xref: /illumos-gate/usr/src/uts/common/io/ib/adapters/hermon/hermon_ioctl.c (revision 8b8be354)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * hermon_ioctl.c
 *    Hemron IOCTL Routines
 *
 *    Implements all ioctl access into the driver.  This includes all routines
 *    necessary for updating firmware, accessing the hermon flash device, and
 *    providing interfaces for VTS.
 */

#include <sys/types.h>
#include <sys/conf.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/modctl.h>
#include <sys/file.h>

#include <sys/ib/adapters/hermon/hermon.h>

/* Hemron HCA state pointer (extern) */
extern void	*hermon_statep;
extern int	hermon_verbose;

#define	DO_WRCONF	1
static int do_bar0 = 1;

/*
 * The ioctl declarations (for firmware flash burning, register read/write
 * (DEBUG-only), and VTS interfaces)
 */
static int hermon_ioctl_flash_read(hermon_state_t *state, dev_t dev,
    intptr_t arg, int mode);
static int hermon_ioctl_flash_write(hermon_state_t *state, dev_t dev,
    intptr_t arg, int mode);
static int hermon_ioctl_flash_erase(hermon_state_t *state, dev_t dev,
    intptr_t arg, int mode);
static int hermon_ioctl_flash_init(hermon_state_t *state, dev_t dev,
    intptr_t arg, int mode);
static int hermon_ioctl_flash_fini(hermon_state_t *state, dev_t dev);
static int hermon_ioctl_flash_cleanup(hermon_state_t *state);
static int hermon_ioctl_flash_cleanup_nolock(hermon_state_t *state);
#ifdef	DEBUG
static int hermon_ioctl_reg_write(hermon_state_t *state, intptr_t arg,
    int mode);
static int hermon_ioctl_reg_read(hermon_state_t *state, intptr_t arg,
    int mode);
#endif	/* DEBUG */
static int hermon_ioctl_write_boot_addr(hermon_state_t *state, dev_t dev,
    intptr_t arg, int mode);
static int hermon_ioctl_info(hermon_state_t *state, dev_t dev,
    intptr_t arg, int mode);
static int hermon_ioctl_ports(hermon_state_t *state, intptr_t arg,
    int mode);
static int hermon_ioctl_loopback(hermon_state_t *state, intptr_t arg,
    int mode);

/* Hemron Flash Functions */
static void hermon_flash_spi_exec_command(hermon_state_t *state,
    ddi_acc_handle_t hdl, uint32_t cmd);
static int hermon_flash_read_sector(hermon_state_t *state,
    uint32_t sector_num);
static int hermon_flash_read_quadlet(hermon_state_t *state, uint32_t *data,
    uint32_t addr);
static int hermon_flash_write_sector(hermon_state_t *state,
    uint32_t sector_num);
static int hermon_flash_spi_write_dword(hermon_state_t *state,
    uint32_t addr, uint32_t data);
static int hermon_flash_write_byte(hermon_state_t *state, uint32_t addr,
    uchar_t data);
static int hermon_flash_erase_sector(hermon_state_t *state,
    uint32_t sector_num);
static int hermon_flash_erase_chip(hermon_state_t *state);
static int hermon_flash_bank(hermon_state_t *state, uint32_t addr);
static uint32_t hermon_flash_read(hermon_state_t *state, uint32_t addr,
    int *err);
static void hermon_flash_write(hermon_state_t *state, uint32_t addr,
    uchar_t data, int *err);
static int hermon_flash_spi_wait_wip(hermon_state_t *state);
static void hermon_flash_spi_write_enable(hermon_state_t *state);
static int hermon_flash_init(hermon_state_t *state);
static int hermon_flash_cfi_init(hermon_state_t *state, uint32_t *cfi_info,
    int *intel_xcmd);
static int hermon_flash_fini(hermon_state_t *state);
static int hermon_flash_reset(hermon_state_t *state);
static uint32_t hermon_flash_read_cfg(hermon_state_t *state,
    ddi_acc_handle_t pci_config_hdl, uint32_t addr);
#ifdef DO_WRCONF
static void hermon_flash_write_cfg(hermon_state_t *state,
    ddi_acc_handle_t pci_config_hdl, uint32_t addr, uint32_t data);
static void hermon_flash_write_cfg_helper(hermon_state_t *state,
    ddi_acc_handle_t pci_config_hdl, uint32_t addr, uint32_t data);
static void hermon_flash_write_confirm(hermon_state_t *state,
    ddi_acc_handle_t pci_config_hdl);
#endif
static void hermon_flash_cfi_byte(uint8_t *ch, uint32_t dword, int i);
static void hermon_flash_cfi_dword(uint32_t *dword, uint8_t *ch, int i);

/* Hemron loopback test functions */
static void hermon_loopback_free_qps(hermon_loopback_state_t *lstate);
static void hermon_loopback_free_state(hermon_loopback_state_t *lstate);
static int hermon_loopback_init(hermon_state_t *state,
    hermon_loopback_state_t *lstate);
static void hermon_loopback_init_qp_info(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm);
static int hermon_loopback_alloc_mem(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm, int sz);
static int hermon_loopback_alloc_qps(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm);
static int hermon_loopback_modify_qp(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm, uint_t qp_num);
static int hermon_loopback_copyout(hermon_loopback_ioctl_t *lb,
    intptr_t arg, int mode);
static int hermon_loopback_post_send(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *tx, hermon_loopback_comm_t *rx);
static int hermon_loopback_poll_cq(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm);

/* Patchable timeout values for flash operations */
int hermon_hw_flash_timeout_gpio_sema = HERMON_HW_FLASH_TIMEOUT_GPIO_SEMA;
int hermon_hw_flash_timeout_config = HERMON_HW_FLASH_TIMEOUT_CONFIG;
int hermon_hw_flash_timeout_write = HERMON_HW_FLASH_TIMEOUT_WRITE;
int hermon_hw_flash_timeout_erase = HERMON_HW_FLASH_TIMEOUT_ERASE;

/*
 * hermon_ioctl()
 */
/* ARGSUSED */
int
hermon_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
    int *rvalp)
{
	hermon_state_t	*state;
	minor_t		instance;
	int		status;

	if (drv_priv(credp) != 0) {
		return (EPERM);
	}

	instance = HERMON_DEV_INSTANCE(dev);
	if (instance == (minor_t)-1) {
		return (EBADF);
	}

	state = ddi_get_soft_state(hermon_statep, instance);
	if (state == NULL) {
		return (EBADF);
	}

	status = 0;

	switch (cmd) {
	case HERMON_IOCTL_FLASH_READ:
		status = hermon_ioctl_flash_read(state, dev, arg, mode);
		break;

	case HERMON_IOCTL_FLASH_WRITE:
		status = hermon_ioctl_flash_write(state, dev, arg, mode);
		break;

	case HERMON_IOCTL_FLASH_ERASE:
		status = hermon_ioctl_flash_erase(state, dev, arg, mode);
		break;

	case HERMON_IOCTL_FLASH_INIT:
		status = hermon_ioctl_flash_init(state, dev, arg, mode);
		break;

	case HERMON_IOCTL_FLASH_FINI:
		status = hermon_ioctl_flash_fini(state, dev);
		break;

	case HERMON_IOCTL_INFO:
		status = hermon_ioctl_info(state, dev, arg, mode);
		break;

	case HERMON_IOCTL_PORTS:
		status = hermon_ioctl_ports(state, arg, mode);
		break;

	case HERMON_IOCTL_LOOPBACK:
		status = hermon_ioctl_loopback(state, arg, mode);
		break;

#ifdef	DEBUG
	case HERMON_IOCTL_REG_WRITE:
		status = hermon_ioctl_reg_write(state, arg, mode);
		break;

	case HERMON_IOCTL_REG_READ:
		status = hermon_ioctl_reg_read(state, arg, mode);
		break;
#endif	/* DEBUG */

	case HERMON_IOCTL_DDR_READ:
		/* XXX guard until the ioctl header is cleaned up */
		status = ENODEV;
		break;

	case HERMON_IOCTL_WRITE_BOOT_ADDR:
		status = hermon_ioctl_write_boot_addr(state, dev, arg, mode);
		break;

	default:
		status = ENOTTY;
		break;
	}
	*rvalp = status;

	return (status);
}

/*
 * hermon_ioctl_flash_read()
 */
static int
hermon_ioctl_flash_read(hermon_state_t *state, dev_t dev, intptr_t arg,
    int mode)
{
	hermon_flash_ioctl_t ioctl_info;
	int status = 0;

	/*
	 * Check that flash init ioctl has been called first.  And check
	 * that the same dev_t that called init is the one calling read now.
	 */
	mutex_enter(&state->hs_fw_flashlock);
	if ((state->hs_fw_flashdev != dev) ||
	    (state->hs_fw_flashstarted == 0)) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EIO);
	}

	/* copy user struct to kernel */
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_flash_ioctl32_t info32;

		if (ddi_copyin((void *)arg, &info32,
		    sizeof (hermon_flash_ioctl32_t), mode) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}
		ioctl_info.af_type = info32.af_type;
		ioctl_info.af_sector = (caddr_t)(uintptr_t)info32.af_sector;
		ioctl_info.af_sector_num = info32.af_sector_num;
		ioctl_info.af_addr = info32.af_addr;
	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyin((void *)arg, &ioctl_info, sizeof (hermon_flash_ioctl_t),
	    mode) != 0) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EFAULT);
	}

	/*
	 * Determine type of READ ioctl
	 */
	switch (ioctl_info.af_type) {
	case HERMON_FLASH_READ_SECTOR:
		/* Check if sector num is too large for flash device */
		if (ioctl_info.af_sector_num >=
		    (state->hs_fw_device_sz >> state->hs_fw_log_sector_sz)) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}

		/* Perform the Sector Read */
		if ((status = hermon_flash_reset(state)) != 0 ||
		    (status = hermon_flash_read_sector(state,
		    ioctl_info.af_sector_num)) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (status);
		}

		/* copyout the firmware sector image data */
		if (ddi_copyout(&state->hs_fw_sector[0],
		    &ioctl_info.af_sector[0], 1 << state->hs_fw_log_sector_sz,
		    mode) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}
		break;

	case HERMON_FLASH_READ_QUADLET:
		/* Check if addr is too large for flash device */
		if (ioctl_info.af_addr >= state->hs_fw_device_sz) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}

		/* Perform the Quadlet Read */
		if ((status = hermon_flash_reset(state)) != 0 ||
		    (status = hermon_flash_read_quadlet(state,
		    &ioctl_info.af_quadlet, ioctl_info.af_addr)) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (status);
		}
		break;

	default:
		mutex_exit(&state->hs_fw_flashlock);
		return (EINVAL);
	}

	/* copy results back to userland */
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_flash_ioctl32_t info32;

		info32.af_quadlet = ioctl_info.af_quadlet;
		info32.af_type = ioctl_info.af_type;
		info32.af_sector_num = ioctl_info.af_sector_num;
		info32.af_sector = (caddr32_t)(uintptr_t)ioctl_info.af_sector;
		info32.af_addr = ioctl_info.af_addr;

		if (ddi_copyout(&info32, (void *)arg,
		    sizeof (hermon_flash_ioctl32_t), mode) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}
	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyout(&ioctl_info, (void *)arg,
	    sizeof (hermon_flash_ioctl_t), mode) != 0) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EFAULT);
	}

	mutex_exit(&state->hs_fw_flashlock);
	return (status);
}

/*
 * hermon_ioctl_flash_write()
 */
static int
hermon_ioctl_flash_write(hermon_state_t *state, dev_t dev, intptr_t arg,
    int mode)
{
	hermon_flash_ioctl_t	ioctl_info;
	int status = 0;

	/*
	 * Check that flash init ioctl has been called first.  And check
	 * that the same dev_t that called init is the one calling write now.
	 */
	mutex_enter(&state->hs_fw_flashlock);
	if ((state->hs_fw_flashdev != dev) ||
	    (state->hs_fw_flashstarted == 0)) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EIO);
	}

	/* copy user struct to kernel */
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_flash_ioctl32_t info32;

		if (ddi_copyin((void *)arg, &info32,
		    sizeof (hermon_flash_ioctl32_t), mode) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}
		ioctl_info.af_type = info32.af_type;
		ioctl_info.af_sector = (caddr_t)(uintptr_t)info32.af_sector;
		ioctl_info.af_sector_num = info32.af_sector_num;
		ioctl_info.af_addr = info32.af_addr;
		ioctl_info.af_byte = info32.af_byte;
	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyin((void *)arg, &ioctl_info,
	    sizeof (hermon_flash_ioctl_t), mode) != 0) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EFAULT);
	}

	/*
	 * Determine type of WRITE ioctl
	 */
	switch (ioctl_info.af_type) {
	case HERMON_FLASH_WRITE_SECTOR:
		/* Check if sector num is too large for flash device */
		if (ioctl_info.af_sector_num >=
		    (state->hs_fw_device_sz >> state->hs_fw_log_sector_sz)) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}

		/* copy in fw sector image data */
		if (ddi_copyin(&ioctl_info.af_sector[0],
		    &state->hs_fw_sector[0], 1 << state->hs_fw_log_sector_sz,
		    mode) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}

		/* Perform Write Sector */
		status = hermon_flash_write_sector(state,
		    ioctl_info.af_sector_num);
		break;

	case HERMON_FLASH_WRITE_BYTE:
		/* Check if addr is too large for flash device */
		if (ioctl_info.af_addr >= state->hs_fw_device_sz) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}

		/* Perform Write Byte */
		/*
		 * CMJ -- is a reset really needed before and after writing
		 * each byte?  This code came from arbel, but we should look
		 * into this.  Also, for SPI, no reset is actually performed.
		 */
		if ((status = hermon_flash_bank(state,
		    ioctl_info.af_addr)) != 0 ||
		    (status = hermon_flash_reset(state)) != 0 ||
		    (status = hermon_flash_write_byte(state,
		    ioctl_info.af_addr, ioctl_info.af_byte)) != 0 ||
		    (status = hermon_flash_reset(state)) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (status);
		}
		break;

	default:
		status = EINVAL;
		break;
	}

	mutex_exit(&state->hs_fw_flashlock);
	return (status);
}

/*
 * hermon_ioctl_flash_erase()
 */
static int
hermon_ioctl_flash_erase(hermon_state_t *state, dev_t dev, intptr_t arg,
    int mode)
{
	hermon_flash_ioctl_t	ioctl_info;
	int status = 0;

	/*
	 * Check that flash init ioctl has been called first.  And check
	 * that the same dev_t that called init is the one calling erase now.
	 */
	mutex_enter(&state->hs_fw_flashlock);
	if ((state->hs_fw_flashdev != dev) ||
	    (state->hs_fw_flashstarted == 0)) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EIO);
	}

	/* copy user struct to kernel */
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_flash_ioctl32_t info32;

		if (ddi_copyin((void *)arg, &info32,
		    sizeof (hermon_flash_ioctl32_t), mode) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}
		ioctl_info.af_type = info32.af_type;
		ioctl_info.af_sector_num = info32.af_sector_num;
	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyin((void *)arg, &ioctl_info, sizeof (hermon_flash_ioctl_t),
	    mode) != 0) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EFAULT);
	}

	/*
	 * Determine type of ERASE ioctl
	 */
	switch (ioctl_info.af_type) {
	case HERMON_FLASH_ERASE_SECTOR:
		/* Check if sector num is too large for flash device */
		if (ioctl_info.af_sector_num >=
		    (state->hs_fw_device_sz >> state->hs_fw_log_sector_sz)) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}

		/* Perform Sector Erase */
		status = hermon_flash_erase_sector(state,
		    ioctl_info.af_sector_num);
		break;

	case HERMON_FLASH_ERASE_CHIP:
		/* Perform Chip Erase */
		status = hermon_flash_erase_chip(state);
		break;

	default:
		status = EINVAL;
		break;
	}

	mutex_exit(&state->hs_fw_flashlock);
	return (status);
}

/*
 * hermon_ioctl_flash_init()
 */
static int
hermon_ioctl_flash_init(hermon_state_t *state, dev_t dev, intptr_t arg,
    int mode)
{
	hermon_flash_init_ioctl_t init_info;
	int ret;
	int intel_xcmd = 0;
	ddi_acc_handle_t pci_hdl = hermon_get_pcihdl(state);

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	state->hs_fw_sector = NULL;

	/*
	 * init cannot be called more than once.  If we have already init'd the
	 * flash, return directly.
	 */
	mutex_enter(&state->hs_fw_flashlock);
	if (state->hs_fw_flashstarted == 1) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EINVAL);
	}

	/* copyin the user struct to kernel */
	if (ddi_copyin((void *)arg, &init_info,
	    sizeof (hermon_flash_init_ioctl_t), mode) != 0) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EFAULT);
	}

	/* Init Flash */
	if ((ret = hermon_flash_init(state)) != 0) {
		if (ret == EIO) {
			goto pio_error;
		}
		mutex_exit(&state->hs_fw_flashlock);
		return (ret);
	}

	/* Read CFI info */
	if ((ret = hermon_flash_cfi_init(state, &init_info.af_cfi_info[0],
	    &intel_xcmd)) != 0) {
		if (ret == EIO) {
			goto pio_error;
		}
		mutex_exit(&state->hs_fw_flashlock);
		return (ret);
	}

	/*
	 * Return error if the command set is unknown.
	 */
	if (state->hs_fw_cmdset == HERMON_FLASH_UNKNOWN_CMDSET) {
		if ((ret = hermon_ioctl_flash_cleanup_nolock(state)) != 0) {
			if (ret == EIO) {
				goto pio_error;
			}
			mutex_exit(&state->hs_fw_flashlock);
			return (ret);
		}
		mutex_exit(&state->hs_fw_flashlock);
		return (EFAULT);
	}

	/* the FMA retry loop starts. */
	hermon_pio_start(state, pci_hdl, pio_error,
	    fm_loop_cnt, fm_status, fm_test);

	/* Read HWREV - least significant 8 bits is revision ID */
	init_info.af_hwrev = pci_config_get32(pci_hdl,
	    HERMON_HW_FLASH_CFG_HWREV) & 0xFF;

	/* the FMA retry loop ends. */
	hermon_pio_end(state, pci_hdl, pio_error, fm_loop_cnt,
	    fm_status, fm_test);

	/* Fill in the firmwate revision numbers */
	init_info.af_fwrev.afi_maj	= state->hs_fw.fw_rev_major;
	init_info.af_fwrev.afi_min	= state->hs_fw.fw_rev_minor;
	init_info.af_fwrev.afi_sub	= state->hs_fw.fw_rev_subminor;

	/* Alloc flash mem for one sector size */
	state->hs_fw_sector = (uint32_t *)kmem_zalloc(1 <<
	    state->hs_fw_log_sector_sz, KM_SLEEP);

	/* Set HW part number and length */
	init_info.af_pn_len = state->hs_hca_pn_len;
	if (state->hs_hca_pn_len != 0) {
		(void) memcpy(init_info.af_hwpn, state->hs_hca_pn,
		    state->hs_hca_pn_len);
	}

	/* Copy ioctl results back to userland */
	if (ddi_copyout(&init_info, (void *)arg,
	    sizeof (hermon_flash_init_ioctl_t), mode) != 0) {
		if ((ret = hermon_ioctl_flash_cleanup_nolock(state)) != 0) {
			if (ret == EIO) {
				goto pio_error;
			}
			mutex_exit(&state->hs_fw_flashlock);
			return (ret);
		}
		mutex_exit(&state->hs_fw_flashlock);
		return (EFAULT);
	}

	/* Set flash state to started */
	state->hs_fw_flashstarted = 1;
	state->hs_fw_flashdev	  = dev;

	mutex_exit(&state->hs_fw_flashlock);

	/*
	 * If "flash init" is successful, add an "on close" callback to the
	 * current dev node to ensure that "flash fini" gets called later
	 * even if the userland process prematurely exits.
	 */
	ret = hermon_umap_db_set_onclose_cb(dev,
	    HERMON_ONCLOSE_FLASH_INPROGRESS,
	    (int (*)(void *))hermon_ioctl_flash_cleanup, state);
	if (ret != DDI_SUCCESS) {
		int status = hermon_ioctl_flash_fini(state, dev);
		if (status != 0) {
			if (status == EIO) {
				hermon_fm_ereport(state, HCA_SYS_ERR,
				    HCA_ERR_IOCTL);
				return (EIO);
			}
			return (status);
		}
	}
	return (0);

pio_error:
	mutex_exit(&state->hs_fw_flashlock);
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}

/*
 * hermon_ioctl_flash_fini()
 */
static int
hermon_ioctl_flash_fini(hermon_state_t *state, dev_t dev)
{
	int ret;

	/*
	 * Check that flash init ioctl has been called first.  And check
	 * that the same dev_t that called init is the one calling fini now.
	 */
	mutex_enter(&state->hs_fw_flashlock);
	if ((state->hs_fw_flashdev != dev) ||
	    (state->hs_fw_flashstarted == 0)) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EINVAL);
	}

	if ((ret = hermon_ioctl_flash_cleanup_nolock(state)) != 0) {
		mutex_exit(&state->hs_fw_flashlock);
		if (ret == EIO) {
			hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
		}
		return (ret);
	}
	mutex_exit(&state->hs_fw_flashlock);

	/*
	 * If "flash fini" is successful, remove the "on close" callback
	 * that was setup during "flash init".
	 */
	ret = hermon_umap_db_clear_onclose_cb(dev,
	    HERMON_ONCLOSE_FLASH_INPROGRESS);
	if (ret != DDI_SUCCESS) {
		return (EFAULT);
	}
	return (0);
}


/*
 * hermon_ioctl_flash_cleanup()
 */
static int
hermon_ioctl_flash_cleanup(hermon_state_t *state)
{
	int status;

	mutex_enter(&state->hs_fw_flashlock);
	status = hermon_ioctl_flash_cleanup_nolock(state);
	mutex_exit(&state->hs_fw_flashlock);

	return (status);
}


/*
 * hermon_ioctl_flash_cleanup_nolock()
 */
static int
hermon_ioctl_flash_cleanup_nolock(hermon_state_t *state)
{
	int status;
	ASSERT(MUTEX_HELD(&state->hs_fw_flashlock));

	/* free flash mem */
	if (state->hs_fw_sector) {
		kmem_free(state->hs_fw_sector, 1 << state->hs_fw_log_sector_sz);
	}

	/* Fini the Flash */
	if ((status = hermon_flash_fini(state)) != 0)
		return (status);

	/* Set flash state to fini */
	state->hs_fw_flashstarted = 0;
	state->hs_fw_flashdev	  = 0;
	return (0);
}


/*
 * hermon_ioctl_info()
 */
static int
hermon_ioctl_info(hermon_state_t *state, dev_t dev, intptr_t arg, int mode)
{
	hermon_info_ioctl_t	 info;
	hermon_flash_init_ioctl_t init_info;

	/*
	 * Access to Hemron VTS ioctls is not allowed in "maintenance mode".
	 */
	if (state->hs_operational_mode == HERMON_MAINTENANCE_MODE) {
		return (EFAULT);
	}

	/* copyin the user struct to kernel */
	if (ddi_copyin((void *)arg, &info, sizeof (hermon_info_ioctl_t),
	    mode) != 0) {
		return (EFAULT);
	}

	/*
	 * Check ioctl revision
	 */
	if (info.ai_revision != HERMON_VTS_IOCTL_REVISION) {
		return (EINVAL);
	}

	/*
	 * If the 'fw_device_sz' has not been initialized yet, we initialize it
	 * here.  This is done by leveraging the
	 * hermon_ioctl_flash_init()/fini() calls.  We also hold our own mutex
	 * around this operation in case we have multiple VTS threads in
	 * process at the same time.
	 */
	mutex_enter(&state->hs_info_lock);
	if (state->hs_fw_device_sz == 0) {
		if (hermon_ioctl_flash_init(state, dev, (intptr_t)&init_info,
		    (FKIOCTL | mode)) != 0) {
			mutex_exit(&state->hs_info_lock);
			return (EFAULT);
		}
		(void) hermon_ioctl_flash_fini(state, dev);
	}
	mutex_exit(&state->hs_info_lock);

	info.ai_hw_rev		 = state->hs_revision_id;
	info.ai_flash_sz	 = state->hs_fw_device_sz;
	info.ai_fw_rev.afi_maj	 = state->hs_fw.fw_rev_major;
	info.ai_fw_rev.afi_min	 = state->hs_fw.fw_rev_minor;
	info.ai_fw_rev.afi_sub	 = state->hs_fw.fw_rev_subminor;

	/* Copy ioctl results back to user struct */
	if (ddi_copyout(&info, (void *)arg, sizeof (hermon_info_ioctl_t),
	    mode) != 0) {
		return (EFAULT);
	}

	return (0);
}

/*
 * hermon_ioctl_ports()
 */
static int
hermon_ioctl_ports(hermon_state_t *state, intptr_t arg, int mode)
{
	hermon_ports_ioctl_t	info;
	hermon_stat_port_ioctl_t	portstat;
	ibt_hca_portinfo_t	pi;
	uint_t			tbl_size;
	ib_gid_t		*sgid_tbl;
	ib_pkey_t		*pkey_tbl;
	int			i;

	/*
	 * Access to Hemron VTS ioctls is not allowed in "maintenance mode".
	 */
	if (state->hs_operational_mode == HERMON_MAINTENANCE_MODE) {
		return (EFAULT);
	}

	/* copyin the user struct to kernel */
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_ports_ioctl32_t info32;

		if (ddi_copyin((void *)arg, &info32,
		    sizeof (hermon_ports_ioctl32_t), mode) != 0) {
			return (EFAULT);
		}
		info.ap_revision  = info32.ap_revision;
		info.ap_ports	  =
		    (hermon_stat_port_ioctl_t *)(uintptr_t)info32.ap_ports;
		info.ap_num_ports = info32.ap_num_ports;

	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyin((void *)arg, &info, sizeof (hermon_ports_ioctl_t),
	    mode) != 0) {
		return (EFAULT);
	}

	/*
	 * Check ioctl revision
	 */
	if (info.ap_revision != HERMON_VTS_IOCTL_REVISION) {
		return (EINVAL);
	}

	/* Allocate space for temporary GID table/PKey table */
	tbl_size = (1 << state->hs_cfg_profile->cp_log_max_gidtbl);
	sgid_tbl = (ib_gid_t *)kmem_zalloc(tbl_size * sizeof (ib_gid_t),
	    KM_SLEEP);
	tbl_size = (1 << state->hs_cfg_profile->cp_log_max_pkeytbl);
	pkey_tbl = (ib_pkey_t *)kmem_zalloc(tbl_size * sizeof (ib_pkey_t),
	    KM_SLEEP);

	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*sgid_tbl, *pkey_tbl))

	/*
	 * Setup the number of ports, then loop through all ports and
	 * query properties of each.
	 */
	info.ap_num_ports = (uint8_t)state->hs_cfg_profile->cp_num_ports;
	for (i = 0; i < info.ap_num_ports; i++) {
		/*
		 * Get portstate information from the device.  If
		 * hermon_port_query() fails, leave zeroes in user
		 * struct port entry and continue.
		 */
		bzero(&pi, sizeof (ibt_hca_portinfo_t));
		pi.p_sgid_tbl = sgid_tbl;
		pi.p_pkey_tbl = pkey_tbl;
		(void) hermon_port_query(state, i + 1, &pi);

		portstat.asp_port_num	= pi.p_port_num;
		portstat.asp_state	= pi.p_linkstate;
		portstat.asp_guid	= pi.p_sgid_tbl[0].gid_guid;

		/*
		 * Copy queried port results back to user struct.  If
		 * this fails, then break out of loop, attempt to copy
		 * out remaining info to user struct, and return (without
		 * error).
		 */
		if (ddi_copyout(&portstat,
		    &(((hermon_stat_port_ioctl_t *)info.ap_ports)[i]),
		    sizeof (hermon_stat_port_ioctl_t), mode) != 0) {
			break;
		}
	}

	/* Free the temporary space used for GID table/PKey table */
	tbl_size = (1 << state->hs_cfg_profile->cp_log_max_gidtbl);
	kmem_free(sgid_tbl, tbl_size * sizeof (ib_gid_t));
	tbl_size = (1 << state->hs_cfg_profile->cp_log_max_pkeytbl);
	kmem_free(pkey_tbl, tbl_size * sizeof (ib_pkey_t));

	/* Copy ioctl results back to user struct */
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_ports_ioctl32_t info32;

		info32.ap_revision  = info.ap_revision;
		info32.ap_ports	    = (caddr32_t)(uintptr_t)info.ap_ports;
		info32.ap_num_ports = info.ap_num_ports;

		if (ddi_copyout(&info32, (void *)arg,
		    sizeof (hermon_ports_ioctl32_t), mode) != 0) {
			return (EFAULT);
		}
	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyout(&info, (void *)arg, sizeof (hermon_ports_ioctl_t),
	    mode) != 0) {
		return (EFAULT);
	}

	return (0);
}

/*
 * hermon_ioctl_loopback()
 */
static int
hermon_ioctl_loopback(hermon_state_t *state, intptr_t arg, int mode)
{
	hermon_loopback_ioctl_t	lb;
	hermon_loopback_state_t	lstate;
	ibt_hca_portinfo_t 	pi;
	uint_t			tbl_size, loopmax, max_usec;
	ib_gid_t		*sgid_tbl;
	ib_pkey_t		*pkey_tbl;
	int			j, iter, ret;

	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(lstate))

	/*
	 * Access to Hemron VTS ioctls is not allowed in "maintenance mode".
	 */
	if (state->hs_operational_mode == HERMON_MAINTENANCE_MODE) {
		return (EFAULT);
	}

	/* copyin the user struct to kernel */
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_loopback_ioctl32_t lb32;

		if (ddi_copyin((void *)arg, &lb32,
		    sizeof (hermon_loopback_ioctl32_t), mode) != 0) {
			return (EFAULT);
		}
		lb.alb_revision	    = lb32.alb_revision;
		lb.alb_send_buf	    = (caddr_t)(uintptr_t)lb32.alb_send_buf;
		lb.alb_fail_buf	    = (caddr_t)(uintptr_t)lb32.alb_fail_buf;
		lb.alb_buf_sz	    = lb32.alb_buf_sz;
		lb.alb_num_iter	    = lb32.alb_num_iter;
		lb.alb_pass_done    = lb32.alb_pass_done;
		lb.alb_timeout	    = lb32.alb_timeout;
		lb.alb_error_type   = lb32.alb_error_type;
		lb.alb_port_num	    = lb32.alb_port_num;
		lb.alb_num_retry    = lb32.alb_num_retry;
	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyin((void *)arg, &lb, sizeof (hermon_loopback_ioctl_t),
	    mode) != 0) {
		return (EFAULT);
	}

	/* Initialize the internal loopback test state structure */
	bzero(&lstate, sizeof (hermon_loopback_state_t));

	/*
	 * Check ioctl revision
	 */
	if (lb.alb_revision != HERMON_VTS_IOCTL_REVISION) {
		lb.alb_error_type = HERMON_LOOPBACK_INVALID_REVISION;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		return (EINVAL);
	}

	/* Validate that specified port number is legal */
	if (!hermon_portnum_is_valid(state, lb.alb_port_num)) {
		lb.alb_error_type = HERMON_LOOPBACK_INVALID_PORT;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		return (EINVAL);
	}

	/* Allocate space for temporary GID table/PKey table */
	tbl_size = (1 << state->hs_cfg_profile->cp_log_max_gidtbl);
	sgid_tbl = (ib_gid_t *)kmem_zalloc(tbl_size * sizeof (ib_gid_t),
	    KM_SLEEP);
	tbl_size = (1 << state->hs_cfg_profile->cp_log_max_pkeytbl);
	pkey_tbl = (ib_pkey_t *)kmem_zalloc(tbl_size * sizeof (ib_pkey_t),
	    KM_SLEEP);

	/*
	 * Get portstate information from specific port on device
	 */
	bzero(&pi, sizeof (ibt_hca_portinfo_t));
	pi.p_sgid_tbl = sgid_tbl;
	pi.p_pkey_tbl = pkey_tbl;
	if (hermon_port_query(state, lb.alb_port_num, &pi) != 0) {
		/* Free the temporary space used for GID table/PKey table */
		tbl_size = (1 << state->hs_cfg_profile->cp_log_max_gidtbl);
		kmem_free(sgid_tbl, tbl_size * sizeof (ib_gid_t));
		tbl_size = (1 << state->hs_cfg_profile->cp_log_max_pkeytbl);
		kmem_free(pkey_tbl, tbl_size * sizeof (ib_pkey_t));

		lb.alb_error_type = HERMON_LOOPBACK_INVALID_PORT;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EINVAL);
	}

	lstate.hls_port	   = pi.p_port_num;
	lstate.hls_lid	   = pi.p_base_lid;
	lstate.hls_pkey_ix = (pi.p_linkstate == HERMON_PORT_LINK_ACTIVE) ?
	    1 : 0;	/* XXX bogus assumption of a SUN subnet manager */
	lstate.hls_state   = state;
	lstate.hls_retry   = lb.alb_num_retry;

	/* Free the temporary space used for GID table/PKey table */
	tbl_size = (1 << state->hs_cfg_profile->cp_log_max_gidtbl);
	kmem_free(sgid_tbl, tbl_size * sizeof (ib_gid_t));
	tbl_size = (1 << state->hs_cfg_profile->cp_log_max_pkeytbl);
	kmem_free(pkey_tbl, tbl_size * sizeof (ib_pkey_t));

	/*
	 * Compute the timeout duration in usec per the formula:
	 *    to_usec_per_retry = 4.096us * (2 ^ supplied_timeout)
	 * (plus we add a little fudge-factor here too)
	 */
	lstate.hls_timeout = lb.alb_timeout;
	max_usec = (4096 * (1 << lstate.hls_timeout)) / 1000;
	max_usec = max_usec * (lstate.hls_retry + 1);
	max_usec = max_usec + 10000;

	/*
	 * Determine how many times we should loop before declaring a
	 * timeout failure.
	 */
	loopmax	 = max_usec/HERMON_VTS_LOOPBACK_MIN_WAIT_DUR;
	if ((max_usec % HERMON_VTS_LOOPBACK_MIN_WAIT_DUR) != 0) {
		loopmax++;
	}

	if (lb.alb_send_buf == NULL || lb.alb_buf_sz == 0) {
		lb.alb_error_type = HERMON_LOOPBACK_SEND_BUF_INVALID;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EINVAL);
	}

	/* Allocate protection domain (PD) */
	if (hermon_loopback_init(state, &lstate) != 0) {
		lb.alb_error_type = lstate.hls_err;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EFAULT);
	}

	/* Allocate and register a TX buffer */
	if (hermon_loopback_alloc_mem(&lstate, &lstate.hls_tx,
	    lb.alb_buf_sz) != 0) {
		lb.alb_error_type =
		    HERMON_LOOPBACK_SEND_BUF_MEM_REGION_ALLOC_FAIL;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EFAULT);
	}

	/* Allocate and register an RX buffer */
	if (hermon_loopback_alloc_mem(&lstate, &lstate.hls_rx,
	    lb.alb_buf_sz) != 0) {
		lb.alb_error_type =
		    HERMON_LOOPBACK_RECV_BUF_MEM_REGION_ALLOC_FAIL;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EFAULT);
	}

	/* Copy in the transmit buffer data */
	if (ddi_copyin((void *)lb.alb_send_buf, lstate.hls_tx.hlc_buf,
	    lb.alb_buf_sz, mode) != 0) {
		lb.alb_error_type = HERMON_LOOPBACK_SEND_BUF_COPY_FAIL;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EFAULT);
	}

	/* Allocate the transmit QP and CQs */
	lstate.hls_err = HERMON_LOOPBACK_XMIT_SEND_CQ_ALLOC_FAIL;
	if (hermon_loopback_alloc_qps(&lstate, &lstate.hls_tx) != 0) {
		lb.alb_error_type = lstate.hls_err;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EFAULT);
	}

	/* Allocate the receive QP and CQs */
	lstate.hls_err = HERMON_LOOPBACK_RECV_SEND_CQ_ALLOC_FAIL;
	if (hermon_loopback_alloc_qps(&lstate, &lstate.hls_rx) != 0) {
		lb.alb_error_type = lstate.hls_err;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EFAULT);
	}

	/* Activate the TX QP (connect to RX QP) */
	lstate.hls_err = HERMON_LOOPBACK_XMIT_QP_INIT_FAIL;
	if (hermon_loopback_modify_qp(&lstate, &lstate.hls_tx,
	    lstate.hls_rx.hlc_qp_num) != 0) {
		lb.alb_error_type = lstate.hls_err;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EFAULT);
	}

	/* Activate the RX QP (connect to TX QP) */
	lstate.hls_err = HERMON_LOOPBACK_RECV_QP_INIT_FAIL;
	if (hermon_loopback_modify_qp(&lstate, &lstate.hls_rx,
	    lstate.hls_tx.hlc_qp_num) != 0) {
		lb.alb_error_type = lstate.hls_err;
		(void) hermon_loopback_copyout(&lb, arg, mode);
		hermon_loopback_free_state(&lstate);
		return (EFAULT);
	}

	/* Run the loopback test (for specified number of iterations) */
	lb.alb_pass_done = 0;
	for (iter = 0; iter < lb.alb_num_iter; iter++) {
		lstate.hls_err = 0;
		bzero(lstate.hls_rx.hlc_buf, lb.alb_buf_sz);

		/* Post RDMA Write work request */
		if (hermon_loopback_post_send(&lstate, &lstate.hls_tx,
		    &lstate.hls_rx) != IBT_SUCCESS) {
			lb.alb_error_type = HERMON_LOOPBACK_WQE_POST_FAIL;
			(void) hermon_loopback_copyout(&lb, arg, mode);
			hermon_loopback_free_state(&lstate);
			return (EFAULT);
		}

		/* Poll the TX CQ for a completion every few ticks */
		for (j = 0; j < loopmax; j++) {
			delay(drv_usectohz(HERMON_VTS_LOOPBACK_MIN_WAIT_DUR));

			ret = hermon_loopback_poll_cq(&lstate, &lstate.hls_tx);
			if (((ret != IBT_SUCCESS) && (ret != IBT_CQ_EMPTY)) ||
			    ((ret == IBT_CQ_EMPTY) && (j == loopmax - 1))) {
				lb.alb_error_type =
				    HERMON_LOOPBACK_CQ_POLL_FAIL;
				if (ddi_copyout(lstate.hls_rx.hlc_buf,
				    lb.alb_fail_buf, lstate.hls_tx.hlc_buf_sz,
				    mode) != 0) {
					return (EFAULT);
				}
				(void) hermon_loopback_copyout(&lb, arg, mode);
				hermon_loopback_free_state(&lstate);
				return (EFAULT);
			} else if (ret == IBT_CQ_EMPTY) {
				continue;
			}

			/* Compare the data buffers */
			if (bcmp(lstate.hls_tx.hlc_buf, lstate.hls_rx.hlc_buf,
			    lb.alb_buf_sz) == 0) {
				break;
			} else {
				lb.alb_error_type =
				    HERMON_LOOPBACK_SEND_RECV_COMPARE_FAIL;
				if (ddi_copyout(lstate.hls_rx.hlc_buf,
				    lb.alb_fail_buf, lstate.hls_tx.hlc_buf_sz,
				    mode) != 0) {
					return (EFAULT);
				}
				(void) hermon_loopback_copyout(&lb, arg, mode);
				hermon_loopback_free_state(&lstate);
				return (EFAULT);
			}
		}

		lstate.hls_err	 = HERMON_LOOPBACK_SUCCESS;
		lb.alb_pass_done = iter + 1;
	}

	lb.alb_error_type = HERMON_LOOPBACK_SUCCESS;

	/* Copy ioctl results back to user struct */
	ret = hermon_loopback_copyout(&lb, arg, mode);

	/* Free up everything and release all consumed resources */
	hermon_loopback_free_state(&lstate);

	return (ret);
}

#ifdef	DEBUG
/*
 * hermon_ioctl_reg_read()
 */
static int
hermon_ioctl_reg_read(hermon_state_t *state, intptr_t arg, int mode)
{
	hermon_reg_ioctl_t	rdreg;
	uint32_t		*addr;
	uintptr_t		baseaddr;
	int			status;
	ddi_acc_handle_t	handle;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	/*
	 * Access to Hemron registers is not allowed in "maintenance mode".
	 * This is primarily because the device may not have BARs to access
	 */
	if (state->hs_operational_mode == HERMON_MAINTENANCE_MODE) {
		return (EFAULT);
	}

	/* Copy in the hermon_reg_ioctl_t structure */
	status = ddi_copyin((void *)arg, &rdreg, sizeof (hermon_reg_ioctl_t),
	    mode);
	if (status != 0) {
		return (EFAULT);
	}

	/* Determine base address for requested register set */
	switch (rdreg.arg_reg_set) {
	case HERMON_CMD_BAR:
		baseaddr = (uintptr_t)state->hs_reg_cmd_baseaddr;
		handle = hermon_get_cmdhdl(state);
		break;

	case HERMON_UAR_BAR:
		baseaddr = (uintptr_t)state->hs_reg_uar_baseaddr;
		handle = hermon_get_uarhdl(state);
		break;


	default:
		return (EINVAL);
	}

	/* Ensure that address is properly-aligned */
	addr = (uint32_t *)((baseaddr + rdreg.arg_offset) & ~0x3);

	/* the FMA retry loop starts. */
	hermon_pio_start(state, handle, pio_error, fm_loop_cnt,
	    fm_status, fm_test);

	/* Read the register pointed to by addr */
	rdreg.arg_data = ddi_get32(handle, addr);

	/* the FMA retry loop ends. */
	hermon_pio_end(state, handle, pio_error, fm_loop_cnt, fm_status,
	    fm_test);

	/* Copy in the result into the hermon_reg_ioctl_t structure */
	status = ddi_copyout(&rdreg, (void *)arg, sizeof (hermon_reg_ioctl_t),
	    mode);
	if (status != 0) {
		return (EFAULT);
	}
	return (0);

pio_error:
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}


/*
 * hermon_ioctl_reg_write()
 */
static int
hermon_ioctl_reg_write(hermon_state_t *state, intptr_t arg, int mode)
{
	hermon_reg_ioctl_t	wrreg;
	uint32_t		*addr;
	uintptr_t		baseaddr;
	int			status;
	ddi_acc_handle_t	handle;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	/*
	 * Access to Hermon registers is not allowed in "maintenance mode".
	 * This is primarily because the device may not have BARs to access
	 */
	if (state->hs_operational_mode == HERMON_MAINTENANCE_MODE) {
		return (EFAULT);
	}

	/* Copy in the hermon_reg_ioctl_t structure */
	status = ddi_copyin((void *)arg, &wrreg, sizeof (hermon_reg_ioctl_t),
	    mode);
	if (status != 0) {
		return (EFAULT);
	}

	/* Determine base address for requested register set */
	switch (wrreg.arg_reg_set) {
	case HERMON_CMD_BAR:
		baseaddr = (uintptr_t)state->hs_reg_cmd_baseaddr;
		handle = hermon_get_cmdhdl(state);
		break;

	case HERMON_UAR_BAR:
		baseaddr = (uintptr_t)state->hs_reg_uar_baseaddr;
		handle = hermon_get_uarhdl(state);
		break;

	default:
		return (EINVAL);
	}

	/* Ensure that address is properly-aligned */
	addr = (uint32_t *)((baseaddr + wrreg.arg_offset) & ~0x3);

	/* the FMA retry loop starts. */
	hermon_pio_start(state, handle, pio_error, fm_loop_cnt,
	    fm_status, fm_test);

	/* Write the data to the register pointed to by addr */
	ddi_put32(handle, addr, wrreg.arg_data);

	/* the FMA retry loop ends. */
	hermon_pio_end(state, handle, pio_error, fm_loop_cnt, fm_status,
	    fm_test);
	return (0);

pio_error:
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}
#endif	/* DEBUG */

static int
hermon_ioctl_write_boot_addr(hermon_state_t *state, dev_t dev, intptr_t arg,
    int mode)
{
	hermon_flash_ioctl_t	ioctl_info;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	/*
	 * Check that flash init ioctl has been called first.  And check
	 * that the same dev_t that called init is the one calling write now.
	 */
	mutex_enter(&state->hs_fw_flashlock);
	if ((state->hs_fw_flashdev != dev) ||
	    (state->hs_fw_flashstarted == 0)) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EIO);
	}

	/* copy user struct to kernel */
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_flash_ioctl32_t info32;

		if (ddi_copyin((void *)arg, &info32,
		    sizeof (hermon_flash_ioctl32_t), mode) != 0) {
			mutex_exit(&state->hs_fw_flashlock);
			return (EFAULT);
		}
		ioctl_info.af_type = info32.af_type;
		ioctl_info.af_sector = (caddr_t)(uintptr_t)info32.af_sector;
		ioctl_info.af_sector_num = info32.af_sector_num;
		ioctl_info.af_addr = info32.af_addr;
		ioctl_info.af_byte = info32.af_byte;
	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyin((void *)arg, &ioctl_info,
	    sizeof (hermon_flash_ioctl_t), mode) != 0) {
		mutex_exit(&state->hs_fw_flashlock);
		return (EFAULT);
	}

	switch (state->hs_fw_cmdset) {
	case HERMON_FLASH_AMD_CMDSET:
	case HERMON_FLASH_INTEL_CMDSET:
		break;

	case HERMON_FLASH_SPI_CMDSET:
	{
		ddi_acc_handle_t pci_hdl = hermon_get_pcihdl(state);

		/* the FMA retry loop starts. */
		hermon_pio_start(state, pci_hdl, pio_error,
		    fm_loop_cnt, fm_status, fm_test);

		hermon_flash_write_cfg(state, pci_hdl,
		    HERMON_HW_FLASH_SPI_BOOT_ADDR_REG,
		    (ioctl_info.af_addr << 8) | 0x06);

		/* the FMA retry loop ends. */
		hermon_pio_end(state, pci_hdl, pio_error,
		    fm_loop_cnt, fm_status, fm_test);
		break;
	}

	case HERMON_FLASH_UNKNOWN_CMDSET:
	default:
		mutex_exit(&state->hs_fw_flashlock);
		return (EINVAL);
	}
	mutex_exit(&state->hs_fw_flashlock);
	return (0);

pio_error:
	mutex_exit(&state->hs_fw_flashlock);
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}

/*
 * hermon_flash_reset()
 */
static int
hermon_flash_reset(hermon_state_t *state)
{
	int status;

	/*
	 * Performs a reset to the flash device.  After a reset the flash will
	 * be operating in normal mode (capable of read/write, etc.).
	 */
	switch (state->hs_fw_cmdset) {
	case HERMON_FLASH_AMD_CMDSET:
		hermon_flash_write(state, 0x555, HERMON_HW_FLASH_RESET_AMD,
		    &status);
		if (status != 0) {
			return (status);
		}
		break;

	case HERMON_FLASH_INTEL_CMDSET:
		hermon_flash_write(state, 0x555, HERMON_HW_FLASH_RESET_INTEL,
		    &status);
		if (status != 0) {
			return (status);
		}
		break;

	/* It appears no reset is needed for SPI */
	case HERMON_FLASH_SPI_CMDSET:
		status = 0;
		break;

	case HERMON_FLASH_UNKNOWN_CMDSET:
	default:
		status = EINVAL;
		break;
	}
	return (status);
}

/*
 * hermon_flash_read_sector()
 */
static int
hermon_flash_read_sector(hermon_state_t *state, uint32_t sector_num)
{
	uint32_t addr;
	uint32_t end_addr;
	uint32_t *image;
	int i, status;

	image = (uint32_t *)&state->hs_fw_sector[0];

	/*
	 * Calculate the start and end address of the sector, based on the
	 * sector number passed in.
	 */
	addr = sector_num << state->hs_fw_log_sector_sz;
	end_addr = addr + (1 << state->hs_fw_log_sector_sz);

	/* Set the flash bank correctly for the given address */
	if ((status = hermon_flash_bank(state, addr)) != 0)
		return (status);

	/* Read the entire sector, one quadlet at a time */
	for (i = 0; addr < end_addr; i++, addr += 4) {
		image[i] = hermon_flash_read(state, addr, &status);
		if (status != 0) {
			return (status);
		}
	}
	return (0);
}

/*
 * hermon_flash_read_quadlet()
 */
static int
hermon_flash_read_quadlet(hermon_state_t *state, uint32_t *data,
    uint32_t addr)
{
	int status;

	/* Set the flash bank correctly for the given address */
	if ((status = hermon_flash_bank(state, addr)) != 0) {
		return (status);
	}

	/* Read one quadlet of data */
	*data = hermon_flash_read(state, addr, &status);
	if (status != 0) {
		return (EIO);
	}

	return (0);
}

/*
 * hermon_flash_write_sector()
 */
static int
hermon_flash_write_sector(hermon_state_t *state, uint32_t sector_num)
{
	uint32_t	addr;
	uint32_t	end_addr;
	uint32_t	*databuf;
	uchar_t		*sector;
	int		status = 0;
	int		i;

	sector = (uchar_t *)&state->hs_fw_sector[0];

	/*
	 * Calculate the start and end address of the sector, based on the
	 * sector number passed in.
	 */
	addr = sector_num << state->hs_fw_log_sector_sz;
	end_addr = addr + (1 << state->hs_fw_log_sector_sz);

	/* Set the flash bank correctly for the given address */
	if ((status = hermon_flash_bank(state, addr)) != 0 ||
	    (status = hermon_flash_reset(state)) != 0) {
		return (status);
	}

	/* Erase the sector before writing */
	status = hermon_flash_erase_sector(state, sector_num);
	if (status != 0) {
		return (status);
	}

	switch (state->hs_fw_cmdset) {
	case HERMON_FLASH_SPI_CMDSET:
		databuf = (uint32_t *)(void *)sector;
		/* Write the sector, one dword at a time */
		for (i = 0; addr < end_addr; i++, addr += 4) {
			if ((status = hermon_flash_spi_write_dword(state, addr,
			    htonl(databuf[i]))) != 0) {
				return (status);
			}
		}
		status = hermon_flash_reset(state);
		break;

	case HERMON_FLASH_INTEL_CMDSET:
	case HERMON_FLASH_AMD_CMDSET:
		/* Write the sector, one byte at a time */
		for (i = 0; addr < end_addr; i++, addr++) {
			status = hermon_flash_write_byte(state, addr,
			    sector[i]);
			if (status != 0) {
				break;
			}
		}
		status = hermon_flash_reset(state);
		break;

	case HERMON_FLASH_UNKNOWN_CMDSET:
	default:
		status = EINVAL;
		break;
	}

	return (status);
}

/*
 * hermon_flash_spi_write_dword()
 *
 * NOTE: This function assumes that "data" is in network byte order.
 *
 */
static int
hermon_flash_spi_write_dword(hermon_state_t *state, uint32_t addr,
    uint32_t data)
{
	int status;
	ddi_acc_handle_t	hdl;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	hdl = hermon_get_pcihdl(state);

	/* the FMA retry loop starts. */
	hermon_pio_start(state, hdl, pio_error, fm_loop_cnt, fm_status,
	    fm_test);

	/* Issue Write Enable */
	hermon_flash_spi_write_enable(state);

	/* Set the Address */
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_SPI_ADDR,
	    addr & HERMON_HW_FLASH_SPI_ADDR_MASK);

	/* Set the Data */
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_SPI_DATA, data);

	/* Set the Page Program and execute */
	hermon_flash_spi_exec_command(state, hdl,
	    HERMON_HW_FLASH_SPI_INSTR_PHASE_OFF |
	    HERMON_HW_FLASH_SPI_ADDR_PHASE_OFF |
	    HERMON_HW_FLASH_SPI_DATA_PHASE_OFF |
	    HERMON_HW_FLASH_SPI_TRANS_SZ_4B |
	    (HERMON_HW_FLASH_SPI_PAGE_PROGRAM <<
	    HERMON_HW_FLASH_SPI_INSTR_SHIFT));

	/* Wait for write to complete */
	if ((status = hermon_flash_spi_wait_wip(state)) != 0) {
		return (status);
	}

	/* the FMA retry loop ends. */
	hermon_pio_end(state, hdl, pio_error, fm_loop_cnt, fm_status, fm_test);
	return (0);

pio_error:
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}

/*
 * hermon_flash_write_byte()
 */
static int
hermon_flash_write_byte(hermon_state_t *state, uint32_t addr, uchar_t data)
{
	uint32_t stat;
	int status = 0;
	int dword_addr;
	int byte_offset;
	int i;
	union {
		uint8_t		bytes[4];
		uint32_t	dword;
	} dword;

	switch (state->hs_fw_cmdset) {
	case HERMON_FLASH_AMD_CMDSET:
		/* Issue Flash Byte program command */
		hermon_flash_write(state, addr, 0xAA, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, 0x55, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, 0xA0, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, data, &status);
		if (status != 0) {
			return (status);
		}

		/* Wait for Write Byte to Complete */
		i = 0;
		do {
			drv_usecwait(1);
			stat = hermon_flash_read(state, addr & ~3, &status);
			if (status != 0) {
				return (status);
			}

			if (i == hermon_hw_flash_timeout_write) {
				cmn_err(CE_WARN,
				    "hermon_flash_write_byte: ACS write "
				    "timeout: addr: 0x%x, data: 0x%x\n",
				    addr, data);
				hermon_fm_ereport(state, HCA_SYS_ERR,
				    HCA_ERR_IOCTL);
				return (EIO);
			}
			i++;
		} while (data != ((stat >> ((3 - (addr & 3)) << 3)) & 0xFF));

		break;

	case HERMON_FLASH_INTEL_CMDSET:
		/* Issue Flash Byte program command */
		hermon_flash_write(state, addr, HERMON_HW_FLASH_ICS_WRITE,
		    &status);
		if (status != 0) {
			return (status);
		}
		hermon_flash_write(state, addr, data, &status);
		if (status != 0) {
			return (status);
		}

		/* Wait for Write Byte to Complete */
		i = 0;
		do {
			drv_usecwait(1);
			stat = hermon_flash_read(state, addr & ~3, &status);
			if (status != 0) {
				return (status);
			}

			if (i == hermon_hw_flash_timeout_write) {
				cmn_err(CE_WARN,
				    "hermon_flash_write_byte: ICS write "
				    "timeout: addr: %x, data: %x\n",
				    addr, data);
				hermon_fm_ereport(state, HCA_SYS_ERR,
				    HCA_ERR_IOCTL);
				return (EIO);
			}
			i++;
		} while ((stat & HERMON_HW_FLASH_ICS_READY) == 0);

		if (stat & HERMON_HW_FLASH_ICS_ERROR) {
			cmn_err(CE_WARN,
			    "hermon_flash_write_byte: ICS write cmd error: "
			    "addr: %x, data: %x\n",
			    addr, data);
			hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
			return (EIO);
		}
		break;

	case HERMON_FLASH_SPI_CMDSET:
		/*
		 * Our lowest write granularity on SPI is a dword.
		 * To support this ioctl option, we can read in the
		 * dword that contains this byte, modify this byte,
		 * and write the dword back out.
		 */

		/* Determine dword offset and byte offset within the dword */
		byte_offset = addr & 3;
		dword_addr = addr - byte_offset;
#ifdef _LITTLE_ENDIAN
		byte_offset = 3 - byte_offset;
#endif

		/* Read in dword */
		if ((status = hermon_flash_read_quadlet(state, &dword.dword,
		    dword_addr)) != 0)
			break;

		/* Set "data" to the appopriate byte */
		dword.bytes[byte_offset] = data;

		/* Write modified dword back out */
		status = hermon_flash_spi_write_dword(state, dword_addr,
		    dword.dword);

		break;

	case HERMON_FLASH_UNKNOWN_CMDSET:
	default:
		cmn_err(CE_WARN,
		    "hermon_flash_write_byte: unknown cmd set: 0x%x\n",
		    state->hs_fw_cmdset);
		status = EINVAL;
		break;
	}

	return (status);
}

/*
 * hermon_flash_erase_sector()
 */
static int
hermon_flash_erase_sector(hermon_state_t *state, uint32_t sector_num)
{
	ddi_acc_handle_t	hdl;
	uint32_t addr;
	uint32_t stat;
	int status = 0;
	int i;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	/* Get address from sector num */
	addr = sector_num << state->hs_fw_log_sector_sz;

	switch (state->hs_fw_cmdset) {
	case HERMON_FLASH_AMD_CMDSET:
		/* Issue Flash Sector Erase Command */
		hermon_flash_write(state, addr, 0xAA, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, 0x55, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, 0x80, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, 0xAA, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, 0x55, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, 0x30, &status);
		if (status != 0) {
			return (status);
		}

		/* Wait for Sector Erase to complete */
		i = 0;
		do {
			drv_usecwait(1);
			stat = hermon_flash_read(state, addr, &status);
			if (status != 0) {
				return (status);
			}

			if (i == hermon_hw_flash_timeout_erase) {
				cmn_err(CE_WARN,
				    "hermon_flash_erase_sector: "
				    "ACS erase timeout\n");
				hermon_fm_ereport(state, HCA_SYS_ERR,
				    HCA_ERR_IOCTL);
				return (EIO);
			}
			i++;
		} while (stat != 0xFFFFFFFF);
		break;

	case HERMON_FLASH_INTEL_CMDSET:
		/* Issue Flash Sector Erase Command */
		hermon_flash_write(state, addr, HERMON_HW_FLASH_ICS_ERASE,
		    &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, addr, HERMON_HW_FLASH_ICS_CONFIRM,
		    &status);
		if (status != 0) {
			return (status);
		}

		/* Wait for Sector Erase to complete */
		i = 0;
		do {
			drv_usecwait(1);
			stat = hermon_flash_read(state, addr & ~3, &status);
			if (status != 0) {
				return (status);
			}

			if (i == hermon_hw_flash_timeout_erase) {
				cmn_err(CE_WARN,
				    "hermon_flash_erase_sector: "
				    "ICS erase timeout\n");
				hermon_fm_ereport(state, HCA_SYS_ERR,
				    HCA_ERR_IOCTL);
				return (EIO);
			}
			i++;
		} while ((stat & HERMON_HW_FLASH_ICS_READY) == 0);

		if (stat & HERMON_HW_FLASH_ICS_ERROR) {
			cmn_err(CE_WARN,
			    "hermon_flash_erase_sector: "
			    "ICS erase cmd error\n");
			hermon_fm_ereport(state, HCA_SYS_ERR,
			    HCA_ERR_IOCTL);
			return (EIO);
		}
		break;

	case HERMON_FLASH_SPI_CMDSET:
		hdl = hermon_get_pcihdl(state);

		/* the FMA retry loop starts. */
		hermon_pio_start(state, hdl, pio_error, fm_loop_cnt, fm_status,
		    fm_test);

		/* Issue Write Enable */
		hermon_flash_spi_write_enable(state);

		/* Set the Address */
		hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_SPI_ADDR,
		    addr & HERMON_HW_FLASH_SPI_ADDR_MASK);

		/* Issue Flash Sector Erase */
		hermon_flash_spi_exec_command(state, hdl,
		    HERMON_HW_FLASH_SPI_INSTR_PHASE_OFF |
		    HERMON_HW_FLASH_SPI_ADDR_PHASE_OFF |
		    ((uint32_t)(HERMON_HW_FLASH_SPI_SECTOR_ERASE) <<
		    HERMON_HW_FLASH_SPI_INSTR_SHIFT));

		/* the FMA retry loop ends. */
		hermon_pio_end(state, hdl, pio_error, fm_loop_cnt, fm_status,
		    fm_test);

		/* Wait for Sector Erase to complete */
		status = hermon_flash_spi_wait_wip(state);
		break;

	case HERMON_FLASH_UNKNOWN_CMDSET:
	default:
		cmn_err(CE_WARN,
		    "hermon_flash_erase_sector: unknown cmd set: 0x%x\n",
		    state->hs_fw_cmdset);
		status = EINVAL;
		break;
	}

	/* Reset the flash device */
	if (status == 0) {
		status = hermon_flash_reset(state);
	}
	return (status);

pio_error:
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}

/*
 * hermon_flash_erase_chip()
 */
static int
hermon_flash_erase_chip(hermon_state_t *state)
{
	uint32_t stat;
	uint_t size;
	int status = 0;
	int i;
	int num_sect;

	switch (state->hs_fw_cmdset) {
	case HERMON_FLASH_AMD_CMDSET:
		/* Issue Flash Chip Erase Command */
		hermon_flash_write(state, 0, 0xAA, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, 0, 0x55, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, 0, 0x80, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, 0, 0xAA, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, 0, 0x55, &status);
		if (status != 0) {
			return (status);
		}

		hermon_flash_write(state, 0, 0x10, &status);
		if (status != 0) {
			return (status);
		}

		/* Wait for Chip Erase to Complete */
		i = 0;
		do {
			drv_usecwait(1);
			stat = hermon_flash_read(state, 0, &status);
			if (status != 0) {
				return (status);
			}

			if (i == hermon_hw_flash_timeout_erase) {
				cmn_err(CE_WARN,
				    "hermon_flash_erase_chip: erase timeout\n");
				hermon_fm_ereport(state, HCA_SYS_ERR,
				    HCA_ERR_IOCTL);
				return (EIO);
			}
			i++;
		} while (stat != 0xFFFFFFFF);
		break;

	case HERMON_FLASH_INTEL_CMDSET:
	case HERMON_FLASH_SPI_CMDSET:
		/*
		 * These chips don't have a chip erase command, so erase
		 * all blocks one at a time.
		 */
		size = (0x1 << state->hs_fw_log_sector_sz);
		num_sect = state->hs_fw_device_sz / size;

		for (i = 0; i < num_sect; i++) {
			status = hermon_flash_erase_sector(state, i);
			if (status != 0) {
				cmn_err(CE_WARN,
				    "hermon_flash_erase_chip: "
				    "sector %d erase error\n", i);
				return (status);
			}
		}
		break;

	case HERMON_FLASH_UNKNOWN_CMDSET:
	default:
		cmn_err(CE_WARN, "hermon_flash_erase_chip: "
		    "unknown cmd set: 0x%x\n", state->hs_fw_cmdset);
		status = EINVAL;
		break;
	}

	return (status);
}

/*
 * hermon_flash_spi_write_enable()
 */
static void
hermon_flash_spi_write_enable(hermon_state_t *state)
{
	ddi_acc_handle_t	hdl;

	hdl = hermon_get_pcihdl(state);

	hermon_flash_spi_exec_command(state, hdl,
	    HERMON_HW_FLASH_SPI_INSTR_PHASE_OFF |
	    (HERMON_HW_FLASH_SPI_WRITE_ENABLE <<
	    HERMON_HW_FLASH_SPI_INSTR_SHIFT));
}

/*
 * hermon_flash_spi_wait_wip()
 */
static int
hermon_flash_spi_wait_wip(hermon_state_t *state)
{
	ddi_acc_handle_t	hdl;
	uint32_t		status;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	hdl = hermon_get_pcihdl(state);

	/* the FMA retry loop starts. */
	hermon_pio_start(state, hdl, pio_error, fm_loop_cnt, fm_status,
	    fm_test);

	/* wait on the gateway to clear busy */
	do {
		status = hermon_flash_read_cfg(state, hdl,
		    HERMON_HW_FLASH_SPI_GW);
	} while (status & HERMON_HW_FLASH_SPI_BUSY);

	/* now, get the status and check for WIP to clear */
	do {
		hermon_flash_spi_exec_command(state, hdl,
		    HERMON_HW_FLASH_SPI_READ_OP |
		    HERMON_HW_FLASH_SPI_INSTR_PHASE_OFF |
		    HERMON_HW_FLASH_SPI_DATA_PHASE_OFF |
		    HERMON_HW_FLASH_SPI_TRANS_SZ_4B |
		    (HERMON_HW_FLASH_SPI_READ_STATUS_REG <<
		    HERMON_HW_FLASH_SPI_INSTR_SHIFT));

		status = hermon_flash_read_cfg(state, hdl,
		    HERMON_HW_FLASH_SPI_DATA);
	} while (status & HERMON_HW_FLASH_SPI_WIP);

	/* the FMA retry loop ends. */
	hermon_pio_end(state, hdl, pio_error, fm_loop_cnt, fm_status, fm_test);
	return (0);

pio_error:
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}

/*
 * hermon_flash_bank()
 */
static int
hermon_flash_bank(hermon_state_t *state, uint32_t addr)
{
	ddi_acc_handle_t	hdl;
	uint32_t		bank;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	/* Set handle */
	hdl = hermon_get_pcihdl(state);

	/* Determine the bank setting from the address */
	bank = addr & HERMON_HW_FLASH_BANK_MASK;

	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(state->hs_fw_flashbank))

	/*
	 * If the bank is different from the currently set bank, we need to
	 * change it.  Also, if an 'addr' of 0 is given, this allows the
	 * capability to force the flash bank to 0.  This is useful at init
	 * time to initially set the bank value
	 */
	if (state->hs_fw_flashbank != bank || addr == 0) {
		switch (state->hs_fw_cmdset) {
		case HERMON_FLASH_SPI_CMDSET:
			/* CMJ: not needed for hermon */
			break;

		case HERMON_FLASH_INTEL_CMDSET:
		case HERMON_FLASH_AMD_CMDSET:
			/* the FMA retry loop starts. */
			hermon_pio_start(state, hdl, pio_error, fm_loop_cnt,
			    fm_status, fm_test);

			hermon_flash_write_cfg(state, hdl,
			    HERMON_HW_FLASH_GPIO_DATACLEAR, 0x70);
			hermon_flash_write_cfg(state, hdl,
			    HERMON_HW_FLASH_GPIO_DATASET, (bank >> 15) & 0x70);

			/* the FMA retry loop ends. */
			hermon_pio_end(state, hdl, pio_error, fm_loop_cnt,
			    fm_status, fm_test);
			break;

		case HERMON_FLASH_UNKNOWN_CMDSET:
		default:
			return (EINVAL);
		}

		state->hs_fw_flashbank = bank;
	}
	return (0);

pio_error:
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}

/*
 * hermon_flash_spi_exec_command()
 */
static void
hermon_flash_spi_exec_command(hermon_state_t *state, ddi_acc_handle_t hdl,
    uint32_t cmd)
{
	uint32_t data;
	int timeout = 0;

	cmd |= HERMON_HW_FLASH_SPI_BUSY | HERMON_HW_FLASH_SPI_ENABLE_OFF;

	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_SPI_GW, cmd);

	do {
		data = hermon_flash_read_cfg(state, hdl,
		    HERMON_HW_FLASH_SPI_GW);
		timeout++;
	} while ((data & HERMON_HW_FLASH_SPI_BUSY) &&
	    (timeout < hermon_hw_flash_timeout_config));
}

/*
 * hermon_flash_read()
 */
static uint32_t
hermon_flash_read(hermon_state_t *state, uint32_t addr, int *err)
{
	ddi_acc_handle_t	hdl;
	uint32_t		data = 0;
	int			timeout, status = 0;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	hdl = hermon_get_pcihdl(state);

	/* the FMA retry loop starts. */
	hermon_pio_start(state, hdl, pio_error, fm_loop_cnt, fm_status,
	    fm_test);

	switch (state->hs_fw_cmdset) {
	case HERMON_FLASH_SPI_CMDSET:
		/* Set the transaction address */
		hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_SPI_ADDR,
		    (addr & HERMON_HW_FLASH_SPI_ADDR_MASK));

		hermon_flash_spi_exec_command(state, hdl,
		    HERMON_HW_FLASH_SPI_READ_OP |
		    HERMON_HW_FLASH_SPI_INSTR_PHASE_OFF |
		    HERMON_HW_FLASH_SPI_ADDR_PHASE_OFF |
		    HERMON_HW_FLASH_SPI_DATA_PHASE_OFF |
		    HERMON_HW_FLASH_SPI_TRANS_SZ_4B |
		    (HERMON_HW_FLASH_SPI_READ <<
		    HERMON_HW_FLASH_SPI_INSTR_SHIFT));

		data = hermon_flash_read_cfg(state, hdl,
		    HERMON_HW_FLASH_SPI_DATA);
		break;

	case HERMON_FLASH_INTEL_CMDSET:
	case HERMON_FLASH_AMD_CMDSET:
		/*
		 * The Read operation does the following:
		 *   1) Write the masked address to the HERMON_FLASH_ADDR
		 *	register. Only the least significant 19 bits are valid.
		 *   2) Read back the register until the command has completed.
		 *   3) Read the data retrieved from the address at the
		 *	HERMON_FLASH_DATA register.
		 */
		hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_ADDR,
		    (addr & HERMON_HW_FLASH_ADDR_MASK) | (1 << 29));

		timeout = 0;
		do {
			data = hermon_flash_read_cfg(state, hdl,
			    HERMON_HW_FLASH_ADDR);
			timeout++;
		} while ((data & HERMON_HW_FLASH_CMD_MASK) &&
		    (timeout < hermon_hw_flash_timeout_config));

		if (timeout == hermon_hw_flash_timeout_config) {
			cmn_err(CE_WARN, "hermon_flash_read: command timed "
			    "out.\n");
			*err = EIO;
			hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
			return (data);
		}

		data = hermon_flash_read_cfg(state, hdl, HERMON_HW_FLASH_DATA);
		break;

	case HERMON_FLASH_UNKNOWN_CMDSET:
	default:
		cmn_err(CE_CONT, "hermon_flash_read: unknown cmdset: 0x%x\n",
		    state->hs_fw_cmdset);
		status = EINVAL;
		break;
	}


	/* the FMA retry loop ends. */
	hermon_pio_end(state, hdl, pio_error, fm_loop_cnt, fm_status, fm_test);
	*err = status;
	return (data);

pio_error:
	*err = EIO;
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (data);
}

/*
 * hermon_flash_write()
 */
static void
hermon_flash_write(hermon_state_t *state, uint32_t addr, uchar_t data, int *err)
{
	ddi_acc_handle_t	hdl;
	int			cmd;
	int			timeout;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	hdl = hermon_get_pcihdl(state);

	/* the FMA retry loop starts. */
	hermon_pio_start(state, hdl, pio_error, fm_loop_cnt, fm_status,
	    fm_test);

	/*
	 * The Write operation does the following:
	 *   1) Write the data to be written to the HERMON_FLASH_DATA offset.
	 *   2) Write the address to write the data to to the HERMON_FLASH_ADDR
	 *	offset.
	 *   3) Wait until the write completes.
	 */

	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_DATA, data << 24);
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_ADDR,
	    (addr & 0x7FFFF) | (2 << 29));

	timeout = 0;
	do {
		cmd = hermon_flash_read_cfg(state, hdl, HERMON_HW_FLASH_ADDR);
		timeout++;
	} while ((cmd & HERMON_HW_FLASH_CMD_MASK) &&
	    (timeout < hermon_hw_flash_timeout_config));

	if (timeout == hermon_hw_flash_timeout_config) {
		cmn_err(CE_WARN, "hermon_flash_write: config cmd timeout.\n");
		*err = EIO;
		hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
		return;
	}

	/* the FMA retry loop ends. */
	hermon_pio_end(state, hdl, pio_error, fm_loop_cnt, fm_status, fm_test);
	*err = 0;
	return;

pio_error:
	*err = EIO;
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
}

/*
 * hermon_flash_init()
 */
static int
hermon_flash_init(hermon_state_t *state)
{
	uint32_t		word;
	ddi_acc_handle_t	hdl;
	int			sema_cnt;
	int			gpio;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	/* Set handle */
	hdl = hermon_get_pcihdl(state);

	/* the FMA retry loop starts. */
	hermon_pio_start(state, hdl, pio_error, fm_loop_cnt, fm_status,
	    fm_test);

	/* Init the flash */

#ifdef DO_WRCONF
	/*
	 * Grab the WRCONF semaphore.
	 */
	word = hermon_flash_read_cfg(state, hdl, HERMON_HW_FLASH_WRCONF_SEMA);
#endif

	/*
	 * Grab the GPIO semaphore.  This allows us exclusive access to the
	 * GPIO settings on the Hermon for the duration of the flash burning
	 * procedure.
	 */
	sema_cnt = 0;
	do {
		word = hermon_flash_read_cfg(state, hdl,
		    HERMON_HW_FLASH_GPIO_SEMA);
		if (word == 0) {
			break;
		}

		sema_cnt++;
		drv_usecwait(1);

	} while (sema_cnt < hermon_hw_flash_timeout_gpio_sema);

	/*
	 * Determine if we timed out trying to grab the GPIO semaphore
	 */
	if (sema_cnt == hermon_hw_flash_timeout_gpio_sema) {
		cmn_err(CE_WARN, "hermon_flash_init: GPIO SEMA timeout\n");
		cmn_err(CE_WARN, "GPIO_SEMA value: 0x%x\n", word);
		hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
		return (EIO);
	}

	/* Save away original GPIO Values */
	state->hs_fw_gpio[0] = hermon_flash_read_cfg(state, hdl,
	    HERMON_HW_FLASH_GPIO_DATA);

	/* Set new GPIO value */
	gpio = state->hs_fw_gpio[0] | HERMON_HW_FLASH_GPIO_PIN_ENABLE;
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_DATA, gpio);

	/* Save away original GPIO Values */
	state->hs_fw_gpio[1] = hermon_flash_read_cfg(state, hdl,
	    HERMON_HW_FLASH_GPIO_MOD0);
	state->hs_fw_gpio[2] = hermon_flash_read_cfg(state, hdl,
	    HERMON_HW_FLASH_GPIO_MOD1);

	/* unlock GPIO */
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_LOCK,
	    HERMON_HW_FLASH_GPIO_UNLOCK_VAL);

	/*
	 * Set new GPIO values
	 */
	gpio = state->hs_fw_gpio[1] | HERMON_HW_FLASH_GPIO_PIN_ENABLE;
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_MOD0, gpio);

	gpio = state->hs_fw_gpio[2] & ~HERMON_HW_FLASH_GPIO_PIN_ENABLE;
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_MOD1, gpio);

	/* re-lock GPIO */
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_LOCK, 0);

	/* Set CPUMODE to enable hermon to access the flash device */
	/* CMJ This code came from arbel.  Hermon doesn't seem to need it. */
	/*
	 *	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_CPUMODE,
	 *	    1 << HERMON_HW_FLASH_CPU_SHIFT);
	 */

	/* the FMA retry loop ends. */
	hermon_pio_end(state, hdl, pio_error, fm_loop_cnt, fm_status, fm_test);
	return (0);

pio_error:
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}

/*
 * hermon_flash_cfi_init
 *   Implements access to the CFI (Common Flash Interface) data
 */
static int
hermon_flash_cfi_init(hermon_state_t *state, uint32_t *cfi_info,
    int *intel_xcmd)
{
	uint32_t	data;
	uint32_t	sector_sz_bytes;
	uint32_t	bit_count;
	uint8_t		cfi_ch_info[HERMON_CFI_INFO_SIZE];
	int		i;
	int		status;

	/* Right now, all hermon cards use SPI. */
	if (hermon_device_mode(state)) {
		/*
		 * Don't use CFI for SPI part. Just fill in what we need
		 * and return.
		 */
		state->hs_fw_cmdset = HERMON_FLASH_SPI_CMDSET;
		state->hs_fw_log_sector_sz = HERMON_FLASH_SPI_LOG_SECTOR_SIZE;
		state->hs_fw_device_sz = HERMON_FLASH_SPI_DEVICE_SIZE;

		/*
		 * set this to inform caller of cmdset type.
		 */
		cfi_ch_info[0x13] = HERMON_FLASH_SPI_CMDSET;
		hermon_flash_cfi_dword(&cfi_info[4], cfi_ch_info, 0x10);
		return (0);
	}

	/*
	 * Determine if the user command supports the Intel Extended
	 * Command Set. The query string is contained in the fourth
	 * quad word.
	 */
	hermon_flash_cfi_byte(cfi_ch_info, cfi_info[0x04], 0x10);
	if (cfi_ch_info[0x10] == 'M' &&
	    cfi_ch_info[0x11] == 'X' &&
	    cfi_ch_info[0x12] == '2') {
		*intel_xcmd = 1; /* support is there */
		if (hermon_verbose) {
			IBTF_DPRINTF_L2("hermon",
			    "Support for Intel X is present\n");
		}
	}

	/* CFI QUERY */
	hermon_flash_write(state, 0x55, HERMON_FLASH_CFI_INIT, &status);
	if (status != 0) {
		return (status);
	}

	/* temporarily set the cmdset in order to do the initial read */
	state->hs_fw_cmdset = HERMON_FLASH_INTEL_CMDSET;

	/* Read in CFI data */
	for (i = 0; i < HERMON_CFI_INFO_SIZE; i += 4) {
		data = hermon_flash_read(state, i, &status);
		if (status != 0) {
			return (status);
		}
		hermon_flash_cfi_byte(cfi_ch_info, data, i);
	}

	/* Determine chip set */
	state->hs_fw_cmdset = HERMON_FLASH_UNKNOWN_CMDSET;
	if (cfi_ch_info[0x20] == 'Q' &&
	    cfi_ch_info[0x22] == 'R' &&
	    cfi_ch_info[0x24] == 'Y') {
		/*
		 * Mode: x16 working in x8 mode (Intel).
		 * Pack data - skip spacing bytes.
		 */
		if (hermon_verbose) {
			IBTF_DPRINTF_L2("hermon",
			    "x16 working in x8 mode (Intel)\n");
		}
		for (i = 0; i < HERMON_CFI_INFO_SIZE; i += 2) {
			cfi_ch_info[i/2] = cfi_ch_info[i];
		}
	}
	state->hs_fw_cmdset = cfi_ch_info[0x13];

	if (state->hs_fw_cmdset != HERMON_FLASH_INTEL_CMDSET &&
	    state->hs_fw_cmdset != HERMON_FLASH_AMD_CMDSET) {
		cmn_err(CE_WARN,
		    "hermon_flash_cfi_init: UNKNOWN chip cmd set 0x%04x\n",
		    state->hs_fw_cmdset);
		state->hs_fw_cmdset = HERMON_FLASH_UNKNOWN_CMDSET;
		return (0);
	}

	/* Determine total bytes in one sector size */
	sector_sz_bytes = ((cfi_ch_info[0x30] << 8) | cfi_ch_info[0x2F]) << 8;

	/* Calculate equivalent of log2 (n) */
	for (bit_count = 0; sector_sz_bytes > 1; bit_count++) {
		sector_sz_bytes >>= 1;
	}

	/* Set sector size */
	state->hs_fw_log_sector_sz = bit_count;

	/* Set flash size */
	state->hs_fw_device_sz = 0x1 << cfi_ch_info[0x27];

	/* Reset to turn off CFI mode */
	if ((status = hermon_flash_reset(state)) != 0)
		goto out;

	/* Pass CFI data back to user command. */
	for (i = 0; i < HERMON_FLASH_CFI_SIZE_QUADLET; i++) {
		hermon_flash_cfi_dword(&cfi_info[i], cfi_ch_info, i << 2);
	}

	if (*intel_xcmd == 1) {
		/*
		 * Inform the user cmd that this driver does support the
		 * Intel Extended Command Set.
		 */
		cfi_ch_info[0x10] = 'M';
		cfi_ch_info[0x11] = 'X';
		cfi_ch_info[0x12] = '2';
	} else {
		cfi_ch_info[0x10] = 'Q';
		cfi_ch_info[0x11] = 'R';
		cfi_ch_info[0x12] = 'Y';
	}
	cfi_ch_info[0x13] = state->hs_fw_cmdset;
	hermon_flash_cfi_dword(&cfi_info[0x4], cfi_ch_info, 0x10);
out:
	return (status);
}

/*
 * hermon_flash_fini()
 */
static int
hermon_flash_fini(hermon_state_t *state)
{
	int status;
	ddi_acc_handle_t hdl;

	/* initialize the FMA retry loop */
	hermon_pio_init(fm_loop_cnt, fm_status, fm_test);

	/* Set handle */
	hdl = hermon_get_pcihdl(state);

	if ((status = hermon_flash_bank(state, 0)) != 0)
		return (status);

	/* the FMA retry loop starts. */
	hermon_pio_start(state, hdl, pio_error, fm_loop_cnt, fm_status,
	    fm_test);

	/*
	 * Restore original GPIO Values
	 */
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_DATA,
	    state->hs_fw_gpio[0]);

	/* unlock GPIOs */
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_LOCK,
	    HERMON_HW_FLASH_GPIO_UNLOCK_VAL);

	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_MOD0,
	    state->hs_fw_gpio[1]);
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_MOD1,
	    state->hs_fw_gpio[2]);

	/* re-lock GPIOs */
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_LOCK, 0);

	/* Give up gpio semaphore */
	hermon_flash_write_cfg(state, hdl, HERMON_HW_FLASH_GPIO_SEMA, 0);

	/* the FMA retry loop ends. */
	hermon_pio_end(state, hdl, pio_error, fm_loop_cnt, fm_status, fm_test);
	return (0);

pio_error:
	hermon_fm_ereport(state, HCA_SYS_ERR, HCA_ERR_IOCTL);
	return (EIO);
}

/*
 * hermon_flash_read_cfg
 */
static uint32_t
hermon_flash_read_cfg(hermon_state_t *state, ddi_acc_handle_t pci_config_hdl,
    uint32_t addr)
{
	uint32_t	read;

	if (do_bar0) {
		read = ddi_get32(hermon_get_cmdhdl(state), (uint32_t *)(void *)
		    (state->hs_reg_cmd_baseaddr + addr));
	} else {
		/*
		 * Perform flash read operation:
		 *   1) Place addr to read from on the HERMON_HW_FLASH_CFG_ADDR
		 *	register
		 *   2) Read data at that addr from the HERMON_HW_FLASH_CFG_DATA
		 *	 register
		 */
		pci_config_put32(pci_config_hdl, HERMON_HW_FLASH_CFG_ADDR,
		    addr);
		read = pci_config_get32(pci_config_hdl,
		    HERMON_HW_FLASH_CFG_DATA);
	}

	return (read);
}

#ifdef DO_WRCONF
static void
hermon_flash_write_cfg(hermon_state_t *state,
    ddi_acc_handle_t pci_config_hdl, uint32_t addr, uint32_t data)
{
	hermon_flash_write_cfg_helper(state, pci_config_hdl, addr, data);
	hermon_flash_write_confirm(state, pci_config_hdl);
}

static void
hermon_flash_write_confirm(hermon_state_t *state,
    ddi_acc_handle_t pci_config_hdl)
{
	uint32_t	sem_value = 1;

	hermon_flash_write_cfg_helper(state, pci_config_hdl,
	    HERMON_HW_FLASH_WRCONF_SEMA, 0);
	while (sem_value) {
		sem_value = hermon_flash_read_cfg(state, pci_config_hdl,
		    HERMON_HW_FLASH_WRCONF_SEMA);
	}
}
#endif

/*
 * hermon_flash_write_cfg
 */
static void
#ifdef DO_WRCONF
hermon_flash_write_cfg_helper(hermon_state_t *state,
    ddi_acc_handle_t pci_config_hdl, uint32_t addr, uint32_t data)
#else
hermon_flash_write_cfg(hermon_state_t *state,
    ddi_acc_handle_t pci_config_hdl, uint32_t addr, uint32_t data)
#endif
{
	if (do_bar0) {
		ddi_put32(hermon_get_cmdhdl(state), (uint32_t *)(void *)
		    (state->hs_reg_cmd_baseaddr + addr), data);

	} else {

		/*
		 * Perform flash write operation:
		 *   1) Place addr to write to on the HERMON_HW_FLASH_CFG_ADDR
		 *	register
		 *   2) Place data to write on to the HERMON_HW_FLASH_CFG_DATA
		 *	register
		 */
		pci_config_put32(pci_config_hdl, HERMON_HW_FLASH_CFG_ADDR,
		    addr);
		pci_config_put32(pci_config_hdl, HERMON_HW_FLASH_CFG_DATA,
		    data);
	}
}

/*
 * Support routines to convert Common Flash Interface (CFI) data
 * from a 32  bit word to a char array, and from a char array to
 * a 32 bit word.
 */
static void
hermon_flash_cfi_byte(uint8_t *ch, uint32_t dword, int i)
{
	ch[i] = (uint8_t)((dword & 0xFF000000) >> 24);
	ch[i+1] = (uint8_t)((dword & 0x00FF0000) >> 16);
	ch[i+2] = (uint8_t)((dword & 0x0000FF00) >> 8);
	ch[i+3] = (uint8_t)((dword & 0x000000FF));
}

static void
hermon_flash_cfi_dword(uint32_t *dword, uint8_t *ch, int i)
{
	*dword = (uint32_t)
	    ((uint32_t)ch[i] << 24 |
	    (uint32_t)ch[i+1] << 16 |
	    (uint32_t)ch[i+2] << 8 |
	    (uint32_t)ch[i+3]);
}

/*
 * hermon_loopback_free_qps
 */
static void
hermon_loopback_free_qps(hermon_loopback_state_t *lstate)
{
	int i;

	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*lstate))

	if (lstate->hls_tx.hlc_qp_hdl != NULL) {
		(void) hermon_qp_free(lstate->hls_state,
		    &lstate->hls_tx.hlc_qp_hdl, IBC_FREE_QP_AND_QPN, NULL,
		    HERMON_NOSLEEP);
	}
	if (lstate->hls_rx.hlc_qp_hdl != NULL) {
		(void) hermon_qp_free(lstate->hls_state,
		    &lstate->hls_rx.hlc_qp_hdl, IBC_FREE_QP_AND_QPN, NULL,
		    HERMON_NOSLEEP);
	}
	lstate->hls_tx.hlc_qp_hdl = NULL;
	lstate->hls_rx.hlc_qp_hdl = NULL;
	for (i = 0; i < 2; i++) {
		if (lstate->hls_tx.hlc_cqhdl[i] != NULL) {
			(void) hermon_cq_free(lstate->hls_state,
			    &lstate->hls_tx.hlc_cqhdl[i], HERMON_NOSLEEP);
		}
		if (lstate->hls_rx.hlc_cqhdl[i] != NULL) {
			(void) hermon_cq_free(lstate->hls_state,
			    &lstate->hls_rx.hlc_cqhdl[i], HERMON_NOSLEEP);
		}
		lstate->hls_tx.hlc_cqhdl[i] = NULL;
		lstate->hls_rx.hlc_cqhdl[i] = NULL;
	}
}

/*
 * hermon_loopback_free_state
 */
static void
hermon_loopback_free_state(hermon_loopback_state_t *lstate)
{
	hermon_loopback_free_qps(lstate);
	if (lstate->hls_tx.hlc_mrhdl != NULL) {
		(void) hermon_mr_deregister(lstate->hls_state,
		    &lstate->hls_tx.hlc_mrhdl, HERMON_MR_DEREG_ALL,
		    HERMON_NOSLEEP);
	}
	if (lstate->hls_rx.hlc_mrhdl !=  NULL) {
		(void) hermon_mr_deregister(lstate->hls_state,
		    &lstate->hls_rx.hlc_mrhdl, HERMON_MR_DEREG_ALL,
		    HERMON_NOSLEEP);
	}
	if (lstate->hls_pd_hdl != NULL) {
		(void) hermon_pd_free(lstate->hls_state, &lstate->hls_pd_hdl);
	}
	if (lstate->hls_tx.hlc_buf != NULL) {
		kmem_free(lstate->hls_tx.hlc_buf, lstate->hls_tx.hlc_buf_sz);
	}
	if (lstate->hls_rx.hlc_buf != NULL) {
		kmem_free(lstate->hls_rx.hlc_buf, lstate->hls_rx.hlc_buf_sz);
	}
	bzero(lstate, sizeof (hermon_loopback_state_t));
}

/*
 * hermon_loopback_init
 */
static int
hermon_loopback_init(hermon_state_t *state, hermon_loopback_state_t *lstate)
{
	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*lstate))

	lstate->hls_hca_hdl = (ibc_hca_hdl_t)state;
	lstate->hls_status  = hermon_pd_alloc(lstate->hls_state,
	    &lstate->hls_pd_hdl, HERMON_NOSLEEP);
	if (lstate->hls_status != IBT_SUCCESS) {
		lstate->hls_err = HERMON_LOOPBACK_PROT_DOMAIN_ALLOC_FAIL;
		return (EFAULT);
	}

	return (0);
}

/*
 * hermon_loopback_init_qp_info
 */
static void
hermon_loopback_init_qp_info(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm)
{
	bzero(&comm->hlc_cq_attr, sizeof (ibt_cq_attr_t));
	bzero(&comm->hlc_qp_attr, sizeof (ibt_qp_alloc_attr_t));
	bzero(&comm->hlc_qp_info, sizeof (ibt_qp_info_t));

	comm->hlc_wrid = 1;
	comm->hlc_cq_attr.cq_size = 128;
	comm->hlc_qp_attr.qp_sizes.cs_sq_sgl = 3;
	comm->hlc_qp_attr.qp_sizes.cs_rq_sgl = 3;
	comm->hlc_qp_attr.qp_sizes.cs_sq = 16;
	comm->hlc_qp_attr.qp_sizes.cs_rq = 16;
	comm->hlc_qp_attr.qp_flags = IBT_WR_SIGNALED;

	comm->hlc_qp_info.qp_state = IBT_STATE_RESET;
	comm->hlc_qp_info.qp_trans = IBT_RC_SRV;
	comm->hlc_qp_info.qp_flags = IBT_CEP_RDMA_RD | IBT_CEP_RDMA_WR;
	comm->hlc_qp_info.qp_transport.rc.rc_path.cep_hca_port_num =
	    lstate->hls_port;
	comm->hlc_qp_info.qp_transport.rc.rc_path.cep_pkey_ix =
	    lstate->hls_pkey_ix;
	comm->hlc_qp_info.qp_transport.rc.rc_path.cep_timeout =
	    lstate->hls_timeout;
	comm->hlc_qp_info.qp_transport.rc.rc_path.cep_adds_vect.av_srvl = 0;
	comm->hlc_qp_info.qp_transport.rc.rc_path.cep_adds_vect.av_srate =
	    IBT_SRATE_4X;
	comm->hlc_qp_info.qp_transport.rc.rc_path.cep_adds_vect.av_send_grh = 0;
	comm->hlc_qp_info.qp_transport.rc.rc_path.cep_adds_vect.av_dlid =
	    lstate->hls_lid;
	comm->hlc_qp_info.qp_transport.rc.rc_retry_cnt = lstate->hls_retry;
	comm->hlc_qp_info.qp_transport.rc.rc_sq_psn = 0;
	comm->hlc_qp_info.qp_transport.rc.rc_rq_psn = 0;
	comm->hlc_qp_info.qp_transport.rc.rc_rdma_ra_in	 = 4;
	comm->hlc_qp_info.qp_transport.rc.rc_rdma_ra_out = 4;
	comm->hlc_qp_info.qp_transport.rc.rc_dst_qpn = 0;
	comm->hlc_qp_info.qp_transport.rc.rc_min_rnr_nak = IBT_RNR_NAK_655ms;
	comm->hlc_qp_info.qp_transport.rc.rc_path_mtu = IB_MTU_1K;
}

/*
 * hermon_loopback_alloc_mem
 */
static int
hermon_loopback_alloc_mem(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm, int sz)
{
	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*comm))

	/* Allocate buffer of specified size */
	comm->hlc_buf_sz = sz;
	comm->hlc_buf	 = kmem_zalloc(sz, KM_NOSLEEP);
	if (comm->hlc_buf == NULL) {
		return (EFAULT);
	}

	/* Register the buffer as a memory region */
	comm->hlc_memattr.mr_vaddr = (uint64_t)(uintptr_t)comm->hlc_buf;
	comm->hlc_memattr.mr_len   = (ib_msglen_t)sz;
	comm->hlc_memattr.mr_as	   = NULL;
	comm->hlc_memattr.mr_flags = IBT_MR_NOSLEEP |
	    IBT_MR_ENABLE_REMOTE_WRITE | IBT_MR_ENABLE_LOCAL_WRITE;

	comm->hlc_status = hermon_mr_register(lstate->hls_state,
	    lstate->hls_pd_hdl, &comm->hlc_memattr, &comm->hlc_mrhdl,
	    NULL, HERMON_MPT_DMPT);

	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*comm->hlc_mrhdl))

	comm->hlc_mrdesc.md_vaddr  = comm->hlc_mrhdl->mr_bindinfo.bi_addr;
	comm->hlc_mrdesc.md_lkey   = comm->hlc_mrhdl->mr_lkey;
	comm->hlc_mrdesc.md_rkey   = comm->hlc_mrhdl->mr_rkey;
	if (comm->hlc_status != IBT_SUCCESS) {
		return (EFAULT);
	}
	return (0);
}

/*
 * hermon_loopback_alloc_qps
 */
static int
hermon_loopback_alloc_qps(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm)
{
	uint32_t		i, real_size;
	hermon_qp_info_t		qpinfo;

	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*comm))
	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*lstate))

	/* Allocate send and recv CQs */
	for (i = 0; i < 2; i++) {
		bzero(&comm->hlc_cq_attr, sizeof (ibt_cq_attr_t));
		comm->hlc_cq_attr.cq_size = 128;
		comm->hlc_status = hermon_cq_alloc(lstate->hls_state,
		    (ibt_cq_hdl_t)NULL, &comm->hlc_cq_attr, &real_size,
		    &comm->hlc_cqhdl[i], HERMON_NOSLEEP);
		if (comm->hlc_status != IBT_SUCCESS) {
			lstate->hls_err += i;
			return (EFAULT);
		}
	}

	/* Allocate the QP */
	hermon_loopback_init_qp_info(lstate, comm);
	comm->hlc_qp_attr.qp_pd_hdl	 = (ibt_pd_hdl_t)lstate->hls_pd_hdl;
	comm->hlc_qp_attr.qp_scq_hdl	 = (ibt_cq_hdl_t)comm->hlc_cqhdl[0];
	comm->hlc_qp_attr.qp_rcq_hdl	 = (ibt_cq_hdl_t)comm->hlc_cqhdl[1];
	comm->hlc_qp_attr.qp_ibc_scq_hdl = (ibt_opaque1_t)comm->hlc_cqhdl[0];
	comm->hlc_qp_attr.qp_ibc_rcq_hdl = (ibt_opaque1_t)comm->hlc_cqhdl[1];
	qpinfo.qpi_attrp	= &comm->hlc_qp_attr;
	qpinfo.qpi_type		= IBT_RC_RQP;
	qpinfo.qpi_ibt_qphdl	= NULL;
	qpinfo.qpi_queueszp	= &comm->hlc_chan_sizes;
	qpinfo.qpi_qpn		= &comm->hlc_qp_num;
	comm->hlc_status = hermon_qp_alloc(lstate->hls_state, &qpinfo,
	    HERMON_NOSLEEP);
	if (comm->hlc_status == DDI_SUCCESS) {
		comm->hlc_qp_hdl = qpinfo.qpi_qphdl;
	}

	if (comm->hlc_status != IBT_SUCCESS) {
		lstate->hls_err += 2;
		return (EFAULT);
	}
	return (0);
}

/*
 * hermon_loopback_modify_qp
 */
static int
hermon_loopback_modify_qp(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm, uint_t qp_num)
{
	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*comm))
	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*lstate))

	/* Modify QP to INIT */
	hermon_loopback_init_qp_info(lstate, comm);
	comm->hlc_qp_info.qp_state = IBT_STATE_INIT;
	comm->hlc_status = hermon_qp_modify(lstate->hls_state, comm->hlc_qp_hdl,
	    IBT_CEP_SET_STATE, &comm->hlc_qp_info, &comm->hlc_queue_sizes);
	if (comm->hlc_status != IBT_SUCCESS) {
		return (EFAULT);
	}

	/*
	 * Modify QP to RTR (set destination LID and QP number to local
	 * LID and QP number)
	 */
	comm->hlc_qp_info.qp_state = IBT_STATE_RTR;
	comm->hlc_qp_info.qp_transport.rc.rc_path.cep_adds_vect.av_dlid
	    = lstate->hls_lid;
	comm->hlc_qp_info.qp_transport.rc.rc_dst_qpn = qp_num;
	comm->hlc_status = hermon_qp_modify(lstate->hls_state, comm->hlc_qp_hdl,
	    IBT_CEP_SET_STATE, &comm->hlc_qp_info, &comm->hlc_queue_sizes);
	if (comm->hlc_status != IBT_SUCCESS) {
		lstate->hls_err += 1;
		return (EFAULT);
	}

	/* Modify QP to RTS */
	comm->hlc_qp_info.qp_current_state = IBT_STATE_RTR;
	comm->hlc_qp_info.qp_state = IBT_STATE_RTS;
	comm->hlc_status = hermon_qp_modify(lstate->hls_state, comm->hlc_qp_hdl,
	    IBT_CEP_SET_STATE, &comm->hlc_qp_info, &comm->hlc_queue_sizes);
	if (comm->hlc_status != IBT_SUCCESS) {
		lstate->hls_err += 2;
		return (EFAULT);
	}
	return (0);
}

/*
 * hermon_loopback_copyout
 */
static int
hermon_loopback_copyout(hermon_loopback_ioctl_t *lb, intptr_t arg, int mode)
{
#ifdef _MULTI_DATAMODEL
	if (ddi_model_convert_from(mode & FMODELS) == DDI_MODEL_ILP32) {
		hermon_loopback_ioctl32_t lb32;

		lb32.alb_revision	= lb->alb_revision;
		lb32.alb_send_buf	=
		    (caddr32_t)(uintptr_t)lb->alb_send_buf;
		lb32.alb_fail_buf	=
		    (caddr32_t)(uintptr_t)lb->alb_fail_buf;
		lb32.alb_buf_sz		= lb->alb_buf_sz;
		lb32.alb_num_iter	= lb->alb_num_iter;
		lb32.alb_pass_done	= lb->alb_pass_done;
		lb32.alb_timeout	= lb->alb_timeout;
		lb32.alb_error_type	= lb->alb_error_type;
		lb32.alb_port_num	= lb->alb_port_num;
		lb32.alb_num_retry	= lb->alb_num_retry;

		if (ddi_copyout(&lb32, (void *)arg,
		    sizeof (hermon_loopback_ioctl32_t), mode) != 0) {
			return (EFAULT);
		}
	} else
#endif /* _MULTI_DATAMODEL */
	if (ddi_copyout(lb, (void *)arg, sizeof (hermon_loopback_ioctl_t),
	    mode) != 0) {
		return (EFAULT);
	}
	return (0);
}

/*
 * hermon_loopback_post_send
 */
static int
hermon_loopback_post_send(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *tx, hermon_loopback_comm_t *rx)
{
	int	 ret;

	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*tx))

	bzero(&tx->hlc_sgl, sizeof (ibt_wr_ds_t));
	bzero(&tx->hlc_wr, sizeof (ibt_send_wr_t));

	/* Initialize local address for TX buffer */
	tx->hlc_sgl.ds_va   = tx->hlc_mrdesc.md_vaddr;
	tx->hlc_sgl.ds_key  = tx->hlc_mrdesc.md_lkey;
	tx->hlc_sgl.ds_len  = tx->hlc_buf_sz;

	/* Initialize the remaining details of the work request */
	tx->hlc_wr.wr_id = tx->hlc_wrid++;
	tx->hlc_wr.wr_flags  = IBT_WR_SEND_SIGNAL;
	tx->hlc_wr.wr_nds    = 1;
	tx->hlc_wr.wr_sgl    = &tx->hlc_sgl;
	tx->hlc_wr.wr_opcode = IBT_WRC_RDMAW;
	tx->hlc_wr.wr_trans  = IBT_RC_SRV;

	/* Initialize the remote address for RX buffer */
	tx->hlc_wr.wr.rc.rcwr.rdma.rdma_raddr = rx->hlc_mrdesc.md_vaddr;
	tx->hlc_wr.wr.rc.rcwr.rdma.rdma_rkey  = rx->hlc_mrdesc.md_rkey;
	tx->hlc_complete = 0;
	ret = hermon_post_send(lstate->hls_state, tx->hlc_qp_hdl, &tx->hlc_wr,
	    1, NULL);
	if (ret != IBT_SUCCESS) {
		return (EFAULT);
	}
	return (0);
}

/*
 * hermon_loopback_poll_cq
 */
static int
hermon_loopback_poll_cq(hermon_loopback_state_t *lstate,
    hermon_loopback_comm_t *comm)
{
	_NOTE(NOW_INVISIBLE_TO_OTHER_THREADS(*comm))

	comm->hlc_wc.wc_status	= 0;
	comm->hlc_num_polled	= 0;
	comm->hlc_status = hermon_cq_poll(lstate->hls_state,
	    comm->hlc_cqhdl[0], &comm->hlc_wc, 1, &comm->hlc_num_polled);
	if ((comm->hlc_status == IBT_SUCCESS) &&
	    (comm->hlc_wc.wc_status != IBT_WC_SUCCESS)) {
		comm->hlc_status = ibc_get_ci_failure(0);
	}
	return (comm->hlc_status);
}