, int whom)
{
        int r;
        if (cap == NULL) {
                return (-1);
        }
        r = pmcs_cap(ap, cap, 0, whom, 0);
        return (r);
}

static int
pmcs_scsa_setcap(struct scsi_address *ap, char *cap, int value, int whom)
{
        int r;
        if (cap == NULL) {
                return (-1);
        }
        r = pmcs_cap(ap, cap, value, whom, 1);
        return (r);
}

static int
pmcs_scsa_setup_pkt(struct scsi_pkt *pkt, int (*callback)(caddr_t),
    caddr_t cbarg)
{
        _NOTE(ARGUNUSED(callback, cbarg));
        pmcs_cmd_t *sp = pkt->pkt_ha_private;

        bzero(sp, sizeof (pmcs_cmd_t));
        sp->cmd_pkt = pkt;
        return (0);
}

static void
pmcs_scsa_teardown_pkt(struct scsi_pkt *pkt)
{
        pmcs_cmd_t *sp = pkt->pkt_ha_private;
        sp->cmd_target = NULL;
        sp->cmd_lun = NULL;
}

static int
pmcs_smp_start(struct smp_pkt *smp_pkt)
{
        struct pmcwork *pwrk;
        pmcs_iport_t *iport;
        const uint_t rdoff = SAS_SMP_MAX_PAYLOAD;
        uint32_t msg[PMCS_MSG_SIZE], *ptr, htag, status;
        uint64_t wwn;
        pmcs_hw_t *pwp;
        pmcs_phy_t *pptr;
        pmcs_xscsi_t *xp;
        uint_t reqsz, rspsz, will_retry;
        int result;

        pwp = smp_pkt->smp_pkt_address->smp_a_hba_tran->smp_tran_hba_private;
        bcopy(smp_pkt->smp_pkt_address->smp_a_wwn, &wwn, SAS_WWN_BYTE_SIZE);

        pmcs_prt(pwp, PMCS_PRT_DEBUG1, NULL, NULL,
            "%s: starting for wwn 0x%" PRIx64, __func__, wwn);

        will_retry = smp_pkt->smp_pkt_will_retry;

        (void) pmcs_acquire_scratch(pwp, B_TRUE);
        reqsz = smp_pkt->smp_pkt_reqsize;
        if (reqsz > SAS_SMP_MAX_PAYLOAD) {
                reqsz = SAS_SMP_MAX_PAYLOAD;
        }
        (void) memcpy(pwp->scratch, smp_pkt->smp_pkt_req, reqsz);

        rspsz = smp_pkt->smp_pkt_rspsize;
        if (rspsz > SAS_SMP_MAX_PAYLOAD) {
                rspsz = SAS_SMP_MAX_PAYLOAD;
        }

        /*
         * The request size from the SMP driver always includes 4 bytes
         * for the CRC. The PMCS chip, however, doesn't want to see those
         * counts as part of the transfer size.
         */
        reqsz -= 4;

        pptr = pmcs_find_phy_by_wwn(pwp, wwn);
        /* PHY is now locked */
        if (pptr == NULL || pptr->dtype != EXPANDER) {
                if (pptr) {
                        pmcs_unlock_phy(pptr);
                }
                pmcs_release_scratch(pwp);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, NULL,
                    "%s: could not find phy", __func__);
                smp_pkt->smp_pkt_reason = ENXIO;
                return (DDI_FAILURE);
        }

        if ((pptr->iport == NULL) || !pptr->valid_device_id) {
                pmcs_unlock_phy(pptr);
                pmcs_release_scratch(pwp);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, pptr->target,
                    "%s: Can't reach PHY %s", __func__, pptr->path);
                smp_pkt->smp_pkt_reason = ENXIO;
                return (DDI_FAILURE);
        }

        pwrk = pmcs_gwork(pwp, PMCS_TAG_TYPE_WAIT, pptr);
        if (pwrk == NULL) {
                pmcs_unlock_phy(pptr);
                pmcs_release_scratch(pwp);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, NULL,
                    "%s: could not get work structure", __func__);
                smp_pkt->smp_pkt_reason = will_retry ? EAGAIN : EBUSY;
                return (DDI_FAILURE);
        }

        pwrk->arg = msg;
        pwrk->dtype = EXPANDER;
        mutex_enter(&pwp->iqp_lock[PMCS_IQ_OTHER]);
        ptr = GET_IQ_ENTRY(pwp, PMCS_IQ_OTHER);
        if (ptr == NULL) {
                pmcs_pwork(pwp, pwrk);
                mutex_exit(&pwp->iqp_lock[PMCS_IQ_OTHER]);
                pmcs_unlock_phy(pptr);
                pmcs_release_scratch(pwp);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: could not get IQ entry", __func__);
                smp_pkt->smp_pkt_reason = will_retry ? EAGAIN :EBUSY;
                return (DDI_FAILURE);
        }
        msg[0] = LE_32(PMCS_HIPRI(pwp, PMCS_OQ_GENERAL, PMCIN_SMP_REQUEST));
        msg[1] = LE_32(pwrk->htag);
        msg[2] = LE_32(pptr->device_id);
        msg[3] = LE_32(SMP_INDIRECT_RESPONSE | SMP_INDIRECT_REQUEST);
        msg[8] = LE_32(DWORD0(pwp->scratch_dma));
        msg[9] = LE_32(DWORD1(pwp->scratch_dma));
        msg[10] = LE_32(reqsz);
        msg[11] = 0;
        msg[12] = LE_32(DWORD0(pwp->scratch_dma+rdoff));
        msg[13] = LE_32(DWORD1(pwp->scratch_dma+rdoff));
        msg[14] = LE_32(rspsz);
        msg[15] = 0;

        COPY_MESSAGE(ptr, msg, PMCS_MSG_SIZE);

        pmcs_hold_iport(pptr->iport);
        iport = pptr->iport;
        pmcs_smp_acquire(iport);
        pwrk->state = PMCS_WORK_STATE_ONCHIP;
        htag = pwrk->htag;
        INC_IQ_ENTRY(pwp, PMCS_IQ_OTHER);
        pmcs_unlock_phy(pptr);
        WAIT_FOR(pwrk, smp_pkt->smp_pkt_timeout * 1000, result);
        pmcs_pwork(pwp, pwrk);
        pmcs_smp_release(iport);
        pmcs_rele_iport(iport);
        pmcs_lock_phy(pptr);
        if (result) {
                pmcs_timed_out(pwp, htag, __func__);
                if (pmcs_abort(pwp, pptr, htag, 0, 0)) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, pptr, pptr->target,
                            "%s: Unable to issue SMP ABORT for htag 0x%08x",
                            __func__, htag);
                } else {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, pptr, pptr->target,
                            "%s: Issuing SMP ABORT for htag 0x%08x",
                            __func__, htag);
                }
                pmcs_unlock_phy(pptr);
                pmcs_release_scratch(pwp);
                smp_pkt->smp_pkt_reason = ETIMEDOUT;
                return (DDI_FAILURE);
        }
        status = LE_32(msg[2]);
        if (status == PMCOUT_STATUS_OVERFLOW) {
                status = PMCOUT_STATUS_OK;
                smp_pkt->smp_pkt_reason = EOVERFLOW;
        }
        if (status != PMCOUT_STATUS_OK) {
                const char *emsg = pmcs_status_str(status);
                if (emsg == NULL) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, pptr, pptr->target,
                            "SMP operation failed (0x%x)", status);
                } else {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, pptr, pptr->target,
                            "SMP operation failed (%s)", emsg);
                }

                if ((status == PMCOUT_STATUS_ERROR_HW_TIMEOUT) ||
                    (status == PMCOUT_STATUS_IO_XFER_OPEN_RETRY_TIMEOUT)) {
                        smp_pkt->smp_pkt_reason =
                            will_retry ? EAGAIN : ETIMEDOUT;
                        result = DDI_FAILURE;
                } else if (status ==
                    PMCOUT_STATUS_OPEN_CNX_ERROR_IT_NEXUS_LOSS) {
                        xp = pptr->target;
                        if (xp == NULL) {
                                smp_pkt->smp_pkt_reason = EIO;
                                result = DDI_FAILURE;
                                goto out;
                        }
                        if (xp->dev_state !=
                            PMCS_DEVICE_STATE_NON_OPERATIONAL) {
                                xp->dev_state =
                                    PMCS_DEVICE_STATE_NON_OPERATIONAL;
                                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, xp->phy,
                                    xp, "%s: Got _IT_NEXUS_LOSS SMP status. "
                                    "Tgt(0x%p) dev_state set to "
                                    "_NON_OPERATIONAL", __func__,
                                    (void *)xp);
                        }
                        /* ABORT any pending commands related to this device */
                        if (pmcs_abort(pwp, pptr, pptr->device_id, 1, 1) != 0) {
                                pptr->abort_pending = 1;
                                smp_pkt->smp_pkt_reason = EIO;
                                result = DDI_FAILURE;
                        }
                } else {
                        smp_pkt->smp_pkt_reason = will_retry ? EAGAIN : EIO;
                        result = DDI_FAILURE;
                }
        } else {
                (void) memcpy(smp_pkt->smp_pkt_rsp,
                    &((uint8_t *)pwp->scratch)[rdoff], rspsz);
                if (smp_pkt->smp_pkt_reason == EOVERFLOW) {
                        result = DDI_FAILURE;
                } else {
                        result = DDI_SUCCESS;
                }
        }
out:
        pmcs_prt(pwp, PMCS_PRT_DEBUG1, pptr, pptr->target,
            "%s: done for wwn 0x%" PRIx64, __func__, wwn);

        pmcs_unlock_phy(pptr);
        pmcs_release_scratch(pwp);
        return (result);
}

static int
pmcs_smp_init(dev_info_t *self, dev_info_t *child,
    smp_hba_tran_t *tran, smp_device_t *smp_sd)
{
        _NOTE(ARGUNUSED(tran, smp_sd));
        pmcs_iport_t *iport;
        pmcs_hw_t *pwp;
        pmcs_xscsi_t *tgt;
        pmcs_phy_t *phy, *pphy;
        uint64_t wwn;
        char *addr, *tgt_port;
        int ua_form = 1;

        iport = ddi_get_soft_state(pmcs_iport_softstate,
            ddi_get_instance(self));
        ASSERT(iport);
        if (iport == NULL)
                return (DDI_FAILURE);
        pwp = iport->pwp;
        ASSERT(pwp);
        if (pwp == NULL)
                return (DDI_FAILURE);

        /* Get "target-port" prop from devinfo node */
        if (ddi_prop_lookup_string(DDI_DEV_T_ANY, child,
            DDI_PROP_DONTPASS | DDI_PROP_NOTPROM,
            SCSI_ADDR_PROP_TARGET_PORT, &tgt_port) != DDI_SUCCESS) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL, "%s: Failed to "
                    "lookup prop ("SCSI_ADDR_PROP_TARGET_PORT")", __func__);
                /* Dont fail _smp_init() because we couldnt get/set a prop */
                return (DDI_SUCCESS);
        }

        /*
         * Validate that this tran_tgt_init is for an active iport.
         */
        if (iport->ua_state == UA_INACTIVE) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: Init on inactive iport for '%s'", __func__, tgt_port);
                ddi_prop_free(tgt_port);
                return (DDI_FAILURE);
        }

        mutex_enter(&pwp->lock);

        /* Retrieve softstate using unit-address */
        tgt = pmcs_get_target(iport, tgt_port, B_TRUE);
        if (tgt == NULL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: tgt softstate not found", __func__);
                ddi_prop_free(tgt_port);
                mutex_exit(&pwp->lock);
                return (DDI_FAILURE);
        }

        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, NULL, tgt, "%s: %s (%s)",
            __func__, ddi_get_name(child), tgt_port);

        mutex_enter(&tgt->statlock);
        phy = tgt->phy;
        ASSERT(mutex_owned(&phy->phy_lock));

        if (IS_ROOT_PHY(phy)) {
                /* Expander attached to HBA - don't ref_count it */
                wwn = pwp->sas_wwns[0];
        } else {
                pmcs_inc_phy_ref_count(phy);

                /*
                 * Parent (in topology) is also an expander
                 * Now that we've increased the ref count on phy, it's OK
                 * to drop the lock so we can acquire the parent's lock.
                 */
                pphy = phy->parent;
                mutex_exit(&tgt->statlock);
                pmcs_unlock_phy(phy);
                pmcs_lock_phy(pphy);
                wwn = pmcs_barray2wwn(pphy->sas_address);
                pmcs_unlock_phy(pphy);
                pmcs_lock_phy(phy);
                mutex_enter(&tgt->statlock);
        }

        /*
         * If this is the 1st smp_init, add this to our list.
         */
        if (tgt->target_num == PMCS_INVALID_TARGET_NUM) {
                int target;
                for (target = 0; target < pwp->max_dev; target++) {
                        if (pwp->targets[target] != NULL) {
                                continue;
                        }

                        pwp->targets[target] = tgt;
                        tgt->target_num = (uint16_t)target;
                        tgt->assigned = 1;
                        tgt->dev_state = PMCS_DEVICE_STATE_OPERATIONAL;
                        break;
                }

                if (target == pwp->max_dev) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, NULL, NULL,
                            "Target list full.");
                        goto smp_init_fail;
                }
        }

        if (!pmcs_assign_device(pwp, tgt)) {
                pwp->targets[tgt->target_num] = NULL;
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, NULL, tgt,
                    "%s: pmcs_assign_device failed for target 0x%p",
                    __func__, (void *)tgt);
                goto smp_init_fail;
        }

        /*
         * Update the attached port and target port pm properties
         */
        tgt->smpd = smp_sd;

        pmcs_unlock_phy(phy);
        mutex_exit(&pwp->lock);

        tgt->ref_count++;
        tgt->dtype = phy->dtype;
        mutex_exit(&tgt->statlock);

        pmcs_update_phy_pm_props(phy, 0, 0, B_TRUE);

        addr = scsi_wwn_to_wwnstr(wwn, ua_form, NULL);
        if (smp_device_prop_update_string(smp_sd, SCSI_ADDR_PROP_ATTACHED_PORT,
            addr) != DDI_SUCCESS) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL, "%s: Failed to set "
                    "prop ("SCSI_ADDR_PROP_ATTACHED_PORT")", __func__);
        }
        (void) scsi_free_wwnstr(addr);
        ddi_prop_free(tgt_port);
        return (DDI_SUCCESS);

smp_init_fail:
        tgt->phy = NULL;
        tgt->target_num = PMCS_INVALID_TARGET_NUM;
        phy->target = NULL;
        if (!IS_ROOT_PHY(phy)) {
                pmcs_dec_phy_ref_count(phy);
        }
        mutex_exit(&tgt->statlock);
        pmcs_unlock_phy(phy);
        mutex_exit(&pwp->lock);
        ddi_soft_state_bystr_free(iport->tgt_sstate, tgt->unit_address);
        ddi_prop_free(tgt_port);
        return (DDI_FAILURE);
}

static void
pmcs_smp_free(dev_info_t *self, dev_info_t *child,
    smp_hba_tran_t *tran, smp_device_t *smp)
{
        _NOTE(ARGUNUSED(tran, smp));
        pmcs_iport_t *iport;
        pmcs_hw_t *pwp;
        pmcs_xscsi_t *tgt;
        pmcs_phy_t *phyp;
        char *tgt_port;

        iport = ddi_get_soft_state(pmcs_iport_softstate,
            ddi_get_instance(self));
        ASSERT(iport);
        if (iport == NULL)
                return;

        pwp = iport->pwp;
        if (pwp == NULL)
                return;
        ASSERT(pwp);

        /* Get "target-port" prop from devinfo node */
        if (ddi_prop_lookup_string(DDI_DEV_T_ANY, child,
            DDI_PROP_DONTPASS | DDI_PROP_NOTPROM,
            SCSI_ADDR_PROP_TARGET_PORT, &tgt_port) != DDI_SUCCESS) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL, "%s: Failed to "
                    "lookup prop ("SCSI_ADDR_PROP_TARGET_PORT")", __func__);
                return;
        }

        /* Retrieve softstate using unit-address */
        mutex_enter(&pwp->lock);
        tgt = ddi_soft_state_bystr_get(iport->tgt_sstate, tgt_port);
        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, NULL, tgt, "%s: %s (%s)", __func__,
            ddi_get_name(child), tgt_port);
        ddi_prop_free(tgt_port);

        if (tgt == NULL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                    "%s: tgt softstate not found", __func__);
                mutex_exit(&pwp->lock);
                return;
        }

        phyp = tgt->phy;
        if (phyp) {
                mutex_enter(&phyp->phy_lock);
                if (!IS_ROOT_PHY(phyp)) {
                        pmcs_dec_phy_ref_count(phyp);
                }
        }
        mutex_enter(&tgt->statlock);

        if (--tgt->ref_count == 0) {
                /*
                 * Remove this target from our list. The softstate
                 * will remain, and the device will remain registered
                 * with the hardware unless/until we're told that the
                 * device physically went away.
                 */
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, NULL, tgt,
                    "Removing target 0x%p (vtgt %d) from target list",
                    (void *)tgt, tgt->target_num);
                pwp->targets[tgt->target_num] = NULL;
                tgt->target_num = PMCS_INVALID_TARGET_NUM;
                /* If the PHY has a pointer to this target, clear it */
                if (phyp && (phyp->target == tgt)) {
                        phyp->target = NULL;
                }
                tgt->phy = NULL;
                pmcs_destroy_target(tgt);
        } else {
                mutex_exit(&tgt->statlock);
        }

        if (phyp) {
                mutex_exit(&phyp->phy_lock);
        }
        mutex_exit(&pwp->lock);
}

static int
pmcs_scsi_quiesce(dev_info_t *dip)
{
        pmcs_hw_t *pwp;
        int totactive = -1;
        pmcs_xscsi_t *xp;
        uint16_t target;

        if (ddi_get_soft_state(pmcs_iport_softstate, ddi_get_instance(dip)))
                return (0);             /* iport */

        pwp  = ddi_get_soft_state(pmcs_softc_state, ddi_get_instance(dip));
        if (pwp == NULL) {
                return (-1);
        }
        mutex_enter(&pwp->lock);
        if (pwp->state != STATE_RUNNING) {
                mutex_exit(&pwp->lock);
                return (-1);
        }

        pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL, "%s called", __func__);
        pwp->quiesced = pwp->blocked = 1;
        while (totactive) {
                totactive = 0;
                for (target = 0; target < pwp->max_dev; target++) {
                        xp = pwp->targets[target];
                        if (xp == NULL) {
                                continue;
                        }
                        mutex_enter(&xp->statlock);
                        if (xp->actv_cnt) {
                                totactive += xp->actv_cnt;
                                xp->draining = 1;
                        }
                        mutex_exit(&xp->statlock);
                }
                if (totactive) {
                        cv_wait(&pwp->drain_cv, &pwp->lock);
                }
                /*
                 * The pwp->blocked may have been reset. e.g a SCSI bus reset
                 */
                pwp->blocked = 1;
        }

        for (target = 0; target < pwp->max_dev; target++) {
                xp = pwp->targets[target];
                if (xp == NULL) {
                        continue;
                }
                mutex_enter(&xp->statlock);
                xp->draining = 0;
                mutex_exit(&xp->statlock);
        }

        mutex_exit(&pwp->lock);
        if (totactive == 0) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, xp,
                    "%s drain complete", __func__);
        }
        return (0);
}

static int
pmcs_scsi_unquiesce(dev_info_t *dip)
{
        pmcs_hw_t *pwp;

        if (ddi_get_soft_state(pmcs_iport_softstate, ddi_get_instance(dip)))
                return (0);             /* iport */

        pwp  = ddi_get_soft_state(pmcs_softc_state, ddi_get_instance(dip));
        if (pwp == NULL) {
                return (-1);
        }
        mutex_enter(&pwp->lock);
        if (pwp->state != STATE_RUNNING) {
                mutex_exit(&pwp->lock);
                return (-1);
        }
        pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL, "%s called", __func__);
        pwp->blocked = pwp->quiesced = 0;
        mutex_exit(&pwp->lock);

        /*
         * Run all pending commands.
         */
        pmcs_scsa_wq_run(pwp);

        /*
         * Complete all completed commands.
         * This also unlocks us.
         */
        PMCS_CQ_RUN(pwp);
        return (0);
}

/*
 * Start commands for a particular device
 * If the actual start of a command fails, return B_FALSE.  Any other result
 * is a B_TRUE return.
 */
boolean_t
pmcs_scsa_wq_run_one(pmcs_hw_t *pwp, pmcs_xscsi_t *xp)
{
        pmcs_cmd_t *sp;
        pmcs_phy_t *phyp;
        pmcwork_t *pwrk;
        boolean_t run_one, blocked;
        int rval;

        /*
         * First, check to see if we're blocked or resource limited
         */
        mutex_enter(&pwp->lock);
        blocked = pwp->blocked;
        /*
         * If resource_limited is set, we're resource constrained and
         * we will run only one work request for this target.
         */
        run_one = pwp->resource_limited;
        mutex_exit(&pwp->lock);

        if (blocked) {
                /* Queues will get restarted when we get unblocked */
                return (B_TRUE);
        }

        /*
         * Might as well verify the queue is not empty before moving on
         */
        mutex_enter(&xp->wqlock);
        if (STAILQ_EMPTY(&xp->wq)) {
                mutex_exit(&xp->wqlock);
                return (B_TRUE);
        }
        mutex_exit(&xp->wqlock);

        /*
         * If we're draining or resetting, just reschedule work queue and bail.
         */
        mutex_enter(&xp->statlock);
        if (xp->draining || xp->resetting || xp->special_running ||
            xp->special_needed) {
                mutex_exit(&xp->statlock);
                SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                return (B_TRUE);
        }

        /*
         * Next, check to see if the target is gone.
         */
        if (xp->dev_gone) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, xp,
                    "%s: Flushing wait queue for dead tgt 0x%p", __func__,
                    (void *)xp);
                pmcs_flush_target_queues(pwp, xp, PMCS_TGT_WAIT_QUEUE);
                mutex_exit(&xp->statlock);
                return (B_TRUE);
        }

        /*
         * Increment the PHY's ref_count now so we know it won't go away
         * after we drop the target lock.  Drop it before returning.  If the
         * PHY dies, the commands we attempt to send will fail, but at least
         * we know we have a real PHY pointer.
         */
        phyp = xp->phy;
        pmcs_inc_phy_ref_count(phyp);
        mutex_exit(&xp->statlock);

        mutex_enter(&xp->wqlock);
        while ((sp = STAILQ_FIRST(&xp->wq)) != NULL) {
                pwrk = pmcs_gwork(pwp, PMCS_TAG_TYPE_CBACK, phyp);
                if (pwrk == NULL) {
                        mutex_exit(&xp->wqlock);
                        mutex_enter(&pwp->lock);
                        if (pwp->resource_limited == 0) {
                                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, NULL,
                                    "%s: out of work structures", __func__);
                        }
                        pwp->resource_limited = 1;
                        SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                        mutex_exit(&pwp->lock);
                        return (B_FALSE);
                }
                STAILQ_REMOVE_HEAD(&xp->wq, cmd_next);
                mutex_exit(&xp->wqlock);

                pwrk->xp = xp;
                pwrk->arg = sp;
                pwrk->timer = 0;
                sp->cmd_tag = pwrk->htag;

                pwrk->dtype = xp->dtype;

                if (xp->dtype == SAS) {
                        pwrk->ptr = (void *) pmcs_SAS_done;
                        if ((rval = pmcs_SAS_run(sp, pwrk)) != 0) {
                                if (rval != PMCS_WQ_RUN_FAIL_RES_CMP) {
                                        sp->cmd_tag = 0;
                                }
                                pmcs_dec_phy_ref_count(phyp);
                                pmcs_pwork(pwp, pwrk);
                                SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                                if (rval == PMCS_WQ_RUN_FAIL_RES) {
                                        return (B_FALSE);
                                } else {
                                        return (B_TRUE);
                                }
                        }
                } else {
                        ASSERT(xp->dtype == SATA);
                        pwrk->ptr = (void *) pmcs_SATA_done;
                        if ((rval = pmcs_SATA_run(sp, pwrk)) != 0) {
                                sp->cmd_tag = 0;
                                pmcs_dec_phy_ref_count(phyp);
                                pmcs_pwork(pwp, pwrk);
                                SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                                if (rval == PMCS_WQ_RUN_FAIL_RES) {
                                        return (B_FALSE);
                                } else {
                                        return (B_TRUE);
                                }
                        }
                }

                if (run_one) {
                        goto wq_out;
                }
                mutex_enter(&xp->wqlock);
        }

        mutex_exit(&xp->wqlock);

wq_out:
        pmcs_dec_phy_ref_count(phyp);
        return (B_TRUE);
}

/*
 * Start commands for all devices.
 */
void
pmcs_scsa_wq_run(pmcs_hw_t *pwp)
{
        pmcs_xscsi_t *xp;
        uint16_t target_start, target;
        boolean_t       rval = B_TRUE;

        mutex_enter(&pwp->lock);
        target_start = pwp->last_wq_dev;
        target = target_start;

        do {
                xp = pwp->targets[target];
                if ((xp == NULL) || (STAILQ_EMPTY(&xp->wq))) {
                        if (++target == pwp->max_dev) {
                                target = 0;
                        }
                        continue;
                }

                mutex_exit(&pwp->lock);
                rval = pmcs_scsa_wq_run_one(pwp, xp);
                mutex_enter(&pwp->lock);

                if (rval == B_FALSE) {
                        break;
                }

                if (++target == pwp->max_dev) {
                        target = 0;
                }
        } while (target != target_start);

        if (rval) {
                /*
                 * If we were resource limited, but apparently are not now,
                 * reschedule the work queues anyway.
                 */
                if (pwp->resource_limited) {
                        SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                }
                pwp->resource_limited = 0; /* Not resource-constrained */
        } else {
                /*
                 * Give everybody a chance, and reschedule to run the queues
                 * again as long as we're limited.
                 */
                pwp->resource_limited = 1;
                SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
        }

        pwp->last_wq_dev = target;
        mutex_exit(&pwp->lock);
}

/*
 * Pull the completion queue, drop the lock and complete all elements.
 */

void
pmcs_scsa_cq_run(void *arg)
{
        pmcs_cq_thr_info_t *cqti = (pmcs_cq_thr_info_t *)arg;
        pmcs_hw_t *pwp = cqti->cq_pwp;
        pmcs_cmd_t *sp, *nxt;
        struct scsi_pkt *pkt;
        pmcs_xscsi_t *tgt;
        pmcs_iocomp_cb_t *ioccb, *ioccb_next;
        pmcs_cb_t callback;

        DTRACE_PROBE1(pmcs__scsa__cq__run__start, pmcs_cq_thr_info_t *, cqti);

        mutex_enter(&pwp->cq_lock);

        while (!pwp->cq_info.cq_stop) {
                /*
                 * First, check the I/O completion callback queue.
                 */
                ioccb = pwp->iocomp_cb_head;
                pwp->iocomp_cb_head = NULL;
                pwp->iocomp_cb_tail = NULL;
                mutex_exit(&pwp->cq_lock);

                while (ioccb) {
                        /*
                         * Grab the lock on the work structure. The callback
                         * routine is responsible for clearing it.
                         */
                        mutex_enter(&ioccb->pwrk->lock);
                        ioccb_next = ioccb->next;
                        callback = (pmcs_cb_t)ioccb->pwrk->ptr;
                        (*callback)(pwp, ioccb->pwrk,
                            (uint32_t *)((void *)ioccb->iomb));
                        kmem_cache_free(pwp->iocomp_cb_cache, ioccb);
                        ioccb = ioccb_next;
                }

                /*
                 * Next, run the completion queue
                 */
                mutex_enter(&pwp->cq_lock);
                sp = STAILQ_FIRST(&pwp->cq);
                STAILQ_INIT(&pwp->cq);
                mutex_exit(&pwp->cq_lock);

                DTRACE_PROBE1(pmcs__scsa__cq__run__start__loop,
                    pmcs_cq_thr_info_t *, cqti);

                if (sp && pmcs_check_acc_dma_handle(pwp)) {
                        ddi_fm_service_impact(pwp->dip, DDI_SERVICE_UNAFFECTED);
                }

                while (sp) {
                        nxt = STAILQ_NEXT(sp, cmd_next);
                        pkt = CMD2PKT(sp);
                        tgt = sp->cmd_target;
                        pmcs_prt(pwp, PMCS_PRT_DEBUG3, NULL, tgt,
                            "%s: calling completion on %p for tgt %p", __func__,
                            (void *)sp, (void *)tgt);
                        if (tgt) {
                                mutex_enter(&tgt->statlock);
                                ASSERT(tgt->actv_pkts != 0);
                                tgt->actv_pkts--;
                                mutex_exit(&tgt->statlock);
                        }
                        scsi_hba_pkt_comp(pkt);
                        sp = nxt;
                }

                DTRACE_PROBE1(pmcs__scsa__cq__run__end__loop,
                    pmcs_cq_thr_info_t *, cqti);

                /*
                 * Check if there are more completions to do.  If so, and we've
                 * not been told to stop, skip the wait and cycle through again.
                 */
                mutex_enter(&pwp->cq_lock);
                if ((pwp->iocomp_cb_head == NULL) && STAILQ_EMPTY(&pwp->cq) &&
                    !pwp->cq_info.cq_stop) {
                        mutex_exit(&pwp->cq_lock);
                        mutex_enter(&cqti->cq_thr_lock);
                        cv_wait(&cqti->cq_cv, &cqti->cq_thr_lock);
                        mutex_exit(&cqti->cq_thr_lock);
                        mutex_enter(&pwp->cq_lock);
                }
        }

        mutex_exit(&pwp->cq_lock);
        DTRACE_PROBE1(pmcs__scsa__cq__run__stop, pmcs_cq_thr_info_t *, cqti);
        thread_exit();
}

/*
 * Run a SAS command.  Called with pwrk->lock held, returns unlocked.
 */
static int
pmcs_SAS_run(pmcs_cmd_t *sp, pmcwork_t *pwrk)
{
        pmcs_hw_t *pwp = CMD2PMC(sp);
        struct scsi_pkt *pkt = CMD2PKT(sp);
        pmcs_xscsi_t *xp = pwrk->xp;
        uint32_t iq, lhtag, *ptr;
        sas_ssp_cmd_iu_t sc;
        int sp_pkt_time = 0;

        ASSERT(xp != NULL);
        mutex_enter(&xp->statlock);
        if (!xp->assigned) {
                mutex_exit(&xp->statlock);
                return (PMCS_WQ_RUN_FAIL_OTHER);
        }
        if ((xp->actv_cnt >= xp->qdepth) || xp->recover_wait) {
                mutex_exit(&xp->statlock);
                mutex_enter(&xp->wqlock);
                STAILQ_INSERT_HEAD(&xp->wq, sp, cmd_next);
                mutex_exit(&xp->wqlock);
                return (PMCS_WQ_RUN_FAIL_OTHER);
        }
        GET_IO_IQ_ENTRY(pwp, ptr, pwrk->phy->device_id, iq);
        if (ptr == NULL) {
                mutex_exit(&xp->statlock);
                /*
                 * This is a temporary failure not likely to unblocked by
                 * commands completing as the test for scheduling the
                 * restart of work is a per-device test.
                 */
                mutex_enter(&xp->wqlock);
                STAILQ_INSERT_HEAD(&xp->wq, sp, cmd_next);
                mutex_exit(&xp->wqlock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, xp,
                    "%s: Failed to get IO IQ entry for tgt %d",
                    __func__, xp->target_num);
                return (PMCS_WQ_RUN_FAIL_RES);

        }

        ptr[0] =
            LE_32(PMCS_IOMB_IN_SAS(PMCS_OQ_IODONE, PMCIN_SSP_INI_IO_START));
        ptr[1] = LE_32(pwrk->htag);
        ptr[2] = LE_32(pwrk->phy->device_id);
        ptr[3] = LE_32(pkt->pkt_dma_len);
        if (ptr[3]) {
                ASSERT(pkt->pkt_numcookies);
                if (pkt->pkt_dma_flags & DDI_DMA_READ) {
                        ptr[4] = LE_32(PMCIN_DATADIR_2_INI);
                } else {
                        ptr[4] = LE_32(PMCIN_DATADIR_2_DEV);
                }
                if (pmcs_dma_load(pwp, sp, ptr)) {
                        mutex_exit(&pwp->iqp_lock[iq]);
                        mutex_exit(&xp->statlock);
                        mutex_enter(&xp->wqlock);
                        if (STAILQ_EMPTY(&xp->wq)) {
                                STAILQ_INSERT_HEAD(&xp->wq, sp, cmd_next);
                                mutex_exit(&xp->wqlock);
                                return (PMCS_WQ_RUN_FAIL_RES);
                        } else {
                                mutex_exit(&xp->wqlock);
                                CMD2PKT(sp)->pkt_scbp[0] = STATUS_QFULL;
                                CMD2PKT(sp)->pkt_reason = CMD_CMPLT;
                                CMD2PKT(sp)->pkt_state |= STATE_GOT_BUS |
                                    STATE_GOT_TARGET | STATE_SENT_CMD |
                                    STATE_GOT_STATUS;
                                sp->cmd_tag = 0;
                                mutex_enter(&pwp->cq_lock);
                                STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
                                PMCS_CQ_RUN_LOCKED(pwp);
                                mutex_exit(&pwp->cq_lock);
                                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, xp,
                                    "%s: Failed to dma_load for tgt %d (QF)",
                                    __func__, xp->target_num);
                                return (PMCS_WQ_RUN_FAIL_RES_CMP);
                        }
                }
        } else {
                ptr[4] = LE_32(PMCIN_DATADIR_NONE);
                CLEAN_MESSAGE(ptr, 12);
        }
        xp->actv_cnt++;
        if (xp->actv_cnt > xp->maxdepth) {
                xp->maxdepth = xp->actv_cnt;
                pmcs_prt(pwp, PMCS_PRT_DEBUG2, pwrk->phy, xp, "%s: max depth "
                    "now %u", pwrk->phy->path, xp->maxdepth);
        }
        mutex_exit(&xp->statlock);


#ifdef  DEBUG
        /*
         * Generate a PMCOUT_STATUS_XFER_CMD_FRAME_ISSUED
         * event when this goes out on the wire.
         */
        ptr[4] |= PMCIN_MESSAGE_REPORT;
#endif
        /*
         * Fill in the SSP IU
         */

        bzero(&sc, sizeof (sas_ssp_cmd_iu_t));
        bcopy((uint8_t *)&sp->cmd_lun->scsi_lun, sc.lun, sizeof (scsi_lun_t));

        switch (pkt->pkt_flags & FLAG_TAGMASK) {
        case FLAG_HTAG:
                sc.task_attribute = SAS_CMD_TASK_ATTR_HEAD;
                break;
        case FLAG_OTAG:
                sc.task_attribute = SAS_CMD_TASK_ATTR_ORDERED;
                break;
        case FLAG_STAG:
        default:
                sc.task_attribute = SAS_CMD_TASK_ATTR_SIMPLE;
                break;
        }
        (void) memcpy(sc.cdb, pkt->pkt_cdbp,
            min(SCSA_CDBLEN(sp), sizeof (sc.cdb)));
        (void) memcpy(&ptr[5], &sc, sizeof (sas_ssp_cmd_iu_t));
        pwrk->state = PMCS_WORK_STATE_ONCHIP;
        lhtag = pwrk->htag;
        mutex_exit(&pwrk->lock);
        pmcs_prt(pwp, PMCS_PRT_DEBUG2, NULL, NULL,
            "%s: giving pkt %p (tag %x) to the hardware", __func__,
            (void *)pkt, pwrk->htag);
#ifdef DEBUG
        pmcs_print_entry(pwp, PMCS_PRT_DEBUG3, "SAS INI Message", ptr);
#endif
        mutex_enter(&xp->aqlock);
        STAILQ_INSERT_TAIL(&xp->aq, sp, cmd_next);
        mutex_exit(&xp->aqlock);
        sp_pkt_time = CMD2PKT(sp)->pkt_time;
        INC_IQ_ENTRY(pwp, iq);
        mutex_enter(&pwrk->lock);
        if (lhtag == pwrk->htag) {
                pwrk->timer = US2WT(sp_pkt_time * 1000000);
                if (pwrk->timer == 0) {
                        pwrk->timer = US2WT(1000000);
                }
        }
        mutex_exit(&pwrk->lock);

        /*
         * If we just submitted the last command queued from device state
         * recovery, clear the wq_recovery_tail pointer.
         */
        mutex_enter(&xp->wqlock);
        if (xp->wq_recovery_tail == sp) {
                xp->wq_recovery_tail = NULL;
        }
        mutex_exit(&xp->wqlock);

        return (PMCS_WQ_RUN_SUCCESS);
}

/*
 * Complete a SAS command
 *
 * Called with pwrk lock held.
 * The free of pwrk releases the lock.
 */

static void
pmcs_SAS_done(pmcs_hw_t *pwp, pmcwork_t *pwrk, uint32_t *msg)
{
        pmcs_cmd_t *sp = pwrk->arg;
        pmcs_phy_t *pptr = pwrk->phy;
        pmcs_xscsi_t *xp = pwrk->xp;
        struct scsi_pkt *pkt = CMD2PKT(sp);
        int dead;
        uint32_t sts;
        boolean_t aborted = B_FALSE;
        boolean_t do_ds_recovery = B_FALSE;

        ASSERT(xp != NULL);
        ASSERT(sp != NULL);
        ASSERT(pptr != NULL);

        DTRACE_PROBE4(pmcs__io__done, uint64_t, pkt->pkt_dma_len, int,
            (pkt->pkt_dma_flags & DDI_DMA_READ) != 0, hrtime_t, pwrk->start,
            hrtime_t, gethrtime());

        dead = pwrk->dead;

        if (msg) {
                sts = LE_32(msg[2]);
        } else {
                sts = 0;
        }

        if (dead != 0) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp, "%s: dead cmd tag "
                    "0x%x for %s", __func__, pwrk->htag, pptr->path);
                goto out;
        }

        if (sts == PMCOUT_STATUS_ABORTED) {
                aborted = B_TRUE;
        }

        if (pwrk->state == PMCS_WORK_STATE_TIMED_OUT) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                    "%s: cmd 0x%p (tag 0x%x) timed out for %s",
                    __func__, (void *)sp, pwrk->htag, pptr->path);
                CMD2PKT(sp)->pkt_scbp[0] = STATUS_GOOD;
                CMD2PKT(sp)->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET |
                    STATE_SENT_CMD;
                CMD2PKT(sp)->pkt_statistics |= STAT_TIMEOUT;
                goto out;
        }

        /*
         * If the status isn't okay but not underflow,
         * step to the side and parse the (possible) error.
         */
#ifdef DEBUG
        if (msg) {
                pmcs_print_entry(pwp, PMCS_PRT_DEBUG3, "Outbound Message", msg);
        }
#endif
        if (!msg) {
                goto out;
        }

        switch (sts) {
        case PMCOUT_STATUS_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
        case PMCOUT_STATUS_IO_DS_NON_OPERATIONAL:
        case PMCOUT_STATUS_IO_DS_IN_RECOVERY:
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                    "%s: PHY %s requires DS recovery (status=%d)",
                    __func__, pptr->path, sts);
                do_ds_recovery = B_TRUE;
                break;
        case PMCOUT_STATUS_UNDERFLOW:
                (void) pmcs_set_resid(pkt, pkt->pkt_dma_len, LE_32(msg[3]));
                pmcs_prt(pwp, PMCS_PRT_DEBUG_UNDERFLOW, NULL, NULL,
                    "%s: underflow %u for cdb 0x%x",
                    __func__, LE_32(msg[3]), pkt->pkt_cdbp[0] & 0xff);
                sts = PMCOUT_STATUS_OK;
                msg[3] = 0;
                break;
        case PMCOUT_STATUS_OK:
                pkt->pkt_resid = 0;
                break;
        }

        if (sts != PMCOUT_STATUS_OK) {
                pmcs_ioerror(pwp, SAS, pwrk, msg, sts);
        } else {
                if (msg[3]) {
                        uint8_t local[PMCS_QENTRY_SIZE << 1], *xd;
                        sas_ssp_rsp_iu_t *rptr = (void *)local;
                        const int lim =
                            (PMCS_QENTRY_SIZE << 1) - SAS_RSP_HDR_SIZE;
                        static const uint8_t ssp_rsp_evec[] = {
                                0x58, 0x61, 0x56, 0x72, 0x00
                        };

                        /*
                         * Transform the the first part of the response
                         * to host canonical form. This gives us enough
                         * information to figure out what to do with the
                         * rest (which remains unchanged in the incoming
                         * message which can be up to two queue entries
                         * in length).
                         */
                        pmcs_endian_transform(pwp, local, &msg[5],
                            ssp_rsp_evec);
                        xd = (uint8_t *)(&msg[5]);
                        xd += SAS_RSP_HDR_SIZE;

                        if (rptr->datapres == SAS_RSP_DATAPRES_RESPONSE_DATA) {
                                if (rptr->response_data_length != 4) {
                                        pmcs_print_entry(pwp, PMCS_PRT_DEBUG,
                                            "Bad SAS RESPONSE DATA LENGTH",
                                            msg);
                                        pkt->pkt_reason = CMD_TRAN_ERR;
                                        goto out;
                                }
                                (void) memcpy(&sts, xd, sizeof (uint32_t));
                                sts = BE_32(sts);
                                /*
                                 * The only response code we should legally get
                                 * here is an INVALID FRAME response code.
                                 */
                                if (sts == SAS_RSP_INVALID_FRAME) {
                                        pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                                            "%s: pkt %p tgt %u path %s "
                                            "completed: INVALID FRAME response",
                                            __func__, (void *)pkt,
                                            xp->target_num, pptr->path);
                                } else {
                                        pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                                            "%s: pkt %p tgt %u path %s "
                                            "completed: illegal response 0x%x",
                                            __func__, (void *)pkt,
                                            xp->target_num, pptr->path, sts);
                                }
                                pkt->pkt_reason = CMD_TRAN_ERR;
                                goto out;
                        }
                        if (rptr->datapres == SAS_RSP_DATAPRES_SENSE_DATA) {
                                uint32_t slen;
                                slen = rptr->sense_data_length;
                                if (slen > lim) {
                                        slen = lim;
                                }
                                pmcs_latch_status(pwp, sp, rptr->status, xd,
                                    slen, pptr->path);
                        } else if (rptr->datapres == SAS_RSP_DATAPRES_NO_DATA) {
                                pmcout_ssp_comp_t *sspcp;
                                sspcp = (pmcout_ssp_comp_t *)msg;
                                uint32_t *residp;
                                /*
                                 * This is the case for a plain SCSI status.
                                 * Note: If RESC_V is set and we're here, there
                                 * is a residual.  We need to find it and update
                                 * the packet accordingly.
                                 */
                                pmcs_latch_status(pwp, sp, rptr->status, NULL,
                                    0, pptr->path);

                                if (sspcp->resc_v) {
                                        /*
                                         * Point residual to the SSP_RESP_IU
                                         */
                                        residp = (uint32_t *)(sspcp + 1);
                                        /*
                                         * param contains the number of bytes
                                         * between where the SSP_RESP_IU may
                                         * or may not be and the residual.
                                         * Increment residp by the appropriate
                                         * number of words: (param+resc_pad)/4).
                                         */
                                        residp += (LE_32(sspcp->param) +
                                            sspcp->resc_pad) /
                                            sizeof (uint32_t);
                                        pmcs_prt(pwp, PMCS_PRT_DEBUG_UNDERFLOW,
                                            pptr, xp, "%s: tgt 0x%p "
                                            "residual %d for pkt 0x%p",
                                            __func__, (void *) xp, *residp,
                                            (void *) pkt);
                                        ASSERT(LE_32(*residp) <=
                                            pkt->pkt_dma_len);
                                        (void) pmcs_set_resid(pkt,
                                            pkt->pkt_dma_len, LE_32(*residp));
                                }
                        } else {
                                pmcs_print_entry(pwp, PMCS_PRT_DEBUG,
                                    "illegal SAS response", msg);
                                pkt->pkt_reason = CMD_TRAN_ERR;
                                goto out;
                        }
                } else {
                        pmcs_latch_status(pwp, sp, STATUS_GOOD, NULL, 0,
                            pptr->path);
                }
                if (pkt->pkt_dma_len) {
                        pkt->pkt_state |= STATE_XFERRED_DATA;
                }
        }
        pmcs_prt(pwp, PMCS_PRT_DEBUG2, pptr, xp,
            "%s: pkt %p tgt %u done reason=%x state=%x resid=%ld status=%x",
            __func__, (void *)pkt, xp->target_num, pkt->pkt_reason,
            pkt->pkt_state, pkt->pkt_resid, pkt->pkt_scbp[0]);

        if (pwrk->state == PMCS_WORK_STATE_ABORTED) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                    "%s: scsi_pkt 0x%p aborted for PHY %s; work = 0x%p",
                    __func__, (void *)pkt, pptr->path, (void *)pwrk);
                aborted = B_TRUE;
        }

out:
        pmcs_dma_unload(pwp, sp);
        mutex_enter(&xp->statlock);

        /*
         * If the device no longer has a PHY pointer, clear the PHY pointer
         * from the work structure before we free it.  Otherwise, pmcs_pwork
         * may decrement the ref_count on a PHY that's been freed.
         */
        if (xp->phy == NULL) {
                pwrk->phy = NULL;
        }

        /*
         * We may arrive here due to a command timing out, which in turn
         * could be addressed in a different context.  So, free the work
         * back, but only after confirming it's not already been freed
         * elsewhere.
         */
        if (pwrk->htag != PMCS_TAG_FREE) {
                pmcs_pwork(pwp, pwrk);
        }

        /*
         * If the device is gone, we only put this command on the completion
         * queue if the work structure is not marked dead.  If it's marked
         * dead, it will already have been put there.
         */
        if (xp->dev_gone) {
                mutex_exit(&xp->statlock);
                if (!dead) {
                        mutex_enter(&xp->aqlock);
                        STAILQ_REMOVE(&xp->aq, sp, pmcs_cmd, cmd_next);
                        mutex_exit(&xp->aqlock);
                        pmcs_prt(pwp, PMCS_PRT_DEBUG3, pptr, xp,
                            "%s: Removing cmd 0x%p (htag 0x%x) from aq",
                            __func__, (void *)sp, sp->cmd_tag);
                        mutex_enter(&pwp->cq_lock);
                        STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
                        PMCS_CQ_RUN_LOCKED(pwp);
                        mutex_exit(&pwp->cq_lock);
                        pmcs_prt(pwp, PMCS_PRT_DEBUG2, pptr, xp,
                            "%s: Completing command for dead target 0x%p",
                            __func__, (void *)xp);
                }
                return;
        }

        ASSERT(xp->actv_cnt > 0);
        if (--(xp->actv_cnt) == 0) {
                if (xp->draining) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG1, pptr, xp,
                            "%s: waking up drain waiters", __func__);
                        cv_signal(&pwp->drain_cv);
                }
        }
        mutex_exit(&xp->statlock);

        /*
         * If the status is other than OK, determine if it's something that
         * is worth re-attempting enumeration.  If so, mark the PHY.
         */
        if (sts != PMCOUT_STATUS_OK) {
                pmcs_status_disposition(pptr, sts);
        }

        if (dead == 0) {
#ifdef  DEBUG
                pmcs_cmd_t *wp;
                mutex_enter(&xp->aqlock);
                STAILQ_FOREACH(wp, &xp->aq, cmd_next) {
                        if (wp == sp) {
                                break;
                        }
                }
                ASSERT(wp != NULL);
#else
                mutex_enter(&xp->aqlock);
#endif
                pmcs_prt(pwp, PMCS_PRT_DEBUG3, pptr, xp,
                    "%s: Removing cmd 0x%p (htag 0x%x) from aq", __func__,
                    (void *)sp, sp->cmd_tag);
                STAILQ_REMOVE(&xp->aq, sp, pmcs_cmd, cmd_next);
                if (aborted) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                            "%s: Aborted cmd for tgt 0x%p, signaling waiters",
                            __func__, (void *)xp);
                        cv_signal(&xp->abort_cv);
                }
                mutex_exit(&xp->aqlock);
        }

        /*
         * If do_ds_recovery is set, we need to initiate device state
         * recovery.  In this case, we put this I/O back on the head of
         * the wait queue to run again after recovery is complete
         */
        if (do_ds_recovery) {
                mutex_enter(&xp->statlock);
                pmcs_start_dev_state_recovery(xp, pptr);
                mutex_exit(&xp->statlock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG1, pptr, xp, "%s: Putting cmd 0x%p "
                    "back on wq during recovery for tgt 0x%p", __func__,
                    (void *)sp, (void *)xp);
                mutex_enter(&xp->wqlock);
                if (xp->wq_recovery_tail == NULL) {
                        STAILQ_INSERT_HEAD(&xp->wq, sp, cmd_next);
                } else {
                        /*
                         * If there are other I/Os waiting at the head due to
                         * device state recovery, add this one in the right spot
                         * to maintain proper order.
                         */
                        STAILQ_INSERT_AFTER(&xp->wq, xp->wq_recovery_tail, sp,
                            cmd_next);
                }
                xp->wq_recovery_tail = sp;
                mutex_exit(&xp->wqlock);
        } else {
                /*
                 * If we're not initiating device state recovery and this
                 * command was not "dead", put it on the completion queue
                 */
                if (!dead) {
                        mutex_enter(&pwp->cq_lock);
                        STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
                        PMCS_CQ_RUN_LOCKED(pwp);
                        mutex_exit(&pwp->cq_lock);
                }
        }
}

/*
 * Run a SATA command (normal reads and writes),
 * or block and schedule a SATL interpretation
 * of the command.
 *
 * Called with pwrk lock held, returns unlocked.
 */

static int
pmcs_SATA_run(pmcs_cmd_t *sp, pmcwork_t *pwrk)
{
        pmcs_hw_t *pwp = CMD2PMC(sp);
        struct scsi_pkt *pkt = CMD2PKT(sp);
        pmcs_xscsi_t *xp;
        uint8_t cdb_base, asc, tag;
        uint32_t *ptr, lhtag, iq, nblk, i, mtype;
        fis_t fis;
        size_t amt;
        uint64_t lba;
        int sp_pkt_time = 0;

        xp = pwrk->xp;
        ASSERT(xp != NULL);

        /*
         * First, see if this is just a plain read/write command.
         * If not, we have to queue it up for processing, block
         * any additional commands from coming in, and wake up
         * the thread that will process this command.
         */
        cdb_base = pkt->pkt_cdbp[0] & 0x1f;
        if (cdb_base != SCMD_READ && cdb_base != SCMD_WRITE) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG1, NULL, NULL,
                    "%s: special SATA cmd %p", __func__, (void *)sp);

                ASSERT(xp->phy != NULL);
                pmcs_pwork(pwp, pwrk);
                pmcs_lock_phy(xp->phy);
                mutex_enter(&xp->statlock);
                xp->special_needed = 1; /* Set the special_needed flag */
                STAILQ_INSERT_TAIL(&xp->sq, sp, cmd_next);
                if (pmcs_run_sata_special(pwp, xp)) {
                        SCHEDULE_WORK(pwp, PMCS_WORK_SATA_RUN);
                }
                mutex_exit(&xp->statlock);
                pmcs_unlock_phy(xp->phy);

                return (PMCS_WQ_RUN_SUCCESS);
        }

        pmcs_prt(pwp, PMCS_PRT_DEBUG2, NULL, NULL, "%s: regular cmd", __func__);

        mutex_enter(&xp->statlock);
        if (!xp->assigned) {
                mutex_exit(&xp->statlock);
                return (PMCS_WQ_RUN_FAIL_OTHER);
        }
        if (xp->special_running || xp->special_needed || xp->recover_wait) {
                mutex_exit(&xp->statlock);
                mutex_enter(&xp->wqlock);
                STAILQ_INSERT_HEAD(&xp->wq, sp, cmd_next);
                mutex_exit(&xp->wqlock);
                /*
                 * By the time we get here the special
                 * commands running or waiting to be run
                 * may have come and gone, so kick our
                 * worker to run the waiting queues
                 * just in case.
                 */
                SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                return (PMCS_WQ_RUN_FAIL_OTHER);
        }
        lba = xp->capacity;
        mutex_exit(&xp->statlock);

        /*
         * Extract data length and lba parameters out of the command. The
         * function pmcs_SATA_rwparm returns a non-zero ASC value if the CDB
         * values are considered illegal.
         */
        asc = pmcs_SATA_rwparm(pkt->pkt_cdbp, &nblk, &lba, lba);
        if (asc) {
                uint8_t sns[18];
                bzero(sns, sizeof (sns));
                sns[0] = 0xf0;
                sns[2] = 0x5;
                sns[12] = asc;
                pmcs_latch_status(pwp, sp, STATUS_CHECK, sns, sizeof (sns),
                    pwrk->phy->path);
                pmcs_pwork(pwp, pwrk);
                mutex_enter(&pwp->cq_lock);
                STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
                PMCS_CQ_RUN_LOCKED(pwp);
                mutex_exit(&pwp->cq_lock);
                return (PMCS_WQ_RUN_SUCCESS);
        }

        /*
         * If the command decodes as not moving any data, complete it here.
         */
        amt = nblk;
        amt <<= 9;
        amt = pmcs_set_resid(pkt, amt, nblk << 9);
        if (amt == 0) {
                pmcs_latch_status(pwp, sp, STATUS_GOOD, NULL, 0,
                    pwrk->phy->path);
                pmcs_pwork(pwp, pwrk);
                mutex_enter(&pwp->cq_lock);
                STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
                PMCS_CQ_RUN_LOCKED(pwp);
                mutex_exit(&pwp->cq_lock);
                return (PMCS_WQ_RUN_SUCCESS);
        }

        /*
         * Get an inbound queue entry for this I/O
         */
        GET_IO_IQ_ENTRY(pwp, ptr, xp->phy->device_id, iq);
        if (ptr == NULL) {
                /*
                 * This is a temporary failure not likely to unblocked by
                 * commands completing as the test for scheduling the
                 * restart of work is a per-device test.
                 */
                mutex_enter(&xp->wqlock);
                STAILQ_INSERT_HEAD(&xp->wq, sp, cmd_next);
                mutex_exit(&xp->wqlock);
                pmcs_dma_unload(pwp, sp);
                SCHEDULE_WORK(pwp, PMCS_WORK_RUN_QUEUES);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, xp,
                    "%s: Failed to get IO IQ entry for tgt %d",
                    __func__, xp->target_num);
                return (PMCS_WQ_RUN_FAIL_RES);
        }

        /*
         * Get a tag.  At this point, hold statlock until the tagmap is
         * updated (just prior to sending the cmd to the hardware).
         */
        mutex_enter(&xp->statlock);
        for (tag = 0; tag < xp->qdepth; tag++) {
                if ((xp->tagmap & (1 << tag)) == 0) {
                        break;
                }
        }

        if (tag == xp->qdepth) {
                mutex_exit(&xp->statlock);
                mutex_exit(&pwp->iqp_lock[iq]);
                mutex_enter(&xp->wqlock);
                STAILQ_INSERT_HEAD(&xp->wq, sp, cmd_next);
                mutex_exit(&xp->wqlock);
                return (PMCS_WQ_RUN_FAIL_OTHER);
        }

        sp->cmd_satltag = (uint8_t)tag;

        /*
         * Set up the command
         */
        bzero(fis, sizeof (fis));
        ptr[0] =
            LE_32(PMCS_IOMB_IN_SAS(PMCS_OQ_IODONE, PMCIN_SATA_HOST_IO_START));
        ptr[1] = LE_32(pwrk->htag);
        ptr[2] = LE_32(pwrk->phy->device_id);
        ptr[3] = LE_32(amt);

        if (xp->ncq) {
                mtype = SATA_PROTOCOL_FPDMA | (tag << 16);
                fis[0] = ((nblk & 0xff) << 24) | (C_BIT << 8) | FIS_REG_H2DEV;
                if (cdb_base == SCMD_READ) {
                        fis[0] |= (READ_FPDMA_QUEUED << 16);
                } else {
                        fis[0] |= (WRITE_FPDMA_QUEUED << 16);
                }
                fis[1] = (FEATURE_LBA << 24) | (lba & 0xffffff);
                fis[2] = ((nblk & 0xff00) << 16) | ((lba >> 24) & 0xffffff);
                fis[3] = tag << 3;
        } else {
                int op;
                fis[0] = (C_BIT << 8) | FIS_REG_H2DEV;
                if (xp->pio) {
                        mtype = SATA_PROTOCOL_PIO;
                        if (cdb_base == SCMD_READ) {
                                op = READ_SECTORS_EXT;
                        } else {
                                op = WRITE_SECTORS_EXT;
                        }
                } else {
                        mtype = SATA_PROTOCOL_DMA;
                        if (cdb_base == SCMD_READ) {
                                op = READ_DMA_EXT;
                        } else {
                                op = WRITE_DMA_EXT;
                        }
                }
                fis[0] |= (op << 16);
                fis[1] = (FEATURE_LBA << 24) | (lba & 0xffffff);
                fis[2] = (lba >> 24) & 0xffffff;
                fis[3] = nblk;
        }

        if (cdb_base == SCMD_READ) {
                ptr[4] = LE_32(mtype | PMCIN_DATADIR_2_INI);
        } else {
                ptr[4] = LE_32(mtype | PMCIN_DATADIR_2_DEV);
        }
#ifdef  DEBUG
        /*
         * Generate a PMCOUT_STATUS_XFER_CMD_FRAME_ISSUED
         * event when this goes out on the wire.
         */
        ptr[4] |= PMCIN_MESSAGE_REPORT;
#endif
        for (i = 0; i < (sizeof (fis_t))/(sizeof (uint32_t)); i++) {
                ptr[i+5] = LE_32(fis[i]);
        }
        if (pmcs_dma_load(pwp, sp, ptr)) {
                mutex_exit(&xp->statlock);
                mutex_exit(&pwp->iqp_lock[iq]);
                mutex_enter(&xp->wqlock);
                STAILQ_INSERT_HEAD(&xp->wq, sp, cmd_next);
                mutex_exit(&xp->wqlock);
                pmcs_prt(pwp, PMCS_PRT_DEBUG, NULL, xp,
                    "%s: Failed to dma_load for tgt %d",
                    __func__, xp->target_num);
                return (PMCS_WQ_RUN_FAIL_RES);

        }

        pwrk->state = PMCS_WORK_STATE_ONCHIP;
        lhtag = pwrk->htag;
        mutex_exit(&pwrk->lock);
        xp->tagmap |= (1 << tag);
        xp->actv_cnt++;
        if (xp->actv_cnt > xp->maxdepth) {
                xp->maxdepth = xp->actv_cnt;
                pmcs_prt(pwp, PMCS_PRT_DEBUG2, pwrk->phy, xp,
                    "%s: max depth now %u", pwrk->phy->path, xp->maxdepth);
        }
        mutex_exit(&xp->statlock);
        mutex_enter(&xp->aqlock);
        STAILQ_INSERT_TAIL(&xp->aq, sp, cmd_next);
        mutex_exit(&xp->aqlock);
        pmcs_prt(pwp, PMCS_PRT_DEBUG2, NULL, NULL,
            "%s: giving pkt %p to hardware", __func__, (void *)pkt);
#ifdef DEBUG
        pmcs_print_entry(pwp, PMCS_PRT_DEBUG3, "SATA INI Message", ptr);
#endif
        sp_pkt_time = CMD2PKT(sp)->pkt_time;
        INC_IQ_ENTRY(pwp, iq);
        mutex_enter(&pwrk->lock);
        if (lhtag == pwrk->htag) {
                pwrk->timer = US2WT(sp_pkt_time * 1000000);
                if (pwrk->timer == 0) {
                        pwrk->timer = US2WT(1000000);
                }
        }
        mutex_exit(&pwrk->lock);

        return (PMCS_WQ_RUN_SUCCESS);
}

/*
 * Complete a SATA command.  Called with pwrk lock held.
 */
void
pmcs_SATA_done(pmcs_hw_t *pwp, pmcwork_t *pwrk, uint32_t *msg)
{
        pmcs_cmd_t *sp = pwrk->arg;
        struct scsi_pkt *pkt = CMD2PKT(sp);
        pmcs_phy_t *pptr = pwrk->phy;
        int dead;
        uint32_t sts;
        pmcs_xscsi_t *xp;
        boolean_t aborted = B_FALSE;

        xp = pwrk->xp;
        ASSERT(xp != NULL);

        DTRACE_PROBE4(pmcs__io__done, uint64_t, pkt->pkt_dma_len, int,
            (pkt->pkt_dma_flags & DDI_DMA_READ) != 0, hrtime_t, pwrk->start,
            hrtime_t, gethrtime());

        dead = pwrk->dead;

        if (msg) {
                sts = LE_32(msg[2]);
        } else {
                sts = 0;
        }

        if (dead != 0) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp, "%s: dead cmd tag "
                    "0x%x for %s", __func__, pwrk->htag, pptr->path);
                goto out;
        }
        if ((pwrk->state == PMCS_WORK_STATE_TIMED_OUT) &&
            (sts != PMCOUT_STATUS_ABORTED)) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                    "%s: cmd 0x%p (tag 0x%x) timed out for %s",
                    __func__, (void *)sp, pwrk->htag, pptr->path);
                CMD2PKT(sp)->pkt_scbp[0] = STATUS_GOOD;
                /* pkt_reason already set to CMD_TIMEOUT */
                ASSERT(CMD2PKT(sp)->pkt_reason == CMD_TIMEOUT);
                CMD2PKT(sp)->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET |
                    STATE_SENT_CMD;
                CMD2PKT(sp)->pkt_statistics |= STAT_TIMEOUT;
                goto out;
        }

        pmcs_prt(pwp, PMCS_PRT_DEBUG2, pptr, xp, "%s: pkt %p tgt %u done",
            __func__, (void *)pkt, xp->target_num);

        /*
         * If the status isn't okay but not underflow,
         * step to the side and parse the (possible) error.
         */
#ifdef DEBUG
        if (msg) {
                pmcs_print_entry(pwp, PMCS_PRT_DEBUG3, "Outbound Message", msg);
        }
#endif
        if (!msg) {
                goto out;
        }

        /*
         * If the status isn't okay or we got a FIS response of some kind,
         * step to the side and parse the (possible) error.
         */
        if ((sts != PMCOUT_STATUS_OK) || (LE_32(msg[3]) != 0)) {
                if (sts == PMCOUT_STATUS_IO_DS_NON_OPERATIONAL) {
                        mutex_exit(&pwrk->lock);
                        pmcs_lock_phy(pptr);
                        mutex_enter(&xp->statlock);
                        if ((xp->resetting == 0) && (xp->reset_success != 0) &&
                            (xp->reset_wait == 0)) {
                                mutex_exit(&xp->statlock);
                                if (pmcs_reset_phy(pwp, pptr,
                                    PMCS_PHYOP_LINK_RESET) != 0) {
                                        pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                                            "%s: PHY (%s) Local Control/Link "
                                            "Reset FAILED as part of error "
                                            "recovery", __func__, pptr->path);
                                }
                                mutex_enter(&xp->statlock);
                        }
                        mutex_exit(&xp->statlock);
                        pmcs_unlock_phy(pptr);
                        mutex_enter(&pwrk->lock);
                }
                pmcs_ioerror(pwp, SATA, pwrk, msg, sts);
        } else {
                pmcs_latch_status(pwp, sp, STATUS_GOOD, NULL, 0,
                    pwrk->phy->path);
                pkt->pkt_state |= STATE_XFERRED_DATA;
                pkt->pkt_resid = 0;
        }

        pmcs_prt(pwp, PMCS_PRT_DEBUG2, pptr, xp,
            "%s: pkt %p tgt %u done reason=%x state=%x resid=%ld status=%x",
            __func__, (void *)pkt, xp->target_num, pkt->pkt_reason,
            pkt->pkt_state, pkt->pkt_resid, pkt->pkt_scbp[0]);

        if (pwrk->state == PMCS_WORK_STATE_ABORTED) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                    "%s: scsi_pkt 0x%p aborted for PHY %s; work = 0x%p",
                    __func__, (void *)pkt, pptr->path, (void *)pwrk);
                aborted = B_TRUE;
        }

out:
        pmcs_dma_unload(pwp, sp);
        mutex_enter(&xp->statlock);
        xp->tagmap &= ~(1 << sp->cmd_satltag);

        /*
         * If the device no longer has a PHY pointer, clear the PHY pointer
         * from the work structure before we free it.  Otherwise, pmcs_pwork
         * may decrement the ref_count on a PHY that's been freed.
         */
        if (xp->phy == NULL) {
                pwrk->phy = NULL;
        }

        /*
         * We may arrive here due to a command timing out, which in turn
         * could be addressed in a different context.  So, free the work
         * back, but only after confirming it's not already been freed
         * elsewhere.
         */
        if (pwrk->htag != PMCS_TAG_FREE) {
                pmcs_pwork(pwp, pwrk);
        }

        if (xp->dev_gone) {
                mutex_exit(&xp->statlock);
                if (!dead) {
                        mutex_enter(&xp->aqlock);
                        STAILQ_REMOVE(&xp->aq, sp, pmcs_cmd, cmd_next);
                        mutex_exit(&xp->aqlock);
                        pmcs_prt(pwp, PMCS_PRT_DEBUG3, pptr, xp,
                            "%s: Removing cmd 0x%p (htag 0x%x) from aq",
                            __func__, (void *)sp, sp->cmd_tag);
                        mutex_enter(&pwp->cq_lock);
                        STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
                        PMCS_CQ_RUN_LOCKED(pwp);
                        mutex_exit(&pwp->cq_lock);
                        pmcs_prt(pwp, PMCS_PRT_DEBUG2, pptr, xp,
                            "%s: Completing command for dead target 0x%p",
                            __func__, (void *)xp);
                }
                return;
        }

        ASSERT(xp->actv_cnt > 0);
        if (--(xp->actv_cnt) == 0) {
                if (xp->draining) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG1, pptr, xp,
                            "%s: waking up drain waiters", __func__);
                        cv_signal(&pwp->drain_cv);
                } else if (xp->special_needed) {
                        SCHEDULE_WORK(pwp, PMCS_WORK_SATA_RUN);
                }
        }
        mutex_exit(&xp->statlock);

        /*
         * If the status is other than OK, determine if it's something that
         * is worth re-attempting enumeration.  If so, mark the PHY.
         */
        if (sts != PMCOUT_STATUS_OK) {
                pmcs_status_disposition(pptr, sts);
        }

        if (dead == 0) {
#ifdef  DEBUG
                pmcs_cmd_t *wp;
                mutex_enter(&xp->aqlock);
                STAILQ_FOREACH(wp, &xp->aq, cmd_next) {
                        if (wp == sp) {
                                break;
                        }
                }
                ASSERT(wp != NULL);
#else
                mutex_enter(&xp->aqlock);
#endif
                STAILQ_REMOVE(&xp->aq, sp, pmcs_cmd, cmd_next);
                if (aborted) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG, pptr, xp,
                            "%s: Aborted cmd for tgt 0x%p, signaling waiters",
                            __func__, (void *)xp);
                        cv_signal(&xp->abort_cv);
                }
                mutex_exit(&xp->aqlock);
                mutex_enter(&pwp->cq_lock);
                STAILQ_INSERT_TAIL(&pwp->cq, sp, cmd_next);
                PMCS_CQ_RUN_LOCKED(pwp);
                mutex_exit(&pwp->cq_lock);
        }
}

static uint8_t
pmcs_SATA_rwparm(uint8_t *cdb, uint32_t *xfr, uint64_t *lba, uint64_t lbamax)
{
        uint8_t asc = 0;
        switch (cdb[0]) {
        case SCMD_READ_G5:
        case SCMD_WRITE_G5:
                *xfr =
                    (((uint32_t)cdb[10]) <<  24) |
                    (((uint32_t)cdb[11]) <<  16) |
                    (((uint32_t)cdb[12]) <<   8) |
                    ((uint32_t)cdb[13]);
                *lba =
                    (((uint64_t)cdb[2]) << 56) |
                    (((uint64_t)cdb[3]) << 48) |
                    (((uint64_t)cdb[4]) << 40) |
                    (((uint64_t)cdb[5]) << 32) |
                    (((uint64_t)cdb[6]) << 24) |
                    (((uint64_t)cdb[7]) << 16) |
                    (((uint64_t)cdb[8]) <<  8) |
                    ((uint64_t)cdb[9]);
                /* Check for illegal bits */
                if (cdb[15]) {
                        asc = 0x24;     /* invalid field in cdb */
                }
                break;
        case SCMD_READ_G4:
        case SCMD_WRITE_G4:
                *xfr =
                    (((uint32_t)cdb[6]) <<  16) |
                    (((uint32_t)cdb[7]) <<   8) |
                    ((uint32_t)cdb[8]);
                *lba =
                    (((uint32_t)cdb[2]) << 24) |
                    (((uint32_t)cdb[3]) << 16) |
                    (((uint32_t)cdb[4]) <<  8) |
                    ((uint32_t)cdb[5]);
                /* Check for illegal bits */
                if (cdb[11]) {
                        asc = 0x24;     /* invalid field in cdb */
                }
                break;
        case SCMD_READ_G1:
        case SCMD_WRITE_G1:
                *xfr = (((uint32_t)cdb[7]) <<  8) | ((uint32_t)cdb[8]);
                *lba =
                    (((uint32_t)cdb[2]) << 24) |
                    (((uint32_t)cdb[3]) << 16) |
                    (((uint32_t)cdb[4]) <<  8) |
                    ((uint32_t)cdb[5]);
                /* Check for illegal bits */
                if (cdb[9]) {
                        asc = 0x24;     /* invalid field in cdb */
                }
                break;
        case SCMD_READ:
        case SCMD_WRITE:
                *xfr = cdb[4];
                if (*xfr == 0) {
                        *xfr = 256;
                }
                *lba =
                    (((uint32_t)cdb[1] & 0x1f) << 16) |
                    (((uint32_t)cdb[2]) << 8) |
                    ((uint32_t)cdb[3]);
                /* Check for illegal bits */
                if (cdb[5]) {
                        asc = 0x24;     /* invalid field in cdb */
                }
                break;
        }

        if (asc == 0) {
                if ((*lba + *xfr) > lbamax) {
                        asc = 0x21;     /* logical block out of range */
                }
        }
        return (asc);
}

/*
 * Called with pwrk lock held.
 */
static void
pmcs_ioerror(pmcs_hw_t *pwp, pmcs_dtype_t t, pmcwork_t *pwrk, uint32_t *w,
    uint32_t status)
{
        static uint8_t por[] = {
            0xf0, 0x0, 0x6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x28
        };
        static uint8_t parity[] = {
            0xf0, 0x0, 0xb, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x47, 5
        };
        const char *msg;
        char buf[20];
        pmcs_cmd_t *sp = pwrk->arg;
        pmcs_phy_t *phyp = pwrk->phy;
        struct scsi_pkt *pkt = CMD2PKT(sp);
        uint32_t resid;

        ASSERT(w != NULL);
        resid = LE_32(w[3]);

        msg = pmcs_status_str(status);
        if (msg == NULL) {
                (void) snprintf(buf, sizeof (buf), "Error 0x%x", status);
                msg = buf;
        }

        if (status != PMCOUT_STATUS_OK) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG1, phyp, NULL,
                    "%s: device %s tag 0x%x status %s @ %llu", __func__,
                    phyp->path, pwrk->htag, msg,
                    (unsigned long long)gethrtime());
        }

        pkt->pkt_reason = CMD_CMPLT;            /* default reason */

        switch (status) {
        case PMCOUT_STATUS_OK:
                if (t == SATA) {
                        int i;
                        fis_t fis;
                        for (i = 0; i < sizeof (fis) / sizeof (fis[0]); i++) {
                                fis[i] = LE_32(w[4+i]);
                        }
                        if ((fis[0] & 0xff) != FIS_REG_D2H) {
                                pmcs_prt(pwp, PMCS_PRT_DEBUG, phyp, NULL,
                                    "unexpected fis code 0x%x", fis[0] & 0xff);
                        } else {
                                pmcs_prt(pwp, PMCS_PRT_DEBUG, phyp, NULL,
                                    "FIS ERROR");
                                pmcs_fis_dump(pwp, fis);
                        }
                        pkt->pkt_reason = CMD_TRAN_ERR;
                        break;
                }
                pmcs_latch_status(pwp, sp, STATUS_GOOD, NULL, 0, phyp->path);
                break;

        case PMCOUT_STATUS_ABORTED:
                /*
                 * Command successfully aborted.
                 */
                if (phyp->dead) {
                        pkt->pkt_reason = CMD_DEV_GONE;
                        pkt->pkt_state = STATE_GOT_BUS;
                } else if (pwrk->ssp_event != 0) {
                        pkt->pkt_reason = CMD_TRAN_ERR;
                        pkt->pkt_state = STATE_GOT_BUS;
                } else if (pwrk->state == PMCS_WORK_STATE_TIMED_OUT) {
                        pkt->pkt_reason = CMD_TIMEOUT;
                        pkt->pkt_statistics |= STAT_TIMEOUT;
                        pkt->pkt_state = STATE_GOT_BUS | STATE_GOT_TARGET |
                            STATE_SENT_CMD;
                } else {
                        pkt->pkt_reason = CMD_ABORTED;
                        pkt->pkt_statistics |= STAT_ABORTED;
                        pkt->pkt_state = STATE_GOT_BUS | STATE_GOT_TARGET |
                            STATE_SENT_CMD;
                }

                /*
                 * PMCS_WORK_STATE_TIMED_OUT doesn't need to be preserved past
                 * this point, so go ahead and mark it as aborted.
                 */
                pwrk->state = PMCS_WORK_STATE_ABORTED;
                break;

        case PMCOUT_STATUS_UNDERFLOW:
                /*
                 * This will only get called for SATA
                 */
                pkt->pkt_resid = resid;
                if (pkt->pkt_dma_len < pkt->pkt_resid) {
                        (void) pmcs_set_resid(pkt, pkt->pkt_dma_len, resid);
                }
                pmcs_latch_status(pwp, sp, STATUS_GOOD, NULL, 0, phyp->path);
                break;

        case PMCOUT_STATUS_NO_DEVICE:
        case PMCOUT_STATUS_XFER_ERROR_SATA_LINK_TIMEOUT:
                pkt->pkt_reason = CMD_DEV_GONE;
                break;

        case PMCOUT_STATUS_OPEN_CNX_ERROR_WRONG_DESTINATION:
                /*
                 * Need to do rediscovery. We probably have
                 * the wrong device (disk swap), so kill
                 * this one.
                 */
        case PMCOUT_STATUS_OPEN_CNX_PROTOCOL_NOT_SUPPORTED:
        case PMCOUT_STATUS_OPEN_CNX_ERROR_ZONE_VIOLATION:
        case PMCOUT_STATUS_OPEN_CNX_ERROR_CONNECTION_RATE_NOT_SUPPORTED:
        case PMCOUT_STATUS_OPEN_CNX_ERROR_UNKNOWN_ERROR:
                /*
                 * Need to do rediscovery.
                 */
                if (!phyp->dead) {
                        mutex_exit(&pwrk->lock);
                        pmcs_lock_phy(pwrk->phy);
                        pmcs_kill_changed(pwp, pwrk->phy, 0);
                        pmcs_unlock_phy(pwrk->phy);
                        mutex_enter(&pwrk->lock);
                        pkt->pkt_reason = CMD_INCOMPLETE;
                        pkt->pkt_state = STATE_GOT_BUS;
                } else {
                        pkt->pkt_reason = CMD_DEV_GONE;
                }
                break;

        case PMCOUT_STATUS_OPEN_CNX_ERROR_BREAK:
        case PMCOUT_STATUS_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
        case PMCOUT_STATUS_OPENCNX_ERROR_BAD_DESTINATION:
        case PMCOUT_STATUS_IO_XFER_ERROR_NAK_RECEIVED:
                /* cmd is pending on the target */
        case PMCOUT_STATUS_XFER_ERROR_OFFSET_MISMATCH:
        case PMCOUT_STATUS_XFER_ERROR_REJECTED_NCQ_MODE:
                /* transitory - commands sent while in NCQ failure mode */
        case PMCOUT_STATUS_XFER_ERROR_ABORTED_NCQ_MODE:
                /* NCQ failure */
        case PMCOUT_STATUS_IO_PORT_IN_RESET:
        case PMCOUT_STATUS_XFER_ERR_BREAK:
        case PMCOUT_STATUS_XFER_ERR_PHY_NOT_READY:
                pkt->pkt_reason = CMD_INCOMPLETE;
                pkt->pkt_state = STATE_GOT_BUS;
                break;

        case PMCOUT_STATUS_IO_XFER_OPEN_RETRY_TIMEOUT:
                pmcs_prt(pwp, PMCS_PRT_DEBUG, phyp, phyp->target,
                    "STATUS_BUSY for htag 0x%08x", sp->cmd_tag);
                pmcs_latch_status(pwp, sp, STATUS_BUSY, NULL, 0, phyp->path);
                break;

        case PMCOUT_STATUS_OPEN_CNX_ERROR_STP_RESOURCES_BUSY:
                /* synthesize a RESERVATION CONFLICT */
                pmcs_prt(pwp, PMCS_PRT_DEBUG, phyp, phyp->target,
                    "%s: Potential affiliation active on 0x%" PRIx64, __func__,
                    pmcs_barray2wwn(phyp->sas_address));
                pmcs_latch_status(pwp, sp, STATUS_RESERVATION_CONFLICT, NULL,
                    0, phyp->path);
                break;

        case PMCOUT_STATUS_XFER_ERROR_ABORTED_DUE_TO_SRST:
                /* synthesize a power-on/reset */
                pmcs_latch_status(pwp, sp, STATUS_CHECK, por, sizeof (por),
                    phyp->path);
                break;

        case PMCOUT_STATUS_XFER_ERROR_UNEXPECTED_PHASE:
        case PMCOUT_STATUS_XFER_ERROR_RDY_OVERRUN:
        case PMCOUT_STATUS_XFER_ERROR_RDY_NOT_EXPECTED:
        case PMCOUT_STATUS_XFER_ERROR_CMD_ISSUE_ACK_NAK_TIMEOUT:
        case PMCOUT_STATUS_XFER_ERROR_CMD_ISSUE_BREAK_BEFORE_ACK_NACK:
        case PMCOUT_STATUS_XFER_ERROR_CMD_ISSUE_PHY_DOWN_BEFORE_ACK_NAK:
                /* synthesize a PARITY ERROR */
                pmcs_latch_status(pwp, sp, STATUS_CHECK, parity,
                    sizeof (parity), phyp->path);
                break;

        case PMCOUT_STATUS_IO_XFER_ERROR_DMA:
        case PMCOUT_STATUS_IO_NOT_VALID:
        case PMCOUT_STATUS_PROG_ERROR:
        case PMCOUT_STATUS_XFER_ERROR_PEER_ABORTED:
        case PMCOUT_STATUS_XFER_ERROR_SATA: /* non-NCQ failure */
        default:
                pkt->pkt_reason = CMD_TRAN_ERR;
                break;
        }
}

/*
 * Latch up SCSI status
 */

void
pmcs_latch_status(pmcs_hw_t *pwp, pmcs_cmd_t *sp, uint8_t status,
    uint8_t *snsp, size_t snslen, char *path)
{
        static const char c1[] =
            "%s: Status Byte 0x%02x for CDB0=0x%02x (%02x %02x %02x) "
            "HTAG 0x%x @ %llu";
        static const char c2[] =
            "%s: Status Byte 0x%02x for CDB0=0x%02x HTAG 0x%x @ %llu";

        CMD2PKT(sp)->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET |
            STATE_SENT_CMD | STATE_GOT_STATUS;
        CMD2PKT(sp)->pkt_scbp[0] = status;

        if (status == STATUS_CHECK && snsp &&
            (size_t)SCSA_STSLEN(sp) >= sizeof (struct scsi_arq_status)) {
                struct scsi_arq_status *aqp =
                    (void *) CMD2PKT(sp)->pkt_scbp;
                size_t amt = sizeof (struct scsi_extended_sense);
                uint8_t key = scsi_sense_key(snsp);
                uint8_t asc = scsi_sense_asc(snsp);
                uint8_t ascq = scsi_sense_ascq(snsp);
                if (amt > snslen) {
                        amt = snslen;
                }
                pmcs_prt(pwp, PMCS_PRT_DEBUG_SCSI_STATUS, NULL, NULL, c1, path,
                    status, CMD2PKT(sp)->pkt_cdbp[0] & 0xff, key, asc, ascq,
                    sp->cmd_tag, (unsigned long long)gethrtime());
                CMD2PKT(sp)->pkt_state |= STATE_ARQ_DONE;
                (*(uint8_t *)&aqp->sts_rqpkt_status) = STATUS_GOOD;
                aqp->sts_rqpkt_statistics = 0;
                aqp->sts_rqpkt_reason = CMD_CMPLT;
                aqp->sts_rqpkt_state = STATE_GOT_BUS |
                    STATE_GOT_TARGET | STATE_SENT_CMD |
                    STATE_XFERRED_DATA | STATE_GOT_STATUS;
                (void) memcpy(&aqp->sts_sensedata, snsp, amt);
                if (aqp->sts_sensedata.es_class != CLASS_EXTENDED_SENSE) {
                        aqp->sts_rqpkt_reason = CMD_TRAN_ERR;
                        aqp->sts_rqpkt_state = 0;
                        aqp->sts_rqpkt_resid =
                            sizeof (struct scsi_extended_sense);
                } else {
                        aqp->sts_rqpkt_resid =
                            sizeof (struct scsi_extended_sense) - amt;
                }
        } else if (status) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG_SCSI_STATUS, NULL, NULL, c2,
                    path, status, CMD2PKT(sp)->pkt_cdbp[0] & 0xff,
                    sp->cmd_tag, (unsigned long long)gethrtime());
        }

        CMD2PKT(sp)->pkt_reason = CMD_CMPLT;
}

/*
 * Calculate and set packet residual and return the amount
 * left over after applying various filters.
 */
size_t
pmcs_set_resid(struct scsi_pkt *pkt, size_t amt, uint32_t cdbamt)
{
        pkt->pkt_resid = cdbamt;
        if (amt > pkt->pkt_resid) {
                amt = pkt->pkt_resid;
        }
        if (amt > pkt->pkt_dma_len) {
                amt = pkt->pkt_dma_len;
        }
        return (amt);
}

/*
 * Return the existing target softstate (unlocked) if there is one.  If so,
 * the PHY is locked and that lock must be freed by the caller after the
 * target/PHY linkage is established.  If there isn't one, and alloc_tgt is
 * TRUE, then allocate one.
 */
pmcs_xscsi_t *
pmcs_get_target(pmcs_iport_t *iport, char *tgt_port, boolean_t alloc_tgt)
{
        pmcs_hw_t *pwp = iport->pwp;
        pmcs_phy_t *phyp;
        pmcs_xscsi_t *tgt;
        uint64_t wwn;
        char unit_address[PMCS_MAX_UA_SIZE];
        int ua_form = 1;

        /*
         * Find the PHY for this target
         */
        phyp = pmcs_find_phy_by_sas_address(pwp, iport, NULL, tgt_port);
        if (phyp == NULL) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG3, NULL, NULL,
                    "%s: No PHY for target @ %s", __func__, tgt_port);
                return (NULL);
        }

        tgt = ddi_soft_state_bystr_get(iport->tgt_sstate, tgt_port);

        if (tgt) {
                mutex_enter(&tgt->statlock);
                /*
                 * There's already a target.  Check its PHY pointer to see
                 * if we need to clear the old linkages
                 */
                if (tgt->phy && (tgt->phy != phyp)) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                            "%s: Target PHY updated from %p to %p", __func__,
                            (void *)tgt->phy, (void *)phyp);
                        if (!IS_ROOT_PHY(tgt->phy)) {
                                pmcs_dec_phy_ref_count(tgt->phy);
                                pmcs_inc_phy_ref_count(phyp);
                        }
                        tgt->phy->target = NULL;
                }

                /*
                 * If this target has no PHY pointer and alloc_tgt is FALSE,
                 * that implies we expect the target to already exist.  This
                 * implies that there has already been a tran_tgt_init on at
                 * least one LU.
                 */
                if ((tgt->phy == NULL) && !alloc_tgt) {
                        pmcs_prt(pwp, PMCS_PRT_DEBUG, phyp, tgt,
                            "%s: Establish linkage from new PHY to old target @"
                            "%s", __func__, tgt->unit_address);
                        for (int idx = 0; idx < tgt->ref_count; idx++) {
                                pmcs_inc_phy_ref_count(phyp);
                        }
                }

                /*
                 * Set this target pointer back up, since it's been
                 * through pmcs_clear_xp().
                 */
                tgt->dev_gone = 0;
                tgt->assigned = 1;
                tgt->dtype = phyp->dtype;
                tgt->dev_state = PMCS_DEVICE_STATE_OPERATIONAL;
                tgt->phy = phyp;
                phyp->target = tgt;

                mutex_exit(&tgt->statlock);
                return (tgt);
        }

        /*
         * Make sure the PHY we found is on the correct iport
         */
        if (phyp->iport != iport) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG, phyp, NULL,
                    "%s: No target at %s on this iport", __func__, tgt_port);
                pmcs_unlock_phy(phyp);
                return (NULL);
        }

        /*
         * If this was just a lookup (i.e. alloc_tgt is false), return now.
         */
        if (alloc_tgt == B_FALSE) {
                pmcs_unlock_phy(phyp);
                return (NULL);
        }

        /*
         * Allocate the new softstate
         */
        wwn = pmcs_barray2wwn(phyp->sas_address);
        (void) scsi_wwn_to_wwnstr(wwn, ua_form, unit_address);

        if (ddi_soft_state_bystr_zalloc(iport->tgt_sstate, unit_address) !=
            DDI_SUCCESS) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                    "%s: Couldn't alloc softstate for device at %s",
                    __func__, unit_address);
                pmcs_unlock_phy(phyp);
                return (NULL);
        }

        tgt = ddi_soft_state_bystr_get(iport->tgt_sstate, unit_address);
        ASSERT(tgt != NULL);
        STAILQ_INIT(&tgt->wq);
        STAILQ_INIT(&tgt->aq);
        STAILQ_INIT(&tgt->sq);
        mutex_init(&tgt->statlock, NULL, MUTEX_DRIVER,
            DDI_INTR_PRI(pwp->intr_pri));
        mutex_init(&tgt->wqlock, NULL, MUTEX_DRIVER,
            DDI_INTR_PRI(pwp->intr_pri));
        mutex_init(&tgt->aqlock, NULL, MUTEX_DRIVER,
            DDI_INTR_PRI(pwp->intr_pri));
        cv_init(&tgt->reset_cv, NULL, CV_DRIVER, NULL);
        cv_init(&tgt->abort_cv, NULL, CV_DRIVER, NULL);
        list_create(&tgt->lun_list, sizeof (pmcs_lun_t),
            offsetof(pmcs_lun_t, lun_list_next));
        tgt->qdepth = 1;
        tgt->target_num = PMCS_INVALID_TARGET_NUM;
        bcopy(unit_address, tgt->unit_address, PMCS_MAX_UA_SIZE);
        tgt->pwp = pwp;
        tgt->ua = strdup(iport->ua);
        tgt->phy = phyp;
        ASSERT((phyp->target == NULL) || (phyp->target == tgt));
        if (phyp->target == NULL) {
                phyp->target = tgt;
        }

        /*
         * Don't allocate LUN softstate for SMP targets
         */
        if (phyp->dtype == EXPANDER) {
                return (tgt);
        }

        if (ddi_soft_state_bystr_init(&tgt->lun_sstate,
            sizeof (pmcs_lun_t), PMCS_LUN_SSTATE_SZ) != 0) {
                pmcs_prt(pwp, PMCS_PRT_DEBUG_CONFIG, phyp, tgt,
                    "%s: LUN soft_state_bystr_init failed", __func__);
                ddi_soft_state_bystr_free(iport->tgt_sstate, tgt_port);
                pmcs_unlock_phy(phyp);
                return (NULL);
        }

        return (tgt);
}