fca/qlc/ql_xioctl.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/* Copyright 2010 QLogic Corporation */

/*
 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
 */

#pragma ident	"Copyright 2010 QLogic Corporation; ql_xioctl.c"

/*
 * ISP2xxx Solaris Fibre Channel Adapter (FCA) driver source file.
 *
 * ***********************************************************************
 * *									**
 * *				NOTICE					**
 * *		COPYRIGHT (C) 1996-2010 QLOGIC CORPORATION		**
 * *			ALL RIGHTS RESERVED				**
 * *									**
 * ***********************************************************************
 *
 */

#include <ql_apps.h>
#include <ql_api.h>
#include <ql_debug.h>
#include <ql_init.h>
#include <ql_iocb.h>
#include <ql_ioctl.h>
#include <ql_mbx.h>
#include <ql_xioctl.h>

/*
 * Local data
 */

/*
 * Local prototypes
 */
static int ql_sdm_ioctl(ql_adapter_state_t *, int, void *, int);
static int ql_sdm_setup(ql_adapter_state_t *, EXT_IOCTL **, void *, int,
    boolean_t (*)(EXT_IOCTL *));
static boolean_t ql_validate_signature(EXT_IOCTL *);
static int ql_sdm_return(ql_adapter_state_t *, EXT_IOCTL *, void *, int);
static void ql_query(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_hba_node(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_hba_port(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_disc_port(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_disc_tgt(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_fw(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_chip(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_driver(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_fcct(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_aen_reg(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_aen_get(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_scsi_passthru(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_wwpn_to_scsiaddr(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_host_idx(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_host_drvname(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_read_nvram(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_write_nvram(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_read_flash(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_write_flash(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_write_vpd(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_read_vpd(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_diagnostic_loopback(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_send_els_rnid(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_set_host_data(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_host_data(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_cna_port(ql_adapter_state_t *, EXT_IOCTL *, int);

static int ql_lun_count(ql_adapter_state_t *, ql_tgt_t *);
static int ql_report_lun(ql_adapter_state_t *, ql_tgt_t *);
static int ql_inq_scan(ql_adapter_state_t *, ql_tgt_t *, int);
static int ql_inq(ql_adapter_state_t *, ql_tgt_t *, int, ql_mbx_iocb_t *,
    uint8_t);
static uint32_t	ql_get_buffer_data(caddr_t, caddr_t, uint32_t, int);
static uint32_t ql_send_buffer_data(caddr_t, caddr_t, uint32_t, int);
static int ql_24xx_flash_desc(ql_adapter_state_t *);
static int ql_setup_flash(ql_adapter_state_t *);
static ql_tgt_t *ql_find_port(ql_adapter_state_t *, uint8_t *, uint16_t);
static int ql_flash_fcode_load(ql_adapter_state_t *, void *, uint32_t, int);
static int ql_flash_fcode_dump(ql_adapter_state_t *, void *, uint32_t,
    uint32_t, int);
static int ql_program_flash_address(ql_adapter_state_t *, uint32_t,
    uint8_t);
static void ql_set_rnid_parameters(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_rnid_parameters(ql_adapter_state_t *, EXT_IOCTL *, int);
static int ql_reset_statistics(ql_adapter_state_t *, EXT_IOCTL *);
static void ql_get_statistics(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_statistics_fc(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_statistics_fc4(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_set_led_state(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_led_state(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_drive_led(ql_adapter_state_t *, uint32_t);
static uint32_t ql_setup_led(ql_adapter_state_t *);
static uint32_t ql_wrapup_led(ql_adapter_state_t *);
static void ql_get_port_summary(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_target_id(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_sfp(ql_adapter_state_t *, EXT_IOCTL *, int);
static int ql_dump_sfp(ql_adapter_state_t *, void *, int);
static ql_fcache_t *ql_setup_fnode(ql_adapter_state_t *);
static void ql_get_fcache(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_fcache_ex(ql_adapter_state_t *, EXT_IOCTL *, int);
void ql_update_fcache(ql_adapter_state_t *, uint8_t *, uint32_t);
static int ql_check_pci(ql_adapter_state_t *, ql_fcache_t *, uint32_t *);
static void ql_flash_layout_table(ql_adapter_state_t *, uint32_t);
static void ql_process_flt(ql_adapter_state_t *, uint32_t);
static void ql_flash_nvram_defaults(ql_adapter_state_t *);
static void ql_port_param(ql_adapter_state_t *, EXT_IOCTL *, int);
static int ql_check_pci(ql_adapter_state_t *, ql_fcache_t *, uint32_t *);
static void ql_get_pci_data(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_fwfcetrace(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_fwexttrace(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_menlo_reset(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_menlo_get_fw_version(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_menlo_update_fw(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_menlo_manage_info(ql_adapter_state_t *, EXT_IOCTL *, int);
static int ql_suspend_hba(ql_adapter_state_t *, uint32_t);
static void ql_restart_hba(ql_adapter_state_t *);
static void ql_get_vp_cnt_id(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_vp_ioctl(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_vport(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_access_flash(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_reset_cmd(ql_adapter_state_t *, EXT_IOCTL *);
static void ql_update_flash_caches(ql_adapter_state_t *);
static void ql_get_dcbx_parameters(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_xgmac_statistics(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_fcf_list(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_get_resource_counts(ql_adapter_state_t *, EXT_IOCTL *, int);
static void ql_qry_adapter_versions(ql_adapter_state_t *, EXT_IOCTL *, int);
static int ql_set_loop_point(ql_adapter_state_t *, uint16_t);

/* ******************************************************************** */
/*			External IOCTL support.				*/
/* ******************************************************************** */

/*
 * ql_alloc_xioctl_resource
 *	Allocates resources needed by module code.
 *
 * Input:
 *	ha:		adapter state pointer.
 *
 * Returns:
 *	SYS_ERRNO
 *
 * Context:
 *	Kernel context.
 */
int
ql_alloc_xioctl_resource(ql_adapter_state_t *ha)
{
	ql_xioctl_t	*xp;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (ha->xioctl != NULL) {
		QL_PRINT_9(CE_CONT, "(%d): already allocated done\n",
		    ha->instance);
		return (0);
	}

	xp = kmem_zalloc(sizeof (ql_xioctl_t), KM_SLEEP);
	if (xp == NULL) {
		EL(ha, "failed, kmem_zalloc\n");
		return (ENOMEM);
	}
	ha->xioctl = xp;

	/* Allocate AEN tracking buffer */
	xp->aen_tracking_queue = kmem_zalloc(EXT_DEF_MAX_AEN_QUEUE *
	    sizeof (EXT_ASYNC_EVENT), KM_SLEEP);
	if (xp->aen_tracking_queue == NULL) {
		EL(ha, "failed, kmem_zalloc-2\n");
		ql_free_xioctl_resource(ha);
		return (ENOMEM);
	}

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);

	return (0);
}

/*
 * ql_free_xioctl_resource
 *	Frees resources used by module code.
 *
 * Input:
 *	ha:		adapter state pointer.
 *
 * Context:
 *	Kernel context.
 */
void
ql_free_xioctl_resource(ql_adapter_state_t *ha)
{
	ql_xioctl_t	*xp = ha->xioctl;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (xp == NULL) {
		QL_PRINT_9(CE_CONT, "(%d): already freed\n", ha->instance);
		return;
	}

	if (xp->aen_tracking_queue != NULL) {
		kmem_free(xp->aen_tracking_queue, EXT_DEF_MAX_AEN_QUEUE *
		    sizeof (EXT_ASYNC_EVENT));
		xp->aen_tracking_queue = NULL;
	}

	kmem_free(xp, sizeof (ql_xioctl_t));
	ha->xioctl = NULL;

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
}

/*
 * ql_xioctl
 *	External IOCTL processing.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	function to perform
 *	arg:	data type varies with request
 *	mode:	flags
 *	cred_p:	credentials pointer
 *	rval_p:	pointer to result value
 *
 * Returns:
 *	0:		success
 *	ENXIO:		No such device or address
 *	ENOPROTOOPT:	Protocol not available
 *
 * Context:
 *	Kernel context.
 */
/* ARGSUSED */
int
ql_xioctl(ql_adapter_state_t *ha, int cmd, intptr_t arg, int mode,
    cred_t *cred_p, int *rval_p)
{
	int	rval;

	QL_PRINT_9(CE_CONT, "(%d): started, cmd=%d\n", ha->instance, cmd);

	if (ha->xioctl == NULL) {
		QL_PRINT_9(CE_CONT, "(%d): no context\n", ha->instance);
		return (ENXIO);
	}

	switch (cmd) {
	case EXT_CC_QUERY:
	case EXT_CC_SEND_FCCT_PASSTHRU:
	case EXT_CC_REG_AEN:
	case EXT_CC_GET_AEN:
	case EXT_CC_SEND_SCSI_PASSTHRU:
	case EXT_CC_WWPN_TO_SCSIADDR:
	case EXT_CC_SEND_ELS_RNID:
	case EXT_CC_SET_DATA:
	case EXT_CC_GET_DATA:
	case EXT_CC_HOST_IDX:
	case EXT_CC_READ_NVRAM:
	case EXT_CC_UPDATE_NVRAM:
	case EXT_CC_READ_OPTION_ROM:
	case EXT_CC_READ_OPTION_ROM_EX:
	case EXT_CC_UPDATE_OPTION_ROM:
	case EXT_CC_UPDATE_OPTION_ROM_EX:
	case EXT_CC_GET_VPD:
	case EXT_CC_SET_VPD:
	case EXT_CC_LOOPBACK:
	case EXT_CC_GET_FCACHE:
	case EXT_CC_GET_FCACHE_EX:
	case EXT_CC_HOST_DRVNAME:
	case EXT_CC_GET_SFP_DATA:
	case EXT_CC_PORT_PARAM:
	case EXT_CC_GET_PCI_DATA:
	case EXT_CC_GET_FWEXTTRACE:
	case EXT_CC_GET_FWFCETRACE:
	case EXT_CC_GET_VP_CNT_ID:
	case EXT_CC_VPORT_CMD:
	case EXT_CC_ACCESS_FLASH:
	case EXT_CC_RESET_FW:
	case EXT_CC_MENLO_MANAGE_INFO:
		rval = ql_sdm_ioctl(ha, cmd, (void *)arg, mode);
		break;
	default:
		/* function not supported. */
		EL(ha, "function=%d not supported\n", cmd);
		rval = ENOPROTOOPT;
	}

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);

	return (rval);
}

/*
 * ql_sdm_ioctl
 *	Provides ioctl functions for SAN/Device Management functions
 *	AKA External Ioctl functions.
 *
 * Input:
 *	ha:		adapter state pointer.
 *	ioctl_code:	ioctl function to perform
 *	arg:		Pointer to EXT_IOCTL cmd data in application land.
 *	mode:		flags
 *
 * Returns:
 *	0:	success
 *	ENOMEM:	Alloc of local EXT_IOCTL struct failed.
 *	EFAULT:	Copyin of caller's EXT_IOCTL struct failed or
 *		copyout of EXT_IOCTL status info failed.
 *	EINVAL:	Signature or version of caller's EXT_IOCTL invalid.
 *	EBUSY:	Device busy
 *
 * Context:
 *	Kernel context.
 */
static int
ql_sdm_ioctl(ql_adapter_state_t *ha, int ioctl_code, void *arg, int mode)
{
	EXT_IOCTL		*cmd;
	int			rval;
	ql_adapter_state_t	*vha;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	/* Copy argument structure (EXT_IOCTL) from application land. */
	if ((rval = ql_sdm_setup(ha, &cmd, arg, mode,
	    ql_validate_signature)) != 0) {
		/*
		 * a non-zero value at this time means a problem getting
		 * the requested information from application land, just
		 * return the error code and hope for the best.
		 */
		EL(ha, "failed, sdm_setup\n");
		return (rval);
	}

	/*
	 * Map the physical ha ptr (which the ioctl is called with)
	 * to the virtual ha that the caller is addressing.
	 */
	if (ha->flags & VP_ENABLED) {
		/* Check that it is within range. */
		if (cmd->HbaSelect > (CFG_IST(ha, CFG_CTRL_2422) ?
		    MAX_24_VIRTUAL_PORTS : MAX_25_VIRTUAL_PORTS)) {
			EL(ha, "Invalid HbaSelect vp index: %xh\n",
			    cmd->HbaSelect);
			cmd->Status = EXT_STATUS_INVALID_VPINDEX;
			cmd->ResponseLen = 0;
			return (EFAULT);
		}
		/*
		 * Special case: HbaSelect == 0 is physical ha
		 */
		if (cmd->HbaSelect != 0) {
			vha = ha->vp_next;
			while (vha != NULL) {
				if (vha->vp_index == cmd->HbaSelect) {
					ha = vha;
					break;
				}
				vha = vha->vp_next;
			}
			/*
			 * The specified vp index may be valid(within range)
			 * but it's not in the list. Currently this is all
			 * we can say.
			 */
			if (vha == NULL) {
				cmd->Status = EXT_STATUS_INVALID_VPINDEX;
				cmd->ResponseLen = 0;
				return (EFAULT);
			}
		}
	}

	/*
	 * If driver is suspended, stalled, or powered down rtn BUSY
	 */
	if (ha->flags & ADAPTER_SUSPENDED ||
	    ha->task_daemon_flags & DRIVER_STALL ||
	    ha->power_level != PM_LEVEL_D0) {
		EL(ha, " %s\n", ha->flags & ADAPTER_SUSPENDED ?
		    "driver suspended" :
		    (ha->task_daemon_flags & DRIVER_STALL ? "driver stalled" :
		    "FCA powered down"));
		cmd->Status = EXT_STATUS_BUSY;
		cmd->ResponseLen = 0;
		rval = EBUSY;

		/* Return results to caller */
		if ((ql_sdm_return(ha, cmd, arg, mode)) == -1) {
			EL(ha, "failed, sdm_return\n");
			rval = EFAULT;
		}
		return (rval);
	}

	switch (ioctl_code) {
	case EXT_CC_QUERY_OS:
		ql_query(ha, cmd, mode);
		break;
	case EXT_CC_SEND_FCCT_PASSTHRU_OS:
		ql_fcct(ha, cmd, mode);
		break;
	case EXT_CC_REG_AEN_OS:
		ql_aen_reg(ha, cmd, mode);
		break;
	case EXT_CC_GET_AEN_OS:
		ql_aen_get(ha, cmd, mode);
		break;
	case EXT_CC_GET_DATA_OS:
		ql_get_host_data(ha, cmd, mode);
		break;
	case EXT_CC_SET_DATA_OS:
		ql_set_host_data(ha, cmd, mode);
		break;
	case EXT_CC_SEND_ELS_RNID_OS:
		ql_send_els_rnid(ha, cmd, mode);
		break;
	case EXT_CC_SCSI_PASSTHRU_OS:
		ql_scsi_passthru(ha, cmd, mode);
		break;
	case EXT_CC_WWPN_TO_SCSIADDR_OS:
		ql_wwpn_to_scsiaddr(ha, cmd, mode);
		break;
	case EXT_CC_HOST_IDX_OS:
		ql_host_idx(ha, cmd, mode);
		break;
	case EXT_CC_HOST_DRVNAME_OS:
		ql_host_drvname(ha, cmd, mode);
		break;
	case EXT_CC_READ_NVRAM_OS:
		ql_read_nvram(ha, cmd, mode);
		break;
	case EXT_CC_UPDATE_NVRAM_OS:
		ql_write_nvram(ha, cmd, mode);
		break;
	case EXT_CC_READ_OPTION_ROM_OS:
	case EXT_CC_READ_OPTION_ROM_EX_OS:
		ql_read_flash(ha, cmd, mode);
		break;
	case EXT_CC_UPDATE_OPTION_ROM_OS:
	case EXT_CC_UPDATE_OPTION_ROM_EX_OS:
		ql_write_flash(ha, cmd, mode);
		break;
	case EXT_CC_LOOPBACK_OS:
		ql_diagnostic_loopback(ha, cmd, mode);
		break;
	case EXT_CC_GET_VPD_OS:
		ql_read_vpd(ha, cmd, mode);
		break;
	case EXT_CC_SET_VPD_OS:
		ql_write_vpd(ha, cmd, mode);
		break;
	case EXT_CC_GET_FCACHE_OS:
		ql_get_fcache(ha, cmd, mode);
		break;
	case EXT_CC_GET_FCACHE_EX_OS:
		ql_get_fcache_ex(ha, cmd, mode);
		break;
	case EXT_CC_GET_SFP_DATA_OS:
		ql_get_sfp(ha, cmd, mode);
		break;
	case EXT_CC_PORT_PARAM_OS:
		ql_port_param(ha, cmd, mode);
		break;
	case EXT_CC_GET_PCI_DATA_OS:
		ql_get_pci_data(ha, cmd, mode);
		break;
	case EXT_CC_GET_FWEXTTRACE_OS:
		ql_get_fwexttrace(ha, cmd, mode);
		break;
	case EXT_CC_GET_FWFCETRACE_OS:
		ql_get_fwfcetrace(ha, cmd, mode);
		break;
	case EXT_CC_MENLO_RESET:
		ql_menlo_reset(ha, cmd, mode);
		break;
	case EXT_CC_MENLO_GET_FW_VERSION:
		ql_menlo_get_fw_version(ha, cmd, mode);
		break;
	case EXT_CC_MENLO_UPDATE_FW:
		ql_menlo_update_fw(ha, cmd, mode);
		break;
	case EXT_CC_MENLO_MANAGE_INFO:
		ql_menlo_manage_info(ha, cmd, mode);
		break;
	case EXT_CC_GET_VP_CNT_ID_OS:
		ql_get_vp_cnt_id(ha, cmd, mode);
		break;
	case EXT_CC_VPORT_CMD_OS:
		ql_vp_ioctl(ha, cmd, mode);
		break;
	case EXT_CC_ACCESS_FLASH_OS:
		ql_access_flash(ha, cmd, mode);
		break;
	case EXT_CC_RESET_FW_OS:
		ql_reset_cmd(ha, cmd);
		break;
	default:
		/* function not supported. */
		EL(ha, "failed, function not supported=%d\n", ioctl_code);

		cmd->Status = EXT_STATUS_INVALID_REQUEST;
		cmd->ResponseLen = 0;
		break;
	}

	/* Return results to caller */
	if (ql_sdm_return(ha, cmd, arg, mode) == -1) {
		EL(ha, "failed, sdm_return\n");
		return (EFAULT);
	}

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);

	return (0);
}

/*
 * ql_sdm_setup
 *	Make a local copy of the EXT_IOCTL struct and validate it.
 *
 * Input:
 *	ha:		adapter state pointer.
 *	cmd_struct:	Pointer to location to store local adrs of EXT_IOCTL.
 *	arg:		Address of application EXT_IOCTL cmd data
 *	mode:		flags
 *	val_sig:	Pointer to a function to validate the ioctl signature.
 *
 * Returns:
 *	0:		success
 *	EFAULT:		Copy in error of application EXT_IOCTL struct.
 *	EINVAL:		Invalid version, signature.
 *	ENOMEM:		Local allocation of EXT_IOCTL failed.
 *
 * Context:
 *	Kernel context.
 */
static int
ql_sdm_setup(ql_adapter_state_t *ha, EXT_IOCTL **cmd_struct, void *arg,
    int mode, boolean_t (*val_sig)(EXT_IOCTL *))
{
	int		rval;
	EXT_IOCTL	*cmd;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	/* Allocate local memory for EXT_IOCTL. */
	*cmd_struct = NULL;
	cmd = (EXT_IOCTL *)kmem_zalloc(sizeof (EXT_IOCTL), KM_SLEEP);
	if (cmd == NULL) {
		EL(ha, "failed, kmem_zalloc\n");
		return (ENOMEM);
	}
	/* Get argument structure. */
	rval = ddi_copyin(arg, (void *)cmd, sizeof (EXT_IOCTL), mode);
	if (rval != 0) {
		EL(ha, "failed, ddi_copyin\n");
		rval = EFAULT;
	} else {
		/*
		 * Check signature and the version.
		 * If either are not valid then neither is the
		 * structure so don't attempt to return any error status
		 * because we can't trust what caller's arg points to.
		 * Just return the errno.
		 */
		if (val_sig(cmd) == 0) {
			EL(ha, "failed, signature\n");
			rval = EINVAL;
		} else if (cmd->Version > EXT_VERSION) {
			EL(ha, "failed, version\n");
			rval = EINVAL;
		}
	}

	if (rval == 0) {
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
		*cmd_struct = cmd;
		cmd->Status = EXT_STATUS_OK;
		cmd->DetailStatus = 0;
	} else {
		kmem_free((void *)cmd, sizeof (EXT_IOCTL));
	}

	return (rval);
}

/*
 * ql_validate_signature
 *	Validate the signature string for an external ioctl call.
 *
 * Input:
 *	sg:	Pointer to EXT_IOCTL signature to validate.
 *
 * Returns:
 *	B_TRUE:		Signature is valid.
 *	B_FALSE:	Signature is NOT valid.
 *
 * Context:
 *	Kernel context.
 */
static boolean_t
ql_validate_signature(EXT_IOCTL *cmd_struct)
{
	/*
	 * Check signature.
	 *
	 * If signature is not valid then neither is the rest of
	 * the structure (e.g., can't trust it), so don't attempt
	 * to return any error status other than the errno.
	 */
	if (bcmp(&cmd_struct->Signature, "QLOGIC", 6) != 0) {
		QL_PRINT_2(CE_CONT, "failed,\n");
		return (B_FALSE);
	}

	return (B_TRUE);
}

/*
 * ql_sdm_return
 *	Copies return data/status to application land for
 *	ioctl call using the SAN/Device Management EXT_IOCTL call interface.
 *
 * Input:
 *	ha:		adapter state pointer.
 *	cmd:		Pointer to kernel copy of requestor's EXT_IOCTL struct.
 *	ioctl_code:	ioctl function to perform
 *	arg:		EXT_IOCTL cmd data in application land.
 *	mode:		flags
 *
 * Returns:
 *	0:	success
 *	EFAULT:	Copy out error.
 *
 * Context:
 *	Kernel context.
 */
/* ARGSUSED */
static int
ql_sdm_return(ql_adapter_state_t *ha, EXT_IOCTL *cmd, void *arg, int mode)
{
	int	rval = 0;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	rval |= ddi_copyout((void *)&cmd->ResponseLen,
	    (void *)&(((EXT_IOCTL*)arg)->ResponseLen), sizeof (uint32_t),
	    mode);

	rval |= ddi_copyout((void *)&cmd->Status,
	    (void *)&(((EXT_IOCTL*)arg)->Status),
	    sizeof (cmd->Status), mode);
	rval |= ddi_copyout((void *)&cmd->DetailStatus,
	    (void *)&(((EXT_IOCTL*)arg)->DetailStatus),
	    sizeof (cmd->DetailStatus), mode);

	kmem_free((void *)cmd, sizeof (EXT_IOCTL));

	if (rval != 0) {
		/* Some copyout operation failed */
		EL(ha, "failed, ddi_copyout\n");
		return (EFAULT);
	}

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);

	return (0);
}

/*
 * ql_query
 *	Performs all EXT_CC_QUERY functions.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	Local EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_query(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	QL_PRINT_9(CE_CONT, "(%d): started, cmd=%d\n", ha->instance,
	    cmd->SubCode);

	/* case off on command subcode */
	switch (cmd->SubCode) {
	case EXT_SC_QUERY_HBA_NODE:
		ql_qry_hba_node(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_HBA_PORT:
		ql_qry_hba_port(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_DISC_PORT:
		ql_qry_disc_port(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_DISC_TGT:
		ql_qry_disc_tgt(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_DRIVER:
		ql_qry_driver(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_FW:
		ql_qry_fw(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_CHIP:
		ql_qry_chip(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_CNA_PORT:
		ql_qry_cna_port(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_ADAPTER_VERSIONS:
		ql_qry_adapter_versions(ha, cmd, mode);
		break;
	case EXT_SC_QUERY_DISC_LUN:
	default:
		/* function not supported. */
		cmd->Status = EXT_STATUS_UNSUPPORTED_SUBCODE;
		EL(ha, "failed, Unsupported Subcode=%xh\n",
		    cmd->SubCode);
		break;
	}

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
}

/*
 * ql_qry_hba_node
 *	Performs EXT_SC_QUERY_HBA_NODE subfunction.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_qry_hba_node(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	EXT_HBA_NODE	tmp_node = {0};
	uint_t		len;
	caddr_t		bufp;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->ResponseLen < sizeof (EXT_HBA_NODE)) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = sizeof (EXT_HBA_NODE);
		EL(ha, "failed, ResponseLen < EXT_HBA_NODE, "
		    "Len=%xh\n", cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	/* fill in the values */

	bcopy(ha->loginparams.node_ww_name.raw_wwn, tmp_node.WWNN,
	    EXT_DEF_WWN_NAME_SIZE);

	(void) sprintf((char *)(tmp_node.Manufacturer), "QLogic Corporation");

	(void) sprintf((char *)(tmp_node.Model), "%x", ha->device_id);

	bcopy(&tmp_node.WWNN[5], tmp_node.SerialNum, 3);

	(void) sprintf((char *)(tmp_node.DriverVersion), QL_VERSION);

	if (CFG_IST(ha, CFG_SBUS_CARD)) {
		size_t		verlen;
		uint16_t	w;
		char		*tmpptr;

		verlen = strlen((char *)(tmp_node.DriverVersion));
		if (verlen + 5 > EXT_DEF_MAX_STR_SIZE) {
			EL(ha, "failed, No room for fpga version string\n");
		} else {
			w = (uint16_t)ddi_get16(ha->sbus_fpga_dev_handle,
			    (uint16_t *)
			    (ha->sbus_fpga_iobase + FPGA_REVISION));

			tmpptr = (char *)&(tmp_node.DriverVersion[verlen+1]);
			if (tmpptr == NULL) {
				EL(ha, "Unable to insert fpga version str\n");
			} else {
				(void) sprintf(tmpptr, "%d.%d",
				    ((w & 0xf0) >> 4), (w & 0x0f));
				tmp_node.DriverAttr |= EXT_CC_HBA_NODE_SBUS;
			}
		}
	}

	(void) sprintf((char *)(tmp_node.FWVersion), "%01d.%02d.%02d",
	    ha->fw_major_version, ha->fw_minor_version,
	    ha->fw_subminor_version);

	if ((CFG_IST(ha, CFG_CTRL_24258081)) == 0) {
		switch (ha->fw_attributes) {
		case FWATTRIB_EF:
			(void) strcat((char *)(tmp_node.FWVersion), " EF");
			break;
		case FWATTRIB_TP:
			(void) strcat((char *)(tmp_node.FWVersion), " TP");
			break;
		case FWATTRIB_IP:
			(void) strcat((char *)(tmp_node.FWVersion), " IP");
			break;
		case FWATTRIB_IPX:
			(void) strcat((char *)(tmp_node.FWVersion), " IPX");
			break;
		case FWATTRIB_FL:
			(void) strcat((char *)(tmp_node.FWVersion), " FL");
			break;
		case FWATTRIB_FPX:
			(void) strcat((char *)(tmp_node.FWVersion), " FLX");
			break;
		default:
			break;
		}
	}

	/* FCode version. */
	/*LINTED [Solaris DDI_DEV_T_ANY Lint error]*/
	if (ddi_getlongprop(DDI_DEV_T_ANY, ha->dip, PROP_LEN_AND_VAL_ALLOC |
	    DDI_PROP_DONTPASS | DDI_PROP_CANSLEEP, "version", (caddr_t)&bufp,
	    (int *)&len) == DDI_PROP_SUCCESS) {
		if (len < EXT_DEF_MAX_STR_SIZE) {
			bcopy(bufp, tmp_node.OptRomVersion, len);
		} else {
			bcopy(bufp, tmp_node.OptRomVersion,
			    EXT_DEF_MAX_STR_SIZE - 1);
			tmp_node.OptRomVersion[EXT_DEF_MAX_STR_SIZE - 1] =
			    '\0';
		}
		kmem_free(bufp, len);
	} else {
		(void) sprintf((char *)tmp_node.OptRomVersion, "0");
	}
	tmp_node.PortCount = 1;
	tmp_node.InterfaceType = EXT_DEF_FC_INTF_TYPE;

	if (ddi_copyout((void *)&tmp_node,
	    (void *)(uintptr_t)(cmd->ResponseAdr),
	    sizeof (EXT_HBA_NODE), mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = sizeof (EXT_HBA_NODE);
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_qry_hba_port
 *	Performs EXT_SC_QUERY_HBA_PORT subfunction.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_qry_hba_port(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	ql_link_t	*link;
	ql_tgt_t	*tq;
	ql_mbx_data_t	mr;
	EXT_HBA_PORT	tmp_port = {0};
	int		rval;
	uint16_t	port_cnt, tgt_cnt, index;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->ResponseLen < sizeof (EXT_HBA_PORT)) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = sizeof (EXT_HBA_PORT);
		EL(ha, "failed, ResponseLen < EXT_HBA_NODE, Len=%xh\n",
		    cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	/* fill in the values */

	bcopy(ha->loginparams.nport_ww_name.raw_wwn, tmp_port.WWPN,
	    EXT_DEF_WWN_NAME_SIZE);
	tmp_port.Id[0] = 0;
	tmp_port.Id[1] = ha->d_id.b.domain;
	tmp_port.Id[2] = ha->d_id.b.area;
	tmp_port.Id[3] = ha->d_id.b.al_pa;

	/* For now we are initiator only driver */
	tmp_port.Type = EXT_DEF_INITIATOR_DEV;

	if (ha->task_daemon_flags & LOOP_DOWN) {
		tmp_port.State = EXT_DEF_HBA_LOOP_DOWN;
	} else if (DRIVER_SUSPENDED(ha)) {
		tmp_port.State = EXT_DEF_HBA_SUSPENDED;
	} else {
		tmp_port.State = EXT_DEF_HBA_OK;
	}

	if (ha->flags & POINT_TO_POINT) {
		tmp_port.Mode = EXT_DEF_P2P_MODE;
	} else {
		tmp_port.Mode = EXT_DEF_LOOP_MODE;
	}
	/*
	 * fill in the portspeed values.
	 *
	 * default to not yet negotiated state
	 */
	tmp_port.PortSpeed = EXT_PORTSPEED_NOT_NEGOTIATED;

	if (tmp_port.State == EXT_DEF_HBA_OK) {
		switch (ha->iidma_rate) {
		case IIDMA_RATE_1GB:
			tmp_port.PortSpeed = EXT_DEF_PORTSPEED_1GBIT;
			break;
		case IIDMA_RATE_2GB:
			tmp_port.PortSpeed = EXT_DEF_PORTSPEED_2GBIT;
			break;
		case IIDMA_RATE_4GB:
			tmp_port.PortSpeed = EXT_DEF_PORTSPEED_4GBIT;
			break;
		case IIDMA_RATE_8GB:
			tmp_port.PortSpeed = EXT_DEF_PORTSPEED_8GBIT;
			break;
		case IIDMA_RATE_10GB:
			tmp_port.PortSpeed = EXT_DEF_PORTSPEED_10GBIT;
			break;
		default:
			tmp_port.PortSpeed = EXT_DEF_PORTSPEED_UNKNOWN;
			EL(ha, "failed, data rate=%xh\n", mr.mb[1]);
			break;
		}
	}

	/* Report all supported port speeds */
	if (CFG_IST(ha, CFG_CTRL_25XX)) {
		tmp_port.PortSupportedSpeed = (EXT_DEF_PORTSPEED_8GBIT |
		    EXT_DEF_PORTSPEED_4GBIT | EXT_DEF_PORTSPEED_2GBIT |
		    EXT_DEF_PORTSPEED_1GBIT);
		/*
		 * Correct supported speeds based on type of
		 * sfp that is present
		 */
		switch (ha->sfp_stat) {
		case 1:
			/* no sfp detected */
			break;
		case 2:
		case 4:
			/* 4GB sfp */
			tmp_port.PortSupportedSpeed &=
			    ~EXT_DEF_PORTSPEED_8GBIT;
			break;
		case 3:
		case 5:
			/* 8GB sfp */
			tmp_port.PortSupportedSpeed &=
			    ~EXT_DEF_PORTSPEED_1GBIT;
			break;
		default:
			EL(ha, "sfp_stat: %xh\n", ha->sfp_stat);
			break;

		}
	} else if (CFG_IST(ha, CFG_CTRL_8081)) {
		tmp_port.PortSupportedSpeed = EXT_DEF_PORTSPEED_10GBIT;
	} else if (CFG_IST(ha, CFG_CTRL_2422)) {
		tmp_port.PortSupportedSpeed = (EXT_DEF_PORTSPEED_4GBIT |
		    EXT_DEF_PORTSPEED_2GBIT | EXT_DEF_PORTSPEED_1GBIT);
	} else if (CFG_IST(ha, CFG_CTRL_2300)) {
		tmp_port.PortSupportedSpeed = (EXT_DEF_PORTSPEED_2GBIT |
		    EXT_DEF_PORTSPEED_1GBIT);
	} else if (CFG_IST(ha, CFG_CTRL_6322)) {
		tmp_port.PortSupportedSpeed = EXT_DEF_PORTSPEED_2GBIT;
	} else if (CFG_IST(ha, CFG_CTRL_2200)) {
		tmp_port.PortSupportedSpeed = EXT_DEF_PORTSPEED_1GBIT;
	} else {
		tmp_port.PortSupportedSpeed = EXT_DEF_PORTSPEED_UNKNOWN;
		EL(ha, "unknown HBA type: %xh\n", ha->device_id);
	}
	tmp_port.LinkState2 = LSB(ha->sfp_stat);
	port_cnt = 0;
	tgt_cnt = 0;

	for (index = 0; index < DEVICE_HEAD_LIST_SIZE; index++) {
		for (link = ha->dev[index].first; link != NULL;
		    link = link->next) {
			tq = link->base_address;

			if (!VALID_TARGET_ID(ha, tq->loop_id)) {
				continue;
			}

			port_cnt++;
			if ((tq->flags & TQF_INITIATOR_DEVICE) == 0) {
				tgt_cnt++;
			}
		}
	}

	tmp_port.DiscPortCount = port_cnt;
	tmp_port.DiscTargetCount = tgt_cnt;

	tmp_port.DiscPortNameType = EXT_DEF_USE_NODE_NAME;

	rval = ddi_copyout((void *)&tmp_port,
	    (void *)(uintptr_t)(cmd->ResponseAdr),
	    sizeof (EXT_HBA_PORT), mode);
	if (rval != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = sizeof (EXT_HBA_PORT);
		QL_PRINT_9(CE_CONT, "(%d): done, ports=%d, targets=%d\n",
		    ha->instance, port_cnt, tgt_cnt);
	}
}

/*
 * ql_qry_disc_port
 *	Performs EXT_SC_QUERY_DISC_PORT subfunction.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 *	cmd->Instance = Port instance in fcport chain.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_qry_disc_port(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	EXT_DISC_PORT	tmp_port = {0};
	ql_link_t	*link;
	ql_tgt_t	*tq;
	uint16_t	index;
	uint16_t	inst = 0;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->ResponseLen < sizeof (EXT_DISC_PORT)) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = sizeof (EXT_DISC_PORT);
		EL(ha, "failed, ResponseLen < EXT_DISC_PORT, Len=%xh\n",
		    cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	for (link = NULL, index = 0;
	    index < DEVICE_HEAD_LIST_SIZE && link == NULL; index++) {
		for (link = ha->dev[index].first; link != NULL;
		    link = link->next) {
			tq = link->base_address;

			if (!VALID_TARGET_ID(ha, tq->loop_id)) {
				continue;
			}
			if (inst != cmd->Instance) {
				inst++;
				continue;
			}

			/* fill in the values */
			bcopy(tq->node_name, tmp_port.WWNN,
			    EXT_DEF_WWN_NAME_SIZE);
			bcopy(tq->port_name, tmp_port.WWPN,
			    EXT_DEF_WWN_NAME_SIZE);

			break;
		}
	}

	if (link == NULL) {
		/* no matching device */
		cmd->Status = EXT_STATUS_DEV_NOT_FOUND;
		EL(ha, "failed, port not found port=%d\n", cmd->Instance);
		cmd->ResponseLen = 0;
		return;
	}

	tmp_port.Id[0] = 0;
	tmp_port.Id[1] = tq->d_id.b.domain;
	tmp_port.Id[2] = tq->d_id.b.area;
	tmp_port.Id[3] = tq->d_id.b.al_pa;

	tmp_port.Type = 0;
	if (tq->flags & TQF_INITIATOR_DEVICE) {
		tmp_port.Type = (uint16_t)(tmp_port.Type |
		    EXT_DEF_INITIATOR_DEV);
	} else if ((tq->flags & TQF_TAPE_DEVICE) == 0) {
		(void) ql_inq_scan(ha, tq, 1);
	} else if (tq->flags & TQF_TAPE_DEVICE) {
		tmp_port.Type = (uint16_t)(tmp_port.Type | EXT_DEF_TAPE_DEV);
	}

	if (tq->flags & TQF_FABRIC_DEVICE) {
		tmp_port.Type = (uint16_t)(tmp_port.Type | EXT_DEF_FABRIC_DEV);
	} else {
		tmp_port.Type = (uint16_t)(tmp_port.Type | EXT_DEF_TARGET_DEV);
	}

	tmp_port.Status = 0;
	tmp_port.Bus = 0;  /* Hard-coded for Solaris */

	bcopy(tq->port_name, &tmp_port.TargetId, 8);

	if (ddi_copyout((void *)&tmp_port,
	    (void *)(uintptr_t)(cmd->ResponseAdr),
	    sizeof (EXT_DISC_PORT), mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = sizeof (EXT_DISC_PORT);
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_qry_disc_tgt
 *	Performs EXT_SC_QUERY_DISC_TGT subfunction.
 *
 * Input:
 *	ha:		adapter state pointer.
 *	cmd:		EXT_IOCTL cmd struct pointer.
 *	mode:		flags.
 *
 *	cmd->Instance = Port instance in fcport chain.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_qry_disc_tgt(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	EXT_DISC_TARGET	tmp_tgt = {0};
	ql_link_t	*link;
	ql_tgt_t	*tq;
	uint16_t	index;
	uint16_t	inst = 0;

	QL_PRINT_9(CE_CONT, "(%d): started, target=%d\n", ha->instance,
	    cmd->Instance);

	if (cmd->ResponseLen < sizeof (EXT_DISC_TARGET)) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = sizeof (EXT_DISC_TARGET);
		EL(ha, "failed, ResponseLen < EXT_DISC_TARGET, Len=%xh\n",
		    cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	/* Scan port list for requested target and fill in the values */
	for (link = NULL, index = 0;
	    index < DEVICE_HEAD_LIST_SIZE && link == NULL; index++) {
		for (link = ha->dev[index].first; link != NULL;
		    link = link->next) {
			tq = link->base_address;

			if (!VALID_TARGET_ID(ha, tq->loop_id) ||
			    tq->flags & TQF_INITIATOR_DEVICE) {
				continue;
			}
			if (inst != cmd->Instance) {
				inst++;
				continue;
			}

			/* fill in the values */
			bcopy(tq->node_name, tmp_tgt.WWNN,
			    EXT_DEF_WWN_NAME_SIZE);
			bcopy(tq->port_name, tmp_tgt.WWPN,
			    EXT_DEF_WWN_NAME_SIZE);

			break;
		}
	}

	if (link == NULL) {
		/* no matching device */
		cmd->Status = EXT_STATUS_DEV_NOT_FOUND;
		cmd->DetailStatus = EXT_DSTATUS_TARGET;
		EL(ha, "failed, not found target=%d\n", cmd->Instance);
		cmd->ResponseLen = 0;
		return;
	}
	tmp_tgt.Id[0] = 0;
	tmp_tgt.Id[1] = tq->d_id.b.domain;
	tmp_tgt.Id[2] = tq->d_id.b.area;
	tmp_tgt.Id[3] = tq->d_id.b.al_pa;

	tmp_tgt.LunCount = (uint16_t)ql_lun_count(ha, tq);

	if ((tq->flags & TQF_TAPE_DEVICE) == 0) {
		(void) ql_inq_scan(ha, tq, 1);
	}

	tmp_tgt.Type = 0;
	if (tq->flags & TQF_TAPE_DEVICE) {
		tmp_tgt.Type = (uint16_t)(tmp_tgt.Type | EXT_DEF_TAPE_DEV);
	}

	if (tq->flags & TQF_FABRIC_DEVICE) {
		tmp_tgt.Type = (uint16_t)(tmp_tgt.Type | EXT_DEF_FABRIC_DEV);
	} else {
		tmp_tgt.Type = (uint16_t)(tmp_tgt.Type | EXT_DEF_TARGET_DEV);
	}

	tmp_tgt.Status = 0;

	tmp_tgt.Bus = 0;  /* Hard-coded for Solaris. */

	bcopy(tq->port_name, &tmp_tgt.TargetId, 8);

	if (ddi_copyout((void *)&tmp_tgt,
	    (void *)(uintptr_t)(cmd->ResponseAdr),
	    sizeof (EXT_DISC_TARGET), mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = sizeof (EXT_DISC_TARGET);
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_qry_fw
 *	Performs EXT_SC_QUERY_FW subfunction.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_qry_fw(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	EXT_FW		fw_info = {0};

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->ResponseLen < sizeof (EXT_FW)) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = sizeof (EXT_FW);
		EL(ha, "failed, ResponseLen < EXT_FW, Len=%xh\n",
		    cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	(void) sprintf((char *)(fw_info.Version), "%d.%02d.%02d",
	    ha->fw_major_version, ha->fw_minor_version,
	    ha->fw_subminor_version);

	fw_info.Attrib = ha->fw_attributes;

	if (ddi_copyout((void *)&fw_info,
	    (void *)(uintptr_t)(cmd->ResponseAdr),
	    sizeof (EXT_FW), mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
		return;
	} else {
		cmd->ResponseLen = sizeof (EXT_FW);
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_qry_chip
 *	Performs EXT_SC_QUERY_CHIP subfunction.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_qry_chip(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	EXT_CHIP	chip = {0};

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->ResponseLen < sizeof (EXT_CHIP)) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = sizeof (EXT_CHIP);
		EL(ha, "failed, ResponseLen < EXT_CHIP, Len=%xh\n",
		    cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	chip.VendorId = ha->ven_id;
	chip.DeviceId = ha->device_id;
	chip.SubVendorId = ha->subven_id;
	chip.SubSystemId = ha->subsys_id;
	chip.IoAddr = ql_pci_config_get32(ha, PCI_CONF_BASE0);
	chip.IoAddrLen = 0x100;
	chip.MemAddr = ql_pci_config_get32(ha, PCI_CONF_BASE1);
	chip.MemAddrLen = 0x100;
	chip.ChipRevID = ha->rev_id;
	if (ha->flags & FUNCTION_1) {
		chip.FuncNo = 1;
	}

	if (ddi_copyout((void *)&chip,
	    (void *)(uintptr_t)(cmd->ResponseAdr),
	    sizeof (EXT_CHIP), mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = sizeof (EXT_CHIP);
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_qry_driver
 *	Performs EXT_SC_QUERY_DRIVER subfunction.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_qry_driver(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	EXT_DRIVER	qd = {0};

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->ResponseLen < sizeof (EXT_DRIVER)) {
		cmd->Status = EXT_STATUS_DATA_OVERRUN;
		cmd->DetailStatus = sizeof (EXT_DRIVER);
		EL(ha, "failed, ResponseLen < EXT_DRIVER, Len=%xh\n",
		    cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	(void) strcpy((void *)&qd.Version[0], QL_VERSION);
	qd.NumOfBus = 1;	/* Fixed for Solaris */
	qd.TargetsPerBus = (uint16_t)
	    (CFG_IST(ha, (CFG_CTRL_24258081 | CFG_EXT_FW_INTERFACE)) ?
	    MAX_24_FIBRE_DEVICES : MAX_22_FIBRE_DEVICES);
	qd.LunsPerTarget = 2030;
	qd.MaxTransferLen = QL_DMA_MAX_XFER_SIZE;
	qd.MaxDataSegments = QL_DMA_SG_LIST_LENGTH;

	if (ddi_copyout((void *)&qd, (void *)(uintptr_t)cmd->ResponseAdr,
	    sizeof (EXT_DRIVER), mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = sizeof (EXT_DRIVER);
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_fcct
 *	IOCTL management server FC-CT passthrough.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	User space CT arguments pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_fcct(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	ql_mbx_iocb_t		*pkt;
	ql_mbx_data_t		mr;
	dma_mem_t		*dma_mem;
	caddr_t			pld;
	uint32_t		pkt_size, pld_byte_cnt, *long_ptr;
	int			rval;
	ql_ct_iu_preamble_t	*ct;
	ql_xioctl_t		*xp = ha->xioctl;
	ql_tgt_t		tq;
	uint16_t		comp_status, loop_id;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	/* Get CT argument structure. */
	if ((ha->topology & QL_SNS_CONNECTION) == 0) {
		EL(ha, "failed, No switch\n");
		cmd->Status = EXT_STATUS_DEV_NOT_FOUND;
		cmd->ResponseLen = 0;
		return;
	}

	if (DRIVER_SUSPENDED(ha)) {
		EL(ha, "failed, LOOP_NOT_READY\n");
		cmd->Status = EXT_STATUS_BUSY;
		cmd->ResponseLen = 0;
		return;
	}

	/* Login management server device. */
	if ((xp->flags & QL_MGMT_SERVER_LOGIN) == 0) {
		tq.d_id.b.al_pa = 0xfa;
		tq.d_id.b.area = 0xff;
		tq.d_id.b.domain = 0xff;
		tq.loop_id = (uint16_t)(CFG_IST(ha, CFG_CTRL_24258081) ?
		    MANAGEMENT_SERVER_24XX_LOOP_ID :
		    MANAGEMENT_SERVER_LOOP_ID);
		rval = ql_login_fport(ha, &tq, tq.loop_id, LFF_NO_PRLI, &mr);
		if (rval != QL_SUCCESS) {
			EL(ha, "failed, server login\n");
			cmd->Status = EXT_STATUS_DEV_NOT_FOUND;
			cmd->ResponseLen = 0;
			return;
		} else {
			xp->flags |= QL_MGMT_SERVER_LOGIN;
		}
	}

	QL_PRINT_9(CE_CONT, "(%d): cmd\n", ha->instance);
	QL_DUMP_9(cmd, 8, sizeof (EXT_IOCTL));

	/* Allocate a DMA Memory Descriptor */
	dma_mem = (dma_mem_t *)kmem_zalloc(sizeof (dma_mem_t), KM_SLEEP);
	if (dma_mem == NULL) {
		EL(ha, "failed, kmem_zalloc\n");
		cmd->Status = EXT_STATUS_NO_MEMORY;
		cmd->ResponseLen = 0;
		return;
	}
	/* Determine maximum buffer size. */
	if (cmd->RequestLen < cmd->ResponseLen) {
		pld_byte_cnt = cmd->ResponseLen;
	} else {
		pld_byte_cnt = cmd->RequestLen;
	}

	/* Allocate command block. */
	pkt_size = (uint32_t)(sizeof (ql_mbx_iocb_t) + pld_byte_cnt);
	pkt = kmem_zalloc(pkt_size, KM_SLEEP);
	if (pkt == NULL) {
		EL(ha, "failed, kmem_zalloc\n");
		cmd->Status = EXT_STATUS_NO_MEMORY;
		cmd->ResponseLen = 0;
		return;
	}
	pld = (caddr_t)pkt + sizeof (ql_mbx_iocb_t);

	/* Get command payload data. */
	if (ql_get_buffer_data((caddr_t)(uintptr_t)cmd->RequestAdr, pld,
	    cmd->RequestLen, mode) != cmd->RequestLen) {
		EL(ha, "failed, get_buffer_data\n");
		kmem_free(pkt, pkt_size);
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		return;
	}

	/* Get DMA memory for the IOCB */
	if (ql_get_dma_mem(ha, dma_mem, pkt_size, LITTLE_ENDIAN_DMA,
	    QL_DMA_RING_ALIGN) != QL_SUCCESS) {
		cmn_err(CE_WARN, "%s(%d): DMA memory "
		    "alloc failed", QL_NAME, ha->instance);
		kmem_free(pkt, pkt_size);
		kmem_free(dma_mem, sizeof (dma_mem_t));
		cmd->Status = EXT_STATUS_MS_NO_RESPONSE;
		cmd->ResponseLen = 0;
		return;
	}

	/* Copy out going payload data to IOCB DMA buffer. */
	ddi_rep_put8(dma_mem->acc_handle, (uint8_t *)pld,
	    (uint8_t *)dma_mem->bp, pld_byte_cnt, DDI_DEV_AUTOINCR);

	/* Sync IOCB DMA buffer. */
	(void) ddi_dma_sync(dma_mem->dma_handle, 0, pld_byte_cnt,
	    DDI_DMA_SYNC_FORDEV);

	/*
	 * Setup IOCB
	 */
	ct = (ql_ct_iu_preamble_t *)pld;
	if (CFG_IST(ha, CFG_CTRL_24258081)) {
		pkt->ms24.entry_type = CT_PASSTHRU_TYPE;
		pkt->ms24.entry_count = 1;

		pkt->ms24.vp_index = ha->vp_index;

		/* Set loop ID */
		pkt->ms24.n_port_hdl = (uint16_t)
		    (ct->gs_type == GS_TYPE_DIR_SERVER ?
		    LE_16(SNS_24XX_HDL) :
		    LE_16(MANAGEMENT_SERVER_24XX_LOOP_ID));

		/* Set ISP command timeout. */
		pkt->ms24.timeout = LE_16(120);

		/* Set cmd/response data segment counts. */
		pkt->ms24.cmd_dseg_count = LE_16(1);
		pkt->ms24.resp_dseg_count = LE_16(1);

		/* Load ct cmd byte count. */
		pkt->ms24.cmd_byte_count = LE_32(cmd->RequestLen);

		/* Load ct rsp byte count. */
		pkt->ms24.resp_byte_count = LE_32(cmd->ResponseLen);

		long_ptr = (uint32_t *)&pkt->ms24.dseg_0_address;

		/* Load MS command entry data segments. */
		*long_ptr++ = (uint32_t)
		    LE_32(LSD(dma_mem->cookie.dmac_laddress));
		*long_ptr++ = (uint32_t)
		    LE_32(MSD(dma_mem->cookie.dmac_laddress));
		*long_ptr++ = (uint32_t)(LE_32(cmd->RequestLen));

		/* Load MS response entry data segments. */
		*long_ptr++ = (uint32_t)
		    LE_32(LSD(dma_mem->cookie.dmac_laddress));
		*long_ptr++ = (uint32_t)
		    LE_32(MSD(dma_mem->cookie.dmac_laddress));
		*long_ptr = (uint32_t)LE_32(cmd->ResponseLen);

		rval = ql_issue_mbx_iocb(ha, (caddr_t)pkt,
		    sizeof (ql_mbx_iocb_t));

		comp_status = (uint16_t)LE_16(pkt->sts24.comp_status);
		if (comp_status == CS_DATA_UNDERRUN) {
			if ((BE_16(ct->max_residual_size)) == 0) {
				comp_status = CS_COMPLETE;
			}
		}

		if (rval != QL_SUCCESS || (pkt->sts24.entry_status & 0x3c) !=
		    0) {
			EL(ha, "failed, I/O timeout or "
			    "es=%xh, ss_l=%xh, rval=%xh\n",
			    pkt->sts24.entry_status,
			    pkt->sts24.scsi_status_l, rval);
			kmem_free(pkt, pkt_size);
			ql_free_dma_resource(ha, dma_mem);
			kmem_free(dma_mem, sizeof (dma_mem_t));
			cmd->Status = EXT_STATUS_MS_NO_RESPONSE;
			cmd->ResponseLen = 0;
			return;
		}
	} else {
		pkt->ms.entry_type = MS_TYPE;
		pkt->ms.entry_count = 1;

		/* Set loop ID */
		loop_id = (uint16_t)(ct->gs_type == GS_TYPE_DIR_SERVER ?
		    SIMPLE_NAME_SERVER_LOOP_ID : MANAGEMENT_SERVER_LOOP_ID);
		if (CFG_IST(ha, CFG_EXT_FW_INTERFACE)) {
			pkt->ms.loop_id_l = LSB(loop_id);
			pkt->ms.loop_id_h = MSB(loop_id);
		} else {
			pkt->ms.loop_id_h = LSB(loop_id);
		}

		/* Set ISP command timeout. */
		pkt->ms.timeout = LE_16(120);

		/* Set data segment counts. */
		pkt->ms.cmd_dseg_count_l = 1;
		pkt->ms.total_dseg_count = LE_16(2);

		/* Response total byte count. */
		pkt->ms.resp_byte_count = LE_32(cmd->ResponseLen);
		pkt->ms.dseg_1_length = LE_32(cmd->ResponseLen);

		/* Command total byte count. */
		pkt->ms.cmd_byte_count = LE_32(cmd->RequestLen);
		pkt->ms.dseg_0_length = LE_32(cmd->RequestLen);

		/* Load command/response data segments. */
		pkt->ms.dseg_0_address[0] = (uint32_t)
		    LE_32(LSD(dma_mem->cookie.dmac_laddress));
		pkt->ms.dseg_0_address[1] = (uint32_t)
		    LE_32(MSD(dma_mem->cookie.dmac_laddress));
		pkt->ms.dseg_1_address[0] = (uint32_t)
		    LE_32(LSD(dma_mem->cookie.dmac_laddress));
		pkt->ms.dseg_1_address[1] = (uint32_t)
		    LE_32(MSD(dma_mem->cookie.dmac_laddress));

		rval = ql_issue_mbx_iocb(ha, (caddr_t)pkt,
		    sizeof (ql_mbx_iocb_t));

		comp_status = (uint16_t)LE_16(pkt->sts.comp_status);
		if (comp_status == CS_DATA_UNDERRUN) {
			if ((BE_16(ct->max_residual_size)) == 0) {
				comp_status = CS_COMPLETE;
			}
		}
		if (rval != QL_SUCCESS || (pkt->sts.entry_status & 0x7e) != 0) {
			EL(ha, "failed, I/O timeout or "
			    "es=%xh, rval=%xh\n", pkt->sts.entry_status, rval);
			kmem_free(pkt, pkt_size);
			ql_free_dma_resource(ha, dma_mem);
			kmem_free(dma_mem, sizeof (dma_mem_t));
			cmd->Status = EXT_STATUS_MS_NO_RESPONSE;
			cmd->ResponseLen = 0;
			return;
		}
	}

	/* Sync in coming DMA buffer. */
	(void) ddi_dma_sync(dma_mem->dma_handle, 0,
	    pld_byte_cnt, DDI_DMA_SYNC_FORKERNEL);
	/* Copy in coming DMA data. */
	ddi_rep_get8(dma_mem->acc_handle, (uint8_t *)pld,
	    (uint8_t *)dma_mem->bp, pld_byte_cnt,
	    DDI_DEV_AUTOINCR);

	/* Copy response payload from DMA buffer to application. */
	if (cmd->ResponseLen != 0) {
		QL_PRINT_9(CE_CONT, "(%d): ResponseLen=%d\n", ha->instance,
		    cmd->ResponseLen);
		QL_DUMP_9(pld, 8, cmd->ResponseLen);

		/* Send response payload. */
		if (ql_send_buffer_data(pld,
		    (caddr_t)(uintptr_t)cmd->ResponseAdr,
		    cmd->ResponseLen, mode) != cmd->ResponseLen) {
			EL(ha, "failed, send_buffer_data\n");
			cmd->Status = EXT_STATUS_COPY_ERR;
			cmd->ResponseLen = 0;
		}
	}

	kmem_free(pkt, pkt_size);
	ql_free_dma_resource(ha, dma_mem);
	kmem_free(dma_mem, sizeof (dma_mem_t));

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
}

/*
 * ql_aen_reg
 *	IOCTL management server Asynchronous Event Tracking Enable/Disable.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_aen_reg(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	EXT_REG_AEN	reg_struct;
	int		rval = 0;
	ql_xioctl_t	*xp = ha->xioctl;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	rval = ddi_copyin((void*)(uintptr_t)cmd->RequestAdr, &reg_struct,
	    cmd->RequestLen, mode);

	if (rval == 0) {
		if (reg_struct.Enable) {
			xp->flags |= QL_AEN_TRACKING_ENABLE;
		} else {
			xp->flags &= ~QL_AEN_TRACKING_ENABLE;
			/* Empty the queue. */
			INTR_LOCK(ha);
			xp->aen_q_head = 0;
			xp->aen_q_tail = 0;
			INTR_UNLOCK(ha);
		}
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	} else {
		cmd->Status = EXT_STATUS_COPY_ERR;
		EL(ha, "failed, ddi_copyin\n");
	}
}

/*
 * ql_aen_get
 *	IOCTL management server Asynchronous Event Record Transfer.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_aen_get(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	uint32_t	out_size;
	EXT_ASYNC_EVENT	*tmp_q;
	EXT_ASYNC_EVENT	aen[EXT_DEF_MAX_AEN_QUEUE];
	uint8_t		i;
	uint8_t		queue_cnt;
	uint8_t		request_cnt;
	ql_xioctl_t	*xp = ha->xioctl;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	/* Compute the number of events that can be returned */
	request_cnt = (uint8_t)(cmd->ResponseLen / sizeof (EXT_ASYNC_EVENT));

	if (request_cnt < EXT_DEF_MAX_AEN_QUEUE) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = EXT_DEF_MAX_AEN_QUEUE;
		EL(ha, "failed, request_cnt < EXT_DEF_MAX_AEN_QUEUE, "
		    "Len=%xh\n", request_cnt);
		cmd->ResponseLen = 0;
		return;
	}

	/* 1st: Make a local copy of the entire queue content. */
	tmp_q = (EXT_ASYNC_EVENT *)xp->aen_tracking_queue;
	queue_cnt = 0;

	INTR_LOCK(ha);
	i = xp->aen_q_head;

	for (; queue_cnt < EXT_DEF_MAX_AEN_QUEUE; ) {
		if (tmp_q[i].AsyncEventCode != 0) {
			bcopy(&tmp_q[i], &aen[queue_cnt],
			    sizeof (EXT_ASYNC_EVENT));
			queue_cnt++;
			tmp_q[i].AsyncEventCode = 0; /* empty out the slot */
		}
		if (i == xp->aen_q_tail) {
			/* done. */
			break;
		}
		i++;
		if (i == EXT_DEF_MAX_AEN_QUEUE) {
			i = 0;
		}
	}

	/* Empty the queue. */
	xp->aen_q_head = 0;
	xp->aen_q_tail = 0;

	INTR_UNLOCK(ha);

	/* 2nd: Now transfer the queue content to user buffer */
	/* Copy the entire queue to user's buffer. */
	out_size = (uint32_t)(queue_cnt * sizeof (EXT_ASYNC_EVENT));
	if (queue_cnt == 0) {
		cmd->ResponseLen = 0;
	} else if (ddi_copyout((void *)&aen[0],
	    (void *)(uintptr_t)(cmd->ResponseAdr),
	    out_size, mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = out_size;
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_enqueue_aen
 *
 * Input:
 *	ha:		adapter state pointer.
 *	event_code:	async event code of the event to add to queue.
 *	payload:	event payload for the queue.
 *	INTR_LOCK must be already obtained.
 *
 * Context:
 *	Interrupt or Kernel context, no mailbox commands allowed.
 */
void
ql_enqueue_aen(ql_adapter_state_t *ha, uint16_t event_code, void *payload)
{
	uint8_t			new_entry;	/* index to current entry */
	uint16_t		*mbx;
	EXT_ASYNC_EVENT		*aen_queue;
	ql_xioctl_t		*xp = ha->xioctl;

	QL_PRINT_9(CE_CONT, "(%d): started, event_code=%d\n", ha->instance,
	    event_code);

	if (xp == NULL) {
		QL_PRINT_9(CE_CONT, "(%d): no context\n", ha->instance);
		return;
	}
	aen_queue = (EXT_ASYNC_EVENT *)xp->aen_tracking_queue;

	if (aen_queue[xp->aen_q_tail].AsyncEventCode != 0) {
		/* Need to change queue pointers to make room. */

		/* Increment tail for adding new entry. */
		xp->aen_q_tail++;
		if (xp->aen_q_tail == EXT_DEF_MAX_AEN_QUEUE) {
			xp->aen_q_tail = 0;
		}
		if (xp->aen_q_head == xp->aen_q_tail) {
			/*
			 * We're overwriting the oldest entry, so need to
			 * update the head pointer.
			 */
			xp->aen_q_head++;
			if (xp->aen_q_head == EXT_DEF_MAX_AEN_QUEUE) {
				xp->aen_q_head = 0;
			}
		}
	}

	new_entry = xp->aen_q_tail;
	aen_queue[new_entry].AsyncEventCode = event_code;

	/* Update payload */
	if (payload != NULL) {
		switch (event_code) {
		case MBA_LIP_OCCURRED:
		case MBA_LOOP_UP:
		case MBA_LOOP_DOWN:
		case MBA_LIP_F8:
		case MBA_LIP_RESET:
		case MBA_PORT_UPDATE:
			break;
		case MBA_RSCN_UPDATE:
			mbx = (uint16_t *)payload;
			/* al_pa */
			aen_queue[new_entry].Payload.RSCN.RSCNInfo[0] =
			    LSB(mbx[2]);
			/* area */
			aen_queue[new_entry].Payload.RSCN.RSCNInfo[1] =
			    MSB(mbx[2]);
			/* domain */
			aen_queue[new_entry].Payload.RSCN.RSCNInfo[2] =
			    LSB(mbx[1]);
			/* save in big endian */
			BIG_ENDIAN_24(&aen_queue[new_entry].
			    Payload.RSCN.RSCNInfo[0]);

			aen_queue[new_entry].Payload.RSCN.AddrFormat =
			    MSB(mbx[1]);

			break;
		default:
			/* Not supported */
			EL(ha, "failed, event code not supported=%xh\n",
			    event_code);
			aen_queue[new_entry].AsyncEventCode = 0;
			break;
		}
	}

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
}

/*
 * ql_scsi_passthru
 *	IOCTL SCSI passthrough.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	User space SCSI command pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_scsi_passthru(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	ql_mbx_iocb_t		*pkt;
	ql_mbx_data_t		mr;
	dma_mem_t		*dma_mem;
	caddr_t			pld;
	uint32_t		pkt_size, pld_size;
	uint16_t		qlnt, retries, cnt, cnt2;
	uint8_t			*name;
	EXT_FC_SCSI_PASSTHRU	*ufc_req;
	EXT_SCSI_PASSTHRU	*usp_req;
	int			rval;
	union _passthru {
		EXT_SCSI_PASSTHRU	sp_cmd;
		EXT_FC_SCSI_PASSTHRU	fc_cmd;
	} pt_req;		/* Passthru request */
	uint32_t		status, sense_sz = 0;
	ql_tgt_t		*tq = NULL;
	EXT_SCSI_PASSTHRU	*sp_req = &pt_req.sp_cmd;
	EXT_FC_SCSI_PASSTHRU	*fc_req = &pt_req.fc_cmd;

	/* SCSI request struct for SCSI passthrough IOs. */
	struct {
		uint16_t	lun;
		uint16_t	sense_length;	/* Sense buffer size */
		size_t		resid;		/* Residual */
		uint8_t		*cdbp;		/* Requestor's CDB */
		uint8_t		*u_sense;	/* Requestor's sense buffer */
		uint8_t		cdb_len;	/* Requestor's CDB length */
		uint8_t		direction;
	} scsi_req;

	struct {
		uint8_t		*rsp_info;
		uint8_t		*req_sense_data;
		uint32_t	residual_length;
		uint32_t	rsp_info_length;
		uint32_t	req_sense_length;
		uint16_t	comp_status;
		uint8_t		state_flags_l;
		uint8_t		state_flags_h;
		uint8_t		scsi_status_l;
		uint8_t		scsi_status_h;
	} sts;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	/* Verify Sub Code and set cnt to needed request size. */
	if (cmd->SubCode == EXT_SC_SEND_SCSI_PASSTHRU) {
		pld_size = sizeof (EXT_SCSI_PASSTHRU);
	} else if (cmd->SubCode == EXT_SC_SEND_FC_SCSI_PASSTHRU) {
		pld_size = sizeof (EXT_FC_SCSI_PASSTHRU);
	} else {
		EL(ha, "failed, invalid SubCode=%xh\n", cmd->SubCode);
		cmd->Status = EXT_STATUS_UNSUPPORTED_SUBCODE;
		cmd->ResponseLen = 0;
		return;
	}

	dma_mem = (dma_mem_t *)kmem_zalloc(sizeof (dma_mem_t), KM_SLEEP);
	if (dma_mem == NULL) {
		EL(ha, "failed, kmem_zalloc\n");
		cmd->Status = EXT_STATUS_NO_MEMORY;
		cmd->ResponseLen = 0;
		return;
	}
	/*  Verify the size of and copy in the passthru request structure. */
	if (cmd->RequestLen != pld_size) {
		/* Return error */
		EL(ha, "failed, RequestLen != cnt, is=%xh, expected=%xh\n",
		    cmd->RequestLen, pld_size);
		cmd->Status = EXT_STATUS_INVALID_PARAM;
		cmd->DetailStatus = EXT_DSTATUS_REQUEST_LEN;
		cmd->ResponseLen = 0;
		return;
	}

	if (ddi_copyin((void *)(uintptr_t)cmd->RequestAdr, &pt_req,
	    pld_size, mode) != 0) {
		EL(ha, "failed, ddi_copyin\n");
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		return;
	}

	/*
	 * Find fc_port from SCSI PASSTHRU structure fill in the scsi_req
	 * request data structure.
	 */
	if (cmd->SubCode == EXT_SC_SEND_SCSI_PASSTHRU) {
		scsi_req.lun = sp_req->TargetAddr.Lun;
		scsi_req.sense_length = sizeof (sp_req->SenseData);
		scsi_req.cdbp = &sp_req->Cdb[0];
		scsi_req.cdb_len = sp_req->CdbLength;
		scsi_req.direction = sp_req->Direction;
		usp_req = (EXT_SCSI_PASSTHRU *)(uintptr_t)cmd->RequestAdr;
		scsi_req.u_sense = &usp_req->SenseData[0];
		cmd->DetailStatus = EXT_DSTATUS_TARGET;

		qlnt = QLNT_PORT;
		name = (uint8_t *)&sp_req->TargetAddr.Target;
		QL_PRINT_9(CE_CONT, "(%d): SubCode=%xh, Target=%lld\n",
		    ha->instance, cmd->SubCode, sp_req->TargetAddr.Target);
		tq = ql_find_port(ha, name, qlnt);
	} else {
		/*
		 * Must be FC PASSTHRU, verified above.
		 */
		if (fc_req->FCScsiAddr.DestType == EXT_DEF_DESTTYPE_WWPN) {
			qlnt = QLNT_PORT;
			name = &fc_req->FCScsiAddr.DestAddr.WWPN[0];
			QL_PRINT_9(CE_CONT, "(%d): SubCode=%xh, "
			    "wwpn=%02x%02x%02x%02x%02x%02x%02x%02x\n",
			    ha->instance, cmd->SubCode, name[0], name[1],
			    name[2], name[3], name[4], name[5], name[6],
			    name[7]);
			tq = ql_find_port(ha, name, qlnt);
		} else if (fc_req->FCScsiAddr.DestType ==
		    EXT_DEF_DESTTYPE_WWNN) {
			qlnt = QLNT_NODE;
			name = &fc_req->FCScsiAddr.DestAddr.WWNN[0];
			QL_PRINT_9(CE_CONT, "(%d): SubCode=%xh, "
			    "wwnn=%02x%02x%02x%02x%02x%02x%02x%02x\n",
			    ha->instance, cmd->SubCode, name[0], name[1],
			    name[2], name[3], name[4], name[5], name[6],
			    name[7]);
			tq = ql_find_port(ha, name, qlnt);
		} else if (fc_req->FCScsiAddr.DestType ==
		    EXT_DEF_DESTTYPE_PORTID) {
			qlnt = QLNT_PID;
			name = &fc_req->FCScsiAddr.DestAddr.Id[0];
			QL_PRINT_9(CE_CONT, "(%d): SubCode=%xh, PID="
			    "%02x%02x%02x\n", ha->instance, cmd->SubCode,
			    name[0], name[1], name[2]);
			tq = ql_find_port(ha, name, qlnt);
		} else {
			EL(ha, "failed, SubCode=%xh invalid DestType=%xh\n",
			    cmd->SubCode, fc_req->FCScsiAddr.DestType);
			cmd->Status = EXT_STATUS_INVALID_PARAM;
			cmd->ResponseLen = 0;
			return;
		}
		scsi_req.lun = fc_req->FCScsiAddr.Lun;
		scsi_req.sense_length = sizeof (fc_req->SenseData);
		scsi_req.cdbp = &sp_req->Cdb[0];
		scsi_req.cdb_len = sp_req->CdbLength;
		ufc_req = (EXT_FC_SCSI_PASSTHRU *)(uintptr_t)cmd->RequestAdr;
		scsi_req.u_sense = &ufc_req->SenseData[0];
		scsi_req.direction = fc_req->Direction;
	}

	if (tq == NULL || !VALID_TARGET_ID(ha, tq->loop_id)) {
		EL(ha, "failed, fc_port not found\n");
		cmd->Status = EXT_STATUS_DEV_NOT_FOUND;
		cmd->ResponseLen = 0;
		return;
	}

	if (tq->flags & TQF_NEED_AUTHENTICATION) {
		EL(ha, "target not available; loopid=%xh\n", tq->loop_id);
		cmd->Status = EXT_STATUS_DEVICE_OFFLINE;
		cmd->ResponseLen = 0;
		return;
	}

	/* Allocate command block. */
	if ((scsi_req.direction == EXT_DEF_SCSI_PASSTHRU_DATA_IN ||
	    scsi_req.direction == EXT_DEF_SCSI_PASSTHRU_DATA_OUT) &&
	    cmd->ResponseLen) {
		pld_size = cmd->ResponseLen;
		pkt_size = (uint32_t)(sizeof (ql_mbx_iocb_t) + pld_size);
		pkt = kmem_zalloc(pkt_size, KM_SLEEP);
		if (pkt == NULL) {
			EL(ha, "failed, kmem_zalloc\n");
			cmd->Status = EXT_STATUS_NO_MEMORY;
			cmd->ResponseLen = 0;
			return;
		}
		pld = (caddr_t)pkt + sizeof (ql_mbx_iocb_t);

		/* Get DMA memory for the IOCB */
		if (ql_get_dma_mem(ha, dma_mem, pld_size, LITTLE_ENDIAN_DMA,
		    QL_DMA_DATA_ALIGN) != QL_SUCCESS) {
			cmn_err(CE_WARN, "%s(%d): request queue DMA memory "
			    "alloc failed", QL_NAME, ha->instance);
			kmem_free(pkt, pkt_size);
			cmd->Status = EXT_STATUS_MS_NO_RESPONSE;
			cmd->ResponseLen = 0;
			return;
		}

		if (scsi_req.direction == EXT_DEF_SCSI_PASSTHRU_DATA_IN) {
			scsi_req.direction = (uint8_t)
			    (CFG_IST(ha, CFG_CTRL_24258081) ?
			    CF_RD : CF_DATA_IN | CF_STAG);
		} else {
			scsi_req.direction = (uint8_t)
			    (CFG_IST(ha, CFG_CTRL_24258081) ?
			    CF_WR : CF_DATA_OUT | CF_STAG);
			cmd->ResponseLen = 0;

			/* Get command payload. */
			if (ql_get_buffer_data(
			    (caddr_t)(uintptr_t)cmd->ResponseAdr,
			    pld, pld_size, mode) != pld_size) {
				EL(ha, "failed, get_buffer_data\n");
				cmd->Status = EXT_STATUS_COPY_ERR;

				kmem_free(pkt, pkt_size);
				ql_free_dma_resource(ha, dma_mem);
				kmem_free(dma_mem, sizeof (dma_mem_t));
				return;
			}

			/* Copy out going data to DMA buffer. */
			ddi_rep_put8(dma_mem->acc_handle, (uint8_t *)pld,
			    (uint8_t *)dma_mem->bp, pld_size,
			    DDI_DEV_AUTOINCR);

			/* Sync DMA buffer. */
			(void) ddi_dma_sync(dma_mem->dma_handle, 0,
			    dma_mem->size, DDI_DMA_SYNC_FORDEV);
		}
	} else {
		scsi_req.direction = (uint8_t)
		    (CFG_IST(ha, CFG_CTRL_24258081) ? 0 : CF_STAG);
		cmd->ResponseLen = 0;

		pkt_size = sizeof (ql_mbx_iocb_t);
		pkt = kmem_zalloc(pkt_size, KM_SLEEP);
		if (pkt == NULL) {
			EL(ha, "failed, kmem_zalloc-2\n");
			cmd->Status = EXT_STATUS_NO_MEMORY;
			return;
		}
		pld = NULL;
		pld_size = 0;
	}

	/* retries = ha->port_down_retry_count; */
	retries = 1;
	cmd->Status = EXT_STATUS_OK;
	cmd->DetailStatus = EXT_DSTATUS_NOADNL_INFO;

	QL_PRINT_9(CE_CONT, "(%d): SCSI cdb\n", ha->instance);
	QL_DUMP_9(scsi_req.cdbp, 8, scsi_req.cdb_len);

	do {
		if (DRIVER_SUSPENDED(ha)) {
			sts.comp_status = CS_LOOP_DOWN_ABORT;
			break;
		}

		if (CFG_IST(ha, CFG_CTRL_24258081)) {
			pkt->cmd24.entry_type = IOCB_CMD_TYPE_7;
			pkt->cmd24.entry_count = 1;

			/* Set LUN number */
			pkt->cmd24.fcp_lun[2] = LSB(scsi_req.lun);
			pkt->cmd24.fcp_lun[3] = MSB(scsi_req.lun);

			/* Set N_port handle */
			pkt->cmd24.n_port_hdl = (uint16_t)LE_16(tq->loop_id);

			/* Set VP Index */
			pkt->cmd24.vp_index = ha->vp_index;

			/* Set target ID */
			pkt->cmd24.target_id[0] = tq->d_id.b.al_pa;
			pkt->cmd24.target_id[1] = tq->d_id.b.area;
			pkt->cmd24.target_id[2] = tq->d_id.b.domain;

			/* Set ISP command timeout. */
			pkt->cmd24.timeout = (uint16_t)LE_16(15);

			/* Load SCSI CDB */
			ddi_rep_put8(ha->hba_buf.acc_handle, scsi_req.cdbp,
			    pkt->cmd24.scsi_cdb, scsi_req.cdb_len,
			    DDI_DEV_AUTOINCR);
			for (cnt = 0; cnt < MAX_CMDSZ;
			    cnt = (uint16_t)(cnt + 4)) {
				ql_chg_endian((uint8_t *)&pkt->cmd24.scsi_cdb
				    + cnt, 4);
			}

			/* Set tag queue control flags */
			pkt->cmd24.task = TA_STAG;

			if (pld_size) {
				/* Set transfer direction. */
				pkt->cmd24.control_flags = scsi_req.direction;

				/* Set data segment count. */
				pkt->cmd24.dseg_count = LE_16(1);

				/* Load total byte count. */
				pkt->cmd24.total_byte_count = LE_32(pld_size);

				/* Load data descriptor. */
				pkt->cmd24.dseg_0_address[0] = (uint32_t)
				    LE_32(LSD(dma_mem->cookie.dmac_laddress));
				pkt->cmd24.dseg_0_address[1] = (uint32_t)
				    LE_32(MSD(dma_mem->cookie.dmac_laddress));
				pkt->cmd24.dseg_0_length = LE_32(pld_size);
			}
		} else if (CFG_IST(ha, CFG_ENABLE_64BIT_ADDRESSING)) {
			pkt->cmd3.entry_type = IOCB_CMD_TYPE_3;
			pkt->cmd3.entry_count = 1;
			if (CFG_IST(ha, CFG_EXT_FW_INTERFACE)) {
				pkt->cmd3.target_l = LSB(tq->loop_id);
				pkt->cmd3.target_h = MSB(tq->loop_id);
			} else {
				pkt->cmd3.target_h = LSB(tq->loop_id);
			}
			pkt->cmd3.lun_l = LSB(scsi_req.lun);
			pkt->cmd3.lun_h = MSB(scsi_req.lun);
			pkt->cmd3.control_flags_l = scsi_req.direction;
			pkt->cmd3.timeout = LE_16(15);
			for (cnt = 0; cnt < scsi_req.cdb_len; cnt++) {
				pkt->cmd3.scsi_cdb[cnt] = scsi_req.cdbp[cnt];
			}
			if (pld_size) {
				pkt->cmd3.dseg_count = LE_16(1);
				pkt->cmd3.byte_count = LE_32(pld_size);
				pkt->cmd3.dseg_0_address[0] = (uint32_t)
				    LE_32(LSD(dma_mem->cookie.dmac_laddress));
				pkt->cmd3.dseg_0_address[1] = (uint32_t)
				    LE_32(MSD(dma_mem->cookie.dmac_laddress));
				pkt->cmd3.dseg_0_length = LE_32(pld_size);
			}
		} else {
			pkt->cmd.entry_type = IOCB_CMD_TYPE_2;
			pkt->cmd.entry_count = 1;
			if (CFG_IST(ha, CFG_EXT_FW_INTERFACE)) {
				pkt->cmd.target_l = LSB(tq->loop_id);
				pkt->cmd.target_h = MSB(tq->loop_id);
			} else {
				pkt->cmd.target_h = LSB(tq->loop_id);
			}
			pkt->cmd.lun_l = LSB(scsi_req.lun);
			pkt->cmd.lun_h = MSB(scsi_req.lun);
			pkt->cmd.control_flags_l = scsi_req.direction;
			pkt->cmd.timeout = LE_16(15);
			for (cnt = 0; cnt < scsi_req.cdb_len; cnt++) {
				pkt->cmd.scsi_cdb[cnt] = scsi_req.cdbp[cnt];
			}
			if (pld_size) {
				pkt->cmd.dseg_count = LE_16(1);
				pkt->cmd.byte_count = LE_32(pld_size);
				pkt->cmd.dseg_0_address = (uint32_t)
				    LE_32(LSD(dma_mem->cookie.dmac_laddress));
				pkt->cmd.dseg_0_length = LE_32(pld_size);
			}
		}
		/* Go issue command and wait for completion. */
		QL_PRINT_9(CE_CONT, "(%d): request pkt\n", ha->instance);
		QL_DUMP_9(pkt, 8, pkt_size);

		status = ql_issue_mbx_iocb(ha, (caddr_t)pkt, pkt_size);

		if (pld_size) {
			/* Sync in coming DMA buffer. */
			(void) ddi_dma_sync(dma_mem->dma_handle, 0,
			    dma_mem->size, DDI_DMA_SYNC_FORKERNEL);
			/* Copy in coming DMA data. */
			ddi_rep_get8(dma_mem->acc_handle, (uint8_t *)pld,
			    (uint8_t *)dma_mem->bp, pld_size,
			    DDI_DEV_AUTOINCR);
		}

		if (CFG_IST(ha, CFG_CTRL_24258081)) {
			pkt->sts24.entry_status = (uint8_t)
			    (pkt->sts24.entry_status & 0x3c);
		} else {
			pkt->sts.entry_status = (uint8_t)
			    (pkt->sts.entry_status & 0x7e);
		}

		if (status == QL_SUCCESS && pkt->sts.entry_status != 0) {
			EL(ha, "failed, entry_status=%xh, d_id=%xh\n",
			    pkt->sts.entry_status, tq->d_id.b24);
			status = QL_FUNCTION_PARAMETER_ERROR;
		}

		sts.comp_status = (uint16_t)(CFG_IST(ha, CFG_CTRL_24258081) ?
		    LE_16(pkt->sts24.comp_status) :
		    LE_16(pkt->sts.comp_status));

		/*
		 * We have verified about all the request that can be so far.
		 * Now we need to start verification of our ability to
		 * actually issue the CDB.
		 */
		if (DRIVER_SUSPENDED(ha)) {
			sts.comp_status = CS_LOOP_DOWN_ABORT;
			break;
		} else if (status == QL_SUCCESS &&
		    (sts.comp_status == CS_PORT_LOGGED_OUT ||
		    sts.comp_status == CS_PORT_UNAVAILABLE)) {
			EL(ha, "login retry d_id=%xh\n", tq->d_id.b24);
			if (tq->flags & TQF_FABRIC_DEVICE) {
				rval = ql_login_fport(ha, tq, tq->loop_id,
				    LFF_NO_PLOGI, &mr);
				if (rval != QL_SUCCESS) {
					EL(ha, "failed, login_fport=%xh, "
					    "d_id=%xh\n", rval, tq->d_id.b24);
				}
			} else {
				rval = ql_login_lport(ha, tq, tq->loop_id,
				    LLF_NONE);
				if (rval != QL_SUCCESS) {
					EL(ha, "failed, login_lport=%xh, "
					    "d_id=%xh\n", rval, tq->d_id.b24);
				}
			}
		} else {
			break;
		}

		bzero((caddr_t)pkt, sizeof (ql_mbx_iocb_t));

	} while (retries--);

	if (sts.comp_status == CS_LOOP_DOWN_ABORT) {
		/* Cannot issue command now, maybe later */
		EL(ha, "failed, suspended\n");
		kmem_free(pkt, pkt_size);
		ql_free_dma_resource(ha, dma_mem);
		kmem_free(dma_mem, sizeof (dma_mem_t));
		cmd->Status = EXT_STATUS_SUSPENDED;
		cmd->ResponseLen = 0;
		return;
	}

	if (status != QL_SUCCESS) {
		/* Command error */
		EL(ha, "failed, I/O\n");
		kmem_free(pkt, pkt_size);
		ql_free_dma_resource(ha, dma_mem);
		kmem_free(dma_mem, sizeof (dma_mem_t));
		cmd->Status = EXT_STATUS_ERR;
		cmd->DetailStatus = status;
		cmd->ResponseLen = 0;
		return;
	}

	/* Setup status. */
	if (CFG_IST(ha, CFG_CTRL_24258081)) {
		sts.scsi_status_l = pkt->sts24.scsi_status_l;
		sts.scsi_status_h = pkt->sts24.scsi_status_h;

		/* Setup residuals. */
		sts.residual_length = LE_32(pkt->sts24.residual_length);

		/* Setup state flags. */
		sts.state_flags_l = pkt->sts24.state_flags_l;
		sts.state_flags_h = pkt->sts24.state_flags_h;
		if (pld_size && sts.comp_status != CS_DATA_UNDERRUN) {
			sts.state_flags_h = (uint8_t)(sts.state_flags_h |
			    SF_GOT_BUS | SF_GOT_TARGET | SF_SENT_CMD |
			    SF_XFERRED_DATA | SF_GOT_STATUS);
		} else {
			sts.state_flags_h = (uint8_t)(sts.state_flags_h |
			    SF_GOT_BUS | SF_GOT_TARGET | SF_SENT_CMD |
			    SF_GOT_STATUS);
		}
		if (scsi_req.direction & CF_WR) {
			sts.state_flags_l = (uint8_t)(sts.state_flags_l |
			    SF_DATA_OUT);
		} else if (scsi_req.direction & CF_RD) {
			sts.state_flags_l = (uint8_t)(sts.state_flags_l |
			    SF_DATA_IN);
		}
		sts.state_flags_l = (uint8_t)(sts.state_flags_l | SF_SIMPLE_Q);

		/* Setup FCP response info. */
		sts.rsp_info_length = sts.scsi_status_h & FCP_RSP_LEN_VALID ?
		    LE_32(pkt->sts24.fcp_rsp_data_length) : 0;
		sts.rsp_info = &pkt->sts24.rsp_sense_data[0];
		for (cnt = 0; cnt < sts.rsp_info_length;
		    cnt = (uint16_t)(cnt + 4)) {
			ql_chg_endian(sts.rsp_info + cnt, 4);
		}

		/* Setup sense data. */
		if (sts.scsi_status_h & FCP_SNS_LEN_VALID) {
			sts.req_sense_length =
			    LE_32(pkt->sts24.fcp_sense_length);
			sts.state_flags_h = (uint8_t)(sts.state_flags_h |
			    SF_ARQ_DONE);
		} else {
			sts.req_sense_length = 0;
		}
		sts.req_sense_data =
		    &pkt->sts24.rsp_sense_data[sts.rsp_info_length];
		cnt2 = (uint16_t)(((uintptr_t)pkt + sizeof (sts_24xx_entry_t)) -
		    (uintptr_t)sts.req_sense_data);
		for (cnt = 0; cnt < cnt2; cnt = (uint16_t)(cnt + 4)) {
			ql_chg_endian(sts.req_sense_data + cnt, 4);
		}
	} else {
		sts.scsi_status_l = pkt->sts.scsi_status_l;
		sts.scsi_status_h = pkt->sts.scsi_status_h;

		/* Setup residuals. */
		sts.residual_length = LE_32(pkt->sts.residual_length);

		/* Setup state flags. */
		sts.state_flags_l = pkt->sts.state_flags_l;
		sts.state_flags_h = pkt->sts.state_flags_h;

		/* Setup FCP response info. */
		sts.rsp_info_length = sts.scsi_status_h & FCP_RSP_LEN_VALID ?
		    LE_16(pkt->sts.rsp_info_length) : 0;
		sts.rsp_info = &pkt->sts.rsp_info[0];

		/* Setup sense data. */
		sts.req_sense_length = sts.scsi_status_h & FCP_SNS_LEN_VALID ?
		    LE_16(pkt->sts.req_sense_length) : 0;
		sts.req_sense_data = &pkt->sts.req_sense_data[0];
	}

	QL_PRINT_9(CE_CONT, "(%d): response pkt\n", ha->instance);
	QL_DUMP_9(&pkt->sts, 8, sizeof (sts_entry_t));

	switch (sts.comp_status) {
	case CS_INCOMPLETE:
	case CS_ABORTED:
	case CS_DEVICE_UNAVAILABLE:
	case CS_PORT_UNAVAILABLE:
	case CS_PORT_LOGGED_OUT:
	case CS_PORT_CONFIG_CHG:
	case CS_PORT_BUSY:
	case CS_LOOP_DOWN_ABORT:
		cmd->Status = EXT_STATUS_BUSY;
		break;
	case CS_RESET:
	case CS_QUEUE_FULL:
		cmd->Status = EXT_STATUS_ERR;
		break;
	case CS_TIMEOUT:
		cmd->Status = EXT_STATUS_ERR;
		break;
	case CS_DATA_OVERRUN:
		cmd->Status = EXT_STATUS_DATA_OVERRUN;
		break;
	case CS_DATA_UNDERRUN:
		cmd->Status = EXT_STATUS_DATA_UNDERRUN;
		break;
	}

	/*
	 * If non data transfer commands fix tranfer counts.
	 */
	if (scsi_req.cdbp[0] == SCMD_TEST_UNIT_READY ||
	    scsi_req.cdbp[0] == SCMD_REZERO_UNIT ||
	    scsi_req.cdbp[0] == SCMD_SEEK ||
	    scsi_req.cdbp[0] == SCMD_SEEK_G1 ||
	    scsi_req.cdbp[0] == SCMD_RESERVE ||
	    scsi_req.cdbp[0] == SCMD_RELEASE ||
	    scsi_req.cdbp[0] == SCMD_START_STOP ||
	    scsi_req.cdbp[0] == SCMD_DOORLOCK ||
	    scsi_req.cdbp[0] == SCMD_VERIFY ||
	    scsi_req.cdbp[0] == SCMD_WRITE_FILE_MARK ||
	    scsi_req.cdbp[0] == SCMD_VERIFY_G0 ||
	    scsi_req.cdbp[0] == SCMD_SPACE ||
	    scsi_req.cdbp[0] == SCMD_ERASE ||
	    (scsi_req.cdbp[0] == SCMD_FORMAT &&
	    (scsi_req.cdbp[1] & FPB_DATA) == 0)) {
		/*
		 * Non data transfer command, clear sts_entry residual
		 * length.
		 */
		sts.residual_length = 0;
		cmd->ResponseLen = 0;
		if (sts.comp_status == CS_DATA_UNDERRUN) {
			sts.comp_status = CS_COMPLETE;
			cmd->Status = EXT_STATUS_OK;
		}
	} else {
		cmd->ResponseLen = pld_size;
	}

	/* Correct ISP completion status */
	if (sts.comp_status == CS_COMPLETE && sts.scsi_status_l == 0 &&
	    (sts.scsi_status_h & FCP_RSP_MASK) == 0) {
		QL_PRINT_9(CE_CONT, "(%d): Correct completion\n",
		    ha->instance);
		scsi_req.resid = 0;
	} else if (sts.comp_status == CS_DATA_UNDERRUN) {
		QL_PRINT_9(CE_CONT, "(%d): Correct UNDERRUN\n",
		    ha->instance);
		scsi_req.resid = sts.residual_length;
		if (sts.scsi_status_h & FCP_RESID_UNDER) {
			cmd->Status = (uint32_t)EXT_STATUS_OK;

			cmd->ResponseLen = (uint32_t)
			    (pld_size - scsi_req.resid);
		} else {
			EL(ha, "failed, Transfer ERROR\n");
			cmd->Status = EXT_STATUS_ERR;
			cmd->ResponseLen = 0;
		}
	} else {
		QL_PRINT_9(CE_CONT, "(%d): error d_id=%xh, comp_status=%xh, "
		    "scsi_status_h=%xh, scsi_status_l=%xh\n", ha->instance,
		    tq->d_id.b24, sts.comp_status, sts.scsi_status_h,
		    sts.scsi_status_l);

		scsi_req.resid = pld_size;
		/*
		 * Handle residual count on SCSI check
		 * condition.
		 *
		 * - If Residual Under / Over is set, use the
		 *   Residual Transfer Length field in IOCB.
		 * - If Residual Under / Over is not set, and
		 *   Transferred Data bit is set in State Flags
		 *   field of IOCB, report residual value of 0
		 *   (you may want to do this for tape
		 *   Write-type commands only). This takes care
		 *   of logical end of tape problem and does
		 *   not break Unit Attention.
		 * - If Residual Under / Over is not set, and
		 *   Transferred Data bit is not set in State
		 *   Flags, report residual value equal to
		 *   original data transfer length.
		 */
		if (sts.scsi_status_l & STATUS_CHECK) {
			cmd->Status = EXT_STATUS_SCSI_STATUS;
			cmd->DetailStatus = sts.scsi_status_l;
			if (sts.scsi_status_h &
			    (FCP_RESID_OVER | FCP_RESID_UNDER)) {
				scsi_req.resid = sts.residual_length;
			} else if (sts.state_flags_h &
			    STATE_XFERRED_DATA) {
				scsi_req.resid = 0;
			}
		}
	}

	if (sts.scsi_status_l & STATUS_CHECK &&
	    sts.scsi_status_h & FCP_SNS_LEN_VALID &&
	    sts.req_sense_length) {
		/*
		 * Check condition with vaild sense data flag set and sense
		 * length != 0
		 */
		if (sts.req_sense_length > scsi_req.sense_length) {
			sense_sz = scsi_req.sense_length;
		} else {
			sense_sz = sts.req_sense_length;
		}

		EL(ha, "failed, Check Condition Status, d_id=%xh\n",
		    tq->d_id.b24);
		QL_DUMP_2(sts.req_sense_data, 8, sts.req_sense_length);

		if (ddi_copyout(sts.req_sense_data, scsi_req.u_sense,
		    (size_t)sense_sz, mode) != 0) {
			EL(ha, "failed, request sense ddi_copyout\n");
		}

		cmd->Status = EXT_STATUS_SCSI_STATUS;
		cmd->DetailStatus = sts.scsi_status_l;
	}

	/* Copy response payload from DMA buffer to application. */
	if (scsi_req.direction & (CF_RD | CF_DATA_IN) &&
	    cmd->ResponseLen != 0) {
		QL_PRINT_9(CE_CONT, "(%d): Data Return resid=%lu, "
		    "byte_count=%u, ResponseLen=%xh\n", ha->instance,
		    scsi_req.resid, pld_size, cmd->ResponseLen);
		QL_DUMP_9(pld, 8, cmd->ResponseLen);

		/* Send response payload. */
		if (ql_send_buffer_data(pld,
		    (caddr_t)(uintptr_t)cmd->ResponseAdr,
		    cmd->ResponseLen, mode) != cmd->ResponseLen) {
			EL(ha, "failed, send_buffer_data\n");
			cmd->Status = EXT_STATUS_COPY_ERR;
			cmd->ResponseLen = 0;
		}
	}

	if (cmd->Status != EXT_STATUS_OK) {
		EL(ha, "failed, cmd->Status=%xh, comp_status=%xh, "
		    "d_id=%xh\n", cmd->Status, sts.comp_status, tq->d_id.b24);
	} else {
		/*EMPTY*/
		QL_PRINT_9(CE_CONT, "(%d): done, ResponseLen=%d\n",
		    ha->instance, cmd->ResponseLen);
	}

	kmem_free(pkt, pkt_size);
	ql_free_dma_resource(ha, dma_mem);
	kmem_free(dma_mem, sizeof (dma_mem_t));
}

/*
 * ql_wwpn_to_scsiaddr
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_wwpn_to_scsiaddr(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	int		status;
	uint8_t		wwpn[EXT_DEF_WWN_NAME_SIZE];
	EXT_SCSI_ADDR	*tmp_addr;
	ql_tgt_t	*tq;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->RequestLen != EXT_DEF_WWN_NAME_SIZE) {
		/* Return error */
		EL(ha, "incorrect RequestLen\n");
		cmd->Status = EXT_STATUS_INVALID_PARAM;
		cmd->DetailStatus = EXT_DSTATUS_REQUEST_LEN;
		return;
	}

	status = ddi_copyin((void*)(uintptr_t)cmd->RequestAdr, wwpn,
	    cmd->RequestLen, mode);

	if (status != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		EL(ha, "failed, ddi_copyin\n");
		return;
	}

	tq = ql_find_port(ha, wwpn, QLNT_PORT);

	if (tq == NULL || tq->flags & TQF_INITIATOR_DEVICE) {
		/* no matching device */
		cmd->Status = EXT_STATUS_DEV_NOT_FOUND;
		EL(ha, "failed, device not found\n");
		return;
	}

	/* Copy out the IDs found.  For now we can only return target ID. */
	tmp_addr = (EXT_SCSI_ADDR *)(uintptr_t)cmd->ResponseAdr;

	status = ddi_copyout((void *)wwpn, (void *)&tmp_addr->Target, 8, mode);

	if (status != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->Status = EXT_STATUS_OK;
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_host_idx
 *	Gets host order index.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_host_idx(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	uint16_t	idx;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->ResponseLen < sizeof (uint16_t)) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = sizeof (uint16_t);
		EL(ha, "failed, ResponseLen < Len=%xh\n", cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	idx = (uint16_t)ha->instance;

	if (ddi_copyout((void *)&idx, (void *)(uintptr_t)(cmd->ResponseAdr),
	    sizeof (uint16_t), mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = sizeof (uint16_t);
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_host_drvname
 *	Gets host driver name
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_host_drvname(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{

	char		drvname[] = QL_NAME;
	uint32_t	qlnamelen;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	qlnamelen = (uint32_t)(strlen(QL_NAME)+1);

	if (cmd->ResponseLen < qlnamelen) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = qlnamelen;
		EL(ha, "failed, ResponseLen: %xh, needed: %xh\n",
		    cmd->ResponseLen, qlnamelen);
		cmd->ResponseLen = 0;
		return;
	}

	if (ddi_copyout((void *)&drvname,
	    (void *)(uintptr_t)(cmd->ResponseAdr),
	    qlnamelen, mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, ddi_copyout\n");
	} else {
		cmd->ResponseLen = qlnamelen-1;
	}

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
}

/*
 * ql_read_nvram
 *	Get NVRAM contents.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_read_nvram(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->ResponseLen < ha->nvram_cache->size) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = ha->nvram_cache->size;
		EL(ha, "failed, ResponseLen != NVRAM, Len=%xh\n",
		    cmd->ResponseLen);
		cmd->ResponseLen = 0;
		return;
	}

	/* Get NVRAM data. */
	if (ql_nv_util_dump(ha, (void *)(uintptr_t)(cmd->ResponseAdr),
	    mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->ResponseLen = 0;
		EL(ha, "failed, copy error\n");
	} else {
		cmd->ResponseLen = ha->nvram_cache->size;
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_write_nvram
 *	Loads NVRAM contents.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_write_nvram(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (cmd->RequestLen < ha->nvram_cache->size) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = ha->nvram_cache->size;
		EL(ha, "failed, RequestLen != NVRAM, Len=%xh\n",
		    cmd->RequestLen);
		return;
	}

	/* Load NVRAM data. */
	if (ql_nv_util_load(ha, (void *)(uintptr_t)(cmd->RequestAdr),
	    mode) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		EL(ha, "failed, copy error\n");
	} else {
		/*EMPTY*/
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_write_vpd
 *	Loads VPD contents.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_write_vpd(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	int32_t		rval = 0;

	if ((CFG_IST(ha, CFG_CTRL_24258081)) == 0) {
		cmd->Status = EXT_STATUS_INVALID_REQUEST;
		EL(ha, "failed, invalid request for HBA\n");
		return;
	}

	if (cmd->RequestLen < QL_24XX_VPD_SIZE) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = QL_24XX_VPD_SIZE;
		EL(ha, "failed, RequestLen != VPD len, len passed=%xh\n",
		    cmd->RequestLen);
		return;
	}

	/* Load VPD data. */
	if ((rval = ql_vpd_load(ha, (void *)(uintptr_t)(cmd->RequestAdr),
	    mode)) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		cmd->DetailStatus = rval;
		EL(ha, "failed, errno=%x\n", rval);
	} else {
		/*EMPTY*/
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_read_vpd
 *	Dumps VPD contents.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_read_vpd(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if ((CFG_IST(ha, CFG_CTRL_24258081)) == 0) {
		cmd->Status = EXT_STATUS_INVALID_REQUEST;
		EL(ha, "failed, invalid request for HBA\n");
		return;
	}

	if (cmd->ResponseLen < QL_24XX_VPD_SIZE) {
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = QL_24XX_VPD_SIZE;
		EL(ha, "failed, ResponseLen < VPD len, len passed=%xh\n",
		    cmd->ResponseLen);
		return;
	}

	/* Dump VPD data. */
	if ((ql_vpd_dump(ha, (void *)(uintptr_t)(cmd->ResponseAdr),
	    mode)) != 0) {
		cmd->Status = EXT_STATUS_COPY_ERR;
		EL(ha, "failed,\n");
	} else {
		/*EMPTY*/
		QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
	}
}

/*
 * ql_get_fcache
 *	Dumps flash cache contents.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_get_fcache(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	uint32_t	bsize, boff, types, cpsize, hsize;
	ql_fcache_t	*fptr;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	CACHE_LOCK(ha);

	if (ha->fcache == NULL) {
		CACHE_UNLOCK(ha);
		cmd->Status = EXT_STATUS_ERR;
		EL(ha, "failed, adapter fcache not setup\n");
		return;
	}

	if ((CFG_IST(ha, CFG_CTRL_24258081)) == 0) {
		bsize = 100;
	} else {
		bsize = 400;
	}

	if (cmd->ResponseLen < bsize) {
		CACHE_UNLOCK(ha);
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = bsize;
		EL(ha, "failed, ResponseLen < %d, len passed=%xh\n",
		    bsize, cmd->ResponseLen);
		return;
	}

	boff = 0;
	bsize = 0;
	fptr = ha->fcache;

	/*
	 * For backwards compatibility, get one of each image type
	 */
	types = (FTYPE_BIOS | FTYPE_FCODE | FTYPE_EFI);
	while ((fptr != NULL) && (fptr->buf != NULL) && (types != 0)) {
		/* Get the next image */
		if ((fptr = ql_get_fbuf(ha->fcache, types)) != NULL) {

			cpsize = (fptr->buflen < 100 ? fptr->buflen : 100);

			if (ddi_copyout(fptr->buf,
			    (void *)(uintptr_t)(cmd->ResponseAdr + boff),
			    cpsize, mode) != 0) {
				CACHE_UNLOCK(ha);
				EL(ha, "ddicopy failed, done\n");
				cmd->Status = EXT_STATUS_COPY_ERR;
				cmd->DetailStatus = 0;
				return;
			}
			boff += 100;
			bsize += cpsize;
			types &= ~(fptr->type);
		}
	}

	/*
	 * Get the firmware image -- it needs to be last in the
	 * buffer at offset 300 for backwards compatibility. Also for
	 * backwards compatibility, the pci header is stripped off.
	 */
	if ((fptr = ql_get_fbuf(ha->fcache, FTYPE_FW)) != NULL) {

		hsize = sizeof (pci_header_t) + sizeof (pci_data_t);
		if (hsize > fptr->buflen) {
			CACHE_UNLOCK(ha);
			EL(ha, "header size (%xh) exceeds buflen (%xh)\n",
			    hsize, fptr->buflen);
			cmd->Status = EXT_STATUS_COPY_ERR;
			cmd->DetailStatus = 0;
			return;
		}

		cpsize = ((fptr->buflen - hsize) < 100 ?
		    fptr->buflen - hsize : 100);

		if (ddi_copyout(fptr->buf+hsize,
		    (void *)(uintptr_t)(cmd->ResponseAdr + 300),
		    cpsize, mode) != 0) {
			CACHE_UNLOCK(ha);
			EL(ha, "fw ddicopy failed, done\n");
			cmd->Status = EXT_STATUS_COPY_ERR;
			cmd->DetailStatus = 0;
			return;
		}
		bsize += 100;
	}

	CACHE_UNLOCK(ha);
	cmd->Status = EXT_STATUS_OK;
	cmd->DetailStatus = bsize;

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
}

/*
 * ql_get_fcache_ex
 *	Dumps flash cache contents.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_get_fcache_ex(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	uint32_t	bsize = 0;
	uint32_t	boff = 0;
	ql_fcache_t	*fptr;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	CACHE_LOCK(ha);
	if (ha->fcache == NULL) {
		CACHE_UNLOCK(ha);
		cmd->Status = EXT_STATUS_ERR;
		EL(ha, "failed, adapter fcache not setup\n");
		return;
	}

	/* Make sure user passed enough buffer space */
	for (fptr = ha->fcache; fptr != NULL; fptr = fptr->next) {
		bsize += FBUFSIZE;
	}

	if (cmd->ResponseLen < bsize) {
		CACHE_UNLOCK(ha);
		if (cmd->ResponseLen != 0) {
			EL(ha, "failed, ResponseLen < %d, len passed=%xh\n",
			    bsize, cmd->ResponseLen);
		}
		cmd->Status = EXT_STATUS_BUFFER_TOO_SMALL;
		cmd->DetailStatus = bsize;
		return;
	}

	boff = 0;
	fptr = ha->fcache;
	while ((fptr != NULL) && (fptr->buf != NULL)) {
		/* Get the next image */
		if (ddi_copyout(fptr->buf,
		    (void *)(uintptr_t)(cmd->ResponseAdr + boff),
		    (fptr->buflen < FBUFSIZE ? fptr->buflen : FBUFSIZE),
		    mode) != 0) {
			CACHE_UNLOCK(ha);
			EL(ha, "failed, ddicopy at %xh, done\n", boff);
			cmd->Status = EXT_STATUS_COPY_ERR;
			cmd->DetailStatus = 0;
			return;
		}
		boff += FBUFSIZE;
		fptr = fptr->next;
	}

	CACHE_UNLOCK(ha);
	cmd->Status = EXT_STATUS_OK;
	cmd->DetailStatus = bsize;

	QL_PRINT_9(CE_CONT, "(%d): done\n", ha->instance);
}

/*
 * ql_read_flash
 *	Get flash contents.
 *
 * Input:
 *	ha:	adapter state pointer.
 *	cmd:	EXT_IOCTL cmd struct pointer.
 *	mode:	flags.
 *
 * Returns:
 *	None, request status indicated in cmd->Status.
 *
 * Context:
 *	Kernel context.
 */
static void
ql_read_flash(ql_adapter_state_t *ha, EXT_IOCTL *cmd, int mode)
{
	ql_xioctl_t	*xp = ha->xioctl;

	QL_PRINT_9(CE_CONT, "(%d): started\n", ha->instance);

	if (ql_stall_driver(ha, 0) != QL_SUCCESS) {
		EL(ha, "ql_stall_driver failed\n");
		cmd->Status = EXT_STATUS_BUSY;
		cmd->DetailStatus = xp->fdesc.flash_size;
		cmd->ResponseLen = 0;
		return;
	}

	if (ql_setup_fcache(ha) != QL_SUCCESS) {
		cmd->Status = EXT_STATUS_ERR;
		cmd->DetailStatus = xp->fdesc.flash_size;
		EL(ha, "failed, ResponseLen=%xh, flash size=%xh\n",
		    cmd->ResponseLen, xp->fdesc.flash_size);
		cmd->ResponseLen = 0;
	} else {
		/* adjust read size to flash size */
		if (cmd->ResponseLen > xp->fdesc.flash_size) {
			EL(ha, "adjusting req=%xh, max=%xh\n",
			    cmd->ResponseLen, xp->fdesc.flash_size);
			cmd->ResponseLen = xp->fdesc.