11174 new driver for Smart Array storage controllers

Portions contributed by: Robert Mustacchi <rm@joyent.com>
Reviewed by: Robert Mustacchi <rm@joyent.com>
Reviewed by: Patrick Mooney <patrick.mooney@joyent.com>
Reviewed by: Marcel Telka <marcel@telka.sk>
Reviewed by: Garrett D'Amore <garrett@damore.org>
Approved by: Dan McDonald <danmcd@joyent.com>

20 files changed, 7992 insertions, 1 deletions

diff --git a/usr/src/pkg/manifests/driver-storage-smrt.p5m b/usr/src/pkg/manifests/driver-storage-smrt.p5m
new file mode 100644
index 0000000000..8ef3e50718
--- /dev/null
+++ b/usr/src/pkg/manifests/driver-storage-smrt.p5m
@@ -0,0 +1,74 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2019 Joyent, Inc.
+#
+
+<include global_zone_only_component>
+set name=pkg.fmri value=pkg:/driver/storage/smrt@$(PKGVERS)
+set name=pkg.summary value="HP SmartArray SAS HBA Driver"
+set name=pkg.description value="HP SmartArray SAS HBA Driver"
+set name=info.classification value=org.opensolaris.category.2008:Drivers/Storage
+set name=variant.arch value=i386
+dir  path=kernel group=sys
+dir  path=kernel/drv group=sys
+dir  path=kernel/drv/$(ARCH64) group=sys
+file path=kernel/drv/$(ARCH64)/smrt group=sys
+file path=kernel/drv/smrt.conf group=sys
+driver name=smrt class=scsi-self-identifying
+#
+# The smrt driver overlaps with cpqary3 and supports several of the same
+# devices. To ensure that folks can still boot existing systems we have
+# left all the devices supported by smrt commented out as they all
+# overlay with cpqary3. In this form, users may swap over and the driver
+# also provides a useful reference for SCSAv3. When adding these
+# aliases, please make sure to remember to add the appropriate '\' to
+# the driver line above and below as needed.
+#
+#   alias=pci103c,1920
+#   alias=pci103c,1921
+#   alias=pci103c,1922
+#   alias=pci103c,1923
+#   alias=pci103c,1924
+#   alias=pci103c,1926
+#   alias=pci103c,1928
+#   alias=pci103c,21bd
+#   alias=pci103c,21be
+#   alias=pci103c,21bf
+#   alias=pci103c,21c0
+#   alias=pci103c,21c1
+#   alias=pci103c,21c2
+#   alias=pci103c,21c3
+#   alias=pci103c,21c5
+#   alias=pci103c,21c6
+#   alias=pci103c,21c7
+#   alias=pci103c,21c8
+#   alias=pci103c,21ca
+#   alias=pci103c,21cb
+#   alias=pci103c,21cc
+#   alias=pci103c,21cd
+#   alias=pci103c,21ce
+#   alias=pci103c,3241
+#   alias=pci103c,3243
+#   alias=pci103c,3245
+#   alias=pci103c,3247
+#   alias=pci103c,3249
+#   alias=pci103c,324a
+#   alias=pci103c,324b
+#   alias=pci103c,3350
+#   alias=pci103c,3351
+#   alias=pci103c,3352
+#   alias=pci103c,3353
+#   alias=pci103c,3354
+#   alias=pci103c,3355
+#   alias=pci103c,3356
+license lic_CDDL license=lic_CDDL
diff --git a/usr/src/uts/common/Makefile.files b/usr/src/uts/common/Makefile.files
index 12dfb48062..b6729071bf 100644
--- a/usr/src/uts/common/Makefile.files
+++ b/usr/src/uts/common/Makefile.files
@@ -2157,6 +2157,20 @@ CPQARY3_OBJS =	cpqary3.o cpqary3_noe.o cpqary3_talk2ctlr.o	\
 		cpqary3_bd.o
 
 #
+#	HP Smart Array driver module (smrt)
+#
+SMRT_OBJS =	smrt.o \
+		smrt_device.o \
+		smrt_interrupts.o \
+		smrt_commands.o \
+		smrt_logvol.o \
+		smrt_hba.o \
+		smrt_ciss_simple.o \
+		smrt_ciss.o \
+		smrt_physical.o \
+		smrt_sata.o
+
+#
 #	ISCSI_INITIATOR module
 #
 ISCSI_INITIATOR_OBJS =	chap.o iscsi_io.o iscsi_thread.o	\
diff --git a/usr/src/uts/common/Makefile.rules b/usr/src/uts/common/Makefile.rules
index edfcf89150..c3ca37feb5 100644
--- a/usr/src/uts/common/Makefile.rules
+++ b/usr/src/uts/common/Makefile.rules
@@ -1108,6 +1108,10 @@ $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/scsi/adapters/scsi_vhci/fops/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/scsi/adapters/smrt/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/fibre-channel/ulp/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
diff --git a/usr/src/uts/common/io/cpqary3/cpqary3.c b/usr/src/uts/common/io/cpqary3/cpqary3.c
index 622f0dcf68..f67d77b3d2 100644
--- a/usr/src/uts/common/io/cpqary3/cpqary3.c
+++ b/usr/src/uts/common/io/cpqary3/cpqary3.c
@@ -41,7 +41,7 @@ extern cpqary3_driver_info_t gdriver_info;
  * Global Variables Definitions
  */
 
-static char cpqary3_brief[]    =	"HP Smart Array Driver";
+static char cpqary3_brief[]    =	"HP Smart Array (Legacy)";
 void *cpqary3_state;
 
 /* HPQaculi Changes */
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt.c
new file mode 100644
index 0000000000..a7ef2b69d7
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt.c
@@ -0,0 +1,565 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+static int smrt_attach(dev_info_t *, ddi_attach_cmd_t);
+static int smrt_detach(dev_info_t *, ddi_detach_cmd_t);
+static int smrt_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
+static void smrt_cleanup(smrt_t *);
+static int smrt_command_comparator(const void *, const void *);
+
+/*
+ * Controller soft state.  Each entry is an object of type "smrt_t".
+ */
+void *smrt_state;
+
+/*
+ * DMA attributes template.  Each controller will make a copy of this template
+ * with appropriate customisations; e.g., the Scatter/Gather List Length.
+ */
+static ddi_dma_attr_t smrt_dma_attr_template = {
+	.dma_attr_version =		DMA_ATTR_V0,
+	.dma_attr_addr_lo =		0x0000000000000000,
+	.dma_attr_addr_hi =		0xFFFFFFFFFFFFFFFF,
+	.dma_attr_count_max =		0x00FFFFFF,
+	.dma_attr_align =		0x20,
+	.dma_attr_burstsizes =		0x20,
+	.dma_attr_minxfer =		DMA_UNIT_8,
+	.dma_attr_maxxfer =		0xFFFFFFFF,
+	/*
+	 * There is some suggestion that at least some, possibly older, Smart
+	 * Array controllers cannot tolerate a DMA segment that straddles a 4GB
+	 * boundary.
+	 */
+	.dma_attr_seg =			0xFFFFFFFF,
+	.dma_attr_sgllen =		1,
+	.dma_attr_granular =		512,
+	.dma_attr_flags =		0
+};
+
+/*
+ * Device memory access attributes for device control registers.
+ */
+ddi_device_acc_attr_t smrt_dev_attributes = {
+	.devacc_attr_version =		DDI_DEVICE_ATTR_V0,
+	.devacc_attr_endian_flags =	DDI_STRUCTURE_LE_ACC,
+	.devacc_attr_dataorder =	DDI_STRICTORDER_ACC,
+	.devacc_attr_access =		0
+};
+
+/*
+ * Character/Block Operations Structure
+ */
+static struct cb_ops smrt_cb_ops = {
+	.cb_rev =			CB_REV,
+	.cb_flag =			D_NEW | D_MP,
+
+	.cb_open =			scsi_hba_open,
+	.cb_close =			scsi_hba_close,
+
+	.cb_ioctl =			smrt_ioctl,
+
+	.cb_strategy =			nodev,
+	.cb_print =			nodev,
+	.cb_dump =			nodev,
+	.cb_read =			nodev,
+	.cb_write =			nodev,
+	.cb_devmap =			nodev,
+	.cb_mmap =			nodev,
+	.cb_segmap =			nodev,
+	.cb_chpoll =			nochpoll,
+	.cb_prop_op =			ddi_prop_op,
+	.cb_str =			NULL,
+	.cb_aread =			nodev,
+	.cb_awrite =			nodev
+};
+
+/*
+ * Device Operations Structure
+ */
+static struct dev_ops smrt_dev_ops = {
+	.devo_rev =			DEVO_REV,
+	.devo_refcnt =			0,
+
+	.devo_attach =			smrt_attach,
+	.devo_detach =			smrt_detach,
+
+	.devo_cb_ops =			&smrt_cb_ops,
+
+	.devo_getinfo =			nodev,
+	.devo_identify =		nulldev,
+	.devo_probe =			nulldev,
+	.devo_reset =			nodev,
+	.devo_bus_ops =			NULL,
+	.devo_power =			nodev,
+	.devo_quiesce =			nodev
+};
+
+/*
+ * Linkage structures
+ */
+static struct modldrv smrt_modldrv = {
+	.drv_modops =			&mod_driverops,
+	.drv_linkinfo =			"HP Smart Array",
+	.drv_dev_ops =			&smrt_dev_ops
+};
+
+static struct modlinkage smrt_modlinkage = {
+	.ml_rev =			MODREV_1,
+	.ml_linkage =			{ &smrt_modldrv, NULL }
+};
+
+
+int
+_init()
+{
+	int r;
+
+	VERIFY0(ddi_soft_state_init(&smrt_state, sizeof (smrt_t), 0));
+
+	if ((r = scsi_hba_init(&smrt_modlinkage)) != 0) {
+		goto fail;
+	}
+
+	if ((r = mod_install(&smrt_modlinkage)) != 0) {
+		scsi_hba_fini(&smrt_modlinkage);
+		goto fail;
+	}
+
+	return (r);
+
+fail:
+	ddi_soft_state_fini(&smrt_state);
+	return (r);
+}
+
+int
+_fini()
+{
+	int r;
+
+	if ((r = mod_remove(&smrt_modlinkage)) == 0) {
+		scsi_hba_fini(&smrt_modlinkage);
+		ddi_soft_state_fini(&smrt_state);
+	}
+
+	return (r);
+}
+
+int
+_info(struct modinfo *modinfop)
+{
+	return (mod_info(&smrt_modlinkage, modinfop));
+}
+
+static int
+smrt_iport_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	const char *addr;
+	dev_info_t *pdip;
+	int instance;
+	smrt_t *smrt;
+
+	if (cmd != DDI_ATTACH)
+		return (DDI_FAILURE);
+
+	/*
+	 * Note, we cannot get to our parent via the tran's tran_hba_private
+	 * member.  This pointer is reset to NULL when the scsi_hba_tran_t
+	 * structure is duplicated.
+	 */
+	addr = scsi_hba_iport_unit_address(dip);
+	VERIFY(addr != NULL);
+	pdip = ddi_get_parent(dip);
+	instance = ddi_get_instance(pdip);
+	smrt = ddi_get_soft_state(smrt_state, instance);
+	VERIFY(smrt != NULL);
+
+	if (strcmp(addr, SMRT_IPORT_VIRT) == 0) {
+		if (smrt_logvol_hba_setup(smrt, dip) != DDI_SUCCESS)
+			return (DDI_FAILURE);
+		smrt->smrt_virt_iport = dip;
+	} else if (strcmp(addr, SMRT_IPORT_PHYS) == 0) {
+		if (smrt_phys_hba_setup(smrt, dip) != DDI_SUCCESS)
+			return (DDI_FAILURE);
+		smrt->smrt_phys_iport = dip;
+	} else {
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+static int
+smrt_iport_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	const char *addr;
+	scsi_hba_tran_t *tran;
+	smrt_t *smrt;
+
+	if (cmd != DDI_DETACH)
+		return (DDI_FAILURE);
+
+	tran = ddi_get_driver_private(dip);
+	VERIFY(tran != NULL);
+	smrt = tran->tran_hba_private;
+	VERIFY(smrt != NULL);
+
+	addr = scsi_hba_iport_unit_address(dip);
+	VERIFY(addr != NULL);
+
+	if (strcmp(addr, SMRT_IPORT_VIRT) == 0) {
+		smrt_logvol_hba_teardown(smrt, dip);
+		smrt->smrt_virt_iport = NULL;
+	} else if (strcmp(addr, SMRT_IPORT_PHYS) == 0) {
+		smrt_phys_hba_teardown(smrt, dip);
+		smrt->smrt_phys_iport = NULL;
+	} else {
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+static int
+smrt_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
+{
+	uint32_t instance;
+	smrt_t *smrt;
+	boolean_t check_for_interrupts = B_FALSE;
+	int r;
+	char taskq_name[64];
+
+	if (scsi_hba_iport_unit_address(dip) != NULL)
+		return (smrt_iport_attach(dip, cmd));
+
+	if (cmd != DDI_ATTACH) {
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Allocate the per-controller soft state object and get
+	 * a pointer to it.
+	 */
+	instance = ddi_get_instance(dip);
+	if (ddi_soft_state_zalloc(smrt_state, instance) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not allocate soft state");
+		return (DDI_FAILURE);
+	}
+	if ((smrt = ddi_get_soft_state(smrt_state, instance)) == NULL) {
+		dev_err(dip, CE_WARN, "could not get soft state");
+		ddi_soft_state_free(smrt_state, instance);
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Initialise per-controller state object.
+	 */
+	smrt->smrt_dip = dip;
+	smrt->smrt_instance = instance;
+	smrt->smrt_next_tag = SMRT_MIN_TAG_NUMBER;
+	list_create(&smrt->smrt_commands, sizeof (smrt_command_t),
+	    offsetof(smrt_command_t, smcm_link));
+	list_create(&smrt->smrt_finishq, sizeof (smrt_command_t),
+	    offsetof(smrt_command_t, smcm_link_finish));
+	list_create(&smrt->smrt_abortq, sizeof (smrt_command_t),
+	    offsetof(smrt_command_t, smcm_link_abort));
+	list_create(&smrt->smrt_volumes, sizeof (smrt_volume_t),
+	    offsetof(smrt_volume_t, smlv_link));
+	list_create(&smrt->smrt_physicals, sizeof (smrt_physical_t),
+	    offsetof(smrt_physical_t, smpt_link));
+	list_create(&smrt->smrt_targets, sizeof (smrt_target_t),
+	    offsetof(smrt_target_t, smtg_link_ctlr));
+	avl_create(&smrt->smrt_inflight, smrt_command_comparator,
+	    sizeof (smrt_command_t), offsetof(smrt_command_t,
+	    smcm_node));
+	cv_init(&smrt->smrt_cv_finishq, NULL, CV_DRIVER, NULL);
+
+	smrt->smrt_init_level |= SMRT_INITLEVEL_BASIC;
+
+	/*
+	 * Perform basic device setup, including identifying the board, mapping
+	 * the I2O registers and the Configuration Table.
+	 */
+	if (smrt_device_setup(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "device setup failed");
+		goto fail;
+	}
+
+	/*
+	 * Select a Transport Method (e.g. Simple or Performant) and update
+	 * the Configuration Table.  This function also waits for the
+	 * controller to become ready.
+	 */
+	if (smrt_ctlr_init(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "controller initialisation failed");
+		goto fail;
+	}
+
+	/*
+	 * Each controller may have a different Scatter/Gather Element count.
+	 * Configure a per-controller set of DMA attributes with the
+	 * appropriate S/G size.
+	 */
+	VERIFY(smrt->smrt_sg_cnt > 0);
+	smrt->smrt_dma_attr = smrt_dma_attr_template;
+	smrt->smrt_dma_attr.dma_attr_sgllen = smrt->smrt_sg_cnt;
+
+	/*
+	 * Now that we have selected a Transport Method, we can configure
+	 * the appropriate interrupt handlers.
+	 */
+	if (smrt_interrupts_setup(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "interrupt handler setup failed");
+		goto fail;
+	}
+
+	/*
+	 * Now that we have the correct interrupt priority, we can initialise
+	 * the mutex.  This must be done before the interrupt handler is
+	 * enabled.
+	 */
+	mutex_init(&smrt->smrt_mutex, NULL, MUTEX_DRIVER,
+	    DDI_INTR_PRI(smrt->smrt_interrupt_pri));
+	smrt->smrt_init_level |= SMRT_INITLEVEL_MUTEX;
+
+	/*
+	 * From this point forward, the controller is able to accept commands
+	 * and (at least by polling) return command submissions.  Setting this
+	 * flag allows the rest of the driver to interact with the device.
+	 */
+	smrt->smrt_status |= SMRT_CTLR_STATUS_RUNNING;
+
+	if (smrt_interrupts_enable(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "interrupt handler could not be enabled");
+		goto fail;
+	}
+
+	if (smrt_ctrl_hba_setup(smrt) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "SCSI framework setup failed");
+		goto fail;
+	}
+
+	/*
+	 * Set the appropriate Interrupt Mask Register bits to start
+	 * command completion interrupts from the controller.
+	 */
+	smrt_intr_set(smrt, B_TRUE);
+	check_for_interrupts = B_TRUE;
+
+	/*
+	 * Register the maintenance routine for periodic execution:
+	 */
+	smrt->smrt_periodic = ddi_periodic_add(smrt_periodic, smrt,
+	    SMRT_PERIODIC_RATE * NANOSEC, DDI_IPL_0);
+	smrt->smrt_init_level |= SMRT_INITLEVEL_PERIODIC;
+
+	(void) snprintf(taskq_name, sizeof (taskq_name), "smrt_discover_%u",
+	    instance);
+	smrt->smrt_discover_taskq = ddi_taskq_create(smrt->smrt_dip, taskq_name,
+	    1, TASKQ_DEFAULTPRI, 0);
+	if (smrt->smrt_discover_taskq == NULL) {
+		dev_err(dip, CE_WARN, "failed to create discovery task queue");
+		goto fail;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_TASKQ;
+
+	if ((r = smrt_event_init(smrt)) != 0) {
+		dev_err(dip, CE_WARN, "could not initialize event subsystem "
+		    "(%d)", r);
+		goto fail;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_ASYNC_EVENT;
+
+	if (scsi_hba_iport_register(dip, SMRT_IPORT_VIRT) != DDI_SUCCESS)
+		goto fail;
+
+	if (scsi_hba_iport_register(dip, SMRT_IPORT_PHYS) != DDI_SUCCESS)
+		goto fail;
+
+	/*
+	 * Announce the attachment of this controller.
+	 */
+	ddi_report_dev(dip);
+
+	return (DDI_SUCCESS);
+
+fail:
+	if (check_for_interrupts) {
+		if (smrt->smrt_stats.smrts_claimed_interrupts == 0) {
+			dev_err(dip, CE_WARN, "controller did not interrupt "
+			    "during attach");
+		}
+	}
+	smrt_cleanup(smrt);
+	return (DDI_FAILURE);
+}
+
+static int
+smrt_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
+{
+	scsi_hba_tran_t *tran = (scsi_hba_tran_t *)ddi_get_driver_private(dip);
+	smrt_t *smrt = (smrt_t *)tran->tran_hba_private;
+
+	if (scsi_hba_iport_unit_address(dip) != NULL)
+		return (smrt_iport_detach(dip, cmd));
+
+	if (cmd != DDI_DETACH) {
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * First, check to make sure that all SCSI framework targets have
+	 * detached.
+	 */
+	mutex_enter(&smrt->smrt_mutex);
+	if (!list_is_empty(&smrt->smrt_targets)) {
+		mutex_exit(&smrt->smrt_mutex);
+		dev_err(smrt->smrt_dip, CE_WARN, "cannot detach; targets still "
+		    "using HBA");
+		return (DDI_FAILURE);
+	}
+
+	if (smrt->smrt_virt_iport != NULL || smrt->smrt_phys_iport != NULL) {
+		mutex_exit(&smrt->smrt_mutex);
+		dev_err(smrt->smrt_dip, CE_WARN, "cannot detach: iports still "
+		    "attached");
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Prevent new targets from attaching now:
+	 */
+	smrt->smrt_status |= SMRT_CTLR_STATUS_DETACHING;
+	mutex_exit(&smrt->smrt_mutex);
+
+	/*
+	 * Clean up all remaining resources.
+	 */
+	smrt_cleanup(smrt);
+
+	return (DDI_SUCCESS);
+}
+
+static int
+smrt_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
+    int *rval)
+{
+	int inst = MINOR2INST(getminor(dev));
+	int status;
+
+	if (secpolicy_sys_config(credp, B_FALSE) != 0) {
+		return (EPERM);
+	}
+
+	/*
+	 * Ensure that we have a soft state object for this instance.
+	 */
+	if (ddi_get_soft_state(smrt_state, inst) == NULL) {
+		return (ENXIO);
+	}
+
+	switch (cmd) {
+	default:
+		status = scsi_hba_ioctl(dev, cmd, arg, mode, credp, rval);
+		break;
+	}
+
+	return (status);
+}
+
+static void
+smrt_cleanup(smrt_t *smrt)
+{
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_ASYNC_EVENT) {
+		smrt_event_fini(smrt);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_ASYNC_EVENT;
+	}
+
+	smrt_interrupts_teardown(smrt);
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_TASKQ) {
+		ddi_taskq_destroy(smrt->smrt_discover_taskq);
+		smrt->smrt_discover_taskq = NULL;
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_TASKQ;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_PERIODIC) {
+		ddi_periodic_delete(smrt->smrt_periodic);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_PERIODIC;
+	}
+
+	smrt_ctrl_hba_teardown(smrt);
+
+	smrt_ctlr_teardown(smrt);
+
+	smrt_device_teardown(smrt);
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_BASIC) {
+		smrt_logvol_teardown(smrt);
+		smrt_phys_teardown(smrt);
+
+		cv_destroy(&smrt->smrt_cv_finishq);
+
+		VERIFY(list_is_empty(&smrt->smrt_commands));
+		list_destroy(&smrt->smrt_commands);
+		list_destroy(&smrt->smrt_finishq);
+		list_destroy(&smrt->smrt_abortq);
+
+		VERIFY(list_is_empty(&smrt->smrt_volumes));
+		list_destroy(&smrt->smrt_volumes);
+
+		VERIFY(list_is_empty(&smrt->smrt_physicals));
+		list_destroy(&smrt->smrt_physicals);
+
+		VERIFY(list_is_empty(&smrt->smrt_targets));
+		list_destroy(&smrt->smrt_targets);
+
+		VERIFY(avl_is_empty(&smrt->smrt_inflight));
+		avl_destroy(&smrt->smrt_inflight);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_BASIC;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_MUTEX) {
+		mutex_destroy(&smrt->smrt_mutex);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_MUTEX;
+	}
+
+	VERIFY0(smrt->smrt_init_level);
+
+	ddi_soft_state_free(smrt_state, ddi_get_instance(smrt->smrt_dip));
+}
+
+/*
+ * Comparator for the "smrt_inflight" AVL tree in a "smrt_t".  This AVL tree
+ * allows a tag ID to be mapped back to the relevant "smrt_command_t".
+ */
+static int
+smrt_command_comparator(const void *lp, const void *rp)
+{
+	const smrt_command_t *l = lp;
+	const smrt_command_t *r = rp;
+
+	if (l->smcm_tag > r->smcm_tag) {
+		return (1);
+	} else if (l->smcm_tag < r->smcm_tag) {
+		return (-1);
+	} else {
+		return (0);
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt.conf b/usr/src/uts/common/io/scsi/adapters/smrt/smrt.conf
new file mode 100644
index 0000000000..758ecd0779
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt.conf
@@ -0,0 +1,16 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2016 Joyent, Inc.
+#
+
+scsi-no-quiesce=1;
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss.c
new file mode 100644
index 0000000000..8da9ac9038
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss.c
@@ -0,0 +1,2023 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+/*
+ * Discovery, Resets, Periodics, and Events
+ * ----------------------------------------
+ *
+ * Discovery is the act of figuring out what logical and physical volumes exist
+ * under the controller.  Discovery happens in response to the following events:
+ *
+ *   o iports for virtual and physical devices being attached
+ *   o Controller event notifications indicating potential topology changes
+ *   o After a reset of the controller, before we can perform I/O again
+ *
+ * Because we have to perform discovery after a reset, which can happen during
+ * panic(), that also means that discovery may be run in panic context.  We
+ * also need to emphasize the need for discovery to happen after a controller
+ * reset.  Once a reset is initiated, we cannot be certain about the addresses
+ * of any of the existing targets until the reset has completed.  The driver
+ * performs I/Os to addresses that the controller provides.  The controller
+ * specification says that these addresses may change after a controller reset.
+ *
+ * Unfortunately, all of this combined means that making sure we can correctly
+ * run discovery is somewhat complicated.  In non-panic contexts, discovery is
+ * always run from a taskq.  We'll kick off the discovery in the taskq if
+ * nothing is pending at that time.  The state is managed by bits in the
+ * smrt_status member of the smrt_t.  There are four bits at this time:
+ *
+ *	SMRT_CTLR_DISCOVERY_REQUESTED	This flag indicates that something has
+ *					requested that a discovery be performed.
+ *					If no flags are set when this is set,
+ *					then we will kick off discovery.  All
+ *					discovery requests are initiated via the
+ *					smrt_discover_request() function.
+ *
+ *	SMRT_CTLR_DISCOVERY_RUNNING	This flag is set at the start of us
+ *					running a discovery.  It is removed when
+ *					discovery finishes.
+ *
+ *	SMRT_CTLR_DISCOVERY_PERIODIC	This flag is set in a number of
+ *					circumstances, which will be described
+ *					in a subsequent section.  This indicates
+ *					that the periodic must kick off the
+ *					discovery process.
+ *
+ *	SMRT_CTLR_DISCOVERY_REQUIRED	This flag indicates that at some point a
+ *					controller reset occurred and we need to
+ *					have a successful discovery to finish
+ *					the act of resetting and allowing I/O to
+ *					continue.
+ *
+ * In general, a request to discover kicks off the taskq to discover entries, if
+ * it hasn't already been requested or started.  This also allows us to coalesce
+ * multiple requests, if needed.  Note that if a request comes in when a
+ * discovery is ongoing, we do not kick off discovery again.  Instead, we set
+ * the SMRT_CTLR_DISCOVERY_REQUESTED flag which will rerun discovery after the
+ * initial pass has completed.
+ *
+ * When a discovery starts, the first thing it does is clear the
+ * SMRT_CTLR_DISCOVERY_REQUESTED flag.  This is important, because any
+ * additional requests for discovery that come in after this has started likely
+ * indicate that we've missed something.  As such, when the discovery process
+ * finishes, if it sees the REQUESTED flag, then it will need to set the
+ * PERIODIC flag.  The PERIODIC flag is used to indicate that we should run
+ * discovery again, but not kick if off immediately.  Instead, it should be
+ * driven by the normal periodic behavior.
+ *
+ * If for some reason the act of discovery fails, or we fail to dispatch
+ * discovery due to a transient error, then we will flag PERIODIC so that the
+ * periodic tick will try and run things again.
+ *
+ * Now, we need to talk about SMRT_CTLR_DISCOVERY_REQUIRED.  This flag is set
+ * after a reset occurs.  The reset thread will be blocked on this.
+ * Importantly, none of the code in the discovery path can ask for a controller
+ * reset at this time.  If at the end of a discovery, this flag is set, then we
+ * will signal the reset thread that it should check on its status by
+ * broadcasting on the smrt_cv_finishq.  At that point, the reset thread will
+ * continue.
+ *
+ * Panic Context
+ * -------------
+ *
+ * All of this talk of threads and taskqs is well and good, but as an HBA
+ * driver, we have a serious responsibility to try and deal with panic sanely.
+ * In panic context, we will directly call the discovery functions and not poll
+ * for them to occur.
+ *
+ * However, because our discovery relies on the target maps, which aren't safe
+ * for panic context at this time, we have to take a different approach.  We
+ * leverage the fact that we have a generation number stored with every
+ * discovery.  If we try to do an I/O to a device where the generation doesn't
+ * match, then we know that it disappeared and should not be used.  We also
+ * sanity check the model, serial numbers, and WWNs to make sure that these are
+ * the same devices.  If they are, then we'll end up updating the address
+ * structures.
+ *
+ * Now, it is possible that when we were panicking, we had a thread that was in
+ * the process of running a discovery or even resetting the system.  Once we're
+ * in panic, those threads aren't running, so if they didn't end up producing a
+ * new view of the world that the SCSI framework is using, then it shouldn't
+ * really matter, as we won't have updated the list of devices.  Importantly,
+ * once we're in that context, we're not going to be attaching or detaching
+ * targets.  If we get a request for one of these targets which has disappeared,
+ * we're going to have to end up giving up.
+ *
+ * Request Attributes
+ * ------------------
+ *
+ * The CISS specification allows for three different kinds of attributes that
+ * describe how requests are queued to the controller.  These are:
+ *
+ *	HEAD OF QUEUE		The request should go to the head of the
+ *				controller queue.  This is used for resets and
+ *				aborts to ensure that they're not blocked behind
+ *				additional I/O.
+ *
+ *	SIMPLE			This queues the request for normal processing.
+ *				Commands queued this way are not special with
+ *				respect to one another.  We use this for all I/O
+ *				and discovery commands.
+ *
+ *	ORDERED			This attribute is used to indicate that commands
+ *				should be submitted and processed in some order.
+ *				This is used primarily for the event
+ *				notification bits so we can ensure that at the
+ *				return of a cancellation of the event
+ *				notification, that any outstanding request has
+ *				been honored.
+ */
+
+static int smrt_ctlr_versions(smrt_t *, uint16_t, smrt_versions_t *);
+static void smrt_discover(void *);
+
+/*
+ * The maximum number of seconds to wait for the controller to come online.
+ */
+unsigned smrt_ciss_init_time = 90;
+
+/*
+ * A tunable that determines the number of events per tick that we'll process
+ * via asynchronous event notification.  If this rate is very high, then we will
+ * not submit the event and it will be picked up at the next tick of the
+ * periodic.
+ */
+uint_t smrt_event_intervention_threshold = 1000;
+
+/*
+ * Converts a LUN Address to a BMIC Identifier.  The BMIC Identifier is used
+ * when performing various physical commands and generally should stay the same
+ * for a given device across inserts and removals; however, not across
+ * controller resets.  These are calculated based on what the CISS specification
+ * calls the 'Level 2' target and bus, which don't have a real meaning in the
+ * SAS world otherwise.
+ */
+uint16_t
+smrt_lun_addr_to_bmic(PhysDevAddr_t *paddr)
+{
+	uint16_t id;
+
+	id = (paddr->Target[1].PeripDev.Bus - 1) << 8;
+	id += paddr->Target[1].PeripDev.Dev;
+
+	return (id);
+}
+
+void
+smrt_write_lun_addr_phys(LUNAddr_t *lun, boolean_t masked, unsigned bus,
+    unsigned target)
+{
+	lun->PhysDev.Mode = masked ? MASK_PERIPHERIAL_DEV_ADDR :
+	    PERIPHERIAL_DEV_ADDR;
+
+	lun->PhysDev.TargetId = target;
+	lun->PhysDev.Bus = bus;
+
+	bzero(&lun->PhysDev.Target, sizeof (lun->PhysDev.Target));
+}
+
+/*
+ * According to the CISS Specification, the controller is always addressed in
+ * Mask Perhiperhal mode with a bus and target ID of zero.  This is used by
+ * commands that need to write to the controller itself, which is generally
+ * discovery and other commands.
+ */
+void
+smrt_write_controller_lun_addr(LUNAddr_t *lun)
+{
+	smrt_write_lun_addr_phys(lun, B_TRUE, 0, 0);
+}
+
+void
+smrt_write_message_common(smrt_command_t *smcm, uint8_t type, int timeout_secs)
+{
+	switch (type) {
+	case CISS_MSG_ABORT:
+	case CISS_MSG_RESET:
+	case CISS_MSG_NOP:
+		break;
+
+	default:
+		panic("unknown message type");
+	}
+
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_MSG;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_HEADOFQUEUE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_NONE;
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout_secs);
+	smcm->smcm_va_cmd->Request.CDBLen = CISS_CDBLEN;
+	smcm->smcm_va_cmd->Request.CDB[0] = type;
+}
+
+void
+smrt_write_message_abort_one(smrt_command_t *smcm, uint32_t tag)
+{
+	smrt_tag_t cisstag;
+
+	/*
+	 * When aborting a particular command, the request is addressed
+	 * to the controller.
+	 */
+	smrt_write_lun_addr_phys(&smcm->smcm_va_cmd->Header.LUN,
+	    B_TRUE, 0, 0);
+
+	smrt_write_message_common(smcm, CISS_MSG_ABORT, 0);
+
+	/*
+	 * Abort a single command.
+	 */
+	smcm->smcm_va_cmd->Request.CDB[1] = CISS_ABORT_TASK;
+
+	/*
+	 * The CISS Specification says that the tag value for a task-level
+	 * abort should be in the CDB in bytes 4-11.
+	 */
+	bzero(&cisstag, sizeof (cisstag));
+	cisstag.tag_value = tag;
+	bcopy(&cisstag, &smcm->smcm_va_cmd->Request.CDB[4],
+	    sizeof (cisstag));
+}
+
+void
+smrt_write_message_abort_all(smrt_command_t *smcm, LUNAddr_t *addr)
+{
+	/*
+	 * When aborting all tasks for a particular Logical Volume,
+	 * the command is addressed not to the controller but to
+	 * the Volume itself.
+	 */
+	smcm->smcm_va_cmd->Header.LUN = *addr;
+
+	smrt_write_message_common(smcm, CISS_MSG_ABORT, 0);
+
+	/*
+	 * Abort all commands for a particular Logical Volume.
+	 */
+	smcm->smcm_va_cmd->Request.CDB[1] = CISS_ABORT_TASKSET;
+}
+
+void
+smrt_write_message_event_notify(smrt_command_t *smcm)
+{
+	smrt_event_notify_req_t senr;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_ORDERED;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+	smcm->smcm_va_cmd->Request.Timeout = 0;
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (senr);
+
+	bzero(&senr, sizeof (senr));
+	senr.senr_opcode = CISS_SCMD_READ;
+	senr.senr_subcode = CISS_BMIC_NOTIFY_ON_EVENT;
+	senr.senr_flags = BE_32(0);
+	senr.senr_size = BE_32(SMRT_EVENT_NOTIFY_BUFLEN);
+
+	bcopy(&senr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (senr)));
+}
+
+void
+smrt_write_message_cancel_event_notify(smrt_command_t *smcm)
+{
+	smrt_event_notify_req_t senr;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_ORDERED;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_WRITE;
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(SMRT_ASYNC_CANCEL_TIMEOUT);
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (senr);
+
+	bzero(&senr, sizeof (senr));
+	senr.senr_opcode = CISS_SCMD_WRITE;
+	senr.senr_subcode = CISS_BMIC_NOTIFY_ON_EVENT_CANCEL;
+	senr.senr_size = BE_32(SMRT_EVENT_NOTIFY_BUFLEN);
+
+	bcopy(&senr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (senr)));
+}
+
+void
+smrt_write_message_reset_ctlr(smrt_command_t *smcm)
+{
+	smrt_write_lun_addr_phys(&smcm->smcm_va_cmd->Header.LUN,
+	    B_TRUE, 0, 0);
+
+	smrt_write_message_common(smcm, CISS_MSG_RESET, 0);
+
+	smcm->smcm_va_cmd->Request.CDB[1] = CISS_RESET_CTLR;
+}
+
+void
+smrt_write_message_nop(smrt_command_t *smcm, int timeout_secs)
+{
+	/*
+	 * No-op messages are always sent to the controller.
+	 */
+	smrt_write_lun_addr_phys(&smcm->smcm_va_cmd->Header.LUN,
+	    B_TRUE, 0, 0);
+
+	smrt_write_message_common(smcm, CISS_MSG_NOP, timeout_secs);
+}
+
+/*
+ * This routine is executed regularly by ddi_periodic_add(9F).  It checks the
+ * health of the controller and looks for submitted commands that have timed
+ * out.
+ */
+void
+smrt_periodic(void *arg)
+{
+	smrt_t *smrt = arg;
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Before we even check if the controller is running to process
+	 * everything else, we must first check if we had a request to kick off
+	 * discovery.  We do this before the check if the controller is running,
+	 * as this may be required to finish a discovery.
+	 */
+	if ((smrt->smrt_status & SMRT_CTLR_DISCOVERY_PERIODIC) != 0 &&
+	    (smrt->smrt_status & SMRT_CTLR_DISCOVERY_RUNNING) == 0 &&
+	    (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) == 0) {
+		if (ddi_taskq_dispatch(smrt->smrt_discover_taskq,
+		    smrt_discover, smrt, DDI_NOSLEEP) != DDI_SUCCESS) {
+			smrt->smrt_stats.smrts_discovery_tq_errors++;
+		} else {
+			smrt->smrt_status &= ~SMRT_CTLR_DISCOVERY_PERIODIC;
+		}
+	}
+
+	if (!(smrt->smrt_status & SMRT_CTLR_STATUS_RUNNING)) {
+		/*
+		 * The device is currently not active, e.g. due to an
+		 * in-progress controller reset.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		return;
+	}
+
+	/*
+	 * Check on the health of the controller firmware.  Note that if the
+	 * controller has locked up, this routine will panic the system.
+	 */
+	smrt_lockup_check(smrt);
+
+	/*
+	 * Reset the event notification threshold counter.
+	 */
+	smrt->smrt_event_count = 0;
+
+	/*
+	 * Check inflight commands to see if they have timed out.
+	 */
+	for (smrt_command_t *smcm = avl_first(&smrt->smrt_inflight);
+	    smcm != NULL; smcm = AVL_NEXT(&smrt->smrt_inflight, smcm)) {
+		if (smcm->smcm_status & SMRT_CMD_STATUS_POLLED) {
+			/*
+			 * Polled commands are timed out by the polling
+			 * routine.
+			 */
+			continue;
+		}
+
+		if (smcm->smcm_status & SMRT_CMD_STATUS_ABORT_SENT) {
+			/*
+			 * This command has been aborted; either it will
+			 * complete or the controller will be reset.
+			 */
+			continue;
+		}
+
+		if (list_link_active(&smcm->smcm_link_abort)) {
+			/*
+			 * Already on the abort queue.
+			 */
+			continue;
+		}
+
+		if (smcm->smcm_expiry == 0) {
+			/*
+			 * This command has no expiry time.
+			 */
+			continue;
+		}
+
+		if (gethrtime() > smcm->smcm_expiry) {
+			list_insert_tail(&smrt->smrt_abortq, smcm);
+			smcm->smcm_status |= SMRT_CMD_STATUS_TIMEOUT;
+		}
+	}
+
+	/*
+	 * Process the abort queue.
+	 */
+	(void) smrt_process_abortq(smrt);
+
+	/*
+	 * Check if we have an outstanding event intervention request.  Note,
+	 * the command in question should always be in a state such that it is
+	 * usable by the system here.  The command is always prepared again by
+	 * the normal event notification path, even if a reset has occurred.
+	 * The reset will be processed before we'd ever consider running an
+	 * event again.  Note, if we fail to submit this, then we leave this for
+	 * the next occurrence of the periodic.
+	 */
+	if (smrt->smrt_status & SMRT_CTLR_ASYNC_INTERVENTION) {
+		smrt->smrt_stats.smrts_events_intervened++;
+
+		if (smrt_submit(smrt, smrt->smrt_event_cmd) == 0) {
+			smrt->smrt_status &= ~SMRT_CTLR_ASYNC_INTERVENTION;
+		}
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+int
+smrt_retrieve(smrt_t *smrt)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		smrt_retrieve_simple(smrt);
+		return (DDI_SUCCESS);
+
+	case SMRT_CTLR_MODE_UNKNOWN:
+		break;
+	}
+
+	panic("unknown controller mode");
+	/* LINTED: E_FUNC_NO_RET_VAL */
+}
+
+/*
+ * Grab a new tag number for this command.  We aim to avoid reusing tag numbers
+ * as much as possible, so as to avoid spurious double completion from the
+ * controller.
+ */
+static void
+smrt_set_new_tag(smrt_t *smrt, smrt_command_t *smcm)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	/*
+	 * Loop until we find a tag that is not in use.  The tag space is
+	 * very large (~30 bits) and the maximum number of inflight commands
+	 * is comparatively small (~1024 in current controllers).
+	 */
+	for (;;) {
+		uint32_t new_tag = smrt->smrt_next_tag;
+
+		if (++smrt->smrt_next_tag > SMRT_MAX_TAG_NUMBER) {
+			smrt->smrt_next_tag = SMRT_MIN_TAG_NUMBER;
+		}
+
+		if (smrt_lookup_inflight(smrt, new_tag) != NULL) {
+			/*
+			 * This tag is already used on an inflight command.
+			 * Choose another.
+			 */
+			continue;
+		}
+
+		/*
+		 * Set the tag for the command and also write it into the
+		 * appropriate part of the request block.
+		 */
+		smcm->smcm_tag = new_tag;
+		smcm->smcm_va_cmd->Header.Tag.tag_value = new_tag;
+		return;
+	}
+}
+
+/*
+ * Submit a command to the controller.
+ */
+int
+smrt_submit(smrt_t *smrt, smrt_command_t *smcm)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+	VERIFY(smcm->smcm_type != SMRT_CMDTYPE_PREINIT);
+
+	/*
+	 * Anything that asks us to ignore the running state of the controller
+	 * must be wired up to poll for completion.
+	 */
+	if (smcm->smcm_status & SMRT_CMD_IGNORE_RUNNING) {
+		VERIFY(smcm->smcm_status & SMRT_CMD_STATUS_POLLED);
+	}
+
+	/*
+	 * If the controller is currently being reset, do not allow command
+	 * submission.  However, if this is one of the commands needed to finish
+	 * reset, as indicated on the command structure, allow it.
+	 */
+	if (!(smrt->smrt_status & SMRT_CTLR_STATUS_RUNNING) &&
+	    !(smcm->smcm_status & SMRT_CMD_IGNORE_RUNNING)) {
+		return (EIO);
+	}
+
+	/*
+	 * Do not allow submission of more concurrent commands than the
+	 * controller supports.
+	 */
+	if (avl_numnodes(&smrt->smrt_inflight) >= smrt->smrt_maxcmds) {
+		return (EAGAIN);
+	}
+
+	/*
+	 * Synchronise the Command Block DMA resources to ensure that the
+	 * device has a consistent view before we pass it the command.
+	 */
+	if (ddi_dma_sync(smcm->smcm_contig.smdma_dma_handle, 0, 0,
+	    DDI_DMA_SYNC_FORDEV) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "DMA sync failure");
+		return (EIO);
+	}
+
+	/*
+	 * Ensure that this command is not re-used without issuing a new
+	 * tag number and performing any appropriate cleanup.
+	 */
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_USED));
+	smcm->smcm_status |= SMRT_CMD_STATUS_USED;
+
+	/*
+	 * Assign a tag that is not currently in use
+	 */
+	smrt_set_new_tag(smrt, smcm);
+
+	/*
+	 * Insert this command into the inflight AVL.
+	 */
+	avl_index_t where;
+	if (avl_find(&smrt->smrt_inflight, smcm, &where) != NULL) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "duplicate submit tag %x",
+		    smcm->smcm_tag);
+	}
+	avl_insert(&smrt->smrt_inflight, smcm, where);
+	if (smrt->smrt_stats.smrts_max_inflight <
+	    avl_numnodes(&smrt->smrt_inflight)) {
+		smrt->smrt_stats.smrts_max_inflight =
+		    avl_numnodes(&smrt->smrt_inflight);
+	}
+
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT));
+	smcm->smcm_status |= SMRT_CMD_STATUS_INFLIGHT;
+
+	smcm->smcm_time_submit = gethrtime();
+
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		smrt_submit_simple(smrt, smcm);
+		return (0);
+
+	case SMRT_CTLR_MODE_UNKNOWN:
+		break;
+	}
+	panic("unknown controller mode");
+	/* LINTED: E_FUNC_NO_RET_VAL */
+}
+
+static void
+smrt_process_finishq_sync(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	if (ddi_dma_sync(smcm->smcm_contig.smdma_dma_handle, 0, 0,
+	    DDI_DMA_SYNC_FORCPU) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "finishq DMA sync failure");
+	}
+}
+
+static void
+smrt_process_finishq_one(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_COMPLETE));
+	smcm->smcm_status |= SMRT_CMD_STATUS_COMPLETE;
+
+	switch (smcm->smcm_type) {
+	case SMRT_CMDTYPE_INTERNAL:
+		cv_broadcast(&smcm->smcm_ctlr->smrt_cv_finishq);
+		return;
+
+	case SMRT_CMDTYPE_SCSA:
+		smrt_hba_complete(smcm);
+		return;
+
+	case SMRT_CMDTYPE_EVENT:
+		smrt_event_complete(smcm);
+		return;
+
+	case SMRT_CMDTYPE_ABORTQ:
+		/*
+		 * Abort messages sent as part of abort queue processing
+		 * do not require any completion activity.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		mutex_enter(&smrt->smrt_mutex);
+		return;
+
+	case SMRT_CMDTYPE_PREINIT:
+		dev_err(smrt->smrt_dip, CE_PANIC, "preinit command "
+		    "completed after initialisation");
+		return;
+	}
+
+	panic("unknown command type");
+}
+
+/*
+ * Process commands in the completion queue.
+ */
+void
+smrt_process_finishq(smrt_t *smrt)
+{
+	smrt_command_t *smcm;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	while ((smcm = list_remove_head(&smrt->smrt_finishq)) != NULL) {
+		/*
+		 * Synchronise the Command Block before we read from it or
+		 * free it, to ensure that any writes from the controller are
+		 * visible.
+		 */
+		smrt_process_finishq_sync(smcm);
+
+		/*
+		 * Check if this command was in line to be aborted.
+		 */
+		if (list_link_active(&smcm->smcm_link_abort)) {
+			/*
+			 * This command was in line, but the controller
+			 * subsequently completed the command before we
+			 * were able to do so.
+			 */
+			list_remove(&smrt->smrt_abortq, smcm);
+			smcm->smcm_status &= ~SMRT_CMD_STATUS_TIMEOUT;
+		}
+
+		/*
+		 * Check if this command has been abandoned by the original
+		 * submitter.  If it has, free it now to avoid a leak.
+		 */
+		if (smcm->smcm_status & SMRT_CMD_STATUS_ABANDONED) {
+			mutex_exit(&smrt->smrt_mutex);
+			smrt_command_free(smcm);
+			mutex_enter(&smrt->smrt_mutex);
+			continue;
+		}
+
+		if (smcm->smcm_status & SMRT_CMD_STATUS_POLLED) {
+			/*
+			 * This command will be picked up and processed
+			 * by "smrt_poll_for()" once the CV is triggered
+			 * at the end of processing.
+			 */
+			smcm->smcm_status |= SMRT_CMD_STATUS_POLL_COMPLETE;
+			continue;
+		}
+
+		smrt_process_finishq_one(smcm);
+	}
+
+	cv_broadcast(&smrt->smrt_cv_finishq);
+}
+
+/*
+ * Process commands in the abort queue.
+ */
+void
+smrt_process_abortq(smrt_t *smrt)
+{
+	smrt_command_t *smcm;
+	smrt_command_t *abort_smcm = NULL;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (list_is_empty(&smrt->smrt_abortq)) {
+		goto out;
+	}
+
+another:
+	mutex_exit(&smrt->smrt_mutex);
+	if ((abort_smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_ABORTQ,
+	    KM_NOSLEEP)) == NULL) {
+		/*
+		 * No resources available to send abort messages.  We will
+		 * try again the next time around.
+		 */
+		mutex_enter(&smrt->smrt_mutex);
+		goto out;
+	}
+	mutex_enter(&smrt->smrt_mutex);
+
+	while ((smcm = list_remove_head(&smrt->smrt_abortq)) != NULL) {
+		if (!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT)) {
+			/*
+			 * This message is not currently inflight, so
+			 * no abort is needed.
+			 */
+			continue;
+		}
+
+		if (smcm->smcm_status & SMRT_CMD_STATUS_ABORT_SENT) {
+			/*
+			 * An abort message has already been sent for
+			 * this command.
+			 */
+			continue;
+		}
+
+		/*
+		 * Send an abort message for the command.
+		 */
+		smrt_write_message_abort_one(abort_smcm, smcm->smcm_tag);
+		if (smrt_submit(smrt, abort_smcm) != 0) {
+			/*
+			 * The command could not be submitted to the
+			 * controller.  Put it back in the abort queue
+			 * and give up for now.
+			 */
+			list_insert_head(&smrt->smrt_abortq, smcm);
+			goto out;
+		}
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABORT_SENT;
+
+		/*
+		 * Record some debugging information about the abort we
+		 * sent:
+		 */
+		smcm->smcm_abort_time = gethrtime();
+		smcm->smcm_abort_tag = abort_smcm->smcm_tag;
+
+		/*
+		 * The abort message was sent.  Release it and
+		 * allocate another command.
+		 */
+		abort_smcm = NULL;
+		goto another;
+	}
+
+out:
+	cv_broadcast(&smrt->smrt_cv_finishq);
+	if (abort_smcm != NULL) {
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(abort_smcm);
+		mutex_enter(&smrt->smrt_mutex);
+	}
+}
+
+int
+smrt_poll_for(smrt_t *smrt, smrt_command_t *smcm)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+	VERIFY(smcm->smcm_status & SMRT_CMD_STATUS_POLLED);
+
+	while (!(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE)) {
+		if (smcm->smcm_expiry != 0) {
+			/*
+			 * This command has an expiry time.  Check to see
+			 * if it has already passed:
+			 */
+			if (smcm->smcm_expiry < gethrtime()) {
+				return (ETIMEDOUT);
+			}
+		}
+
+		if (ddi_in_panic()) {
+			/*
+			 * When the system is panicking, there are no
+			 * interrupts or other threads.  Drive the polling loop
+			 * on our own, but with a small delay to avoid
+			 * aggrevating the controller while we're trying to
+			 * dump.
+			 */
+			(void) smrt_retrieve(smrt);
+			smrt_process_finishq(smrt);
+			drv_usecwait(100);
+			continue;
+		}
+
+		/*
+		 * Wait for command completion to return through the regular
+		 * interrupt handling path.
+		 */
+		if (smcm->smcm_expiry == 0) {
+			cv_wait(&smrt->smrt_cv_finishq, &smrt->smrt_mutex);
+		} else {
+			/*
+			 * Wait only until the expiry time for this command.
+			 */
+			(void) cv_timedwait_sig_hrtime(&smrt->smrt_cv_finishq,
+			    &smrt->smrt_mutex, smcm->smcm_expiry);
+		}
+	}
+
+	/*
+	 * Fire the completion callback for this command.  The callback
+	 * is responsible for freeing the command, so it may not be
+	 * referenced again once this call returns.
+	 */
+	smrt_process_finishq_one(smcm);
+
+	return (0);
+}
+
+void
+smrt_intr_set(smrt_t *smrt, boolean_t enabled)
+{
+	/*
+	 * Read the Interrupt Mask Register.
+	 */
+	uint32_t imr = smrt_get32(smrt, CISS_I2O_INTERRUPT_MASK);
+
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		if (enabled) {
+			imr &= ~CISS_IMR_BIT_SIMPLE_INTR_DISABLE;
+		} else {
+			imr |= CISS_IMR_BIT_SIMPLE_INTR_DISABLE;
+		}
+		smrt_put32(smrt, CISS_I2O_INTERRUPT_MASK, imr);
+		return;
+
+	case SMRT_CTLR_MODE_UNKNOWN:
+		break;
+	}
+	panic("unknown controller mode");
+}
+
+/*
+ * Signal to the controller that we have updated the Configuration Table by
+ * writing to the Inbound Doorbell Register.  The controller will, after some
+ * number of seconds, acknowledge this by clearing the bit.
+ *
+ * If successful, return DDI_SUCCESS.  If the controller takes too long to
+ * acknowledge, return DDI_FAILURE.
+ */
+int
+smrt_cfgtbl_flush(smrt_t *smrt)
+{
+	/*
+	 * Read the current value of the Inbound Doorbell Register.
+	 */
+	uint32_t idr = smrt_get32(smrt, CISS_I2O_INBOUND_DOORBELL);
+
+	/*
+	 * Signal the Configuration Table change to the controller.
+	 */
+	idr |= CISS_IDR_BIT_CFGTBL_CHANGE;
+	smrt_put32(smrt, CISS_I2O_INBOUND_DOORBELL, idr);
+
+	/*
+	 * Wait for the controller to acknowledge the change.
+	 */
+	for (unsigned i = 0; i < smrt_ciss_init_time; i++) {
+		idr = smrt_get32(smrt, CISS_I2O_INBOUND_DOORBELL);
+
+		if ((idr & CISS_IDR_BIT_CFGTBL_CHANGE) == 0) {
+			return (DDI_SUCCESS);
+		}
+
+		/*
+		 * Wait for one second before trying again.
+		 */
+		delay(drv_usectohz(1000000));
+	}
+
+	dev_err(smrt->smrt_dip, CE_WARN, "time out expired before controller "
+	    "configuration completed");
+	return (DDI_FAILURE);
+}
+
+int
+smrt_cfgtbl_transport_has_support(smrt_t *smrt, int xport)
+{
+	VERIFY(xport == CISS_CFGTBL_XPORT_SIMPLE);
+
+	/*
+	 * Read the current value of the "Supported Transport Methods" field in
+	 * the Configuration Table.
+	 */
+	uint32_t xport_active = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->TransportSupport);
+
+	/*
+	 * Check that the desired transport method is supported by the
+	 * controller:
+	 */
+	if ((xport_active & xport) == 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "controller does not support "
+		    "method \"%s\"", xport == CISS_CFGTBL_XPORT_SIMPLE ?
+		    "simple" : "performant");
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_cfgtbl_transport_set(smrt_t *smrt, int xport)
+{
+	VERIFY(xport == CISS_CFGTBL_XPORT_SIMPLE);
+
+	ddi_put32(smrt->smrt_ct_handle, &smrt->smrt_ct->TransportRequest,
+	    xport);
+}
+
+int
+smrt_cfgtbl_transport_confirm(smrt_t *smrt, int xport)
+{
+	VERIFY(xport == CISS_CFGTBL_XPORT_SIMPLE);
+
+	/*
+	 * Read the current value of the TransportActive field in the
+	 * Configuration Table.
+	 */
+	uint32_t xport_active = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->TransportActive);
+
+	/*
+	 * Check that the desired transport method is now active:
+	 */
+	if ((xport_active & xport) == 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "failed to enable transport "
+		    "method \"%s\"", xport == CISS_CFGTBL_XPORT_SIMPLE ?
+		    "simple" : "performant");
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Ensure that the controller is now ready to accept commands.
+	 */
+	if ((xport_active & CISS_CFGTBL_READY_FOR_COMMANDS) == 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "controller not ready to "
+		    "accept commands");
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+uint32_t
+smrt_ctlr_get_maxsgelements(smrt_t *smrt)
+{
+	return (ddi_get32(smrt->smrt_ct_handle, &smrt->smrt_ct->MaxSGElements));
+}
+
+uint32_t
+smrt_ctlr_get_cmdsoutmax(smrt_t *smrt)
+{
+	return (ddi_get32(smrt->smrt_ct_handle, &smrt->smrt_ct->CmdsOutMax));
+}
+
+static uint32_t
+smrt_ctlr_get_hostdrvsup(smrt_t *smrt)
+{
+	return (ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->HostDrvrSupport));
+}
+
+int
+smrt_ctlr_init(smrt_t *smrt)
+{
+	uint8_t signature[4] = { 'C', 'I', 'S', 'S' };
+	int e;
+
+	if ((e = smrt_ctlr_wait_for_state(smrt,
+	    SMRT_WAIT_STATE_READY)) != DDI_SUCCESS) {
+		return (e);
+	}
+
+	/*
+	 * The configuration table contains an ASCII signature ("CISS") which
+	 * should be checked as we initialise the controller.
+	 * See: "9.1 Configuration Table" in CISS Specification.
+	 */
+	for (unsigned i = 0; i < 4; i++) {
+		if (ddi_get8(smrt->smrt_ct_handle,
+		    &smrt->smrt_ct->Signature[i]) != signature[i]) {
+			dev_err(smrt->smrt_dip, CE_WARN, "invalid signature "
+			    "detected");
+			return (DDI_FAILURE);
+		}
+	}
+
+	/*
+	 * Initialise an appropriate Transport Method.  For now, this driver
+	 * only supports the "Simple" method.
+	 */
+	if ((e = smrt_ctlr_init_simple(smrt)) != DDI_SUCCESS) {
+		return (e);
+	}
+
+	/*
+	 * Save some common feature support bitfields.
+	 */
+	smrt->smrt_host_support = smrt_ctlr_get_hostdrvsup(smrt);
+	smrt->smrt_bus_support = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->BusTypes);
+
+	/*
+	 * Read initial controller heartbeat value and mark the current
+	 * reading time.
+	 */
+	smrt->smrt_last_heartbeat = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->HeartBeat);
+	smrt->smrt_last_heartbeat_time = gethrtime();
+
+	/*
+	 * Determine the firmware version of the controller so that we can
+	 * select which type of interrupts to use.
+	 */
+	if ((e = smrt_ctlr_versions(smrt, SMRT_DISCOVER_TIMEOUT,
+	    &smrt->smrt_versions)) != 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "could not identify "
+		    "controller (%d)", e);
+		return (DDI_FAILURE);
+	}
+
+	dev_err(smrt->smrt_dip, CE_NOTE, "!firmware rev %s",
+	    smrt->smrt_versions.smrtv_firmware_rev);
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_ctlr_teardown(smrt_t *smrt)
+{
+	smrt->smrt_status &= ~SMRT_CTLR_STATUS_RUNNING;
+
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		smrt_ctlr_teardown_simple(smrt);
+		return;
+
+	case SMRT_CTLR_MODE_UNKNOWN:
+		return;
+	}
+
+	panic("unknown controller mode");
+}
+
+int
+smrt_ctlr_wait_for_state(smrt_t *smrt, smrt_wait_state_t state)
+{
+	unsigned wait_usec = 100 * 1000;
+	unsigned wait_count = SMRT_WAIT_DELAY_SECONDS * 1000000 / wait_usec;
+
+	VERIFY(state == SMRT_WAIT_STATE_READY ||
+	    state == SMRT_WAIT_STATE_UNREADY);
+
+	/*
+	 * Read from the Scratchpad Register until the expected ready signature
+	 * is detected.  This behaviour is not described in the CISS
+	 * specification.
+	 *
+	 * If the device is not in the desired state immediately, sleep for a
+	 * second and try again.  If the device has not become ready in 300
+	 * seconds, give up.
+	 */
+	for (unsigned i = 0; i < wait_count; i++) {
+		uint32_t spr = smrt_get32(smrt, CISS_I2O_SCRATCHPAD);
+
+		switch (state) {
+		case SMRT_WAIT_STATE_READY:
+			if (spr == CISS_SCRATCHPAD_INITIALISED) {
+				return (DDI_SUCCESS);
+			}
+			break;
+
+		case SMRT_WAIT_STATE_UNREADY:
+			if (spr != CISS_SCRATCHPAD_INITIALISED) {
+				return (DDI_SUCCESS);
+			}
+			break;
+		}
+
+		if (ddi_in_panic()) {
+			/*
+			 * There is no sleep for the panicking, so we
+			 * must spin wait:
+			 */
+			drv_usecwait(wait_usec);
+		} else {
+			/*
+			 * Wait for a quarter second and try again.
+			 */
+			delay(drv_usectohz(wait_usec));
+		}
+	}
+
+	dev_err(smrt->smrt_dip, CE_WARN, "time out waiting for controller "
+	    "to enter state \"%s\"", state == SMRT_WAIT_STATE_READY ?
+	    "ready": "unready");
+	return (DDI_FAILURE);
+}
+
+void
+smrt_lockup_check(smrt_t *smrt)
+{
+	/*
+	 * Read the current controller heartbeat value.
+	 */
+	uint32_t heartbeat = ddi_get32(smrt->smrt_ct_handle,
+	    &smrt->smrt_ct->HeartBeat);
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	/*
+	 * Check to see if the value is the same as last time we looked:
+	 */
+	if (heartbeat != smrt->smrt_last_heartbeat) {
+		/*
+		 * The heartbeat value has changed, which suggests that the
+		 * firmware in the controller has not yet come to a complete
+		 * stop.  Record the new value, as well as the current time.
+		 */
+		smrt->smrt_last_heartbeat = heartbeat;
+		smrt->smrt_last_heartbeat_time = gethrtime();
+		return;
+	}
+
+	/*
+	 * The controller _might_ have been able to signal to us that is
+	 * has locked up.  This is a truly unfathomable state of affairs:
+	 * If the firmware can tell it has flown off the rails, why not
+	 * simply reset the controller?
+	 */
+	uint32_t odr = smrt_get32(smrt, CISS_I2O_OUTBOUND_DOORBELL_STATUS);
+	uint32_t spr = smrt_get32(smrt, CISS_I2O_SCRATCHPAD);
+	if ((odr & CISS_ODR_BIT_LOCKUP) != 0) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "HP SmartArray firmware has "
+		    "reported a critical fault (odr %08x spr %08x)",
+		    odr, spr);
+	}
+
+	if (gethrtime() > smrt->smrt_last_heartbeat_time + 60 * NANOSEC) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "HP SmartArray firmware has "
+		    "stopped responding (odr %08x spr %08x)",
+		    odr, spr);
+	}
+}
+
+/*
+ * Probe the controller with the IDENTIFY CONTROLLER request.  This is a BMIC
+ * command, so it must be submitted to the controller and we must poll for its
+ * completion.  This functionality is only presently used during controller
+ * initialisation, so it uses the special pre-initialisation path for command
+ * allocation and submission.
+ */
+static int
+smrt_ctlr_identify(smrt_t *smrt, uint16_t timeout,
+    smrt_identify_controller_t *resp)
+{
+	smrt_command_t *smcm;
+	smrt_identify_controller_req_t smicr;
+	int r;
+	size_t sz;
+
+	/*
+	 * Allocate a command with a data buffer; the controller will fill it
+	 * with identification information.  There is some suggestion in the
+	 * firmware-level specification that the buffer length should be a
+	 * multiple of 512 bytes for some controllers, so we round up.
+	 */
+	sz = P2ROUNDUP_TYPED(sizeof (*resp), 512, size_t);
+	if ((smcm = smrt_command_alloc_preinit(smrt, sz, KM_SLEEP)) == NULL) {
+		return (ENOMEM);
+	}
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (smicr);
+	smcm->smcm_va_cmd->Request.Timeout = timeout;
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+
+	/*
+	 * Construct the IDENTIFY CONTROLLER request CDB.  Note that any
+	 * reserved fields in the request must be filled with zeroes.
+	 */
+	bzero(&smicr, sizeof (smicr));
+	smicr.smicr_opcode = CISS_SCMD_BMIC_READ;
+	smicr.smicr_lun = 0;
+	smicr.smicr_command = CISS_BMIC_IDENTIFY_CONTROLLER;
+	bcopy(&smicr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (smicr)));
+
+	/*
+	 * Send the command to the device and poll for its completion.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	smcm->smcm_expiry = gethrtime() + timeout * NANOSEC;
+	if ((r = smrt_preinit_command_simple(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * This command timed out, but the driver is not presently
+		 * initialised to the point where we can try to abort it.
+		 * The command was created with the PREINIT type, so it
+		 * does not appear in the global command tracking list.
+		 * In order to avoid problems with DMA from the controller,
+		 * we have to leak the command allocation.
+		 */
+		smcm = NULL;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 * The controller was reset while we were trying to identify
+		 * it.  Report failure.
+		 */
+		r = EIO;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "identify "
+			    "controller error: status 0x%x",
+			    ei->CommandStatus);
+			r = EIO;
+			goto out;
+		}
+	}
+
+	if (resp != NULL) {
+		/*
+		 * Copy the identify response out for the caller.
+		 */
+		bcopy(smcm->smcm_internal->smcmi_va, resp, sizeof (*resp));
+	}
+
+	r = 0;
+
+out:
+	if (smcm != NULL) {
+		smrt_command_free(smcm);
+	}
+	return (r);
+}
+
+/*
+ * The firmware versions in an IDENTIFY CONTROLLER response generally take
+ * the form of a four byte ASCII string containing a dotted decimal version
+ * number; e.g., "8.00".
+ *
+ * This function sanitises the firmware version, replacing unexpected
+ * values with a question mark.
+ */
+static void
+smrt_copy_firmware_version(uint8_t *src, char *dst)
+{
+	for (unsigned i = 0; i < 4; i++) {
+		/*
+		 * Make sure that this is a 7-bit clean ASCII value.
+		 */
+		char c = src[i] <= 0x7f ? (char)(src[i] & 0x7f) : '?';
+
+		if (isalnum(c) || c == '.' || c == ' ') {
+			dst[i] = c;
+		} else {
+			dst[i] = '?';
+		}
+	}
+	dst[4] = '\0';
+}
+
+/*
+ * Using an IDENTIFY CONTROLLER request, determine firmware and controller
+ * version details.  See the comments for "smrt_ctlr_identify()" for more
+ * details about calling context.
+ */
+static int
+smrt_ctlr_versions(smrt_t *smrt, uint16_t timeout, smrt_versions_t *smrtv)
+{
+	smrt_identify_controller_t smic;
+	int r;
+
+	if ((r = smrt_ctlr_identify(smrt, timeout, &smic)) != 0) {
+		return (r);
+	}
+
+	smrtv->smrtv_hardware_version = smic.smic_hardware_version;
+	smrt_copy_firmware_version(smic.smic_firmware_rev,
+	    smrtv->smrtv_firmware_rev);
+	smrt_copy_firmware_version(smic.smic_recovery_rev,
+	    smrtv->smrtv_recovery_rev);
+	smrt_copy_firmware_version(smic.smic_bootblock_rev,
+	    smrtv->smrtv_bootblock_rev);
+
+	return (0);
+}
+
+int
+smrt_ctlr_reset(smrt_t *smrt)
+{
+	smrt_command_t *smcm, *smcm_nop;
+	int r;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (ddi_in_panic()) {
+		goto skip_check;
+	}
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+		/*
+		 * Don't pile on.  One reset is enough.  Wait until
+		 * it's complete, and then return success.
+		 */
+		while (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+			cv_wait(&smrt->smrt_cv_finishq, &smrt->smrt_mutex);
+		}
+		return (0);
+	}
+	smrt->smrt_status |= SMRT_CTLR_STATUS_RESETTING;
+	smrt->smrt_last_reset_start = gethrtime();
+	smrt->smrt_stats.smrts_ctlr_resets++;
+
+skip_check:
+	/*
+	 * Allocate two commands: one for the soft reset message, which we
+	 * cannot free until the controller has reset; and one for the ping we
+	 * will use to determine when it is once again functional.
+	 */
+	mutex_exit(&smrt->smrt_mutex);
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL) {
+		mutex_enter(&smrt->smrt_mutex);
+		return (ENOMEM);
+	}
+	if ((smcm_nop = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL) {
+		smrt_command_free(smcm);
+		mutex_enter(&smrt->smrt_mutex);
+		return (ENOMEM);
+	}
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send a soft reset command to the controller.  If this command
+	 * succeeds, there will likely be no completion notification.  Instead,
+	 * the device should become unavailable for some period of time and
+	 * then become available again.  Once available again, we know the soft
+	 * reset has completed and should abort all in-flight commands.
+	 */
+	smrt_write_message_reset_ctlr(smcm);
+
+	/*
+	 * Disable interrupts now.
+	 */
+	smrt_intr_set(smrt, B_FALSE);
+
+	dev_err(smrt->smrt_dip, CE_WARN, "attempting controller soft reset");
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "submit failed (%d)", r);
+	}
+
+	/*
+	 * Mark every currently inflight command as being reset, including the
+	 * soft reset command we just sent.  Once we confirm the reset works,
+	 * we can safely report that these commands have failed.
+	 */
+	for (smrt_command_t *t = avl_first(&smrt->smrt_inflight);
+	    t != NULL; t = AVL_NEXT(&smrt->smrt_inflight, t)) {
+		t->smcm_status |= SMRT_CMD_STATUS_RESET_SENT;
+	}
+
+	/*
+	 * Now that we have submitted our soft reset command, prevent
+	 * the rest of the driver from interacting with the controller.
+	 */
+	smrt->smrt_status &= ~SMRT_CTLR_STATUS_RUNNING;
+
+	/*
+	 * We do not expect a completion from the controller for our soft
+	 * reset command, but we also cannot remove it from the inflight
+	 * list until we know the controller has actually reset.  To do
+	 * otherwise would potentially allow the controller to scribble
+	 * on the memory we were using.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+
+	if (smrt_ctlr_wait_for_state(smrt, SMRT_WAIT_STATE_UNREADY) !=
+	    DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "controller did not become unready");
+	}
+	dev_err(smrt->smrt_dip, CE_NOTE, "soft reset: controller unready");
+
+	if (smrt_ctlr_wait_for_state(smrt, SMRT_WAIT_STATE_READY) !=
+	    DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "controller did not come become ready");
+	}
+	dev_err(smrt->smrt_dip, CE_NOTE, "soft reset: controller ready");
+
+	/*
+	 * In at least the Smart Array P420i, the controller can take 30-45
+	 * seconds after the scratchpad register shows it as being available
+	 * before it is ready to receive commands.  In order to avoid hitting
+	 * it too early with our post-reset ping, we will sleep for 10 seconds
+	 * here.
+	 */
+	if (ddi_in_panic()) {
+		drv_usecwait(10 * MICROSEC);
+	} else {
+		delay(drv_usectohz(10 * MICROSEC));
+	}
+
+	smrt_ctlr_teardown(smrt);
+	if (smrt_ctlr_init(smrt) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "controller transport could not be configured");
+	}
+	dev_err(smrt->smrt_dip, CE_NOTE, "soft reset: controller configured");
+
+	smrt_write_message_nop(smcm_nop, 0);
+	smcm_nop->smcm_status |= SMRT_CMD_STATUS_POLLED |
+	    SMRT_CMD_IGNORE_RUNNING;
+	if ((r = smrt_submit(smrt, smcm_nop)) != 0) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "ping could not be submitted (%d)", r);
+	}
+
+	/*
+	 * Interrupts are still masked at this stage.  Poll manually in
+	 * a way that will not trigger regular finish queue processing:
+	 */
+	VERIFY(smcm_nop->smcm_status & SMRT_CMD_STATUS_INFLIGHT);
+	for (unsigned i = 0; i < 600; i++) {
+		smrt_retrieve_simple(smrt);
+
+		if (!(smcm_nop->smcm_status & SMRT_CMD_STATUS_INFLIGHT)) {
+			/*
+			 * Remove the ping command from the finish queue and
+			 * process it manually.  This processing must mirror
+			 * what would have been done in smrt_process_finishq().
+			 */
+			VERIFY(list_link_active(&smcm_nop->smcm_link_finish));
+			list_remove(&smrt->smrt_finishq, smcm_nop);
+			smrt_process_finishq_sync(smcm_nop);
+			smcm_nop->smcm_status |= SMRT_CMD_STATUS_POLL_COMPLETE;
+			smrt_process_finishq_one(smcm_nop);
+			break;
+		}
+
+		if (ddi_in_panic()) {
+			drv_usecwait(100 * 1000);
+		} else {
+			delay(drv_usectohz(100 * 1000));
+		}
+	}
+
+	if (!(smcm_nop->smcm_status & SMRT_CMD_STATUS_COMPLETE)) {
+		dev_err(smrt->smrt_dip, CE_PANIC, "soft reset failed: "
+		    "ping did not complete");
+	} else if (smcm_nop->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		dev_err(smrt->smrt_dip, CE_WARN, "soft reset: ping completed "
+		    "in error (status %u)",
+		    (unsigned)smcm_nop->smcm_va_err->CommandStatus);
+	} else {
+		dev_err(smrt->smrt_dip, CE_NOTE, "soft reset: ping completed");
+	}
+
+	/*
+	 * Now that the controller is working again, we can abort any
+	 * commands that were inflight during the reset.
+	 */
+	smrt_command_t *nt;
+	for (smrt_command_t *t = avl_first(&smrt->smrt_inflight);
+	    t != NULL; t = nt) {
+		nt = AVL_NEXT(&smrt->smrt_inflight, t);
+
+		if (t->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+			avl_remove(&smrt->smrt_inflight, t);
+			t->smcm_status &= ~SMRT_CMD_STATUS_INFLIGHT;
+
+			list_insert_tail(&smrt->smrt_finishq, t);
+		}
+	}
+
+	/*
+	 * Quiesce our discovery thread.  Note, because
+	 * SMRT_CTLR_STATUS_RESTARTING is set, nothing can cause it to be
+	 * enabled again.
+	 */
+	if (!ddi_in_panic()) {
+		mutex_exit(&smrt->smrt_mutex);
+		ddi_taskq_wait(smrt->smrt_discover_taskq);
+		mutex_enter(&smrt->smrt_mutex);
+	}
+
+	/*
+	 * Re-enable interrupts.  Now, we must kick off a discovery to make sure
+	 * that the system is in a sane state and that we can perform I/O.
+	 */
+	smrt_intr_set(smrt, B_TRUE);
+	smrt->smrt_status &= ~SMRT_CTLR_STATUS_RESETTING;
+	smrt->smrt_status |= SMRT_CTLR_DISCOVERY_REQUIRED;
+
+	/*
+	 * Attempt a discovery to make sure that the drivers sees a realistic
+	 * view of the world.  If we're not in panic context, spin for the
+	 * asynchronous process to complete, otherwise we're in panic context
+	 * and this is going to happen regardless if we want it to or not.
+	 * Before we kick off the request to run discovery, we reset the
+	 * discovery request flags as we know that nothing else can consider
+	 * running discovery and we don't want to delay until the next smrt
+	 * periodic tick if we can avoid it.  In panic context, if this failed,
+	 * then we won't make it back.
+	 */
+	VERIFY0(smrt->smrt_status & SMRT_CTLR_DISCOVERY_RUNNING);
+	smrt->smrt_status &= ~(SMRT_CTLR_DISCOVERY_MASK);
+	smrt_discover(smrt);
+	if (!ddi_in_panic()) {
+		while (smrt->smrt_status & SMRT_CTLR_DISCOVERY_REQUIRED) {
+			cv_wait(&smrt->smrt_cv_finishq, &smrt->smrt_mutex);
+		}
+	}
+
+	smrt->smrt_status |= SMRT_CTLR_STATUS_RUNNING;
+	smrt->smrt_last_reset_finish = gethrtime();
+
+	/*
+	 * Wake anybody that was waiting for the reset to complete.
+	 */
+	cv_broadcast(&smrt->smrt_cv_finishq);
+
+	/*
+	 * Process the completion queue one last time before we let go
+	 * of the mutex.
+	 */
+	smrt_process_finishq(smrt);
+
+	mutex_exit(&smrt->smrt_mutex);
+	smrt_command_free(smcm_nop);
+	mutex_enter(&smrt->smrt_mutex);
+	return (0);
+}
+
+int
+smrt_event_init(smrt_t *smrt)
+{
+	int ret;
+	smrt_command_t *event, *cancel;
+
+	event = smrt_command_alloc(smrt, SMRT_CMDTYPE_EVENT, KM_NOSLEEP);
+	if (event == NULL)
+		return (ENOMEM);
+	if (smrt_command_attach_internal(smrt, event, SMRT_EVENT_NOTIFY_BUFLEN,
+	    KM_NOSLEEP) != 0) {
+		smrt_command_free(event);
+		return (ENOMEM);
+	}
+	smrt_write_message_event_notify(event);
+
+	cancel = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL, KM_NOSLEEP);
+	if (cancel == NULL) {
+		smrt_command_free(event);
+		return (ENOMEM);
+	}
+	if (smrt_command_attach_internal(smrt, cancel, SMRT_EVENT_NOTIFY_BUFLEN,
+	    KM_NOSLEEP) != 0) {
+		smrt_command_free(event);
+		smrt_command_free(cancel);
+		return (ENOMEM);
+	}
+	smrt_write_message_cancel_event_notify(cancel);
+
+	cv_init(&smrt->smrt_event_queue, NULL, CV_DRIVER, NULL);
+
+	mutex_enter(&smrt->smrt_mutex);
+	if ((ret = smrt_submit(smrt, event)) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(event);
+		smrt_command_free(cancel);
+		return (ret);
+	}
+
+	smrt->smrt_event_cmd = event;
+	smrt->smrt_event_cancel_cmd = cancel;
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (0);
+}
+
+void
+smrt_event_complete(smrt_command_t *smcm)
+{
+	smrt_event_notify_t *sen;
+	boolean_t log, rescan;
+
+	boolean_t intervene = B_FALSE;
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+	VERIFY3P(smcm, ==, smrt->smrt_event_cmd);
+	VERIFY0(smrt->smrt_status & SMRT_CTLR_ASYNC_INTERVENTION);
+
+	smrt->smrt_stats.smrts_events_received++;
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_DETACHING) {
+		cv_signal(&smrt->smrt_event_queue);
+		return;
+	}
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+		intervene = B_TRUE;
+		goto clean;
+	}
+
+	/*
+	 * The event notification command failed for some reason.  Attempt to
+	 * drive on and try again at the next intervention period.  Because this
+	 * may represent a programmer error (though it's hard to know), we wait
+	 * until the next intervention period and don't panic.
+	 */
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+		intervene = B_TRUE;
+
+		smrt->smrt_stats.smrts_events_errors++;
+		dev_err(smrt->smrt_dip, CE_WARN, "!event notification request "
+		    "error: status 0x%x", ei->CommandStatus);
+		goto clean;
+	}
+
+	sen = smcm->smcm_internal->smcmi_va;
+	log = rescan = B_FALSE;
+	switch (sen->sen_class) {
+	case SMRT_EVENT_CLASS_PROTOCOL:
+		/*
+		 * Most of the event protocol class events aren't really
+		 * actionable.  However, subclass 1 indicates errors.  Today,
+		 * the only error is an event overflow.  If there's an event
+		 * overflow, then we must assume that we need to rescan.
+		 */
+		if (sen->sen_subclass == SMRT_EVENT_PROTOCOL_SUBCLASS_ERROR) {
+			rescan = B_TRUE;
+		}
+		break;
+	case SMRT_EVENT_CLASS_HOTPLUG:
+		/*
+		 * We want to log all hotplug events.  However we only need to
+		 * scan these if the subclass indicates the event is for a disk.
+		 */
+		log = B_TRUE;
+		if (sen->sen_subclass == SMRT_EVENT_HOTPLUG_SUBCLASS_DRIVE) {
+			rescan = B_TRUE;
+		}
+		break;
+	case SMRT_EVENT_CLASS_HWERROR:
+	case SMRT_EVENT_CLASS_ENVIRONMENT:
+		log = B_TRUE;
+		break;
+	case SMRT_EVENT_CLASS_PHYS:
+		log = B_TRUE;
+		/*
+		 * This subclass indicates some change for physical drives.  As
+		 * such, this should trigger a rescan.
+		 */
+		if (sen->sen_subclass == SMRT_EVENT_PHYS_SUBCLASS_STATE) {
+			rescan = B_TRUE;
+		}
+		break;
+	case SMRT_EVENT_CLASS_LOGVOL:
+		rescan = B_TRUE;
+		log = B_TRUE;
+		break;
+	default:
+		/*
+		 * While there are other classes of events, it's hard to say how
+		 * actionable they are for the moment.  If we revamp this such
+		 * that it becomes an ireport based system, then we should just
+		 * always log these.  We opt not to at the moment to try and be
+		 * kind to the system log.
+		 */
+		break;
+	}
+
+	/*
+	 * Ideally, this would be an ireport that we could pass onto
+	 * administrators; however, since we don't have any way to generate
+	 * that, we provide a subset of the event information.
+	 */
+	if (log) {
+		const char *rmsg;
+		if (rescan == B_TRUE) {
+			rmsg = "rescanning";
+		} else {
+			rmsg = "not rescanning";
+		}
+		if (sen->sen_message[0] != '\0') {
+			sen->sen_message[sizeof (sen->sen_message) - 1] = '\0';
+			dev_err(smrt->smrt_dip, CE_NOTE, "!controller event "
+			    "class/sub-class/detail %x, %x, %x: %s; %s devices",
+			    sen->sen_class, sen->sen_subclass, sen->sen_detail,
+			    sen->sen_message, rmsg);
+		} else {
+			dev_err(smrt->smrt_dip, CE_NOTE, "!controller event "
+			    "class/sub-class/detail %x, %x, %x; %s devices",
+			    sen->sen_class, sen->sen_subclass, sen->sen_detail,
+			    rmsg);
+		}
+	}
+
+	if (rescan)
+		smrt_discover_request(smrt);
+
+clean:
+	mutex_exit(&smrt->smrt_mutex);
+	smrt_command_reuse(smcm);
+	bzero(smcm->smcm_internal->smcmi_va, SMRT_EVENT_NOTIFY_BUFLEN);
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Make sure we're not _now_ detaching or resetting.
+	 */
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_DETACHING) {
+		cv_signal(&smrt->smrt_event_queue);
+		return;
+	}
+
+	if ((smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) != 0 ||
+	    intervene == B_TRUE) {
+		smrt->smrt_status |= SMRT_CTLR_ASYNC_INTERVENTION;
+		return;
+	}
+
+	/*
+	 * Check out command count per tick.  If it's too high, leave it for
+	 * intervention to solve.  Likely there is some serious driver or
+	 * firmware error going on.
+	 */
+	smrt->smrt_event_count++;
+	if (smrt->smrt_event_count > smrt_event_intervention_threshold) {
+		smrt->smrt_status |= SMRT_CTLR_ASYNC_INTERVENTION;
+		return;
+	}
+
+	if (smrt_submit(smrt, smcm) != 0) {
+		smrt->smrt_status |= SMRT_CTLR_ASYNC_INTERVENTION;
+	}
+}
+
+void
+smrt_event_fini(smrt_t *smrt)
+{
+	int ret;
+	smrt_command_t *event, *cancel;
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * If intervention has been requested, there is nothing for us to do. We
+	 * clear the flag so nothing else accidentally sees this and takes
+	 * action.  We also don't need to bother sending a cancellation request,
+	 * as there is no outstanding event.
+	 */
+	if (smrt->smrt_status & SMRT_CTLR_ASYNC_INTERVENTION) {
+		smrt->smrt_status &= ~SMRT_CTLR_ASYNC_INTERVENTION;
+		goto free;
+	}
+
+	/*
+	 * Submit a cancel request for the event notification queue.  Because we
+	 * submit both the cancel event and the regular notification event as an
+	 * ordered command, we know that by the time this completes, that the
+	 * existing one will have completed.
+	 */
+	smrt->smrt_event_cancel_cmd->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((ret = smrt_submit(smrt, smrt->smrt_event_cancel_cmd)) != 0) {
+		/*
+		 * This is unfortunate.  We've failed to submit the command.  At
+		 * this point all we can do is reset the device.  If the reset
+		 * succeeds, we're done and we can clear all the memory.  If it
+		 * fails, then all we can do is just leak the command and scream
+		 * to the system, sorry.
+		 */
+		if (smrt_ctlr_reset(smrt) != 0) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to reset "
+			    "device after failure to submit cancellation "
+			    "(%d), abandoning smrt_command_t at address %p",
+			    ret, smrt->smrt_event_cmd);
+			smrt->smrt_event_cmd = NULL;
+			goto free;
+		}
+	}
+
+	smrt->smrt_event_cancel_cmd->smcm_expiry = gethrtime() +
+	    SMRT_ASYNC_CANCEL_TIMEOUT * NANOSEC;
+	if ((ret = smrt_poll_for(smrt, smrt->smrt_event_cancel_cmd)) != 0) {
+		VERIFY3S(ret, ==, ETIMEDOUT);
+		VERIFY0(smrt->smrt_event_cancel_cmd->smcm_status &
+		    SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out.  All we can do is hope a reset will
+		 * work.
+		 */
+		if (smrt_ctlr_reset(smrt) != 0) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to reset "
+			    "device after failure to poll for async "
+			    "cancellation command abandoning smrt_command_t "
+			    "event command at address %p and cancellation "
+			    "command at %p", smrt->smrt_event_cmd,
+			    smrt->smrt_event_cancel_cmd);
+			smrt->smrt_event_cmd = NULL;
+			smrt->smrt_event_cancel_cmd = NULL;
+			goto free;
+		}
+
+	}
+
+	/*
+	 * Well, in the end, it's results that count.
+	 */
+	if (smrt->smrt_event_cancel_cmd->smcm_status &
+	    SMRT_CMD_STATUS_RESET_SENT) {
+		goto free;
+	}
+
+	if (smrt->smrt_event_cancel_cmd->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smrt->smrt_event_cancel_cmd->smcm_va_err;
+
+		/*
+		 * This can return a CISS_CMD_TARGET_STATUS entry when the
+		 * controller doesn't think a command is outstanding.  It is
+		 * possible we raced, so don't think too much about that case.
+		 * Anything else leaves us between a rock and a hard place, the
+		 * only way out is a reset.
+		 */
+		if (ei->CommandStatus != CISS_CMD_TARGET_STATUS &&
+		    smrt_ctlr_reset(smrt) != 0) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to reset  "
+			    "device after receiving an error on the async "
+			    "cancellation command (%d); abandoning "
+			    "smrt_command_t event command at address %p and "
+			    "cancellation command at %p", ei->CommandStatus,
+			    smrt->smrt_event_cmd, smrt->smrt_event_cancel_cmd);
+			smrt->smrt_event_cmd = NULL;
+			smrt->smrt_event_cancel_cmd = NULL;
+			goto free;
+		}
+	}
+
+free:
+	event = smrt->smrt_event_cmd;
+	smrt->smrt_event_cmd = NULL;
+	cancel = smrt->smrt_event_cancel_cmd;
+	smrt->smrt_event_cancel_cmd = NULL;
+	mutex_exit(&smrt->smrt_mutex);
+	if (event != NULL)
+		smrt_command_free(event);
+	if (cancel != NULL)
+		smrt_command_free(cancel);
+	cv_destroy(&smrt->smrt_event_queue);
+}
+
+/*
+ * We've been asked to do a discovery in panic context.  This would have
+ * occurred because there was a device reset.  Because we can't rely on the
+ * target maps, all we can do at the moment is go over all the active targets
+ * and note which ones no longer exist.  If this target was required to dump,
+ * then the dump code will encounter a fatal error.  If not, then we should
+ * count ourselves surprisingly lucky.
+ */
+static void
+smrt_discover_panic_check(smrt_t *smrt)
+{
+	smrt_target_t *smtg;
+
+	ASSERT(MUTEX_HELD(&smrt->smrt_mutex));
+	for (smtg = list_head(&smrt->smrt_targets); smtg != NULL;
+	    smtg = list_next(&smrt->smrt_targets, smtg)) {
+		uint64_t gen;
+
+		if (smtg->smtg_physical) {
+			smrt_physical_t *smpt = smtg->smtg_lun.smtg_phys;
+			/*
+			 * Don't worry about drives that aren't visible.
+			 */
+			if (!smpt->smpt_visible)
+				continue;
+			gen = smpt->smpt_gen;
+		} else {
+			smrt_volume_t *smlv = smtg->smtg_lun.smtg_vol;
+			gen = smlv->smlv_gen;
+		}
+
+		if (gen != smrt->smrt_discover_gen) {
+			dev_err(smrt->smrt_dip, CE_WARN, "target %s "
+			    "disappeared during post-panic discovery",
+			    scsi_device_unit_address(smtg->smtg_scsi_dev));
+			smtg->smtg_gone = B_TRUE;
+		}
+	}
+}
+
+static void
+smrt_discover(void *arg)
+{
+	int log = 0, phys = 0;
+	smrt_t *smrt = arg;
+	uint64_t gen;
+	boolean_t runphys, runvirt;
+
+	mutex_enter(&smrt->smrt_mutex);
+	smrt->smrt_status |= SMRT_CTLR_DISCOVERY_RUNNING;
+	smrt->smrt_status &= ~SMRT_CTLR_DISCOVERY_REQUESTED;
+
+	smrt->smrt_discover_gen++;
+	gen = smrt->smrt_discover_gen;
+	runphys = smrt->smrt_phys_tgtmap != NULL;
+	runvirt = smrt->smrt_virt_tgtmap != NULL;
+	mutex_exit(&smrt->smrt_mutex);
+	if (runphys)
+		phys = smrt_phys_discover(smrt, SMRT_DISCOVER_TIMEOUT, gen);
+	if (runvirt)
+		log = smrt_logvol_discover(smrt, SMRT_DISCOVER_TIMEOUT, gen);
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (phys != 0 || log != 0) {
+		if (!ddi_in_panic()) {
+			smrt->smrt_status |= SMRT_CTLR_DISCOVERY_PERIODIC;
+		} else {
+			panic("smrt_t %p failed to perform discovery after "
+			    "a reset in panic context, unable to continue. "
+			    "logvol: %d, phys: %d", smrt, log, phys);
+		}
+	} else {
+		if (!ddi_in_panic() &&
+		    smrt->smrt_status & SMRT_CTLR_DISCOVERY_REQUIRED) {
+			smrt->smrt_status &= ~SMRT_CTLR_DISCOVERY_REQUIRED;
+			cv_broadcast(&smrt->smrt_cv_finishq);
+		}
+
+		if (ddi_in_panic()) {
+			smrt_discover_panic_check(smrt);
+		}
+	}
+	smrt->smrt_status &= ~SMRT_CTLR_DISCOVERY_RUNNING;
+	if (smrt->smrt_status & SMRT_CTLR_DISCOVERY_REQUESTED)
+		smrt->smrt_status |= SMRT_CTLR_DISCOVERY_PERIODIC;
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+/*
+ * Request discovery, which is always run via a taskq.
+ */
+void
+smrt_discover_request(smrt_t *smrt)
+{
+	boolean_t run;
+	ASSERT(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (ddi_in_panic()) {
+		smrt_discover(smrt);
+		return;
+	}
+
+	run = (smrt->smrt_status & SMRT_CTLR_DISCOVERY_MASK) == 0;
+	smrt->smrt_status |= SMRT_CTLR_DISCOVERY_REQUESTED;
+	if (run && ddi_taskq_dispatch(smrt->smrt_discover_taskq,
+	    smrt_discover, smrt, DDI_NOSLEEP) != DDI_SUCCESS) {
+		smrt->smrt_status |= SMRT_CTLR_DISCOVERY_PERIODIC;
+		smrt->smrt_stats.smrts_discovery_tq_errors++;
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss_simple.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss_simple.c
new file mode 100644
index 0000000000..1b3d7b2602
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_ciss_simple.c
@@ -0,0 +1,282 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2016 Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+uint_t
+smrt_isr_hw_simple(caddr_t arg1, caddr_t arg2)
+{
+	_NOTE(ARGUNUSED(arg2))
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	smrt_t *smrt = (smrt_t *)arg1;
+	uint32_t isr = smrt_get32(smrt, CISS_I2O_INTERRUPT_STATUS);
+	hrtime_t now = gethrtime();
+
+	mutex_enter(&smrt->smrt_mutex);
+	if (!(smrt->smrt_status & SMRT_CTLR_STATUS_RUNNING)) {
+		smrt->smrt_stats.smrts_unclaimed_interrupts++;
+		smrt->smrt_last_interrupt_unclaimed = now;
+
+		/*
+		 * We should not be receiving interrupts from the controller
+		 * while the driver is not running.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		return (DDI_INTR_UNCLAIMED);
+	}
+
+	/*
+	 * Check to see if this interrupt came from the device:
+	 */
+	if ((isr & CISS_ISR_BIT_SIMPLE_INTR) == 0) {
+		smrt->smrt_stats.smrts_unclaimed_interrupts++;
+		smrt->smrt_last_interrupt_unclaimed = now;
+
+		/*
+		 * Check to see if the firmware has come to rest.  If it has,
+		 * this routine will panic the system.
+		 */
+		smrt_lockup_check(smrt);
+
+		mutex_exit(&smrt->smrt_mutex);
+		return (DDI_INTR_UNCLAIMED);
+	}
+
+	smrt->smrt_stats.smrts_claimed_interrupts++;
+	smrt->smrt_last_interrupt_claimed = now;
+
+	/*
+	 * The interrupt was from our controller, so collect any pending
+	 * command completions.
+	 */
+	smrt_retrieve_simple(smrt);
+
+	/*
+	 * Process any commands in the completion queue.
+	 */
+	smrt_process_finishq(smrt);
+
+	mutex_exit(&smrt->smrt_mutex);
+	return (DDI_INTR_CLAIMED);
+}
+
+/*
+ * Read tags and process completion of the associated command until the supply
+ * of tags is exhausted.
+ */
+void
+smrt_retrieve_simple(smrt_t *smrt)
+{
+	uint32_t opq;
+	uint32_t none = 0xffffffff;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	while ((opq = smrt_get32(smrt, CISS_I2O_OUTBOUND_POST_Q)) != none) {
+		uint32_t tag = CISS_OPQ_READ_TAG(opq);
+		smrt_command_t *smcm;
+
+		if ((smcm = smrt_lookup_inflight(smrt, tag)) == NULL) {
+			dev_err(smrt->smrt_dip, CE_WARN, "spurious tag %x",
+			    tag);
+			continue;
+		}
+
+		avl_remove(&smrt->smrt_inflight, smcm);
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_INFLIGHT;
+		if (CISS_OPQ_READ_ERROR(opq) != 0) {
+			smcm->smcm_status |= SMRT_CMD_STATUS_ERROR;
+		}
+		smcm->smcm_time_complete = gethrtime();
+
+		/*
+		 * Push this command onto the completion queue.
+		 */
+		list_insert_tail(&smrt->smrt_finishq, smcm);
+	}
+}
+
+/*
+ * Submit a command to the controller by posting it to the Inbound Post Queue
+ * Register.
+ */
+void
+smrt_submit_simple(smrt_t *smrt, smrt_command_t *smcm)
+{
+	smrt_put32(smrt, CISS_I2O_INBOUND_POST_Q, smcm->smcm_pa_cmd);
+}
+
+/*
+ * Submit a command to the controller by posting it to the Inbound Post Queue
+ * Register.  Immediately begin polling on the completion of that command.
+ *
+ * NOTE: This function is for controller initialisation only.  It discards
+ * completions of commands other than the expected command as spurious, and
+ * will not interact correctly with the rest of the driver once it is running.
+ */
+int
+smrt_preinit_command_simple(smrt_t *smrt, smrt_command_t *smcm)
+{
+	/*
+	 * The controller must be initialised to use the Simple Transport
+	 * Method, but not be marked RUNNING.  The command to process must be a
+	 * PREINIT command with the expected tag number, marked for polling.
+	 */
+	VERIFY(smrt->smrt_ctlr_mode == SMRT_CTLR_MODE_SIMPLE);
+	VERIFY(!(smrt->smrt_status & SMRT_CTLR_STATUS_RUNNING));
+	VERIFY(smcm->smcm_type == SMRT_CMDTYPE_PREINIT);
+	VERIFY(smcm->smcm_status & SMRT_CMD_STATUS_POLLED);
+	VERIFY3U(smcm->smcm_tag, ==, SMRT_PRE_TAG_NUMBER);
+
+	/*
+	 * Submit this command to the controller.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_INFLIGHT;
+	smrt_put32(smrt, CISS_I2O_INBOUND_POST_Q, smcm->smcm_pa_cmd);
+
+	/*
+	 * Poll the controller for completions until we see the command we just
+	 * sent, or the timeout expires.
+	 */
+	for (;;) {
+		uint32_t none = 0xffffffff;
+		uint32_t opq = smrt_get32(smrt, CISS_I2O_OUTBOUND_POST_Q);
+		uint32_t tag;
+
+		if (smcm->smcm_expiry != 0) {
+			/*
+			 * This command has an expiry time.  Check to see
+			 * if it has already passed:
+			 */
+			if (smcm->smcm_expiry < gethrtime()) {
+				return (ETIMEDOUT);
+			}
+		}
+
+		if (opq == none) {
+			delay(drv_usectohz(10 * 1000));
+			continue;
+		}
+
+		if ((tag = CISS_OPQ_READ_TAG(opq)) != SMRT_PRE_TAG_NUMBER) {
+			dev_err(smrt->smrt_dip, CE_WARN, "unexpected tag 0x%x"
+			    " completed during driver init", tag);
+			delay(drv_usectohz(10 * 1000));
+			continue;
+		}
+
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_INFLIGHT;
+		if (CISS_OPQ_READ_ERROR(opq) != 0) {
+			smcm->smcm_status |= SMRT_CMD_STATUS_ERROR;
+		}
+		smcm->smcm_time_complete = gethrtime();
+		smcm->smcm_status |= SMRT_CMD_STATUS_POLL_COMPLETE;
+
+		return (0);
+	}
+}
+
+int
+smrt_ctlr_init_simple(smrt_t *smrt)
+{
+	VERIFY(smrt->smrt_ctlr_mode == SMRT_CTLR_MODE_UNKNOWN);
+
+	if (smrt_cfgtbl_transport_has_support(smrt,
+	    CISS_CFGTBL_XPORT_SIMPLE) != DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+	smrt->smrt_ctlr_mode = SMRT_CTLR_MODE_SIMPLE;
+
+	/*
+	 * Disable device interrupts while we are setting up.
+	 */
+	smrt_intr_set(smrt, B_FALSE);
+
+	if ((smrt->smrt_maxcmds = smrt_ctlr_get_cmdsoutmax(smrt)) == 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "maximum outstanding "
+		    "commands set to zero");
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Determine the number of Scatter/Gather List entries this controller
+	 * supports.  The maximum number we allow is CISS_MAXSGENTRIES: the
+	 * number of elements in the static struct we use for command
+	 * submission.
+	 */
+	if ((smrt->smrt_sg_cnt = smrt_ctlr_get_maxsgelements(smrt)) == 0) {
+		/*
+		 * The CISS specification states that if this value is
+		 * zero, we should assume a value of 31 for compatibility
+		 * with older firmware.
+		 */
+		smrt->smrt_sg_cnt = CISS_SGCNT_FALLBACK;
+
+	} else if (smrt->smrt_sg_cnt > CISS_MAXSGENTRIES) {
+		/*
+		 * If the controller supports more than we have allocated,
+		 * just cap the count at the allocation size.
+		 */
+		smrt->smrt_sg_cnt = CISS_MAXSGENTRIES;
+	}
+
+	/*
+	 * Zero the upper 32 bits of the address in the Controller.
+	 */
+	ddi_put32(smrt->smrt_ct_handle, &smrt->smrt_ct->Upper32Addr, 0);
+
+	/*
+	 * Set the Transport Method and flush the changes to the
+	 * Configuration Table.
+	 */
+	smrt_cfgtbl_transport_set(smrt, CISS_CFGTBL_XPORT_SIMPLE);
+	if (smrt_cfgtbl_flush(smrt) != DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	if (smrt_cfgtbl_transport_confirm(smrt,
+	    CISS_CFGTBL_XPORT_SIMPLE) != DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Check the outstanding command cap a second time now that we have
+	 * flushed out the new Transport Method.  This is entirely defensive;
+	 * we do not expect this value to change.
+	 */
+	uint32_t check_again = smrt_ctlr_get_cmdsoutmax(smrt);
+	if (check_again != smrt->smrt_maxcmds) {
+		dev_err(smrt->smrt_dip, CE_WARN, "maximum outstanding commands "
+		    "changed during initialisation (was %u, now %u)",
+		    smrt->smrt_maxcmds, check_again);
+		return (DDI_FAILURE);
+	}
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_ctlr_teardown_simple(smrt_t *smrt)
+{
+	VERIFY(smrt->smrt_ctlr_mode == SMRT_CTLR_MODE_SIMPLE);
+
+	/*
+	 * Due to the nominal simplicity of the simple mode, we have no
+	 * particular teardown to perform as we do not allocate anything
+	 * on the way up.
+	 */
+	smrt->smrt_ctlr_mode = SMRT_CTLR_MODE_UNKNOWN;
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_commands.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_commands.c
new file mode 100644
index 0000000000..edcbfa65e2
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_commands.c
@@ -0,0 +1,362 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+
+static ddi_dma_attr_t smrt_command_dma_attr = {
+	.dma_attr_version =		DMA_ATTR_V0,
+	.dma_attr_addr_lo =		0x00000000,
+	.dma_attr_addr_hi =		0xFFFFFFFF,
+	.dma_attr_count_max =		0x00FFFFFF,
+	.dma_attr_align =		0x20,
+	.dma_attr_burstsizes =		0x20,
+	.dma_attr_minxfer =		DMA_UNIT_8,
+	.dma_attr_maxxfer =		0xFFFFFFFF,
+	.dma_attr_seg =			0x0000FFFF,
+	.dma_attr_sgllen =		1,
+	.dma_attr_granular =		512,
+	.dma_attr_flags =		0
+};
+
+/*
+ * These device access attributes are for command block allocation, where we do
+ * not use any of the structured byte swapping facilities.
+ */
+static ddi_device_acc_attr_t smrt_command_dev_attr = {
+	.devacc_attr_version =		DDI_DEVICE_ATTR_V0,
+	.devacc_attr_endian_flags =	DDI_NEVERSWAP_ACC,
+	.devacc_attr_dataorder =	DDI_STRICTORDER_ACC,
+	.devacc_attr_access =		0
+};
+
+
+static void smrt_contig_free(smrt_dma_t *);
+
+
+static int
+smrt_check_command_type(smrt_command_type_t type)
+{
+	/*
+	 * Note that we leave out the default case in order to utilise
+	 * compiler warnings about missed enum values.
+	 */
+	switch (type) {
+	case SMRT_CMDTYPE_ABORTQ:
+	case SMRT_CMDTYPE_SCSA:
+	case SMRT_CMDTYPE_INTERNAL:
+	case SMRT_CMDTYPE_PREINIT:
+	case SMRT_CMDTYPE_EVENT:
+		return (type);
+	}
+
+	panic("unexpected command type");
+	/* LINTED: E_FUNC_NO_RET_VAL */
+}
+
+static int
+smrt_contig_alloc(smrt_t *smrt, smrt_dma_t *smdma, size_t sz, int kmflags,
+    void **vap, uint32_t *pap)
+{
+	caddr_t va;
+	int rv;
+	dev_info_t *dip = smrt->smrt_dip;
+	int (*dma_wait)(caddr_t) = (kmflags == KM_SLEEP) ? DDI_DMA_SLEEP :
+	    DDI_DMA_DONTWAIT;
+
+	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
+
+	/*
+	 * Ensure we don't try to allocate a second time using the same
+	 * tracking object.
+	 */
+	VERIFY0(smdma->smdma_level);
+
+	if ((rv = ddi_dma_alloc_handle(dip, &smrt_command_dma_attr,
+	    dma_wait, NULL, &smdma->smdma_dma_handle)) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "DMA handle allocation failed (%x)",
+		    rv);
+		goto fail;
+	}
+	smdma->smdma_level |= SMRT_DMALEVEL_HANDLE_ALLOC;
+
+	if ((rv = ddi_dma_mem_alloc(smdma->smdma_dma_handle, sz,
+	    &smrt_command_dev_attr, DDI_DMA_CONSISTENT, dma_wait, NULL,
+	    &va, &smdma->smdma_real_size, &smdma->smdma_acc_handle)) !=
+	    DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "DMA memory allocation failed (%x)", rv);
+		goto fail;
+	}
+	smdma->smdma_level |= SMRT_DMALEVEL_MEMORY_ALLOC;
+
+	if ((rv = ddi_dma_addr_bind_handle(smdma->smdma_dma_handle,
+	    NULL, va, smdma->smdma_real_size,
+	    DDI_DMA_CONSISTENT | DDI_DMA_RDWR, dma_wait, NULL,
+	    smdma->smdma_dma_cookies, &smdma->smdma_dma_ncookies)) !=
+	    DDI_DMA_MAPPED) {
+		dev_err(dip, CE_WARN, "DMA handle bind failed (%x)", rv);
+		goto fail;
+	}
+	smdma->smdma_level |= SMRT_DMALEVEL_HANDLE_BOUND;
+
+	VERIFY3U(smdma->smdma_dma_ncookies, ==, 1);
+	*pap = smdma->smdma_dma_cookies[0].dmac_address;
+	*vap = (void *)va;
+	return (DDI_SUCCESS);
+
+fail:
+	*vap = NULL;
+	*pap = 0;
+	smrt_contig_free(smdma);
+	return (DDI_FAILURE);
+}
+
+static void
+smrt_contig_free(smrt_dma_t *smdma)
+{
+	if (smdma->smdma_level & SMRT_DMALEVEL_HANDLE_BOUND) {
+		VERIFY3U(ddi_dma_unbind_handle(smdma->smdma_dma_handle), ==,
+		    DDI_SUCCESS);
+
+		smdma->smdma_level &= ~SMRT_DMALEVEL_HANDLE_BOUND;
+	}
+
+	if (smdma->smdma_level & SMRT_DMALEVEL_MEMORY_ALLOC) {
+		ddi_dma_mem_free(&smdma->smdma_acc_handle);
+
+		smdma->smdma_level &= ~SMRT_DMALEVEL_MEMORY_ALLOC;
+	}
+
+	if (smdma->smdma_level & SMRT_DMALEVEL_HANDLE_ALLOC) {
+		ddi_dma_free_handle(&smdma->smdma_dma_handle);
+
+		smdma->smdma_level &= ~SMRT_DMALEVEL_HANDLE_ALLOC;
+	}
+
+	VERIFY(smdma->smdma_level == 0);
+	bzero(smdma, sizeof (*smdma));
+}
+
+static smrt_command_t *
+smrt_command_alloc_impl(smrt_t *smrt, smrt_command_type_t type, int kmflags)
+{
+	smrt_command_t *smcm;
+
+	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
+
+	if ((smcm = kmem_zalloc(sizeof (*smcm), kmflags)) == NULL) {
+		return (NULL);
+	}
+
+	smcm->smcm_ctlr = smrt;
+	smcm->smcm_type = smrt_check_command_type(type);
+
+	/*
+	 * Allocate a single contiguous chunk of memory for the command block
+	 * (smcm_va_cmd) and the error information block (smcm_va_err).  The
+	 * physical address of each block should be 32-byte aligned.
+	 */
+	size_t contig_size = 0;
+	contig_size += P2ROUNDUP_TYPED(sizeof (CommandList_t), 32, size_t);
+
+	size_t errorinfo_offset = contig_size;
+	contig_size += P2ROUNDUP_TYPED(sizeof (ErrorInfo_t), 32, size_t);
+
+	if (smrt_contig_alloc(smrt, &smcm->smcm_contig, contig_size,
+	    kmflags, (void **)&smcm->smcm_va_cmd, &smcm->smcm_pa_cmd) !=
+	    DDI_SUCCESS) {
+		kmem_free(smcm, sizeof (*smcm));
+		return (NULL);
+	}
+
+	smcm->smcm_va_err = (void *)((caddr_t)smcm->smcm_va_cmd +
+	    errorinfo_offset);
+	smcm->smcm_pa_err = smcm->smcm_pa_cmd + errorinfo_offset;
+
+	/*
+	 * Ensure we asked for, and received, the correct physical alignment:
+	 */
+	VERIFY0(smcm->smcm_pa_cmd & 0x1f);
+	VERIFY0(smcm->smcm_pa_err & 0x1f);
+
+	/*
+	 * Populate Fields.
+	 */
+	bzero(smcm->smcm_va_cmd, contig_size);
+	smcm->smcm_va_cmd->ErrDesc.Addr = smcm->smcm_pa_err;
+	smcm->smcm_va_cmd->ErrDesc.Len = sizeof (ErrorInfo_t);
+
+	return (smcm);
+}
+
+smrt_command_t *
+smrt_command_alloc_preinit(smrt_t *smrt, size_t datasize, int kmflags)
+{
+	smrt_command_t *smcm;
+
+	if ((smcm = smrt_command_alloc_impl(smrt, SMRT_CMDTYPE_PREINIT,
+	    kmflags)) == NULL) {
+		return (NULL);
+	}
+
+	/*
+	 * Note that most driver infrastructure has not been initialised at
+	 * this time.  All commands are submitted to the controller serially,
+	 * using a pre-specified tag, and are not attached to the command
+	 * tracking list.
+	 */
+	smcm->smcm_tag = SMRT_PRE_TAG_NUMBER;
+	smcm->smcm_va_cmd->Header.Tag.tag_value = SMRT_PRE_TAG_NUMBER;
+
+	if (smrt_command_attach_internal(smrt, smcm, datasize, kmflags) != 0) {
+		smrt_command_free(smcm);
+		return (NULL);
+	}
+
+	return (smcm);
+}
+
+smrt_command_t *
+smrt_command_alloc(smrt_t *smrt, smrt_command_type_t type, int kmflags)
+{
+	smrt_command_t *smcm;
+
+	VERIFY(type != SMRT_CMDTYPE_PREINIT);
+
+	if ((smcm = smrt_command_alloc_impl(smrt, type, kmflags)) == NULL) {
+		return (NULL);
+	}
+
+	/*
+	 * Insert into the per-controller command list.
+	 */
+	mutex_enter(&smrt->smrt_mutex);
+	list_insert_tail(&smrt->smrt_commands, smcm);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (smcm);
+}
+
+int
+smrt_command_attach_internal(smrt_t *smrt, smrt_command_t *smcm, size_t len,
+    int kmflags)
+{
+	smrt_command_internal_t *smcmi;
+
+	VERIFY(kmflags == KM_SLEEP || kmflags == KM_NOSLEEP);
+	VERIFY3U(len, <=, UINT32_MAX);
+
+	if ((smcmi = kmem_zalloc(sizeof (*smcmi), kmflags)) == NULL) {
+		return (ENOMEM);
+	}
+
+	if (smrt_contig_alloc(smrt, &smcmi->smcmi_contig, len, kmflags,
+	    &smcmi->smcmi_va, &smcmi->smcmi_pa) != DDI_SUCCESS) {
+		kmem_free(smcmi, sizeof (*smcmi));
+		return (ENOMEM);
+	}
+
+	bzero(smcmi->smcmi_va, smcmi->smcmi_len);
+
+	smcm->smcm_internal = smcmi;
+
+	smcm->smcm_va_cmd->SG[0].Addr = smcmi->smcmi_pa;
+	smcm->smcm_va_cmd->SG[0].Len = (uint32_t)len;
+	smcm->smcm_va_cmd->Header.SGList = 1;
+	smcm->smcm_va_cmd->Header.SGTotal = 1;
+
+	return (0);
+}
+
+void
+smrt_command_reuse(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Make sure the command is not currently inflight, then
+	 * reset the command status.
+	 */
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT));
+	smcm->smcm_status = SMRT_CMD_STATUS_REUSED;
+
+	/*
+	 * Ensure we are not trying to reuse a command that is in the finish or
+	 * abort queue.
+	 */
+	VERIFY(!list_link_active(&smcm->smcm_link_abort));
+	VERIFY(!list_link_active(&smcm->smcm_link_finish));
+
+	/*
+	 * Clear the previous tag value.
+	 */
+	smcm->smcm_tag = 0;
+	smcm->smcm_va_cmd->Header.Tag.tag_value = 0;
+
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+void
+smrt_command_free(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+
+	/*
+	 * Ensure the object we are about to free is not currently in the
+	 * inflight AVL.
+	 */
+	VERIFY(!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT));
+
+	if (smcm->smcm_internal != NULL) {
+		smrt_command_internal_t *smcmi = smcm->smcm_internal;
+
+		smrt_contig_free(&smcmi->smcmi_contig);
+		kmem_free(smcmi, sizeof (*smcmi));
+	}
+
+	smrt_contig_free(&smcm->smcm_contig);
+
+	if (smcm->smcm_type != SMRT_CMDTYPE_PREINIT) {
+		mutex_enter(&smrt->smrt_mutex);
+
+		/*
+		 * Ensure we are not trying to free a command that is in the
+		 * finish or abort queue.
+		 */
+		VERIFY(!list_link_active(&smcm->smcm_link_abort));
+		VERIFY(!list_link_active(&smcm->smcm_link_finish));
+
+		list_remove(&smrt->smrt_commands, smcm);
+
+		mutex_exit(&smrt->smrt_mutex);
+	}
+
+	kmem_free(smcm, sizeof (*smcm));
+}
+
+smrt_command_t *
+smrt_lookup_inflight(smrt_t *smrt, uint32_t tag)
+{
+	smrt_command_t srch;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	bzero(&srch, sizeof (srch));
+	srch.smcm_tag = tag;
+
+	return (avl_find(&smrt->smrt_inflight, &srch, NULL));
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_device.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_device.c
new file mode 100644
index 0000000000..433b2ea2ee
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_device.c
@@ -0,0 +1,238 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+/*
+ * We must locate what the CISS specification describes as the "I2O
+ * registers".  The Intelligent I/O (I2O) Architecture Specification describes
+ * this somewhat more coherently as "the memory region specified by the first
+ * base address configuration register indicating memory space (offset 10h,
+ * 14h, and so forth)".
+ */
+static int
+smrt_locate_bar(pci_regspec_t *regs, unsigned nregs,
+    unsigned *i2o_bar)
+{
+	/*
+	 * Locate the first memory-mapped BAR:
+	 */
+	for (unsigned i = 0; i < nregs; i++) {
+		unsigned type = regs[i].pci_phys_hi & PCI_ADDR_MASK;
+
+		if (type == PCI_ADDR_MEM32 || type == PCI_ADDR_MEM64) {
+			*i2o_bar = i;
+			return (DDI_SUCCESS);
+		}
+	}
+
+	return (DDI_FAILURE);
+}
+
+static int
+smrt_locate_cfgtbl(smrt_t *smrt, pci_regspec_t *regs, unsigned nregs,
+    unsigned *ct_bar, uint32_t *baseaddr)
+{
+	uint32_t cfg_offset, mem_offset;
+	unsigned want_type;
+	uint32_t want_bar;
+
+	cfg_offset = smrt_get32(smrt, CISS_I2O_CFGTBL_CFG_OFFSET);
+	mem_offset = smrt_get32(smrt, CISS_I2O_CFGTBL_MEM_OFFSET);
+
+	VERIFY3U(cfg_offset, !=, 0xffffffff);
+	VERIFY3U(mem_offset, !=, 0xffffffff);
+
+	/*
+	 * Locate the Configuration Table.  Three different values read
+	 * from two I2O registers allow us to determine the location:
+	 *	- the correct PCI BAR offset is in the low 16 bits of
+	 *	  CISS_I2O_CFGTBL_CFG_OFFSET
+	 *	- bit 16 is 0 for a 32-bit space, and 1 for 64-bit
+	 *	- the memory offset from the base of this BAR is
+	 *	  in CISS_I2O_CFGTBL_MEM_OFFSET
+	 */
+	want_bar = (cfg_offset & 0xffff);
+	want_type = (cfg_offset & (1UL << 16)) ? PCI_ADDR_MEM64 :
+	    PCI_ADDR_MEM32;
+
+	DTRACE_PROBE4(locate_cfgtbl, uint32_t, want_bar, unsigned,
+	    want_type, uint32_t, cfg_offset, uint32_t, mem_offset);
+
+	for (unsigned i = 0; i < nregs; i++) {
+		unsigned type = regs[i].pci_phys_hi & PCI_ADDR_MASK;
+		unsigned bar = PCI_REG_REG_G(regs[i].pci_phys_hi);
+
+		if (type != PCI_ADDR_MEM32 && type != PCI_ADDR_MEM64) {
+			continue;
+		}
+
+		if (bar == want_bar) {
+			*ct_bar = i;
+			*baseaddr = mem_offset;
+			return (DDI_SUCCESS);
+		}
+	}
+
+	return (DDI_FAILURE);
+}
+
+/*
+ * Determine the PCI vendor and device ID which is a proxy for which generation
+ * of controller we're working with.
+ */
+static int
+smrt_identify_device(smrt_t *smrt)
+{
+	ddi_acc_handle_t pci_hdl;
+
+	if (pci_config_setup(smrt->smrt_dip, &pci_hdl) != DDI_SUCCESS)
+		return (DDI_FAILURE);
+
+	smrt->smrt_pci_vendor = pci_config_get16(pci_hdl, PCI_CONF_VENID);
+	smrt->smrt_pci_device = pci_config_get16(pci_hdl, PCI_CONF_DEVID);
+
+	pci_config_teardown(&pci_hdl);
+
+	return (DDI_SUCCESS);
+}
+
+static int
+smrt_map_device(smrt_t *smrt)
+{
+	pci_regspec_t *regs;
+	uint_t regslen, nregs;
+	dev_info_t *dip = smrt->smrt_dip;
+	int r = DDI_FAILURE;
+
+	/*
+	 * Get the list of PCI registers from the DDI property "regs":
+	 */
+	if (ddi_prop_lookup_int_array(DDI_DEV_T_ANY, dip, DDI_PROP_DONTPASS,
+	    "reg", (int **)&regs, &regslen) != DDI_PROP_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not load \"reg\" DDI prop");
+		return (DDI_FAILURE);
+	}
+	nregs = regslen * sizeof (int) / sizeof (pci_regspec_t);
+
+	if (smrt_locate_bar(regs, nregs, &smrt->smrt_i2o_bar) !=
+	    DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "did not find any memory BARs");
+		goto out;
+	}
+
+	/*
+	 * Map enough of the I2O memory space to enable us to talk to the
+	 * device.
+	 */
+	if (ddi_regs_map_setup(dip, smrt->smrt_i2o_bar, &smrt->smrt_i2o_space,
+	    CISS_I2O_MAP_BASE, CISS_I2O_MAP_LIMIT - CISS_I2O_MAP_BASE,
+	    &smrt_dev_attributes, &smrt->smrt_i2o_handle) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "failed to map I2O registers");
+		goto out;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_I2O_MAPPED;
+
+	if (smrt_locate_cfgtbl(smrt, regs, nregs, &smrt->smrt_ct_bar,
+	    &smrt->smrt_ct_baseaddr) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not find config table");
+		goto out;
+	}
+
+	/*
+	 * Map the Configuration Table.
+	 */
+	if (ddi_regs_map_setup(dip, smrt->smrt_ct_bar,
+	    (caddr_t *)&smrt->smrt_ct, smrt->smrt_ct_baseaddr,
+	    sizeof (CfgTable_t), &smrt_dev_attributes,
+	    &smrt->smrt_ct_handle) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not map config table");
+		goto out;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_CFGTBL_MAPPED;
+
+	r = DDI_SUCCESS;
+
+out:
+	ddi_prop_free(regs);
+	return (r);
+}
+
+int
+smrt_device_setup(smrt_t *smrt)
+{
+	/*
+	 * Ensure that the controller is installed in such a fashion that it
+	 * may become a DMA master.
+	 */
+	if (ddi_slaveonly(smrt->smrt_dip) == DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_WARN, "device cannot become DMA "
+		    "master");
+		return (DDI_FAILURE);
+	}
+
+	if (smrt_identify_device(smrt) != DDI_SUCCESS)
+		goto fail;
+
+	if (smrt_map_device(smrt) != DDI_SUCCESS) {
+		goto fail;
+	}
+
+	return (DDI_SUCCESS);
+
+fail:
+	smrt_device_teardown(smrt);
+	return (DDI_FAILURE);
+}
+
+void
+smrt_device_teardown(smrt_t *smrt)
+{
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_CFGTBL_MAPPED) {
+		ddi_regs_map_free(&smrt->smrt_ct_handle);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_CFGTBL_MAPPED;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_I2O_MAPPED) {
+		ddi_regs_map_free(&smrt->smrt_i2o_handle);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_I2O_MAPPED;
+	}
+}
+
+uint32_t
+smrt_get32(smrt_t *smrt, offset_t off)
+{
+	VERIFY3S(off, >=, CISS_I2O_MAP_BASE);
+	VERIFY3S(off, <, CISS_I2O_MAP_BASE + CISS_I2O_MAP_LIMIT);
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	uint32_t *addr = (uint32_t *)(smrt->smrt_i2o_space +
+	    (off - CISS_I2O_MAP_BASE));
+
+	return (ddi_get32(smrt->smrt_i2o_handle, addr));
+}
+
+void
+smrt_put32(smrt_t *smrt, offset_t off, uint32_t val)
+{
+	VERIFY3S(off, >=, CISS_I2O_MAP_BASE);
+	VERIFY3S(off, <, CISS_I2O_MAP_BASE + CISS_I2O_MAP_LIMIT);
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	uint32_t *addr = (uint32_t *)(smrt->smrt_i2o_space +
+	    (off - CISS_I2O_MAP_BASE));
+
+	ddi_put32(smrt->smrt_i2o_handle, addr, val);
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_hba.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_hba.c
new file mode 100644
index 0000000000..0eec7c2482
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_hba.c
@@ -0,0 +1,1457 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2019 Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+/*
+ * The controller is not allowed to attach.
+ */
+static int
+smrt_ctrl_tran_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	return (DDI_FAILURE);
+}
+
+/*
+ * The controller is not allowed to send packets.
+ */
+static int
+smrt_ctrl_tran_start(struct scsi_address *sa, struct scsi_pkt *pkt)
+{
+	return (TRAN_BADPKT);
+}
+
+static boolean_t
+smrt_logvol_parse(const char *ua, uint_t *targp)
+{
+	long targ, lun;
+	const char *comma;
+	char *eptr;
+
+	comma = strchr(ua, ',');
+	if (comma == NULL) {
+		return (B_FALSE);
+	}
+
+	/*
+	 * We expect the target number for a logical unit number to be zero for
+	 * a logical volume.
+	 */
+	if (ddi_strtol(comma + 1, &eptr, 16, &lun) != 0 || *eptr != '\0' ||
+	    lun != 0) {
+		return (B_FALSE);
+	}
+
+	if (ddi_strtol(ua, &eptr, 16, &targ) != 0 || eptr != comma ||
+	    targ < 0 || targ >= SMRT_MAX_LOGDRV) {
+		return (B_FALSE);
+	}
+
+	*targp = (uint_t)targ;
+
+	return (B_TRUE);
+}
+
+static int
+smrt_logvol_tran_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	_NOTE(ARGUNUSED(hba_dip))
+
+	smrt_volume_t *smlv;
+	smrt_target_t *smtg;
+	const char *ua;
+	uint_t targ;
+
+	smrt_t *smrt = (smrt_t *)hba_tran->tran_hba_private;
+	dev_info_t *dip = smrt->smrt_dip;
+
+	/*
+	 * The unit address comes in the form of 'target,lun'.  We expect the
+	 * lun to be zero.  The target is what we set when we added it to the
+	 * target map earlier.
+	 */
+	ua = scsi_device_unit_address(sd);
+	if (ua == NULL) {
+		return (DDI_FAILURE);
+	}
+
+	if (!smrt_logvol_parse(ua, &targ)) {
+		return (DDI_FAILURE);
+	}
+
+	if ((smtg = kmem_zalloc(sizeof (*smtg), KM_NOSLEEP)) == NULL) {
+		dev_err(dip, CE_WARN, "could not allocate target object "
+		    "due to memory exhaustion");
+		return (DDI_FAILURE);
+	}
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_DETACHING) {
+		/*
+		 * We are detaching.  Do not accept any more requests to
+		 * attach targets from the framework.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		kmem_free(smtg, sizeof (*smtg));
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Look for a logical volume for the SCSI unit address of this target.
+	 */
+	if ((smlv = smrt_logvol_lookup_by_id(smrt, targ)) == NULL) {
+		mutex_exit(&smrt->smrt_mutex);
+		kmem_free(smtg, sizeof (*smtg));
+		return (DDI_FAILURE);
+	}
+
+	smtg->smtg_lun.smtg_vol = smlv;
+	smtg->smtg_addr = &smlv->smlv_addr;
+	smtg->smtg_physical = B_FALSE;
+	list_insert_tail(&smlv->smlv_targets, smtg);
+
+	/*
+	 * Link this target object to the controller:
+	 */
+	smtg->smtg_ctlr = smrt;
+	list_insert_tail(&smrt->smrt_targets, smtg);
+
+	smtg->smtg_scsi_dev = sd;
+	VERIFY(sd->sd_dev == tgt_dip);
+
+	scsi_device_hba_private_set(sd, smtg);
+
+	mutex_exit(&smrt->smrt_mutex);
+	return (DDI_SUCCESS);
+}
+
+static void
+smrt_logvol_tran_tgt_free(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	_NOTE(ARGUNUSED(hba_dip, tgt_dip))
+
+	smrt_t *smrt = (smrt_t *)hba_tran->tran_hba_private;
+	smrt_target_t *smtg = scsi_device_hba_private_get(sd);
+	smrt_volume_t *smlv = smtg->smtg_lun.smtg_vol;
+
+	VERIFY(smtg->smtg_scsi_dev == sd);
+	VERIFY(smtg->smtg_physical == B_FALSE);
+
+	mutex_enter(&smrt->smrt_mutex);
+	list_remove(&smlv->smlv_targets, smtg);
+	list_remove(&smrt->smrt_targets, smtg);
+
+	scsi_device_hba_private_set(sd, NULL);
+
+	mutex_exit(&smrt->smrt_mutex);
+
+	kmem_free(smtg, sizeof (*smtg));
+}
+
+static int
+smrt_phys_tran_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	_NOTE(ARGUNUSED(hba_dip))
+
+	smrt_target_t *smtg;
+	smrt_physical_t *smpt;
+	const char *ua, *comma;
+	char *eptr;
+	long lun;
+
+	smrt_t *smrt = (smrt_t *)hba_tran->tran_hba_private;
+	dev_info_t *dip = smrt->smrt_dip;
+
+	/*
+	 * The unit address comes in the form of 'target,lun'.  We expect the
+	 * lun to be zero.  The target is what we set when we added it to the
+	 * target map earlier.
+	 */
+	ua = scsi_device_unit_address(sd);
+	if (ua == NULL)
+		return (DDI_FAILURE);
+
+	comma = strchr(ua, ',');
+	if (comma == NULL) {
+		return (DDI_FAILURE);
+	}
+
+	/*
+	 * Confirm the LUN is zero.  We may want to instead check the scsi
+	 * 'lun'/'lun64' property or do so in addition to this logic.
+	 */
+	if (ddi_strtol(comma + 1, &eptr, 16, &lun) != 0 || *eptr != '\0' ||
+	    lun != 0) {
+		return (DDI_FAILURE);
+	}
+
+	if ((smtg = kmem_zalloc(sizeof (*smtg), KM_NOSLEEP)) == NULL) {
+		dev_err(dip, CE_WARN, "could not allocate target object "
+		    "due to memory exhaustion");
+		return (DDI_FAILURE);
+	}
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_DETACHING) {
+		/*
+		 * We are detaching.  Do not accept any more requests to
+		 * attach targets from the framework.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		kmem_free(smtg, sizeof (*smtg));
+		return (DDI_FAILURE);
+	}
+
+
+	/*
+	 * Look for a physical target based on the unit address of the target
+	 * (which will encode its WWN and LUN).
+	 */
+	smpt = smrt_phys_lookup_by_ua(smrt, ua);
+	if (smpt == NULL) {
+		mutex_exit(&smrt->smrt_mutex);
+		kmem_free(smtg, sizeof (*smtg));
+		return (DDI_FAILURE);
+	}
+
+	smtg->smtg_scsi_dev = sd;
+	smtg->smtg_physical = B_TRUE;
+	smtg->smtg_lun.smtg_phys = smpt;
+	list_insert_tail(&smpt->smpt_targets, smtg);
+	smtg->smtg_addr = &smpt->smpt_addr;
+
+	/*
+	 * Link this target object to the controller:
+	 */
+	smtg->smtg_ctlr = smrt;
+	list_insert_tail(&smrt->smrt_targets, smtg);
+
+	VERIFY(sd->sd_dev == tgt_dip);
+	smtg->smtg_scsi_dev = sd;
+
+	scsi_device_hba_private_set(sd, smtg);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (DDI_SUCCESS);
+}
+
+static void
+smrt_phys_tran_tgt_free(dev_info_t *hba_dip, dev_info_t *tgt_dip,
+    scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
+{
+	_NOTE(ARGUNUSED(hba_dip, tgt_dip))
+
+	smrt_t *smrt = (smrt_t *)hba_tran->tran_hba_private;
+	smrt_target_t *smtg = scsi_device_hba_private_get(sd);
+	smrt_physical_t *smpt = smtg->smtg_lun.smtg_phys;
+
+	VERIFY(smtg->smtg_scsi_dev == sd);
+	VERIFY(smtg->smtg_physical == B_TRUE);
+
+	mutex_enter(&smrt->smrt_mutex);
+	list_remove(&smpt->smpt_targets, smtg);
+	list_remove(&smrt->smrt_targets, smtg);
+
+	scsi_device_hba_private_set(sd, NULL);
+	mutex_exit(&smrt->smrt_mutex);
+	kmem_free(smtg, sizeof (*smtg));
+}
+
+/*
+ * This function is called when the SCSI framework has allocated a packet and
+ * our private per-packet object.
+ *
+ * We choose not to have the framework pre-allocate memory for the CDB.
+ * Instead, we will make available the CDB area in the controller command block
+ * itself.
+ *
+ * Status block memory is allocated by the framework because we passed
+ * SCSI_HBA_TRAN_SCB to scsi_hba_attach_setup(9F).
+ */
+static int
+smrt_tran_setup_pkt(struct scsi_pkt *pkt, int (*callback)(caddr_t),
+    caddr_t arg)
+{
+	_NOTE(ARGUNUSED(arg))
+
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	smrt_command_t *smcm;
+	smrt_command_scsa_t *smcms;
+	int kmflags = callback == SLEEP_FUNC ? KM_SLEEP : KM_NOSLEEP;
+
+	sd = scsi_address_device(&pkt->pkt_address);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+	VERIFY(smrt != NULL);
+	smcms = (smrt_command_scsa_t *)pkt->pkt_ha_private;
+
+	/*
+	 * Check that we have enough space in the command object for the
+	 * request from the target driver:
+	 */
+	if (pkt->pkt_cdblen > CISS_CDBLEN) {
+		/*
+		 * The CDB member of the Request Block of a controller
+		 * command is fixed at 16 bytes.
+		 */
+		dev_err(smrt->smrt_dip, CE_WARN, "oversize CDB: had %u, "
+		    "needed %u", CISS_CDBLEN, pkt->pkt_cdblen);
+		return (-1);
+	}
+
+	/*
+	 * Allocate our command block:
+	 */
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_SCSA,
+	    kmflags)) == NULL) {
+		return (-1);
+	}
+	smcm->smcm_scsa = smcms;
+	smcms->smcms_command = smcm;
+	smcms->smcms_pkt = pkt;
+
+	pkt->pkt_cdbp = &smcm->smcm_va_cmd->Request.CDB[0];
+	smcm->smcm_va_cmd->Request.CDBLen = pkt->pkt_cdblen;
+
+	smcm->smcm_target = smtg;
+
+	return (0);
+}
+
+static void
+smrt_tran_teardown_pkt(struct scsi_pkt *pkt)
+{
+	smrt_command_scsa_t *smcms = (smrt_command_scsa_t *)
+	    pkt->pkt_ha_private;
+	smrt_command_t *smcm = smcms->smcms_command;
+
+	smrt_command_free(smcm);
+
+	pkt->pkt_cdbp = NULL;
+}
+
+static void
+smrt_set_arq_data(struct scsi_pkt *pkt, uchar_t key)
+{
+	struct scsi_arq_status *sts;
+
+	VERIFY3U(pkt->pkt_scblen, >=, sizeof (struct scsi_arq_status));
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	sts = (struct scsi_arq_status *)(pkt->pkt_scbp);
+	bzero(sts, sizeof (*sts));
+
+	/*
+	 * Mock up a CHECK CONDITION SCSI status for the original command:
+	 */
+	sts->sts_status.sts_chk = 1;
+
+	/*
+	 * Pretend that we successfully performed REQUEST SENSE:
+	 */
+	sts->sts_rqpkt_reason = CMD_CMPLT;
+	sts->sts_rqpkt_resid = 0;
+	sts->sts_rqpkt_state = STATE_GOT_BUS | STATE_GOT_TARGET |
+	    STATE_SENT_CMD | STATE_XFERRED_DATA;
+	sts->sts_rqpkt_statistics = 0;
+
+	/*
+	 * Return the key value we were provided in the fake sense data:
+	 */
+	sts->sts_sensedata.es_valid = 1;
+	sts->sts_sensedata.es_class = CLASS_EXTENDED_SENSE;
+	sts->sts_sensedata.es_key = key;
+
+	pkt->pkt_state |= STATE_ARQ_DONE;
+}
+
+/*
+ * When faking up a REPORT LUNS data structure, we simply report one LUN, LUN 0.
+ * We need 16 bytes for this, 4 for the size, 4 reserved bytes, and the 8 for
+ * the actual LUN.
+ */
+static void
+smrt_fake_report_lun(smrt_command_t *smcm, struct scsi_pkt *pkt)
+{
+	size_t sz;
+	char resp[16];
+	struct buf *bp;
+
+	pkt->pkt_reason = CMD_CMPLT;
+	pkt->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET | STATE_SENT_CMD |
+	    STATE_GOT_STATUS;
+
+	/*
+	 * Check to make sure this is valid.  If reserved bits are set or if the
+	 * mode is one other than 0x00, 0x01, 0x02, then it's an illegal
+	 * request.
+	 */
+	if (pkt->pkt_cdbp[1] != 0 || pkt->pkt_cdbp[3] != 0 ||
+	    pkt->pkt_cdbp[4] != 0 || pkt->pkt_cdbp[5] != 0 ||
+	    pkt->pkt_cdbp[10] != 0 || pkt->pkt_cdbp[11] != 0 ||
+	    pkt->pkt_cdbp[2] > 0x2) {
+		smrt_set_arq_data(pkt, KEY_ILLEGAL_REQUEST);
+		return;
+	}
+
+	/*
+	 * Construct the actual REPORT LUNS reply.  We need to indicate a single
+	 * LUN of all zeros.  This means that the length needs to be 8 bytes,
+	 * the size of the lun.  Otherwise, the rest of this structure can be
+	 * zeros.
+	 */
+	bzero(resp, sizeof (resp));
+	resp[3] = sizeof (scsi_lun_t);
+
+	bp = scsi_pkt2bp(pkt);
+	sz = MIN(sizeof (resp), bp->b_bcount);
+
+	bp_mapin(bp);
+	bcopy(resp, bp->b_un.b_addr, sz);
+	bp_mapout(bp);
+	pkt->pkt_state |= STATE_XFERRED_DATA;
+	pkt->pkt_resid = bp->b_bcount - sz;
+	if (pkt->pkt_scblen >= 1) {
+		pkt->pkt_scbp[0] = STATUS_GOOD;
+	}
+}
+
+static int
+smrt_tran_start(struct scsi_address *sa, struct scsi_pkt *pkt)
+{
+	_NOTE(ARGUNUSED(sa))
+
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	smrt_command_scsa_t *smcms;
+	smrt_command_t *smcm;
+	int r;
+
+	sd = scsi_address_device(&pkt->pkt_address);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+	VERIFY(smrt != NULL);
+	smcms = (smrt_command_scsa_t *)pkt->pkt_ha_private;
+	VERIFY(smcms != NULL);
+	smcm = smcms->smcms_command;
+	VERIFY(smcm != NULL);
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_TRAN_START) {
+		/*
+		 * This is a retry of a command that has already been
+		 * used once.  Assign it a new tag number.
+		 */
+		smrt_command_reuse(smcm);
+	}
+	smcm->smcm_status |= SMRT_CMD_STATUS_TRAN_START;
+
+	/*
+	 * The sophisticated firmware in this controller cannot possibly bear
+	 * the following SCSI commands.  It appears to return a response with
+	 * the status STATUS_ACA_ACTIVE (0x30), which is not something we
+	 * expect.  Instead, fake up a failure response.
+	 */
+	switch (pkt->pkt_cdbp[0]) {
+	case SCMD_FORMAT:
+	case SCMD_LOG_SENSE_G1:
+	case SCMD_MODE_SELECT:
+	case SCMD_PERSISTENT_RESERVE_IN:
+		if (smtg->smtg_physical) {
+			break;
+		}
+
+		smrt->smrt_stats.smrts_ignored_scsi_cmds++;
+		smcm->smcm_status |= SMRT_CMD_STATUS_TRAN_IGNORED;
+
+		/*
+		 * Mark the command as completed to the point where we
+		 * received a SCSI status code:
+		 */
+		pkt->pkt_reason = CMD_CMPLT;
+		pkt->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET |
+		    STATE_SENT_CMD | STATE_GOT_STATUS;
+
+		/*
+		 * Mock up sense data for an illegal request:
+		 */
+		smrt_set_arq_data(pkt, KEY_ILLEGAL_REQUEST);
+
+		scsi_hba_pkt_comp(pkt);
+		return (TRAN_ACCEPT);
+	case SCMD_REPORT_LUNS:
+		/*
+		 * The SMRT controller does not accept a REPORT LUNS command for
+		 * logical volumes.  As such, we need to fake up a REPORT LUNS
+		 * response that has a single LUN, LUN 0.
+		 */
+		if (smtg->smtg_physical) {
+			break;
+		}
+
+		smrt_fake_report_lun(smcm, pkt);
+
+		scsi_hba_pkt_comp(pkt);
+		return (TRAN_ACCEPT);
+	default:
+		break;
+	}
+
+	if (pkt->pkt_flags & FLAG_NOINTR) {
+		/*
+		 * We must sleep and wait for the completion of this command.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	}
+
+	/*
+	 * Because we provide a tran_setup_pkt(9E) entrypoint, we must now
+	 * set up the Scatter/Gather List in the Command to reflect any
+	 * DMA resources passed to us by the framework.
+	 */
+	if (pkt->pkt_numcookies > smrt->smrt_sg_cnt) {
+		/*
+		 * More DMA cookies than we are prepared to handle.
+		 */
+		dev_err(smrt->smrt_dip, CE_WARN, "too many DMA cookies (got %u;"
+		    " expected %u)", pkt->pkt_numcookies, smrt->smrt_sg_cnt);
+		return (TRAN_BADPKT);
+	}
+	smcm->smcm_va_cmd->Header.SGList = pkt->pkt_numcookies;
+	smcm->smcm_va_cmd->Header.SGTotal = pkt->pkt_numcookies;
+	for (unsigned i = 0; i < pkt->pkt_numcookies; i++) {
+		smcm->smcm_va_cmd->SG[i].Addr =
+		    LE_64(pkt->pkt_cookies[i].dmac_laddress);
+		smcm->smcm_va_cmd->SG[i].Len =
+		    LE_32(pkt->pkt_cookies[i].dmac_size);
+	}
+
+	/*
+	 * Copy logical volume address from the target object:
+	 */
+	smcm->smcm_va_cmd->Header.LUN = *smcm->smcm_target->smtg_addr;
+
+	/*
+	 * Initialise the command block.
+	 */
+	smcm->smcm_va_cmd->Request.CDBLen = pkt->pkt_cdblen;
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(pkt->pkt_time);
+	if (pkt->pkt_numcookies > 0) {
+		/*
+		 * There are DMA resources; set the transfer direction
+		 * appropriately:
+		 */
+		if (pkt->pkt_dma_flags & DDI_DMA_READ) {
+			smcm->smcm_va_cmd->Request.Type.Direction =
+			    CISS_XFER_READ;
+		} else if (pkt->pkt_dma_flags & DDI_DMA_WRITE) {
+			smcm->smcm_va_cmd->Request.Type.Direction =
+			    CISS_XFER_WRITE;
+		} else {
+			smcm->smcm_va_cmd->Request.Type.Direction =
+			    CISS_XFER_NONE;
+		}
+	} else {
+		/*
+		 * No DMA resources means no transfer.
+		 */
+		smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_NONE;
+	}
+
+	/*
+	 * Initialise the SCSI packet as described in tran_start(9E).  We will
+	 * progressively update these fields as the command moves through the
+	 * submission and completion states.
+	 */
+	pkt->pkt_resid = 0;
+	pkt->pkt_reason = CMD_CMPLT;
+	pkt->pkt_statistics = 0;
+	pkt->pkt_state = 0;
+
+	/*
+	 * If this SCSI packet has a timeout, configure an appropriate
+	 * expiry time:
+	 */
+	if (pkt->pkt_time != 0) {
+		smcm->smcm_expiry = gethrtime() + pkt->pkt_time * NANOSEC;
+	}
+
+	/*
+	 * Submit the command to the controller.
+	 */
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * If we're dumping, there's a chance that the target we're talking to
+	 * could have ended up disappearing during the process of discovery.  If
+	 * this target is part of the dump device, we check here and return that
+	 * we hit a fatal error.
+	 */
+	if (ddi_in_panic() && smtg->smtg_gone) {
+		mutex_exit(&smrt->smrt_mutex);
+
+		dev_err(smrt->smrt_dip, CE_WARN, "smrt_submit failed: target "
+		    "%s is gone, it did not come back after post-panic reset "
+		    "device discovery", scsi_device_unit_address(sd));
+
+		return (TRAN_FATAL_ERROR);
+	}
+
+	smrt->smrt_stats.smrts_tran_starts++;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+
+		dev_err(smrt->smrt_dip, CE_WARN, "smrt_submit failed %d", r);
+
+		/*
+		 * Inform the SCSI framework that we could not submit
+		 * the command.
+		 */
+		return (r == EAGAIN ? TRAN_BUSY : TRAN_FATAL_ERROR);
+	}
+
+	/*
+	 * Update the SCSI packet to reflect submission of the command.
+	 */
+	pkt->pkt_state |= STATE_GOT_BUS | STATE_GOT_TARGET | STATE_SENT_CMD;
+
+	if (pkt->pkt_flags & FLAG_NOINTR) {
+		/*
+		 * Poll the controller for completion of the command we
+		 * submitted.  Once this routine has returned, the completion
+		 * callback will have been fired with either an active response
+		 * (success or error) or a timeout.  The command is freed by
+		 * the completion callback, so it may not be referenced again
+		 * after this call returns.
+		 */
+		(void) smrt_poll_for(smrt, smcm);
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+	return (TRAN_ACCEPT);
+}
+
+static int
+smrt_tran_reset(struct scsi_address *sa, int level)
+{
+	_NOTE(ARGUNUSED(level))
+
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	smrt_command_t *smcm;
+	int r;
+
+	sd = scsi_address_device(sa);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+
+	/*
+	 * The framework has requested some kind of SCSI reset.  A
+	 * controller-level soft reset can take a very long time -- often on
+	 * the order of 30-60 seconds -- but might well be our only option if
+	 * the controller is non-responsive.
+	 *
+	 * First, check if the controller is responding to pings.
+	 */
+again:
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL) {
+		return (0);
+	}
+
+	smrt_write_message_nop(smcm, SMRT_PING_CHECK_TIMEOUT);
+
+	mutex_enter(&smrt->smrt_mutex);
+	smrt->smrt_stats.smrts_tran_resets++;
+	if (ddi_in_panic()) {
+		goto skip_check;
+	}
+
+	if (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+		/*
+		 * The controller is already resetting.  Wait for that
+		 * to finish.
+		 */
+		while (smrt->smrt_status & SMRT_CTLR_STATUS_RESETTING) {
+			cv_wait(&smrt->smrt_cv_finishq, &smrt->smrt_mutex);
+		}
+	}
+
+skip_check:
+	/*
+	 * Submit our ping to the controller.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	smcm->smcm_expiry = gethrtime() + SMRT_PING_CHECK_TIMEOUT * NANOSEC;
+	if (smrt_submit(smrt, smcm) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		return (0);
+	}
+
+	if ((r = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The ping command timed out.  Abandon it now.
+		 */
+		dev_err(smrt->smrt_dip, CE_WARN, "controller ping timed out");
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+
+	} else if ((smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) ||
+	    (smcm->smcm_status & SMRT_CMD_STATUS_ERROR)) {
+		/*
+		 * The command completed in error, or a controller reset
+		 * was sent while we were trying to ping.
+		 */
+		dev_err(smrt->smrt_dip, CE_WARN, "controller ping error");
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		mutex_enter(&smrt->smrt_mutex);
+
+	} else {
+		VERIFY(smcm->smcm_status & SMRT_CMD_STATUS_COMPLETE);
+
+		/*
+		 * The controller is responsive, and a full soft reset would be
+		 * extremely disruptive to the system.  Given our spotty
+		 * support for some SCSI commands (which can upset the target
+		 * drivers) and the historically lax behaviour of the "smrt"
+		 * driver, we grit our teeth and pretend we were able to
+		 * perform a reset.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		return (1);
+	}
+
+	/*
+	 * If a reset has been initiated in the last 90 seconds, try
+	 * another ping.
+	 */
+	if (gethrtime() < smrt->smrt_last_reset_start + 90 * NANOSEC) {
+		dev_err(smrt->smrt_dip, CE_WARN, "controller ping failed, but "
+		    "was recently reset; retrying ping");
+		mutex_exit(&smrt->smrt_mutex);
+
+		/*
+		 * Sleep for a second first.
+		 */
+		if (ddi_in_panic()) {
+			drv_usecwait(1 * MICROSEC);
+		} else {
+			delay(drv_usectohz(1 * MICROSEC));
+		}
+		goto again;
+	}
+
+	dev_err(smrt->smrt_dip, CE_WARN, "controller ping failed; resetting "
+	    "controller");
+	if (smrt_ctlr_reset(smrt) != 0) {
+		dev_err(smrt->smrt_dip, CE_WARN, "controller reset failure");
+		mutex_exit(&smrt->smrt_mutex);
+		return (0);
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+	return (1);
+}
+
+static int
+smrt_tran_abort(struct scsi_address *sa, struct scsi_pkt *pkt)
+{
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	smrt_command_t *smcm = NULL;
+	smrt_command_t *abort_smcm;
+
+	sd = scsi_address_device(sa);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+	VERIFY(smrt != NULL);
+
+
+	if ((abort_smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL) {
+		/*
+		 * No resources available to send an abort message.
+		 */
+		return (0);
+	}
+
+	mutex_enter(&smrt->smrt_mutex);
+	smrt->smrt_stats.smrts_tran_aborts++;
+	if (pkt != NULL) {
+		/*
+		 * The framework wants us to abort a specific SCSI packet.
+		 */
+		smrt_command_scsa_t *smcms = (smrt_command_scsa_t *)
+		    pkt->pkt_ha_private;
+		smcm = smcms->smcms_command;
+
+		if (!(smcm->smcm_status & SMRT_CMD_STATUS_INFLIGHT)) {
+			/*
+			 * This message is not currently in flight, so we
+			 * cannot abort it.
+			 */
+			goto fail;
+		}
+
+		if (smcm->smcm_status & SMRT_CMD_STATUS_ABORT_SENT) {
+			/*
+			 * An abort message for this command has already been
+			 * sent to the controller.  Return failure.
+			 */
+			goto fail;
+		}
+
+		smrt_write_message_abort_one(abort_smcm, smcm->smcm_tag);
+	} else {
+		/*
+		 * The framework wants us to abort every in flight command
+		 * for the target with this address.
+		 */
+		smrt_write_message_abort_all(abort_smcm, smtg->smtg_addr);
+	}
+
+	/*
+	 * Submit the abort message to the controller.
+	 */
+	abort_smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if (smrt_submit(smrt, abort_smcm) != 0) {
+		goto fail;
+	}
+
+	if (pkt != NULL) {
+		/*
+		 * Record some debugging information about the abort we
+		 * sent:
+		 */
+		smcm->smcm_abort_time = gethrtime();
+		smcm->smcm_abort_tag = abort_smcm->smcm_tag;
+
+		/*
+		 * Mark the command as aborted so that we do not send
+		 * a second abort message:
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABORT_SENT;
+	}
+
+	/*
+	 * Poll for completion of the abort message.  Note that this function
+	 * only fails if we set a timeout on the command, which we have not
+	 * done.
+	 */
+	VERIFY0(smrt_poll_for(smrt, abort_smcm));
+
+	if ((abort_smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) ||
+	    (abort_smcm->smcm_status & SMRT_CMD_STATUS_ERROR)) {
+		/*
+		 * Either the controller was reset or the abort command
+		 * failed.
+		 */
+		goto fail;
+	}
+
+	/*
+	 * The command was successfully aborted.
+	 */
+	mutex_exit(&smrt->smrt_mutex);
+	smrt_command_free(abort_smcm);
+	return (1);
+
+fail:
+	mutex_exit(&smrt->smrt_mutex);
+	smrt_command_free(abort_smcm);
+	return (0);
+}
+
+static void
+smrt_hba_complete_status(smrt_command_t *smcm)
+{
+	ErrorInfo_t *ei = smcm->smcm_va_err;
+	struct scsi_pkt *pkt = smcm->smcm_scsa->smcms_pkt;
+
+	bzero(pkt->pkt_scbp, pkt->pkt_scblen);
+
+	if (ei->ScsiStatus != STATUS_CHECK) {
+		/*
+		 * If the SCSI status is not CHECK CONDITION, we don't want
+		 * to try and read the sense data buffer.
+		 */
+		goto simple_status;
+	}
+
+	if (pkt->pkt_scblen < sizeof (struct scsi_arq_status)) {
+		/*
+		 * There is not enough room for a request sense structure.
+		 * Fall back to reporting just the SCSI status code.
+		 */
+		goto simple_status;
+	}
+
+	/* LINTED: E_BAD_PTR_CAST_ALIGN */
+	struct scsi_arq_status *sts = (struct scsi_arq_status *)pkt->pkt_scbp;
+
+	/*
+	 * Copy in the SCSI status from the original command.
+	 */
+	bcopy(&ei->ScsiStatus, &sts->sts_status, sizeof (sts->sts_status));
+
+	/*
+	 * Mock up a successful REQUEST SENSE:
+	 */
+	sts->sts_rqpkt_reason = CMD_CMPLT;
+	sts->sts_rqpkt_resid = 0;
+	sts->sts_rqpkt_state = STATE_GOT_BUS | STATE_GOT_TARGET |
+	    STATE_SENT_CMD | STATE_XFERRED_DATA | STATE_GOT_STATUS;
+	sts->sts_rqpkt_statistics = 0;
+
+	/*
+	 * The sense data from the controller should be copied into place
+	 * starting at the "sts_sensedata" member of the auto request
+	 * sense object.
+	 */
+	size_t sense_len = pkt->pkt_scblen - offsetof(struct scsi_arq_status,
+	    sts_sensedata);
+	if (ei->SenseLen < sense_len) {
+		/*
+		 * Only copy sense data bytes that are within the region
+		 * the controller marked as valid.
+		 */
+		sense_len = ei->SenseLen;
+	}
+	bcopy(ei->SenseInfo, &sts->sts_sensedata, sense_len);
+
+	pkt->pkt_state |= STATE_ARQ_DONE;
+	return;
+
+simple_status:
+	if (pkt->pkt_scblen < sizeof (struct scsi_status)) {
+		/*
+		 * There is not even enough room for the SCSI status byte.
+		 */
+		return;
+	}
+
+	bcopy(&ei->ScsiStatus, pkt->pkt_scbp, sizeof (struct scsi_status));
+}
+
+static void
+smrt_hba_complete_log_error(smrt_command_t *smcm, const char *name)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+	ErrorInfo_t *ei = smcm->smcm_va_err;
+
+	dev_err(smrt->smrt_dip, CE_WARN, "!SCSI command failed: %s: "
+	    "SCSI op %x, CISS status %x, SCSI status %x", name,
+	    (unsigned)smcm->smcm_va_cmd->Request.CDB[0],
+	    (unsigned)ei->CommandStatus, (unsigned)ei->ScsiStatus);
+}
+
+/*
+ * Completion routine for commands submitted to the controller via the SCSI
+ * framework.
+ */
+void
+smrt_hba_complete(smrt_command_t *smcm)
+{
+	smrt_t *smrt = smcm->smcm_ctlr;
+	ErrorInfo_t *ei = smcm->smcm_va_err;
+	struct scsi_pkt *pkt = smcm->smcm_scsa->smcms_pkt;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	pkt->pkt_resid = ei->ResidualCnt;
+
+	/*
+	 * Check if the controller was reset while this packet was in flight.
+	 */
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		if (pkt->pkt_reason != CMD_CMPLT) {
+			/*
+			 * If another error status has already been written,
+			 * do not overwrite it.
+			 */
+			pkt->pkt_reason = CMD_RESET;
+		}
+		pkt->pkt_statistics |= STAT_BUS_RESET | STAT_DEV_RESET;
+		goto finish;
+	}
+
+	if (!(smcm->smcm_status & SMRT_CMD_STATUS_ERROR)) {
+		/*
+		 * The command was completed without error by the controller.
+		 *
+		 * As per the specification, if an error was not signalled
+		 * by the controller through the CISS transport method,
+		 * the error information (including CommandStatus) has not
+		 * been written and should not be checked.
+		 */
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		goto finish;
+	}
+
+	/*
+	 * Check the completion status to determine what befell this request.
+	 */
+	switch (ei->CommandStatus) {
+	case CISS_CMD_SUCCESS:
+		/*
+		 * In a certain sense, the specification contradicts itself.
+		 * On the one hand, it suggests that a successful command
+		 * will not result in a controller write to the error
+		 * information block; on the other hand, it makes room
+		 * for a status code (0) which denotes a successful
+		 * execution.
+		 *
+		 * To be on the safe side, we check for that condition here.
+		 */
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_DATA_UNDERRUN:
+		/*
+		 * A data underrun occurred.  Ideally this will result in
+		 * an appropriate SCSI status and sense data.
+		 */
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_TARGET_STATUS:
+		/*
+		 * The command completed, but an error occurred.  We need
+		 * to provide the sense data to the SCSI framework.
+		 */
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_DATA_OVERRUN:
+		/*
+		 * Data overrun has occurred.
+		 */
+		smrt_hba_complete_log_error(smcm, "data overrun");
+		pkt->pkt_reason = CMD_DATA_OVR;
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_INVALID:
+		/*
+		 * One or more fields in the command has invalid data.
+		 */
+		smrt_hba_complete_log_error(smcm, "invalid command");
+		pkt->pkt_reason = CMD_BADMSG;
+		pkt->pkt_state |= STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_PROTOCOL_ERR:
+		/*
+		 * An error occurred in communication with the end device.
+		 */
+		smrt_hba_complete_log_error(smcm, "protocol error");
+		pkt->pkt_reason = CMD_BADMSG;
+		pkt->pkt_state |= STATE_GOT_STATUS;
+		break;
+
+	case CISS_CMD_HARDWARE_ERR:
+		/*
+		 * A hardware error occurred.
+		 */
+		smrt_hba_complete_log_error(smcm, "hardware error");
+		pkt->pkt_reason = CMD_INCOMPLETE;
+		break;
+
+	case CISS_CMD_CONNECTION_LOST:
+		/*
+		 * The connection with the end device cannot be
+		 * re-established.
+		 */
+		smrt_hba_complete_log_error(smcm, "connection lost");
+		pkt->pkt_reason = CMD_INCOMPLETE;
+		break;
+
+	case CISS_CMD_ABORTED:
+	case CISS_CMD_UNSOLICITED_ABORT:
+		if (smcm->smcm_status & SMRT_CMD_STATUS_TIMEOUT) {
+			/*
+			 * This abort was arranged by the periodic routine
+			 * in response to an elapsed timeout.
+			 */
+			pkt->pkt_reason = CMD_TIMEOUT;
+			pkt->pkt_statistics |= STAT_TIMEOUT;
+		} else {
+			pkt->pkt_reason = CMD_ABORTED;
+		}
+		pkt->pkt_state |= STATE_XFERRED_DATA | STATE_GOT_STATUS;
+		pkt->pkt_statistics |= STAT_ABORTED;
+		break;
+
+	case CISS_CMD_TIMEOUT:
+		smrt_hba_complete_log_error(smcm, "timeout");
+		pkt->pkt_reason = CMD_TIMEOUT;
+		pkt->pkt_statistics |= STAT_TIMEOUT;
+		break;
+
+	default:
+		/*
+		 * This is an error that we were not prepared to handle.
+		 * Signal a generic transport-level error to the framework.
+		 */
+		smrt_hba_complete_log_error(smcm, "unexpected error");
+		pkt->pkt_reason = CMD_TRAN_ERR;
+	}
+
+	/*
+	 * Attempt to read a SCSI status code and any automatic
+	 * request sense data that may exist:
+	 */
+	smrt_hba_complete_status(smcm);
+
+finish:
+	mutex_exit(&smrt->smrt_mutex);
+	scsi_hba_pkt_comp(pkt);
+	mutex_enter(&smrt->smrt_mutex);
+}
+
+static int
+smrt_getcap(struct scsi_address *sa, char *cap, int whom)
+{
+	_NOTE(ARGUNUSED(whom))
+
+	struct scsi_device *sd;
+	smrt_target_t *smtg;
+	smrt_t *smrt;
+	int index;
+
+	sd = scsi_address_device(sa);
+	VERIFY(sd != NULL);
+	smtg = scsi_device_hba_private_get(sd);
+	VERIFY(smtg != NULL);
+	smrt = smtg->smtg_ctlr;
+	VERIFY(smrt != NULL);
+
+	if ((index = scsi_hba_lookup_capstr(cap)) == DDI_FAILURE) {
+		/*
+		 * This capability string could not be translated to an
+		 * ID number, so it must not exist.
+		 */
+		return (-1);
+	}
+
+	switch (index) {
+	case SCSI_CAP_CDB_LEN:
+		/*
+		 * The CDB field in the CISS request block is fixed at 16
+		 * bytes.
+		 */
+		return (CISS_CDBLEN);
+
+	case SCSI_CAP_DMA_MAX:
+		if (smrt->smrt_dma_attr.dma_attr_maxxfer > INT_MAX) {
+			return (INT_MAX);
+		}
+		return ((int)smrt->smrt_dma_attr.dma_attr_maxxfer);
+
+	case SCSI_CAP_SECTOR_SIZE:
+		if (smrt->smrt_dma_attr.dma_attr_granular > INT_MAX) {
+			return (-1);
+		}
+		return ((int)smrt->smrt_dma_attr.dma_attr_granular);
+
+	/*
+	 * If this target corresponds to a physical device, then we always
+	 * indicate that we're on a SAS interconnect.  Otherwise, we default to
+	 * saying that we're on a parallel bus.  We can't use SAS for
+	 * everything, unfortunately.  When you declare yourself to be a SAS
+	 * interconnect, it's expected that you have a full 16-byte WWN as the
+	 * target.  If not, devfsadm will not be able to enumerate the device
+	 * and create /dev/[r]dsk entries.
+	 */
+	case SCSI_CAP_INTERCONNECT_TYPE:
+		if (smtg->smtg_physical) {
+			return (INTERCONNECT_SAS);
+		} else {
+			return (INTERCONNECT_PARALLEL);
+		}
+
+	case SCSI_CAP_DISCONNECT:
+	case SCSI_CAP_SYNCHRONOUS:
+	case SCSI_CAP_WIDE_XFER:
+	case SCSI_CAP_ARQ:
+	case SCSI_CAP_UNTAGGED_QING:
+	case SCSI_CAP_TAGGED_QING:
+		/*
+		 * These capabilities are supported by the driver and the
+		 * controller.  See scsi_ifgetcap(9F) for more information.
+		 */
+		return (1);
+
+	case SCSI_CAP_INITIATOR_ID:
+	case SCSI_CAP_RESET_NOTIFICATION:
+		/*
+		 * These capabilities are not supported.
+		 */
+		return (0);
+
+	default:
+		/*
+		 * The property in question is not known to this driver.
+		 */
+		return (-1);
+	}
+}
+
+/* ARGSUSED */
+static int
+smrt_setcap(struct scsi_address *sa, char *cap, int value, int whom)
+{
+	int index;
+
+	if ((index = scsi_hba_lookup_capstr(cap)) == DDI_FAILURE) {
+		/*
+		 * This capability string could not be translated to an
+		 * ID number, so it must not exist.
+		 */
+		return (-1);
+	}
+
+	if (whom == 0) {
+		/*
+		 * When whom is 0, this is a request to set a capability for
+		 * all targets.  As per the recommendation in tran_setcap(9E),
+		 * we do not support this mode of operation.
+		 */
+		return (-1);
+	}
+
+	switch (index) {
+	case SCSI_CAP_CDB_LEN:
+	case SCSI_CAP_DMA_MAX:
+	case SCSI_CAP_SECTOR_SIZE:
+	case SCSI_CAP_INITIATOR_ID:
+	case SCSI_CAP_DISCONNECT:
+	case SCSI_CAP_SYNCHRONOUS:
+	case SCSI_CAP_WIDE_XFER:
+	case SCSI_CAP_ARQ:
+	case SCSI_CAP_UNTAGGED_QING:
+	case SCSI_CAP_TAGGED_QING:
+	case SCSI_CAP_RESET_NOTIFICATION:
+	case SCSI_CAP_INTERCONNECT_TYPE:
+		/*
+		 * We do not support changing any capabilities at this time.
+		 */
+		return (0);
+
+	default:
+		/*
+		 * The capability in question is not known to this driver.
+		 */
+		return (-1);
+	}
+}
+
+int
+smrt_ctrl_hba_setup(smrt_t *smrt)
+{
+	int flags;
+	dev_info_t *dip = smrt->smrt_dip;
+	scsi_hba_tran_t *tran;
+
+	if ((tran = scsi_hba_tran_alloc(dip, SCSI_HBA_CANSLEEP)) == NULL) {
+		dev_err(dip, CE_WARN, "could not allocate SCSA resources");
+		return (DDI_FAILURE);
+	}
+
+	smrt->smrt_hba_tran = tran;
+	tran->tran_hba_private = smrt;
+
+	tran->tran_tgt_init = smrt_ctrl_tran_tgt_init;
+	tran->tran_tgt_probe = scsi_hba_probe;
+
+	tran->tran_start = smrt_ctrl_tran_start;
+
+	tran->tran_getcap = smrt_getcap;
+	tran->tran_setcap = smrt_setcap;
+
+	tran->tran_setup_pkt = smrt_tran_setup_pkt;
+	tran->tran_teardown_pkt = smrt_tran_teardown_pkt;
+	tran->tran_hba_len = sizeof (smrt_command_scsa_t);
+	tran->tran_interconnect_type = INTERCONNECT_SAS;
+
+	flags = SCSI_HBA_HBA | SCSI_HBA_TRAN_SCB | SCSI_HBA_ADDR_COMPLEX;
+	if (scsi_hba_attach_setup(dip, &smrt->smrt_dma_attr, tran, flags) !=
+	    DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not attach to SCSA framework");
+		scsi_hba_tran_free(tran);
+		return (DDI_FAILURE);
+	}
+
+	smrt->smrt_init_level |= SMRT_INITLEVEL_SCSA;
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_ctrl_hba_teardown(smrt_t *smrt)
+{
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_SCSA) {
+		VERIFY(scsi_hba_detach(smrt->smrt_dip) != DDI_FAILURE);
+		scsi_hba_tran_free(smrt->smrt_hba_tran);
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_SCSA;
+	}
+}
+
+int
+smrt_logvol_hba_setup(smrt_t *smrt, dev_info_t *iport)
+{
+	scsi_hba_tran_t *tran;
+
+	tran = ddi_get_driver_private(iport);
+	if (tran == NULL)
+		return (DDI_FAILURE);
+
+	tran->tran_tgt_init = smrt_logvol_tran_tgt_init;
+	tran->tran_tgt_free = smrt_logvol_tran_tgt_free;
+
+	tran->tran_start = smrt_tran_start;
+	tran->tran_reset = smrt_tran_reset;
+	tran->tran_abort = smrt_tran_abort;
+
+	tran->tran_hba_private = smrt;
+
+	mutex_enter(&smrt->smrt_mutex);
+	if (scsi_hba_tgtmap_create(iport, SCSI_TM_FULLSET, MICROSEC,
+	    2 * MICROSEC, smrt, smrt_logvol_tgtmap_activate,
+	    smrt_logvol_tgtmap_deactivate, &smrt->smrt_virt_tgtmap) !=
+	    DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	smrt_discover_request(smrt);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_logvol_hba_teardown(smrt_t *smrt, dev_info_t *iport)
+{
+	ASSERT(smrt->smrt_virt_iport == iport);
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (smrt->smrt_virt_tgtmap != NULL) {
+		scsi_hba_tgtmap_t *t;
+
+		/*
+		 * Ensure that we can't be racing with discovery.
+		 */
+		while (smrt->smrt_status & SMRT_CTLR_DISCOVERY_RUNNING) {
+			mutex_exit(&smrt->smrt_mutex);
+			ddi_taskq_wait(smrt->smrt_discover_taskq);
+			mutex_enter(&smrt->smrt_mutex);
+		}
+
+		t = smrt->smrt_virt_tgtmap;
+		smrt->smrt_virt_tgtmap = NULL;
+		mutex_exit(&smrt->smrt_mutex);
+		scsi_hba_tgtmap_destroy(t);
+		mutex_enter(&smrt->smrt_mutex);
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+int
+smrt_phys_hba_setup(smrt_t *smrt, dev_info_t *iport)
+{
+	scsi_hba_tran_t *tran;
+
+	tran = ddi_get_driver_private(iport);
+	if (tran == NULL)
+		return (DDI_FAILURE);
+
+	tran->tran_tgt_init = smrt_phys_tran_tgt_init;
+	tran->tran_tgt_free = smrt_phys_tran_tgt_free;
+
+	tran->tran_start = smrt_tran_start;
+	tran->tran_reset = smrt_tran_reset;
+	tran->tran_abort = smrt_tran_abort;
+
+	tran->tran_hba_private = smrt;
+
+	mutex_enter(&smrt->smrt_mutex);
+	if (scsi_hba_tgtmap_create(iport, SCSI_TM_FULLSET, MICROSEC,
+	    2 * MICROSEC, smrt, smrt_phys_tgtmap_activate,
+	    smrt_phys_tgtmap_deactivate, &smrt->smrt_phys_tgtmap) !=
+	    DDI_SUCCESS) {
+		return (DDI_FAILURE);
+	}
+
+	smrt_discover_request(smrt);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (DDI_SUCCESS);
+}
+
+void
+smrt_phys_hba_teardown(smrt_t *smrt, dev_info_t *iport)
+{
+	ASSERT(smrt->smrt_phys_iport == iport);
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	if (smrt->smrt_phys_tgtmap != NULL) {
+		scsi_hba_tgtmap_t *t;
+
+		/*
+		 * Ensure that we can't be racing with discovery.
+		 */
+		while (smrt->smrt_status & SMRT_CTLR_DISCOVERY_RUNNING) {
+			mutex_exit(&smrt->smrt_mutex);
+			ddi_taskq_wait(smrt->smrt_discover_taskq);
+			mutex_enter(&smrt->smrt_mutex);
+		}
+
+		t = smrt->smrt_phys_tgtmap;
+		smrt->smrt_phys_tgtmap = NULL;
+		mutex_exit(&smrt->smrt_mutex);
+		scsi_hba_tgtmap_destroy(t);
+		mutex_enter(&smrt->smrt_mutex);
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_interrupts.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_interrupts.c
new file mode 100644
index 0000000000..18d5b8e936
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_interrupts.c
@@ -0,0 +1,286 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+static char *
+smrt_interrupt_type_name(int type)
+{
+	switch (type) {
+	case DDI_INTR_TYPE_MSIX:
+		return ("MSI-X");
+	case DDI_INTR_TYPE_MSI:
+		return ("MSI");
+	case DDI_INTR_TYPE_FIXED:
+		return ("fixed");
+	default:
+		return ("?");
+	}
+}
+
+static boolean_t
+smrt_try_msix(smrt_t *smrt)
+{
+	char *fwver = smrt->smrt_versions.smrtv_firmware_rev;
+
+	/*
+	 * Generation 9 controllers end up having a different firmware
+	 * versioning scheme than others.  If this is a generation 9 controller,
+	 * which all share the same PCI device ID, then we default to MSI.
+	 */
+	if (smrt->smrt_pci_vendor == SMRT_VENDOR_HP &&
+	    smrt->smrt_pci_device == SMRT_DEVICE_GEN9) {
+		return (B_FALSE);
+	}
+
+	if (fwver[0] == '8' && fwver[1] == '.' && isdigit(fwver[2]) &&
+	    isdigit(fwver[3])) {
+		/*
+		 * Version 8.00 of the Smart Array firmware appears to have
+		 * broken MSI support on at least one controller.  We could
+		 * blindly try MSI-X everywhere, except that on at least some
+		 * 6.XX firmware versions, MSI-X interrupts do not appear
+		 * to be triggered for Simple Transport Method command
+		 * completions.
+		 *
+		 * For now, assume we should try for MSI-X with all 8.XX
+		 * versions of the firmware.
+		 */
+		dev_err(smrt->smrt_dip, CE_NOTE, "!trying MSI-X interrupts "
+		    "to work around 8.XX firmware defect");
+		return (B_TRUE);
+	}
+
+	return (B_FALSE);
+}
+
+static int
+smrt_interrupts_disable(smrt_t *smrt)
+{
+	if (smrt->smrt_interrupt_cap & DDI_INTR_FLAG_BLOCK) {
+		return (ddi_intr_block_disable(smrt->smrt_interrupts,
+		    smrt->smrt_ninterrupts));
+	} else {
+		VERIFY3S(smrt->smrt_ninterrupts, ==, 1);
+
+		return (ddi_intr_disable(smrt->smrt_interrupts[0]));
+	}
+}
+
+int
+smrt_interrupts_enable(smrt_t *smrt)
+{
+	int ret;
+
+	VERIFY(!(smrt->smrt_init_level & SMRT_INITLEVEL_INT_ENABLED));
+
+	if (smrt->smrt_interrupt_cap & DDI_INTR_FLAG_BLOCK) {
+		ret = ddi_intr_block_enable(smrt->smrt_interrupts,
+		    smrt->smrt_ninterrupts);
+	} else {
+		VERIFY3S(smrt->smrt_ninterrupts, ==, 1);
+
+		ret = ddi_intr_enable(smrt->smrt_interrupts[0]);
+	}
+
+	if (ret == DDI_SUCCESS) {
+		smrt->smrt_init_level |= SMRT_INITLEVEL_INT_ENABLED;
+	}
+
+	return (ret);
+}
+
+static void
+smrt_interrupts_free(smrt_t *smrt)
+{
+	for (int i = 0; i < smrt->smrt_ninterrupts; i++) {
+		(void) ddi_intr_free(smrt->smrt_interrupts[i]);
+	}
+	smrt->smrt_ninterrupts = 0;
+	smrt->smrt_interrupt_type = 0;
+	smrt->smrt_interrupt_cap = 0;
+	smrt->smrt_interrupt_pri = 0;
+}
+
+static int
+smrt_interrupts_alloc(smrt_t *smrt, int type)
+{
+	dev_info_t *dip = smrt->smrt_dip;
+	int nintrs = 0;
+	int navail = 0;
+
+	if (ddi_intr_get_nintrs(dip, type, &nintrs) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not count %s interrupts",
+		    smrt_interrupt_type_name(type));
+		return (DDI_FAILURE);
+	}
+	if (nintrs < 1) {
+		dev_err(dip, CE_WARN, "no %s interrupts supported",
+		    smrt_interrupt_type_name(type));
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_intr_get_navail(dip, type, &navail) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not count available %s "
+		    "interrupts", smrt_interrupt_type_name(type));
+		return (DDI_FAILURE);
+	}
+	if (navail < 1) {
+		dev_err(dip, CE_WARN, "no %s interrupts available",
+		    smrt_interrupt_type_name(type));
+		return (DDI_FAILURE);
+	}
+
+	if (ddi_intr_alloc(dip, smrt->smrt_interrupts, type, 0, 1,
+	    &smrt->smrt_ninterrupts, DDI_INTR_ALLOC_STRICT) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "%s interrupt allocation failed",
+		    smrt_interrupt_type_name(type));
+		smrt_interrupts_free(smrt);
+		return (DDI_FAILURE);
+	}
+
+	smrt->smrt_init_level |= SMRT_INITLEVEL_INT_ALLOC;
+	smrt->smrt_interrupt_type = type;
+	return (DDI_SUCCESS);
+}
+
+int
+smrt_interrupts_setup(smrt_t *smrt)
+{
+	int types;
+	unsigned ipri;
+	uint_t (*hw_isr)(caddr_t, caddr_t);
+	dev_info_t *dip = smrt->smrt_dip;
+
+	/*
+	 * Select the correct hardware interrupt service routine for the
+	 * Transport Method we have configured:
+	 */
+	switch (smrt->smrt_ctlr_mode) {
+	case SMRT_CTLR_MODE_SIMPLE:
+		hw_isr = smrt_isr_hw_simple;
+		break;
+	default:
+		panic("unknown controller mode");
+	}
+
+	if (ddi_intr_get_supported_types(dip, &types) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not get support interrupts");
+		goto fail;
+	}
+
+	/*
+	 * At least one firmware version has been released for the Smart Array
+	 * line with entirely defective MSI support.  The specification is
+	 * somewhat unclear on the precise nature of MSI-X support with Smart
+	 * Array controllers, particularly with respect to the Simple Transport
+	 * Method, but for those broken firmware versions we need to try
+	 * anyway.
+	 */
+	if (smrt_try_msix(smrt) && (types & DDI_INTR_TYPE_MSIX)) {
+		if (smrt_interrupts_alloc(smrt, DDI_INTR_TYPE_MSIX) ==
+		    DDI_SUCCESS) {
+			goto add_handler;
+		}
+	}
+
+	/*
+	 * If MSI-X is not available, or not expected to work, fall back to
+	 * MSI.
+	 */
+	if (types & DDI_INTR_TYPE_MSI) {
+		if (smrt_interrupts_alloc(smrt, DDI_INTR_TYPE_MSI) ==
+		    DDI_SUCCESS) {
+			goto add_handler;
+		}
+	}
+
+	/*
+	 * If neither MSI-X nor MSI is available, fall back to fixed
+	 * interrupts.  Note that the use of fixed interrupts has been
+	 * observed, with some combination of controllers and systems, to
+	 * result in interrupts stopping completely at random times.
+	 */
+	if (types & DDI_INTR_TYPE_FIXED) {
+		if (smrt_interrupts_alloc(smrt, DDI_INTR_TYPE_FIXED) ==
+		    DDI_SUCCESS) {
+			goto add_handler;
+		}
+	}
+
+	/*
+	 * We were unable to allocate any interrupts.
+	 */
+	dev_err(dip, CE_WARN, "interrupt allocation failed");
+	goto fail;
+
+add_handler:
+	/*
+	 * Ensure that we have not been given a high-level interrupt, as our
+	 * interrupt handlers do not support them.
+	 */
+	if (ddi_intr_get_pri(smrt->smrt_interrupts[0], &ipri) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not determine interrupt priority");
+		goto fail;
+	}
+	if (ipri >= ddi_intr_get_hilevel_pri()) {
+		dev_err(dip, CE_WARN, "high level interrupts not supported");
+		goto fail;
+	}
+	smrt->smrt_interrupt_pri = ipri;
+
+	if (ddi_intr_get_cap(smrt->smrt_interrupts[0],
+	    &smrt->smrt_interrupt_cap) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "could not get %s interrupt cap",
+		    smrt_interrupt_type_name(smrt->smrt_interrupt_type));
+		goto fail;
+	}
+
+	if (ddi_intr_add_handler(smrt->smrt_interrupts[0], hw_isr,
+	    (caddr_t)smrt, NULL) != DDI_SUCCESS) {
+		dev_err(dip, CE_WARN, "adding %s interrupt failed",
+		    smrt_interrupt_type_name(smrt->smrt_interrupt_type));
+		goto fail;
+	}
+	smrt->smrt_init_level |= SMRT_INITLEVEL_INT_ADDED;
+
+	return (DDI_SUCCESS);
+
+fail:
+	smrt_interrupts_teardown(smrt);
+	return (DDI_FAILURE);
+}
+
+void
+smrt_interrupts_teardown(smrt_t *smrt)
+{
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_INT_ENABLED) {
+		(void) smrt_interrupts_disable(smrt);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_INT_ENABLED;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_INT_ADDED) {
+		(void) ddi_intr_remove_handler(smrt->smrt_interrupts[0]);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_INT_ADDED;
+	}
+
+	if (smrt->smrt_init_level & SMRT_INITLEVEL_INT_ALLOC) {
+		smrt_interrupts_free(smrt);
+
+		smrt->smrt_init_level &= ~SMRT_INITLEVEL_INT_ALLOC;
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_logvol.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_logvol.c
new file mode 100644
index 0000000000..05963ac2e2
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_logvol.c
@@ -0,0 +1,367 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+static void
+smrt_logvol_free(smrt_volume_t *smlv)
+{
+	/*
+	 * By this stage of teardown, all of the SCSI target drivers
+	 * must have been detached from this logical volume.
+	 */
+	VERIFY(list_is_empty(&smlv->smlv_targets));
+	list_destroy(&smlv->smlv_targets);
+
+	kmem_free(smlv, sizeof (*smlv));
+}
+
+smrt_volume_t *
+smrt_logvol_lookup_by_id(smrt_t *smrt, unsigned long id)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	for (smrt_volume_t *smlv = list_head(&smrt->smrt_volumes);
+	    smlv != NULL; smlv = list_next(&smrt->smrt_volumes, smlv)) {
+		if (smlv->smlv_addr.LogDev.VolId == id) {
+			return (smlv);
+		}
+	}
+
+	return (NULL);
+}
+
+static int
+smrt_read_logvols(smrt_t *smrt, smrt_report_logical_lun_t *smrll, uint64_t gen)
+{
+	smrt_report_logical_lun_ent_t *ents = smrll->smrll_data.ents;
+	uint32_t count = BE_32(smrll->smrll_datasize) /
+	    sizeof (smrt_report_logical_lun_ent_t);
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (count > SMRT_MAX_LOGDRV) {
+		count = SMRT_MAX_LOGDRV;
+	}
+
+	for (unsigned i = 0; i < count; i++) {
+		smrt_volume_t *smlv;
+		char id[SCSI_MAXNAMELEN];
+
+		DTRACE_PROBE2(read_logvol, unsigned, i,
+		    smrt_report_logical_lun_ent_t *, &ents[i]);
+
+		if ((smlv = smrt_logvol_lookup_by_id(smrt,
+		    ents[i].smrle_addr.VolId)) == NULL) {
+
+			/*
+			 * This is a new Logical Volume, so add it the the list.
+			 */
+			if ((smlv = kmem_zalloc(sizeof (*smlv), KM_NOSLEEP)) ==
+			    NULL) {
+				return (ENOMEM);
+			}
+
+			list_create(&smlv->smlv_targets,
+			    sizeof (smrt_target_t),
+			    offsetof(smrt_target_t, smtg_link_lun));
+
+			smlv->smlv_ctlr = smrt;
+			list_insert_tail(&smrt->smrt_volumes, smlv);
+		}
+
+		/*
+		 * Always make sure that the address and the generation are up
+		 * to date, regardless of where this came from.
+		 */
+		smlv->smlv_addr.LogDev = ents[i].smrle_addr;
+		smlv->smlv_gen = gen;
+		(void) snprintf(id, sizeof (id), "%x",
+		    smlv->smlv_addr.LogDev.VolId);
+		if (!ddi_in_panic() &&
+		    scsi_hba_tgtmap_set_add(smrt->smrt_virt_tgtmap,
+		    SCSI_TGT_SCSI_DEVICE, id, NULL) != DDI_SUCCESS) {
+			return (EIO);
+		}
+	}
+
+	return (0);
+}
+
+static int
+smrt_read_logvols_ext(smrt_t *smrt, smrt_report_logical_lun_t *smrll,
+    uint64_t gen)
+{
+	smrt_report_logical_lun_extent_t *extents =
+	    smrll->smrll_data.extents;
+	uint32_t count = BE_32(smrll->smrll_datasize) /
+	    sizeof (smrt_report_logical_lun_extent_t);
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (count > SMRT_MAX_LOGDRV) {
+		count = SMRT_MAX_LOGDRV;
+	}
+
+	for (unsigned i = 0; i < count; i++) {
+		smrt_volume_t *smlv;
+		char id[SCSI_MAXNAMELEN];
+
+		DTRACE_PROBE2(read_logvol_ext, unsigned, i,
+		    smrt_report_logical_lun_extent_t *, &extents[i]);
+
+		if ((smlv = smrt_logvol_lookup_by_id(smrt,
+		    extents[i].smrle_addr.VolId)) != NULL) {
+			if ((smlv->smlv_flags & SMRT_VOL_FLAG_WWN) &&
+			    bcmp(extents[i].smrle_wwn, smlv->smlv_wwn,
+			    16) != 0) {
+				dev_err(smrt->smrt_dip, CE_PANIC, "logical "
+				    "volume %u WWN changed unexpectedly", i);
+			}
+		} else {
+			/*
+			 * This is a new Logical Volume, so add it the the list.
+			 */
+			if ((smlv = kmem_zalloc(sizeof (*smlv), KM_NOSLEEP)) ==
+			    NULL) {
+				return (ENOMEM);
+			}
+
+			bcopy(extents[i].smrle_wwn, smlv->smlv_wwn, 16);
+			smlv->smlv_flags |= SMRT_VOL_FLAG_WWN;
+
+			list_create(&smlv->smlv_targets,
+			    sizeof (smrt_target_t),
+			    offsetof(smrt_target_t, smtg_link_lun));
+
+			smlv->smlv_ctlr = smrt;
+			list_insert_tail(&smrt->smrt_volumes, smlv);
+		}
+
+		/*
+		 * Always make sure that the address and the generation are up
+		 * to date.  The address may have changed on a reset.
+		 */
+		smlv->smlv_addr.LogDev = extents[i].smrle_addr;
+		smlv->smlv_gen = gen;
+		(void) snprintf(id, sizeof (id), "%x",
+		    smlv->smlv_addr.LogDev.VolId);
+		if (!ddi_in_panic() &&
+		    scsi_hba_tgtmap_set_add(smrt->smrt_virt_tgtmap,
+		    SCSI_TGT_SCSI_DEVICE, id, NULL) != DDI_SUCCESS) {
+			return (EIO);
+		}
+	}
+
+	return (0);
+}
+
+/*
+ * Discover the currently visible set of Logical Volumes exposed by the
+ * controller.
+ */
+int
+smrt_logvol_discover(smrt_t *smrt, uint16_t timeout, uint64_t gen)
+{
+	smrt_command_t *smcm;
+	smrt_report_logical_lun_t *smrll;
+	smrt_report_logical_lun_req_t smrllr = { 0 };
+	int r;
+
+	/*
+	 * Allocate the command to send to the device, including buffer space
+	 * for the returned list of Logical Volumes.
+	 */
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL || smrt_command_attach_internal(smrt, smcm,
+	    sizeof (smrt_report_logical_lun_t), KM_NOSLEEP) != 0) {
+		r = ENOMEM;
+		mutex_enter(&smrt->smrt_mutex);
+		goto out;
+	}
+
+	smrll = smcm->smcm_internal->smcmi_va;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (smrllr);
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout);
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+
+	/*
+	 * The Report Logical LUNs command is essentially a vendor-specific
+	 * SCSI command, which we assemble into the CDB region of the command
+	 * block.
+	 */
+	bzero(&smrllr, sizeof (smrllr));
+	smrllr.smrllr_opcode = CISS_SCMD_REPORT_LOGICAL_LUNS;
+	smrllr.smrllr_extflag = 1;
+	smrllr.smrllr_datasize = htonl(sizeof (smrt_report_logical_lun_t));
+	bcopy(&smrllr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (smrllr)));
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send the command to the device.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		goto out;
+	}
+
+	/*
+	 * Poll for completion.
+	 */
+	smcm->smcm_expiry = gethrtime() + timeout * NANOSEC;
+	if ((r = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out; abandon it now.  Remove the POLLED
+		 * flag so that the periodic routine will send an abort to
+		 * clean it up next time around.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+		smcm = NULL;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 * The controller was reset while we were trying to discover
+		 * logical volumes.  Report failure.
+		 */
+		r = EIO;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "logical volume "
+			    "discovery error: status 0x%x", ei->CommandStatus);
+			r = EIO;
+			goto out;
+		}
+	}
+
+	if (!ddi_in_panic() &&
+	    scsi_hba_tgtmap_set_begin(smrt->smrt_virt_tgtmap) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_WARN, "failed to begin target map "
+		    "observation on %s", SMRT_IPORT_VIRT);
+		r = EIO;
+		goto out;
+	}
+
+	if ((smrll->smrll_extflag & 0x1) != 0) {
+		r = smrt_read_logvols_ext(smrt, smrll, gen);
+	} else {
+		r = smrt_read_logvols(smrt, smrll, gen);
+	}
+
+	if (r == 0 && !ddi_in_panic()) {
+		if (scsi_hba_tgtmap_set_end(smrt->smrt_virt_tgtmap, 0) !=
+		    DDI_SUCCESS) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to end target "
+			    "map observation on %s", SMRT_IPORT_VIRT);
+			r = EIO;
+		}
+	} else if (r != 0 && !ddi_in_panic()) {
+		if (scsi_hba_tgtmap_set_flush(smrt->smrt_virt_tgtmap) !=
+		    DDI_SUCCESS) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to end target "
+			    "map observation on %s", SMRT_IPORT_VIRT);
+			r = EIO;
+		}
+	}
+
+	if (r == 0) {
+		/*
+		 * Update the time of the last successful Logical Volume
+		 * discovery:
+		 */
+		smrt->smrt_last_log_discovery = gethrtime();
+	}
+
+out:
+	mutex_exit(&smrt->smrt_mutex);
+
+	if (smcm != NULL) {
+		smrt_command_free(smcm);
+	}
+	return (r);
+}
+
+void
+smrt_logvol_tgtmap_activate(void *arg, char *addr, scsi_tgtmap_tgt_type_t type,
+    void **privpp)
+{
+	smrt_t *smrt = arg;
+	unsigned long volume;
+	char *eptr;
+
+	VERIFY(type == SCSI_TGT_SCSI_DEVICE);
+	VERIFY0(ddi_strtoul(addr, &eptr, 16, &volume));
+	VERIFY3S(*eptr, ==, '\0');
+	VERIFY3S(volume, >=, 0);
+	VERIFY3S(volume, <, SMRT_MAX_LOGDRV);
+	mutex_enter(&smrt->smrt_mutex);
+	VERIFY(smrt_logvol_lookup_by_id(smrt, volume) != NULL);
+	mutex_exit(&smrt->smrt_mutex);
+	*privpp = NULL;
+}
+
+boolean_t
+smrt_logvol_tgtmap_deactivate(void *arg, char *addr,
+    scsi_tgtmap_tgt_type_t type, void *priv, scsi_tgtmap_deact_rsn_t reason)
+{
+	smrt_t *smrt = arg;
+	smrt_volume_t *smlv;
+	unsigned long volume;
+	char *eptr;
+
+	VERIFY(type == SCSI_TGT_SCSI_DEVICE);
+	VERIFY(priv == NULL);
+	VERIFY0(ddi_strtoul(addr, &eptr, 16, &volume));
+	VERIFY3S(*eptr, ==, '\0');
+	VERIFY3S(volume, >=, 0);
+	VERIFY3S(volume, <, SMRT_MAX_LOGDRV);
+
+	mutex_enter(&smrt->smrt_mutex);
+	smlv = smrt_logvol_lookup_by_id(smrt, volume);
+	VERIFY(smlv != NULL);
+
+	list_remove(&smrt->smrt_volumes, smlv);
+	smrt_logvol_free(smlv);
+	mutex_exit(&smrt->smrt_mutex);
+
+	return (B_FALSE);
+}
+
+void
+smrt_logvol_teardown(smrt_t *smrt)
+{
+	smrt_volume_t *smlv;
+
+	while ((smlv = list_remove_head(&smrt->smrt_volumes)) != NULL) {
+		smrt_logvol_free(smlv);
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_physical.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_physical.c
new file mode 100644
index 0000000000..88ed57bc7d
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_physical.c
@@ -0,0 +1,612 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017 Joyent, Inc.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+static void
+smrt_physical_free(smrt_physical_t *smpt)
+{
+	VERIFY(list_is_empty(&smpt->smpt_targets));
+	VERIFY(smpt->smpt_info != NULL);
+
+	kmem_free(smpt->smpt_info, sizeof (*smpt->smpt_info));
+	list_destroy(&smpt->smpt_targets);
+	kmem_free(smpt, sizeof (*smpt));
+}
+
+/*
+ * Determine if a physical device enumerated should be shown to the world. There
+ * are three conditions to satisfy for this to be true.
+ *
+ * 1. The device (SAS, SATA, SES, etc.) must not have a masked CISS address.  A
+ * masked CISS address indicates a device that we should not be performing I/O
+ * to.
+ * 2. The drive (SAS or SATA device) must not be marked as a member of a logical
+ * volume.
+ * 3. The drive (SAS or SATA device) must not be marked as a spare.
+ */
+static boolean_t
+smrt_physical_visible(PhysDevAddr_t *addr, smrt_identify_physical_drive_t *info)
+{
+	if (addr->Mode == SMRT_CISS_MODE_MASKED) {
+		return (B_FALSE);
+	}
+
+	if ((info->sipd_more_flags & (SMRT_MORE_FLAGS_LOGVOL |
+	    SMRT_MORE_FLAGS_SPARE)) != 0) {
+		return (B_FALSE);
+	}
+
+	return (B_TRUE);
+}
+
+/*
+ * Note, the caller is responsible for making sure that the unit-address form of
+ * the WWN is pased in.  Any additional information to target a specific LUN
+ * will be ignored.
+ */
+smrt_physical_t *
+smrt_phys_lookup_by_ua(smrt_t *smrt, const char *ua)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	/*
+	 * Sanity check that the caller has provided us enough bytes for a
+	 * properly formed unit-address form of a WWN.
+	 */
+	if (strlen(ua) < SCSI_WWN_UA_STRLEN)
+		return (NULL);
+
+	for (smrt_physical_t *smpt = list_head(&smrt->smrt_physicals);
+	    smpt != NULL; smpt = list_next(&smrt->smrt_physicals, smpt)) {
+		char wwnstr[SCSI_WWN_BUFLEN];
+
+		(void) scsi_wwn_to_wwnstr(smpt->smpt_wwn, 1, wwnstr);
+		if (strncmp(wwnstr, ua, SCSI_WWN_UA_STRLEN) != 0)
+			continue;
+
+		/*
+		 * Verify that the UA string is either a comma or null there.
+		 * We accept the comma in case it's being used as part of a
+		 * normal UA with a LUN.
+		 */
+		if (ua[SCSI_WWN_UA_STRLEN] != '\0' &&
+		    ua[SCSI_WWN_UA_STRLEN] != ',') {
+			continue;
+		}
+
+		return (smpt);
+	}
+
+	return (NULL);
+}
+
+static smrt_physical_t *
+smrt_phys_lookup_by_wwn(smrt_t *smrt, uint64_t wwn)
+{
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	for (smrt_physical_t *smpt = list_head(&smrt->smrt_physicals);
+	    smpt != NULL; smpt = list_next(&smrt->smrt_physicals, smpt)) {
+		if (wwn == smpt->smpt_wwn)
+			return (smpt);
+	}
+
+	return (NULL);
+}
+
+static int
+smrt_phys_identify(smrt_t *smrt, smrt_identify_physical_drive_t *info,
+    uint16_t bmic, uint16_t timeout)
+{
+	smrt_command_t *smcm = NULL;
+	smrt_identify_physical_drive_t *sipd;
+	smrt_identify_physical_drive_req_t sipdr;
+	int ret;
+	size_t sz, copysz;
+
+	sz = sizeof (smrt_identify_physical_drive_t);
+	sz = P2ROUNDUP_TYPED(sz, 512, size_t);
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL || smrt_command_attach_internal(smrt, smcm,
+	    sizeof (*sipd), KM_NOSLEEP) != 0) {
+		ret = ENOMEM;
+		goto out;
+	}
+
+	sipd = smcm->smcm_internal->smcmi_va;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (sipdr);
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout);
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+
+	/*
+	 * Construct the IDENTIFY PHYSICAL DEVICE request CDB.  Note that any
+	 * reserved fields in the request must be filled with zeroes.
+	 */
+	bzero(&sipdr, sizeof (sipdr));
+	sipdr.sipdr_opcode = CISS_SCMD_BMIC_READ;
+	sipdr.sipdr_lun = 0;
+	sipdr.sipdr_bmic_index1 = bmic & 0x00ff;
+	sipdr.sipdr_command = CISS_BMIC_IDENTIFY_PHYSICAL_DEVICE;
+	sipdr.sipdr_bmic_index2 = (bmic & 0xff00) >> 8;
+	bcopy(&sipdr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (sipdr)));
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send the command to the device.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((ret = smrt_submit(smrt, smcm)) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+		goto out;
+	}
+
+	/*
+	 * Poll for completion.
+	 */
+	smcm->smcm_expiry = gethrtime() + timeout * NANOSEC;
+	if ((ret = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(ret, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out; abandon it now.  Remove the POLLED
+		 * flag so that the periodic routine will send an abort to
+		 * clean it up next time around.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+		smcm = NULL;
+		mutex_exit(&smrt->smrt_mutex);
+		goto out;
+	}
+	mutex_exit(&smrt->smrt_mutex);
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 * The controller was reset while we were trying to discover
+		 * physical volumes.  Report failure.
+		 */
+		ret = EIO;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "identify physical "
+			    "device error: status 0x%x", ei->CommandStatus);
+			ret = EIO;
+			goto out;
+		}
+
+		copysz = MIN(sizeof (*sipd), sz - ei->ResidualCnt);
+	} else {
+		copysz = sizeof (*sipd);
+	}
+
+
+	sz = MIN(sizeof (*sipd), copysz);
+	bcopy(sipd, info, sizeof (*sipd));
+
+	ret = 0;
+out:
+	if (smcm != NULL) {
+		smrt_command_free(smcm);
+	}
+
+	return (ret);
+}
+
+static int
+smrt_read_phys_ext(smrt_t *smrt, smrt_report_physical_lun_t *smrpl,
+    uint16_t timeout, uint64_t gen)
+{
+	smrt_report_physical_lun_extent_t *extents = smrpl->smrpl_data.extents;
+	uint32_t count = BE_32(smrpl->smrpl_datasize) /
+	    sizeof (smrt_report_physical_lun_extent_t);
+	uint32_t i;
+
+	VERIFY(MUTEX_HELD(&smrt->smrt_mutex));
+
+	if (count > SMRT_MAX_PHYSDEV) {
+		count = SMRT_MAX_PHYSDEV;
+	}
+
+	for (i = 0; i < count; i++) {
+		int ret;
+		smrt_physical_t *smpt;
+		smrt_identify_physical_drive_t *info;
+		smrt_report_physical_opdi_t *opdi;
+		uint16_t bmic;
+		uint64_t wwn, satawwn;
+		char name[SCSI_MAXNAMELEN];
+
+		opdi = &extents[i].srple_extdata.srple_opdi;
+
+		mutex_exit(&smrt->smrt_mutex);
+
+		/*
+		 * Get the extended information about this device.
+		 */
+		info = kmem_zalloc(sizeof (*info), KM_NOSLEEP);
+		if (info == NULL) {
+			mutex_enter(&smrt->smrt_mutex);
+			return (ENOMEM);
+		}
+
+		bmic = smrt_lun_addr_to_bmic(&extents[i].srple_addr);
+		ret = smrt_phys_identify(smrt, info, bmic, timeout);
+		if (ret != 0) {
+			mutex_enter(&smrt->smrt_mutex);
+			kmem_free(info, sizeof (*info));
+			return (ret);
+		}
+
+		wwn = *(uint64_t *)opdi->srpo_wwid;
+		wwn = BE_64(wwn);
+
+		/*
+		 * SATA devices may not have a proper WWN returned from firmware
+		 * based on the SATL specification.  Try to fetch the proper id
+		 * for SATA devices, if the drive has one.  If the drive doesn't
+		 * have one or the SATL refuses to give us one, we use whatever
+		 * the controller told us.
+		 */
+		if (opdi->srpo_dtype == SMRT_DTYPE_SATA &&
+		    smrt_sata_determine_wwn(smrt, &extents[i].srple_addr,
+		    &satawwn, timeout) == 0) {
+			wwn = satawwn;
+		}
+
+		mutex_enter(&smrt->smrt_mutex);
+		smpt = smrt_phys_lookup_by_wwn(smrt, wwn);
+		if (smpt != NULL) {
+			/*
+			 * Sanity check that the model and serial number of this
+			 * device is the same for this WWN.  If it's not, the
+			 * controller is probably lying about something.
+			 */
+			if (bcmp(smpt->smpt_info->sipd_model, info->sipd_model,
+			    sizeof (info->sipd_model)) != 0 ||
+			    bcmp(smpt->smpt_info->sipd_serial,
+			    info->sipd_serial, sizeof (info->sipd_serial)) !=
+			    0 || smpt->smpt_dtype != opdi->srpo_dtype) {
+				dev_err(smrt->smrt_dip, CE_PANIC, "physical "
+				    "target with wwn 0x%" PRIx64 " changed "
+				    "model, serial, or type unexpectedly: "
+				    "smrt_physical_t %p, phys info: %p", wwn,
+				    smpt, info);
+			}
+
+			/*
+			 * When panicking, we don't allow a device's visibility
+			 * to change to being invisible and be able to actually
+			 * panic.  We only worry about devices which are used
+			 * for I/O.  We purposefully ignore SES devices.
+			 */
+			if (ddi_in_panic() &&
+			    (opdi->srpo_dtype == SMRT_DTYPE_SATA ||
+			    opdi->srpo_dtype == SMRT_DTYPE_SAS)) {
+				boolean_t visible;
+
+				visible = smrt_physical_visible(
+				    &smpt->smpt_addr.PhysDev, smpt->smpt_info);
+
+				if (visible != smpt->smpt_visible) {
+					dev_err(smrt->smrt_dip, CE_PANIC,
+					    "physical target with wwn 0x%"
+					    PRIx64 " changed visibility status "
+					    "unexpectedly", wwn);
+				}
+			}
+
+			kmem_free(smpt->smpt_info, sizeof (*smpt->smpt_info));
+			smpt->smpt_info = NULL;
+		} else {
+			smpt = kmem_zalloc(sizeof (smrt_physical_t),
+			    KM_NOSLEEP);
+			if (smpt == NULL) {
+				kmem_free(info, sizeof (*info));
+				return (ENOMEM);
+			}
+
+			smpt->smpt_wwn = wwn;
+			smpt->smpt_dtype = opdi->srpo_dtype;
+			list_create(&smpt->smpt_targets, sizeof (smrt_target_t),
+			    offsetof(smrt_target_t, smtg_link_lun));
+			smpt->smpt_ctlr = smrt;
+			list_insert_tail(&smrt->smrt_physicals, smpt);
+		}
+
+		VERIFY3P(smpt->smpt_info, ==, NULL);
+
+		/*
+		 * Determine if this device is supported and if it's visible to
+		 * the system.  Some devices may not be visible to the system
+		 * because they're used in logical volumes or spares.
+		 * Unsupported devices are also not visible.
+		 */
+		switch (smpt->smpt_dtype) {
+		case SMRT_DTYPE_SATA:
+		case SMRT_DTYPE_SAS:
+			smpt->smpt_supported = B_TRUE;
+			smpt->smpt_visible =
+			    smrt_physical_visible(&extents[i].srple_addr, info);
+			break;
+		case SMRT_DTYPE_SES:
+			smpt->smpt_supported = B_TRUE;
+			smpt->smpt_visible =
+			    smrt_physical_visible(&extents[i].srple_addr, info);
+			break;
+		default:
+			smpt->smpt_visible = B_FALSE;
+			smpt->smpt_supported = B_FALSE;
+		}
+
+		smpt->smpt_info = info;
+		smpt->smpt_addr.PhysDev = extents[i].srple_addr;
+		smpt->smpt_bmic = bmic;
+		smpt->smpt_gen = gen;
+		(void) scsi_wwn_to_wwnstr(smpt->smpt_wwn, 1, name);
+		if (!ddi_in_panic() && smpt->smpt_visible &&
+		    scsi_hba_tgtmap_set_add(smrt->smrt_phys_tgtmap,
+		    SCSI_TGT_SCSI_DEVICE, name, NULL) != DDI_SUCCESS) {
+			return (EIO);
+		}
+	}
+
+	return (0);
+}
+
+int
+smrt_phys_discover(smrt_t *smrt, uint16_t timeout, uint64_t gen)
+{
+	smrt_command_t *smcm;
+	smrt_report_physical_lun_t *smrpl;
+	smrt_report_physical_lun_req_t smrplr;
+	int r;
+
+	/*
+	 * Allocate the command to send to the device, including buffer space
+	 * for the returned list of Physical Volumes.
+	 */
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL || smrt_command_attach_internal(smrt, smcm,
+	    sizeof (*smrpl), KM_NOSLEEP) != 0) {
+		r = ENOMEM;
+		mutex_enter(&smrt->smrt_mutex);
+		goto out;
+	}
+
+	smrpl = smcm->smcm_internal->smcmi_va;
+
+	smrt_write_controller_lun_addr(&smcm->smcm_va_cmd->Header.LUN);
+
+	smcm->smcm_va_cmd->Request.CDBLen = sizeof (smrplr);
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout);
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+
+	/*
+	 * The Report Physical LUNs command is essentially a vendor-specific
+	 * SCSI command, which we assemble into the CDB region of the command
+	 * block.
+	 */
+	bzero(&smrplr, sizeof (smrplr));
+	smrplr.smrplr_opcode = CISS_SCMD_REPORT_PHYSICAL_LUNS;
+	smrplr.smrplr_extflag = SMRT_REPORT_PHYSICAL_LUN_EXT_OPDI;
+	smrplr.smrplr_datasize = BE_32(sizeof (smrt_report_physical_lun_t));
+	bcopy(&smrplr, &smcm->smcm_va_cmd->Request.CDB[0],
+	    MIN(CISS_CDBLEN, sizeof (smrplr)));
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send the command to the device.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		goto out;
+	}
+
+	/*
+	 * Poll for completion.
+	 */
+	smcm->smcm_expiry = gethrtime() + timeout * NANOSEC;
+	if ((r = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out; abandon it now.  Remove the POLLED
+		 * flag so that the periodic routine will send an abort to
+		 * clean it up next time around.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+		smcm = NULL;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 *
+		 * The controller was reset while we were trying to discover
+		 * logical volumes.  Report failure.
+		 */
+		r = EIO;
+		goto out;
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "physical target "
+			    "discovery error: status 0x%x", ei->CommandStatus);
+			r = EIO;
+			goto out;
+		}
+	}
+
+	/*
+	 * If the controller doesn't support extended physical reporting, it
+	 * likely doesn't even support physical devices that we'd care about
+	 * exposing.  As such, we treat this as an OK case.
+	 */
+	if ((smrpl->smrpl_extflag & SMRT_REPORT_PHYSICAL_LUN_EXT_MASK) !=
+	    SMRT_REPORT_PHYSICAL_LUN_EXT_OPDI) {
+		r = 0;
+		goto out;
+	}
+
+	if (!ddi_in_panic() &&
+	    scsi_hba_tgtmap_set_begin(smrt->smrt_phys_tgtmap) != DDI_SUCCESS) {
+		dev_err(smrt->smrt_dip, CE_WARN, "failed to begin target map "
+		    "observation on %s", SMRT_IPORT_PHYS);
+		r = EIO;
+		goto out;
+	}
+
+	r = smrt_read_phys_ext(smrt, smrpl, timeout, gen);
+
+	if (r == 0 && !ddi_in_panic()) {
+		if (scsi_hba_tgtmap_set_end(smrt->smrt_phys_tgtmap, 0) !=
+		    DDI_SUCCESS) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to end target "
+			    "map observation on %s", SMRT_IPORT_PHYS);
+			r = EIO;
+		}
+	} else if (r != 0 && !ddi_in_panic()) {
+		if (scsi_hba_tgtmap_set_flush(smrt->smrt_phys_tgtmap) !=
+		    DDI_SUCCESS) {
+			dev_err(smrt->smrt_dip, CE_WARN, "failed to end target "
+			    "map observation on %s", SMRT_IPORT_PHYS);
+			r = EIO;
+		}
+	}
+
+	if (r == 0) {
+		smrt_physical_t *smpt, *next;
+
+		/*
+		 * Prune physical devices that do not match the current
+		 * generation and are not marked as visible devices.  Visible
+		 * devices will be dealt with as part of the target map work.
+		 */
+		for (smpt = list_head(&smrt->smrt_physicals), next = NULL;
+		    smpt != NULL; smpt = next) {
+			next = list_next(&smrt->smrt_physicals, smpt);
+			if (smpt->smpt_visible || smpt->smpt_gen == gen)
+				continue;
+			list_remove(&smrt->smrt_physicals, smpt);
+			smrt_physical_free(smpt);
+		}
+
+		/*
+		 * Update the time of the last successful Physical Volume
+		 * discovery:
+		 */
+		smrt->smrt_last_phys_discovery = gethrtime();
+
+		/*
+		 * Now, for each unsupported device that we haven't warned about
+		 * encountering, try and give the administrator some hope of
+		 * knowing about this.
+		 */
+		for (smpt = list_head(&smrt->smrt_physicals), next = NULL;
+		    smpt != NULL; smpt = next) {
+			if (smpt->smpt_supported || smpt->smpt_unsup_warn)
+				continue;
+			smpt->smpt_unsup_warn = B_TRUE;
+			dev_err(smrt->smrt_dip, CE_WARN, "encountered "
+			    "unsupported device with device type %d",
+			    smpt->smpt_dtype);
+		}
+	}
+
+out:
+	mutex_exit(&smrt->smrt_mutex);
+
+	if (smcm != NULL) {
+		smrt_command_free(smcm);
+	}
+	return (r);
+}
+
+void
+smrt_phys_tgtmap_activate(void *arg, char *addr, scsi_tgtmap_tgt_type_t type,
+    void **privpp)
+{
+	smrt_t *smrt = arg;
+	smrt_physical_t *smpt;
+
+	VERIFY3S(type, ==, SCSI_TGT_SCSI_DEVICE);
+	mutex_enter(&smrt->smrt_mutex);
+	smpt = smrt_phys_lookup_by_ua(smrt, addr);
+	VERIFY(smpt != NULL);
+	VERIFY(smpt->smpt_supported);
+	VERIFY(smpt->smpt_visible);
+	*privpp = NULL;
+	mutex_exit(&smrt->smrt_mutex);
+}
+
+boolean_t
+smrt_phys_tgtmap_deactivate(void *arg, char *addr, scsi_tgtmap_tgt_type_t type,
+    void *priv, scsi_tgtmap_deact_rsn_t reason)
+{
+	smrt_t *smrt = arg;
+	smrt_physical_t *smpt;
+
+	VERIFY3S(type, ==, SCSI_TGT_SCSI_DEVICE);
+	VERIFY3P(priv, ==, NULL);
+
+	mutex_enter(&smrt->smrt_mutex);
+	smpt = smrt_phys_lookup_by_ua(smrt, addr);
+
+	/*
+	 * If the device disappeared or became invisible, then it may have
+	 * already been removed.
+	 */
+	if (smpt == NULL || !smpt->smpt_visible) {
+		mutex_exit(&smrt->smrt_mutex);
+		return (B_FALSE);
+	}
+
+	list_remove(&smrt->smrt_physicals, smpt);
+	smrt_physical_free(smpt);
+	mutex_exit(&smrt->smrt_mutex);
+	return (B_FALSE);
+}
+
+void
+smrt_phys_teardown(smrt_t *smrt)
+{
+	smrt_physical_t *smpt;
+
+	while ((smpt = list_remove_head(&smrt->smrt_physicals)) != NULL) {
+		smrt_physical_free(smpt);
+	}
+}
diff --git a/usr/src/uts/common/io/scsi/adapters/smrt/smrt_sata.c b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_sata.c
new file mode 100644
index 0000000000..6224b97732
--- /dev/null
+++ b/usr/src/uts/common/io/scsi/adapters/smrt/smrt_sata.c
@@ -0,0 +1,160 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright 2017 Joyent, Inc.
+ */
+
+/*
+ * Collection of routines specific to SATA devices and attempting to make them
+ * work.
+ */
+
+#include <sys/scsi/adapters/smrt/smrt.h>
+
+/*
+ * This is a buffer size that should easily cover all of the data that we need
+ * to properly determine the buffer allocation.
+ */
+#define	SMRT_SATA_INQ83_LEN	256
+
+/*
+ * We need to try and determine if a SATA WWN exists on the device.  SAT-2
+ * defines that the response to the inquiry page 0x83.
+ */
+int
+smrt_sata_determine_wwn(smrt_t *smrt, PhysDevAddr_t *addr, uint64_t *wwnp,
+    uint16_t timeout)
+{
+	smrt_command_t *smcm;
+	int r;
+	uint8_t *inq;
+	uint64_t wwn;
+	size_t resid;
+
+	VERIFY3P(wwnp, !=, NULL);
+
+	if ((smcm = smrt_command_alloc(smrt, SMRT_CMDTYPE_INTERNAL,
+	    KM_NOSLEEP)) == NULL || smrt_command_attach_internal(smrt, smcm,
+	    SMRT_SATA_INQ83_LEN, KM_NOSLEEP) != 0) {
+		if (smcm != NULL) {
+			smrt_command_free(smcm);
+		}
+		return (ENOMEM);
+	}
+
+	smcm->smcm_va_cmd->Header.LUN.PhysDev = *addr;
+	smcm->smcm_va_cmd->Request.CDBLen = CDB_GROUP0;
+	smcm->smcm_va_cmd->Request.Type.Type = CISS_TYPE_CMD;
+	smcm->smcm_va_cmd->Request.Type.Attribute = CISS_ATTR_SIMPLE;
+	smcm->smcm_va_cmd->Request.Type.Direction = CISS_XFER_READ;
+	smcm->smcm_va_cmd->Request.Timeout = LE_16(timeout);
+
+	smcm->smcm_va_cmd->Request.CDB[0] = SCMD_INQUIRY;
+	smcm->smcm_va_cmd->Request.CDB[1] = 1;
+	smcm->smcm_va_cmd->Request.CDB[2] = 0x83;
+	smcm->smcm_va_cmd->Request.CDB[3] = (SMRT_SATA_INQ83_LEN & 0xff00) >> 8;
+	smcm->smcm_va_cmd->Request.CDB[4] = SMRT_SATA_INQ83_LEN & 0x00ff;
+	smcm->smcm_va_cmd->Request.CDB[5] = 0;
+
+	mutex_enter(&smrt->smrt_mutex);
+
+	/*
+	 * Send the command to the device.
+	 */
+	smcm->smcm_status |= SMRT_CMD_STATUS_POLLED;
+	if ((r = smrt_submit(smrt, smcm)) != 0) {
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		return (r);
+	}
+
+	if ((r = smrt_poll_for(smrt, smcm)) != 0) {
+		VERIFY3S(r, ==, ETIMEDOUT);
+		VERIFY0(smcm->smcm_status & SMRT_CMD_STATUS_POLL_COMPLETE);
+
+		/*
+		 * The command timed out; abandon it now.  Remove the POLLED
+		 * flag so that the periodic routine will send an abort to
+		 * clean it up next time around.
+		 */
+		smcm->smcm_status |= SMRT_CMD_STATUS_ABANDONED;
+		smcm->smcm_status &= ~SMRT_CMD_STATUS_POLLED;
+		mutex_exit(&smrt->smrt_mutex);
+		return (r);
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_RESET_SENT) {
+		/*
+		 * The controller was reset while we were trying to discover
+		 * logical volumes.  Report failure.
+		 */
+		mutex_exit(&smrt->smrt_mutex);
+		smrt_command_free(smcm);
+		return (EIO);
+	}
+
+	if (smcm->smcm_status & SMRT_CMD_STATUS_ERROR) {
+		ErrorInfo_t *ei = smcm->smcm_va_err;
+
+		if (ei->CommandStatus != CISS_CMD_DATA_UNDERRUN) {
+			dev_err(smrt->smrt_dip, CE_WARN, "physical target "
+			    "SATA WWN error: status 0x%x", ei->CommandStatus);
+			mutex_exit(&smrt->smrt_mutex);
+			smrt_command_free(smcm);
+			return (EIO);
+		}
+		resid = ei->ResidualCnt;
+	} else {
+		resid = 0;
+	}
+
+	mutex_exit(&smrt->smrt_mutex);
+
+	/*
+	 * We must have at least 12 bytes.  The first four bytes are the header,
+	 * the next four are for the LUN header, and the last 8 are for the
+	 * actual WWN, which according to SAT-2 will always be first.
+	 */
+	if (SMRT_SATA_INQ83_LEN - resid < 16) {
+		smrt_command_free(smcm);
+		return (EINVAL);
+	}
+	inq = smcm->smcm_internal->smcmi_va;
+
+	/*
+	 * Sanity check we have the right page.
+	 */
+	if (inq[1] != 0x83) {
+		smrt_command_free(smcm);
+		return (EINVAL);
+	}
+
+	/*
+	 * Check to see if we have a proper Network Address Authority (NAA)
+	 * based world wide number for this LUN.  It is possible that firmware
+	 * interposes on this and constructs a fake world wide number (WWN).  If
+	 * this is the case, we don't want to actually use it.  We need to
+	 * verify that the WWN declares the correct naming authority and is of
+	 * the proper length.
+	 */
+	if ((inq[5] & 0x30) != 0 || (inq[5] & 0x0f) != 3 || inq[7] != 8) {
+		smrt_command_free(smcm);
+		return (ENOTSUP);
+	}
+
+	bcopy(&inq[8], &wwn, sizeof (uint64_t));
+	*wwnp = BE_64(wwn);
+
+	smrt_command_free(smcm);
+
+	return (0);
+}
diff --git a/usr/src/uts/common/sys/scsi/adapters/smrt/smrt.h b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt.h
new file mode 100644
index 0000000000..5aba743834
--- /dev/null
+++ b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt.h
@@ -0,0 +1,750 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#ifndef	_SMRT_H
+#define	_SMRT_H
+
+#include <sys/types.h>
+#include <sys/pci.h>
+#include <sys/param.h>
+#include <sys/errno.h>
+#include <sys/conf.h>
+#include <sys/map.h>
+#include <sys/modctl.h>
+#include <sys/kmem.h>
+#include <sys/cmn_err.h>
+#include <sys/stat.h>
+#include <sys/scsi/scsi.h>
+#include <sys/scsi/impl/spc3_types.h>
+#include <sys/devops.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/sdt.h>
+#include <sys/policy.h>
+#include <sys/ctype.h>
+
+#if !defined(_LITTLE_ENDIAN) || !defined(_BIT_FIELDS_LTOH)
+/*
+ * This driver contains a number of multi-byte bit fields and other structs
+ * that are only correct on a system with the same ordering as x86.
+ */
+#error "smrt: driver works only on little endian systems"
+#endif
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Some structures are statically sized based on the expected number of logical
+ * drives and controllers in the system.  These definitions are used throughout
+ * other driver-specific header files, and must appear prior to their
+ * inclusion.
+ */
+#define	SMRT_MAX_LOGDRV		64	/* Maximum number of logical drives */
+#define	SMRT_MAX_PHYSDEV	128	/* Maximum number of physical devices */
+
+#include <sys/scsi/adapters/smrt/smrt_ciss.h>
+#include <sys/scsi/adapters/smrt/smrt_scsi.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+extern ddi_device_acc_attr_t smrt_dev_attributes;
+
+typedef enum smrt_init_level {
+	SMRT_INITLEVEL_BASIC =			(0x1 << 0),
+	SMRT_INITLEVEL_I2O_MAPPED =		(0x1 << 1),
+	SMRT_INITLEVEL_CFGTBL_MAPPED =		(0x1 << 2),
+	SMRT_INITLEVEL_PERIODIC =		(0x1 << 3),
+	SMRT_INITLEVEL_INT_ALLOC =		(0x1 << 4),
+	SMRT_INITLEVEL_INT_ADDED =		(0x1 << 5),
+	SMRT_INITLEVEL_INT_ENABLED =		(0x1 << 6),
+	SMRT_INITLEVEL_SCSA =			(0x1 << 7),
+	SMRT_INITLEVEL_MUTEX =			(0x1 << 8),
+	SMRT_INITLEVEL_TASKQ =			(0x1 << 9),
+	SMRT_INITLEVEL_ASYNC_EVENT =		(0x1 << 10),
+} smrt_init_level_t;
+
+/*
+ * Commands issued to the controller carry a (generally 32-bit, though with
+ * two reserved signalling bits) identifying tag number.  In order to avoid
+ * having the controller confuse us by double-reporting the completion of a
+ * particular tag, we try to reuse them as infrequently as possible.  In
+ * practice, this means looping through a range of values.  The minimum and
+ * maximum value are defined below.  A single command tag value is set aside
+ * for polled commands sent prior to full initialisation of the driver.
+ */
+#define	SMRT_PRE_TAG_NUMBER			0x00000bad
+#define	SMRT_MIN_TAG_NUMBER			0x00001000
+#define	SMRT_MAX_TAG_NUMBER			0x0fffffff
+
+/*
+ * Character strings that represent the names of the iports used for both
+ * physical and virtual volumes.
+ */
+#define	SMRT_IPORT_PHYS				"p0"
+#define	SMRT_IPORT_VIRT				"v0"
+
+/*
+ * Definitions to support waiting for the controller to converge on a
+ * particular state: ready or not ready.  These are used with
+ * smrt_ctlr_wait_for_state().
+ */
+#define	SMRT_WAIT_DELAY_SECONDS			120
+typedef enum smrt_wait_state {
+	SMRT_WAIT_STATE_READY = 1,
+	SMRT_WAIT_STATE_UNREADY
+} smrt_wait_state_t;
+
+typedef enum smrt_ctlr_mode {
+	SMRT_CTLR_MODE_UNKNOWN = 0,
+	SMRT_CTLR_MODE_SIMPLE
+} smrt_ctlr_mode_t;
+
+/*
+ * In addition to Logical Volumes, we also expose the controller at a
+ * pseudo target address on the SCSI bus we are essentially pretending to be.
+ */
+#define	SMRT_CONTROLLER_TARGET			128
+
+/*
+ * When waiting for volume discovery to complete, we wait for a maximum
+ * duration (in seconds) before giving up.
+ */
+#define	SMRT_DISCOVER_TIMEOUT			30
+
+/*
+ * The maintenance routine which checks for controller lockup and aborts
+ * commands that have passed their timeout runs periodically.  The time is
+ * expressed in seconds.
+ */
+#define	SMRT_PERIODIC_RATE			5
+
+/*
+ * At times, we need to check if the controller is still responding.  To do
+ * that, we send a Nop message to the controller and make sure it completes
+ * successfully.  So that we don't wait forever, we set a timeout (in seconds).
+ */
+#define	SMRT_PING_CHECK_TIMEOUT			60
+
+/*
+ * When detaching the device, we may need to have an asynchronous event
+ * cancellation be issued.  While this should be relatively smooth, we don't
+ * want to wait forever for it.  As such we set a timeout in seconds.
+ */
+#define	SMRT_ASYNC_CANCEL_TIMEOUT		60
+
+/*
+ * HP PCI vendor ID and Generation 9 device ID. Used to identify generations of
+ * supported controllers.
+ */
+#define	SMRT_VENDOR_HP				0x103c
+#define	SMRT_DEVICE_GEN9			0x3238
+
+typedef enum smrt_controller_status {
+	/*
+	 * An attempt is being made to detach the controller instance.
+	 */
+	SMRT_CTLR_STATUS_DETACHING =		(0x1 << 0),
+
+	/*
+	 * The controller is believed to be functioning correctly.  The driver
+	 * is to allow command submission, process interrupts, and perform
+	 * periodic background maintenance.
+	 */
+	SMRT_CTLR_STATUS_RUNNING =		(0x1 << 1),
+
+	/*
+	 * The controller is currently being reset.
+	 */
+	SMRT_CTLR_STATUS_RESETTING =		(0x1 << 2),
+
+	/*
+	 * Our async event notification command is currently in need of help
+	 * from the broader driver.  This will be set by smrt_event_complete()
+	 * to indicate that the command is not being processed due to a
+	 * controller reset or because another fatal error occurred.  The
+	 * periodic will have to pick up and recover this for us.  It is only
+	 * safe for the driver to manipulate the event command outside of
+	 * smrt_event_complete() if this flag is set.
+	 */
+	SMRT_CTLR_ASYNC_INTERVENTION =		(0x1 << 3),
+
+	/*
+	 * See the theory statement on discovery and resets in smrt_ciss.c for
+	 * an explanation of these values.
+	 */
+	SMRT_CTLR_DISCOVERY_REQUESTED =		(0x1 << 4),
+	SMRT_CTLR_DISCOVERY_RUNNING =		(0x1 << 5),
+	SMRT_CTLR_DISCOVERY_PERIODIC =		(0x1 << 6),
+	SMRT_CTLR_DISCOVERY_REQUIRED =		(0x1 << 7),
+} smrt_controller_status_t;
+
+#define	SMRT_CTLR_DISCOVERY_MASK	(SMRT_CTLR_DISCOVERY_REQUESTED | \
+    SMRT_CTLR_DISCOVERY_RUNNING | SMRT_CTLR_DISCOVERY_PERIODIC)
+
+typedef struct smrt_stats {
+	uint64_t smrts_tran_aborts;
+	uint64_t smrts_tran_resets;
+	uint64_t smrts_tran_starts;
+	uint64_t smrts_ctlr_resets;
+	unsigned smrts_max_inflight;
+	uint64_t smrts_unclaimed_interrupts;
+	uint64_t smrts_claimed_interrupts;
+	uint64_t smrts_ignored_scsi_cmds;
+	uint64_t smrts_events_received;
+	uint64_t smrts_events_errors;
+	uint64_t smrts_events_intervened;
+	uint64_t smrts_discovery_tq_errors;
+} smrt_stats_t;
+
+typedef struct smrt_versions {
+	uint8_t smrtv_hardware_version;
+
+	/*
+	 * These strings must be large enough to hold the 4 byte version string
+	 * retrieved from an IDENTIFY CONTROLLER response, as well as the
+	 * terminating NUL byte:
+	 */
+	char smrtv_firmware_rev[5];
+	char smrtv_recovery_rev[5];
+	char smrtv_bootblock_rev[5];
+} smrt_versions_t;
+
+typedef struct smrt smrt_t;
+typedef struct smrt_command smrt_command_t;
+typedef struct smrt_command_internal smrt_command_internal_t;
+typedef struct smrt_command_scsa smrt_command_scsa_t;
+typedef struct smrt_pkt smrt_pkt_t;
+
+/*
+ * Per-Controller Structure
+ */
+struct smrt {
+	dev_info_t *smrt_dip;
+	int smrt_instance;
+	smrt_controller_status_t smrt_status;
+	smrt_stats_t smrt_stats;
+
+	/*
+	 * Controller configuration discovered during initialisation.
+	 */
+	uint32_t smrt_host_support;
+	uint32_t smrt_bus_support;
+	uint32_t smrt_maxcmds;
+	uint32_t smrt_sg_cnt;
+	smrt_versions_t smrt_versions;
+	uint16_t smrt_pci_vendor;
+	uint16_t smrt_pci_device;
+
+	/*
+	 * iport specific data
+	 */
+	dev_info_t *smrt_virt_iport;
+	dev_info_t *smrt_phys_iport;
+	scsi_hba_tgtmap_t *smrt_virt_tgtmap;
+	scsi_hba_tgtmap_t *smrt_phys_tgtmap;
+
+	/*
+	 * The transport mode of the controller.
+	 */
+	smrt_ctlr_mode_t smrt_ctlr_mode;
+
+	/*
+	 * The current initialisation level of the driver.  Bits in this field
+	 * are set during initialisation and unset during cleanup of the
+	 * allocated resources.
+	 */
+	smrt_init_level_t smrt_init_level;
+
+	/*
+	 * Essentially everything is protected by "smrt_mutex".  When the
+	 * completion queue is updated, threads sleeping on "smrt_cv_finishq"
+	 * are awoken.
+	 */
+	kmutex_t smrt_mutex;
+	kcondvar_t smrt_cv_finishq;
+
+	/*
+	 * List of enumerated logical volumes (smrt_volume_t).
+	 */
+	list_t smrt_volumes;
+
+	/*
+	 * List of enumerated physical devices (smrt_physical_t).
+	 */
+	list_t smrt_physicals;
+
+	/*
+	 * List of attached SCSA target drivers (smrt_target_t).
+	 */
+	list_t smrt_targets;
+
+	/*
+	 * Controller Heartbeat Tracking
+	 */
+	uint32_t smrt_last_heartbeat;
+	hrtime_t smrt_last_heartbeat_time;
+
+	hrtime_t smrt_last_interrupt_claimed;
+	hrtime_t smrt_last_interrupt_unclaimed;
+	hrtime_t smrt_last_reset_start;
+	hrtime_t smrt_last_reset_finish;
+
+	/*
+	 * Command object tracking.  These lists, and all commands within the
+	 * lists, are protected by "smrt_mutex".
+	 */
+	uint32_t smrt_next_tag;
+	avl_tree_t smrt_inflight;
+	list_t smrt_commands;		/* List of all commands. */
+	list_t smrt_finishq;		/* List of completed commands. */
+	list_t smrt_abortq;		/* List of commands to abort. */
+
+	/*
+	 * Discovery coordination
+	 */
+	ddi_taskq_t *smrt_discover_taskq;
+	hrtime_t smrt_last_phys_discovery;
+	hrtime_t smrt_last_log_discovery;
+	uint64_t smrt_discover_gen;
+
+	/*
+	 * Controller interrupt handler registration.
+	 */
+	int smrt_interrupt_type;
+	int smrt_interrupt_cap;
+	uint_t smrt_interrupt_pri;
+	ddi_intr_handle_t smrt_interrupts[1];
+	int smrt_ninterrupts;
+
+	ddi_periodic_t smrt_periodic;
+
+	scsi_hba_tran_t *smrt_hba_tran;
+
+	ddi_dma_attr_t smrt_dma_attr;
+
+	/*
+	 * Access to the I2O Registers:
+	 */
+	unsigned smrt_i2o_bar;
+	caddr_t smrt_i2o_space;
+	ddi_acc_handle_t smrt_i2o_handle;
+
+	/*
+	 * Access to the Configuration Table:
+	 */
+	unsigned smrt_ct_bar;
+	uint32_t smrt_ct_baseaddr;
+	CfgTable_t *smrt_ct;
+	ddi_acc_handle_t smrt_ct_handle;
+
+	/*
+	 * Asynchronous Event State
+	 */
+	uint32_t smrt_event_count;
+	smrt_command_t *smrt_event_cmd;
+	smrt_command_t *smrt_event_cancel_cmd;
+	kcondvar_t smrt_event_queue;
+};
+
+/*
+ * Logical Volume Structure
+ */
+typedef enum smrt_volume_flags {
+	SMRT_VOL_FLAG_WWN =			(0x1 << 0),
+} smrt_volume_flags_t;
+
+typedef struct smrt_volume {
+	LUNAddr_t smlv_addr;
+	smrt_volume_flags_t smlv_flags;
+
+	uint8_t smlv_wwn[16];
+	uint64_t smlv_gen;
+
+	smrt_t *smlv_ctlr;
+	list_node_t smlv_link;
+
+	/*
+	 * List of SCSA targets currently attached to this Logical Volume:
+	 */
+	list_t smlv_targets;
+} smrt_volume_t;
+
+typedef struct smrt_physical {
+	LUNAddr_t smpt_addr;
+	uint64_t smpt_wwn;
+	uint8_t smpt_dtype;
+	uint16_t smpt_bmic;
+	uint64_t smpt_gen;
+	boolean_t smpt_supported;
+	boolean_t smpt_visible;
+	boolean_t smpt_unsup_warn;
+	list_node_t smpt_link;
+	list_t smpt_targets;
+	smrt_t *smpt_ctlr;
+	smrt_identify_physical_drive_t *smpt_info;
+} smrt_physical_t;
+
+/*
+ * Per-Target Structure
+ */
+typedef struct smrt_target {
+	struct scsi_device *smtg_scsi_dev;
+
+	boolean_t smtg_physical;
+
+	/*
+	 * This is only used when performing discovery during panic, as we need
+	 * a mechanism to determine if the set of drives has shifted.
+	 */
+	boolean_t smtg_gone;
+
+	/*
+	 * Linkage back to the device that this target represents. This may be
+	 * either a smrt_volume_t or a smrt_physical_t. We keep a pointer to the
+	 * address, as that's the one thing we generally care about.
+	 */
+	union {
+		smrt_physical_t *smtg_phys;
+		smrt_volume_t *smtg_vol;
+	} smtg_lun;
+	list_node_t smtg_link_lun;
+	LUNAddr_t *smtg_addr;
+
+	/*
+	 * Linkage back to the controller:
+	 */
+	smrt_t *smtg_ctlr;
+	list_node_t smtg_link_ctlr;
+} smrt_target_t;
+
+/*
+ * DMA Resource Tracking Structure
+ */
+typedef enum smrt_dma_level {
+	SMRT_DMALEVEL_HANDLE_ALLOC =		(0x1 << 0),
+	SMRT_DMALEVEL_MEMORY_ALLOC =		(0x1 << 1),
+	SMRT_DMALEVEL_HANDLE_BOUND =		(0x1 << 2),
+} smrt_dma_level_t;
+
+typedef struct smrt_dma {
+	smrt_dma_level_t smdma_level;
+	size_t smdma_real_size;
+	ddi_dma_handle_t smdma_dma_handle;
+	ddi_acc_handle_t smdma_acc_handle;
+	ddi_dma_cookie_t smdma_dma_cookies[1];
+	uint_t smdma_dma_ncookies;
+} smrt_dma_t;
+
+
+typedef enum smrt_command_status {
+	/*
+	 * When a command is submitted to the controller, it is marked USED
+	 * to avoid accidental reuse of the command without reinitialising
+	 * critical fields.  The submitted command is also marked INFLIGHT
+	 * to reflect its inclusion in the "smrt_inflight" AVL tree.  When
+	 * the command is completed by the controller, INFLIGHT is unset.
+	 */
+	SMRT_CMD_STATUS_USED =			(0x1 << 0),
+	SMRT_CMD_STATUS_INFLIGHT =		(0x1 << 1),
+
+	/*
+	 * This flag is set during abort queue processing to record that this
+	 * command was aborted in response to an expired timeout, and not some
+	 * other cancellation.  If the controller is able to abort the command,
+	 * we use this flag to let the SCSI framework know that the command
+	 * timed out.
+	 */
+	SMRT_CMD_STATUS_TIMEOUT =		(0x1 << 2),
+
+	/*
+	 * The controller set the error bit when completing this command.
+	 * Details of the particular fault may be read from the error
+	 * information written by the controller.
+	 */
+	SMRT_CMD_STATUS_ERROR =			(0x1 << 3),
+
+	/*
+	 * This command has been abandoned by the original submitter.  This
+	 * could happen if the command did not complete in a timely fashion.
+	 * When it reaches the finish queue it will be freed without further
+	 * processing.
+	 */
+	SMRT_CMD_STATUS_ABANDONED =		(0x1 << 4),
+
+	/*
+	 * This command has made it through the completion queue and had final
+	 * processing performed.
+	 */
+	SMRT_CMD_STATUS_COMPLETE =		(0x1 << 5),
+
+	/*
+	 * A polled message will be ignored by the regular processing of the
+	 * completion queue.  The blocking function doing the polling is
+	 * responsible for watching the command on which it has set the POLLED
+	 * flag.  Regular completion queue processing (which might happen in
+	 * the polling function, or it might happen in the interrupt handler)
+	 * will set POLL_COMPLETE once it is out of the finish queue
+	 * altogether.
+	 */
+	SMRT_CMD_STATUS_POLLED =		(0x1 << 6),
+	SMRT_CMD_STATUS_POLL_COMPLETE =		(0x1 << 7),
+
+	/*
+	 * An abort message has been sent to the controller in an attempt to
+	 * cancel this command.
+	 */
+	SMRT_CMD_STATUS_ABORT_SENT =		(0x1 << 8),
+
+	/*
+	 * This command has been passed to our tran_start(9E) handler.
+	 */
+	SMRT_CMD_STATUS_TRAN_START =		(0x1 << 9),
+
+	/*
+	 * This command was for a SCSI command that we are explicitly avoiding
+	 * sending to the controller.
+	 */
+	SMRT_CMD_STATUS_TRAN_IGNORED =		(0x1 << 10),
+
+	/*
+	 * This command has been submitted once, and subsequently passed to
+	 * smrt_command_reuse().
+	 */
+	SMRT_CMD_STATUS_REUSED =		(0x1 << 11),
+
+	/*
+	 * A controller reset has been issued, so a response for this command
+	 * is not expected.  If one arrives before the controller reset has
+	 * taken effect, it likely cannot be trusted.
+	 */
+	SMRT_CMD_STATUS_RESET_SENT =		(0x1 << 12),
+
+	/*
+	 * Certain commands related to discovery and pinging need to be run
+	 * during the context after a reset has occurred, but before the
+	 * controller is considered.  Such commands can use this flag to bypass
+	 * the normal smrt_submit() check.
+	 */
+	SMRT_CMD_IGNORE_RUNNING =		(0x1 << 13),
+} smrt_command_status_t;
+
+typedef enum smrt_command_type {
+	SMRT_CMDTYPE_INTERNAL = 1,
+	SMRT_CMDTYPE_EVENT,
+	SMRT_CMDTYPE_ABORTQ,
+	SMRT_CMDTYPE_SCSA,
+	SMRT_CMDTYPE_PREINIT,
+} smrt_command_type_t;
+
+struct smrt_command {
+	uint32_t smcm_tag;
+	smrt_command_type_t smcm_type;
+	smrt_command_status_t smcm_status;
+
+	smrt_t *smcm_ctlr;
+	smrt_target_t *smcm_target;
+
+	list_node_t smcm_link;		/* Linkage for allocated list. */
+	list_node_t smcm_link_finish;	/* Linkage for completion list. */
+	list_node_t smcm_link_abort;	/* Linkage for abort list. */
+	avl_node_t smcm_node;		/* Inflight AVL membership. */
+
+	hrtime_t smcm_time_submit;
+	hrtime_t smcm_time_complete;
+
+	hrtime_t smcm_expiry;
+
+	/*
+	 * The time at which an abort message was sent to try and terminate
+	 * this command, as well as the tag of the abort message itself:
+	 */
+	hrtime_t smcm_abort_time;
+	uint32_t smcm_abort_tag;
+
+	/*
+	 * Ancillary data objects.  Only one of these will be allocated for any
+	 * given command, but we nonetheless resist the temptation to use a
+	 * union of pointers in order to make incorrect usage obvious.
+	 */
+	smrt_command_scsa_t *smcm_scsa;
+	smrt_command_internal_t *smcm_internal;
+
+	/*
+	 * Physical allocation tracking for the actual command to send to the
+	 * controller.
+	 */
+	smrt_dma_t smcm_contig;
+
+	CommandList_t *smcm_va_cmd;
+	uint32_t smcm_pa_cmd;
+
+	ErrorInfo_t *smcm_va_err;
+	uint32_t smcm_pa_err;
+};
+
+/*
+ * Commands issued internally to the driver (as opposed to by the HBA
+ * framework) generally require a buffer in which to assemble the command body,
+ * and for receiving the response from the controller.  The following object
+ * tracks this (optional) extra buffer.
+ */
+struct smrt_command_internal {
+	smrt_dma_t smcmi_contig;
+
+	void *smcmi_va;
+	uint32_t smcmi_pa;
+	size_t smcmi_len;
+};
+
+/*
+ * Commands issued via the SCSI framework have a number of additional
+ * properties.
+ */
+struct smrt_command_scsa {
+	struct scsi_pkt *smcms_pkt;
+	smrt_command_t *smcms_command;
+};
+
+
+/*
+ * CISS transport routines.
+ */
+void smrt_periodic(void *);
+void smrt_lockup_check(smrt_t *);
+int smrt_submit(smrt_t *, smrt_command_t *);
+void smrt_submit_simple(smrt_t *, smrt_command_t *);
+int smrt_retrieve(smrt_t *);
+void smrt_retrieve_simple(smrt_t *);
+int smrt_poll_for(smrt_t *, smrt_command_t *);
+int smrt_preinit_command_simple(smrt_t *, smrt_command_t *);
+
+/*
+ * Interrupt service routines.
+ */
+int smrt_interrupts_setup(smrt_t *);
+int smrt_interrupts_enable(smrt_t *);
+void smrt_interrupts_teardown(smrt_t *);
+uint32_t smrt_isr_hw_simple(caddr_t, caddr_t);
+
+/*
+ * Interrupt enable/disable routines.
+ */
+void smrt_intr_set(smrt_t *, boolean_t);
+
+/*
+ * Controller initialisation routines.
+ */
+int smrt_ctlr_init(smrt_t *);
+void smrt_ctlr_teardown(smrt_t *);
+int smrt_ctlr_reset(smrt_t *);
+int smrt_ctlr_wait_for_state(smrt_t *, smrt_wait_state_t);
+int smrt_ctlr_init_simple(smrt_t *);
+void smrt_ctlr_teardown_simple(smrt_t *);
+int smrt_cfgtbl_flush(smrt_t *);
+int smrt_cfgtbl_transport_has_support(smrt_t *, int);
+void smrt_cfgtbl_transport_set(smrt_t *, int);
+int smrt_cfgtbl_transport_confirm(smrt_t *, int);
+uint32_t smrt_ctlr_get_cmdsoutmax(smrt_t *);
+uint32_t smrt_ctlr_get_maxsgelements(smrt_t *);
+
+/*
+ * Device enumeration and lookup routines.
+ */
+void smrt_discover_request(smrt_t *);
+
+int smrt_logvol_discover(smrt_t *, uint16_t, uint64_t);
+void smrt_logvol_teardown(smrt_t *);
+smrt_volume_t *smrt_logvol_lookup_by_id(smrt_t *, unsigned long);
+void smrt_logvol_tgtmap_activate(void *, char *, scsi_tgtmap_tgt_type_t,
+    void **);
+boolean_t smrt_logvol_tgtmap_deactivate(void *, char *, scsi_tgtmap_tgt_type_t,
+    void *, scsi_tgtmap_deact_rsn_t);
+
+int smrt_phys_discover(smrt_t *, uint16_t, uint64_t);
+smrt_physical_t *smrt_phys_lookup_by_ua(smrt_t *, const char *);
+void smrt_phys_teardown(smrt_t *);
+void smrt_phys_tgtmap_activate(void *, char *, scsi_tgtmap_tgt_type_t,
+    void **);
+boolean_t smrt_phys_tgtmap_deactivate(void *, char *, scsi_tgtmap_tgt_type_t,
+    void *, scsi_tgtmap_deact_rsn_t);
+
+/*
+ * SCSI framework routines.
+ */
+int smrt_ctrl_hba_setup(smrt_t *);
+void smrt_ctrl_hba_teardown(smrt_t *);
+
+int smrt_logvol_hba_setup(smrt_t *, dev_info_t *);
+void smrt_logvol_hba_teardown(smrt_t *, dev_info_t *);
+int smrt_phys_hba_setup(smrt_t *, dev_info_t *);
+void smrt_phys_hba_teardown(smrt_t *, dev_info_t *);
+
+void smrt_hba_complete(smrt_command_t *);
+
+void smrt_process_finishq(smrt_t *);
+void smrt_process_abortq(smrt_t *);
+
+/*
+ * Command block management.
+ */
+smrt_command_t *smrt_command_alloc(smrt_t *, smrt_command_type_t,
+    int);
+smrt_command_t *smrt_command_alloc_preinit(smrt_t *, size_t, int);
+int smrt_command_attach_internal(smrt_t *, smrt_command_t *, size_t,
+    int);
+void smrt_command_free(smrt_command_t *);
+smrt_command_t *smrt_lookup_inflight(smrt_t *, uint32_t);
+void smrt_command_reuse(smrt_command_t *);
+
+/*
+ * Device message construction routines.
+ */
+void smrt_write_lun_addr_phys(LUNAddr_t *, boolean_t, unsigned, unsigned);
+void smrt_write_controller_lun_addr(LUNAddr_t *);
+uint16_t smrt_lun_addr_to_bmic(PhysDevAddr_t *);
+void smrt_write_message_abort_one(smrt_command_t *, uint32_t);
+void smrt_write_message_abort_all(smrt_command_t *, LUNAddr_t *);
+void smrt_write_message_nop(smrt_command_t *, int);
+void smrt_write_message_event_notify(smrt_command_t *);
+
+/*
+ * Device management routines.
+ */
+int smrt_device_setup(smrt_t *);
+void smrt_device_teardown(smrt_t *);
+uint32_t smrt_get32(smrt_t *, offset_t);
+void smrt_put32(smrt_t *, offset_t, uint32_t);
+
+/*
+ * SATA related routines.
+ */
+int smrt_sata_determine_wwn(smrt_t *, PhysDevAddr_t *, uint64_t *, uint16_t);
+
+/*
+ * Asynchronous Event Notification
+ */
+int smrt_event_init(smrt_t *);
+void smrt_event_fini(smrt_t *);
+void smrt_event_complete(smrt_command_t *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SMRT_H */
diff --git a/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_ciss.h b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_ciss.h
new file mode 100644
index 0000000000..e1f1db68b3
--- /dev/null
+++ b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_ciss.h
@@ -0,0 +1,345 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (C) 2013 Hewlett-Packard Development Company, L.P.
+ * Copyright (c) 2017, Joyent, Inc.
+ */
+
+#ifndef	_SMRT_CISS_H
+#define	_SMRT_CISS_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/*
+ * Maximum number of Scatter/Gather List entries.  These entries are statically
+ * allocated for all commands.
+ */
+#define	CISS_MAXSGENTRIES			64
+
+/*
+ * If the controller advertises a value of 0 for the maximum S/G list length it
+ * supports, the specification states that we should assume a value of 31.
+ */
+#define	CISS_SGCNT_FALLBACK			31
+
+/*
+ * The CDB field in the request block is fixed at 16 bytes in length.  (See
+ * "3.2. Request Block" in the CISS specification.)
+ */
+#define	CISS_CDBLEN				16
+
+/*
+ * Command Status Values.  These are listed in "Table 2 Command Status" in "3.3
+ * Error Info" of the CISS specification.
+ */
+#define	CISS_CMD_SUCCESS			0x00
+#define	CISS_CMD_TARGET_STATUS			0x01
+#define	CISS_CMD_DATA_UNDERRUN			0x02
+#define	CISS_CMD_DATA_OVERRUN			0x03
+#define	CISS_CMD_INVALID			0x04
+#define	CISS_CMD_PROTOCOL_ERR			0x05
+#define	CISS_CMD_HARDWARE_ERR			0x06
+#define	CISS_CMD_CONNECTION_LOST		0x07
+#define	CISS_CMD_ABORTED			0x08
+#define	CISS_CMD_ABORT_FAILED			0x09
+#define	CISS_CMD_UNSOLICITED_ABORT		0x0a
+#define	CISS_CMD_TIMEOUT			0x0b
+#define	CISS_CMD_UNABORTABLE			0x0c
+
+/*
+ * Request Transfer Directions, used in "RequestBlock.Type.Direction":
+ */
+#define	CISS_XFER_NONE				0x00
+#define	CISS_XFER_WRITE				0x01
+#define	CISS_XFER_READ				0x02
+#define	CISS_XFER_RSVD				0x03
+
+/*
+ * Request Attributes, used in "RequestBlock.Type.Attribute":
+ */
+#define	CISS_ATTR_UNTAGGED			0x00
+#define	CISS_ATTR_SIMPLE			0x04
+#define	CISS_ATTR_HEADOFQUEUE			0x05
+#define	CISS_ATTR_ORDERED			0x06
+
+/*
+ * Request Type, used in "RequestBlock.Type.Type":
+ */
+#define	CISS_TYPE_CMD				0x00
+#define	CISS_TYPE_MSG				0x01
+
+/*
+ * I2O Space Register Offsets
+ *
+ * The name "I2O", and these register offsets, appear to be amongst the last
+ * vestiges of a long-defunct attempt at standardising mainframe-style I/O
+ * channels in the Intel server space: the Intelligent Input/Output (I2O)
+ * Architecture Specification.
+ *
+ * The draft of version 1.5 of this specification, in section "4.2.1.5.1
+ * Extensions for PCI", suggests that the following are memory offsets into
+ * "the memory region specified by the first base address configuration
+ * register indicating memory space (offset 10h, 14h, and so forth)".  These
+ * match up with the offsets of the first two BARs in a PCI configuration space
+ * type 0 header.
+ *
+ * The specification also calls out the Inbound Post List FIFO, write-only at
+ * offset 40h; the Outbound Post List FIFO, read-only at offset 44h; the
+ * Interrupt Status Register, at offset 30h; and the Interrupt Mask Register,
+ * at offset 34h.
+ *
+ * This ill-fated attempt to increase the proprietary complexity of (and
+ * presumably, thus, the gross margin on) computer systems is all but extinct.
+ * The transport layer of this storage controller is all that's left of their
+ * religion.
+ */
+#define	CISS_I2O_INBOUND_DOORBELL		0x20
+#define	CISS_I2O_INTERRUPT_STATUS		0x30
+#define	CISS_I2O_INTERRUPT_MASK			0x34
+#define	CISS_I2O_INBOUND_POST_Q			0x40
+#define	CISS_I2O_OUTBOUND_POST_Q		0x44
+#define	CISS_I2O_OUTBOUND_DOORBELL_STATUS	0x9c
+#define	CISS_I2O_OUTBOUND_DOORBELL_CLEAR	0xa0
+#define	CISS_I2O_SCRATCHPAD			0xb0
+#define	CISS_I2O_CFGTBL_CFG_OFFSET		0xb4
+#define	CISS_I2O_CFGTBL_MEM_OFFSET		0xb8
+
+/*
+ * Rather than make a lot of small mappings for each part of the address
+ * space we wish to access, we will make one large mapping.  If more
+ * offsets are added to the I2O list above, this space should be extended
+ * appropriately.
+ */
+#define	CISS_I2O_MAP_BASE			0x20
+#define	CISS_I2O_MAP_LIMIT			0x100
+
+/*
+ * The Scratchpad Register (I2O_SCRATCHPAD) is not mentioned in the CISS
+ * specification.  It serves at least two known functions:
+ *	- Signalling controller readiness
+ *	- Exposing a debugging code when the controller firmware locks up
+ */
+#define	CISS_SCRATCHPAD_INITIALISED		0xffff0000
+
+/*
+ * Outbound Doorbell Register Values.
+ *
+ * These are read from the Outbound Doorbell Set/Status Register
+ * (CISS_I2O_OUTBOUND_DOORBELL_STATUS), but cleared by writing to the Clear
+ * Register (CISS_I2O_OUTBOUND_DOORBELL_CLEAR).
+ */
+#define	CISS_ODR_BIT_INTERRUPT			(1UL << 0)
+#define	CISS_ODR_BIT_LOCKUP			(1UL << 1)
+
+/*
+ * Inbound Doorbell Register Values.
+ *
+ * These are written to and read from the Inbound Doorbell Register
+ * (CISS_I2O_INBOUND_DOORBELL).
+ */
+#define	CISS_IDR_BIT_CFGTBL_CHANGE		(1UL << 0)
+
+/*
+ * Interrupt Mask Register Values.
+ *
+ * These are written to and read from the Interrupt Mask Register
+ * (CISS_I2O_INTERRUPT_MASK).  Note that a 1 bit in this register masks or
+ * disables the interrupt in question; to enable the interrupt the bit must be
+ * set to 0.
+ */
+#define	CISS_IMR_BIT_SIMPLE_INTR_DISABLE	(1UL << 3)
+
+/*
+ * Interrupt Status Register Values.
+ *
+ * These are read from the Interrupt Status Register
+ * (CISS_I2O_INTERRUPT_STATUS).
+ */
+#define	CISS_ISR_BIT_SIMPLE_INTR		(1UL << 3)
+
+/*
+ * Transport Methods.
+ *
+ * These bit positions are used in the Configuration Table to detect controller
+ * support for a particular method, via "TransportSupport"; to request that the
+ * controller enable a particular method, via "TransportRequest"; and to detect
+ * whether the controller has acknowledged the request and enabled the desired
+ * method, via "TransportActive".
+ *
+ * See: "9.1 Configuration Table" in the CISS Specification.
+ */
+#define	CISS_CFGTBL_READY_FOR_COMMANDS		(1UL << 0)
+#define	CISS_CFGTBL_XPORT_SIMPLE		(1UL << 1)
+#define	CISS_CFGTBL_XPORT_PERFORMANT		(1UL << 2)
+#define	CISS_CFGTBL_XPORT_MEMQ			(1UL << 4)
+
+/*
+ * In the Simple Transport Method, when the appropriate interrupt status bit is
+ * set (CISS_ISR_BIT_SIMPLE_INTR), the Outbound Post Queue register is
+ * repeatedly read for notifications of the completion of commands previously
+ * submitted to the controller.  These macros help break up the read value into
+ * its component fields: the tag number, and whether or not the command
+ * completed in error.
+ */
+#define	CISS_OPQ_READ_TAG(x)			((x) >> 2)
+#define	CISS_OPQ_READ_ERROR(x)			((x) & (1UL << 1))
+
+/*
+ * Physical devices that are reported may be marked as 'masked'. A masked device
+ * is one that the driver can see, but must not perform any I/O to.
+ */
+#define	SMRT_CISS_MODE_MASKED			3
+
+/*
+ * The following packed structures are used to ease the manipulation of
+ * requests and responses from the controller.
+ */
+#pragma pack(1)
+
+typedef struct smrt_tag {
+	uint32_t reserved:1;
+	uint32_t error:1;
+	uint32_t tag_value:30;
+	uint32_t unused;
+} smrt_tag_t;
+
+typedef union SCSI3Addr {
+	struct {
+		uint8_t Dev;
+		uint8_t Bus:6;
+		uint8_t Mode:2;
+	} PeripDev;
+	struct {
+		uint8_t DevLSB;
+		uint8_t DevMSB:6;
+		uint8_t Mode:2;
+	} LogDev;
+	struct {
+		uint8_t Dev:5;
+		uint8_t Bus:3;
+		uint8_t Targ:6;
+		uint8_t Mode:2;
+	} LogUnit;
+} SCSI3Addr_t;
+
+typedef struct PhysDevAddr {
+	uint32_t TargetId:24;
+	uint32_t Bus:6;
+	uint32_t Mode:2;
+	SCSI3Addr_t Target[2];
+} PhysDevAddr_t;
+
+typedef struct LogDevAddr {
+	uint32_t VolId:30;
+	uint32_t Mode:2;
+	uint8_t reserved[4];
+} LogDevAddr_t;
+
+typedef union LUNAddr {
+	uint8_t LunAddrBytes[8];
+	SCSI3Addr_t SCSI3Lun[4];
+	PhysDevAddr_t PhysDev;
+	LogDevAddr_t LogDev;
+} LUNAddr_t;
+
+typedef struct CommandListHeader {
+	uint8_t ReplyQueue;
+	uint8_t SGList;
+	uint16_t SGTotal;
+	smrt_tag_t Tag;
+	LUNAddr_t LUN;
+} CommandListHeader_t;
+
+typedef struct RequestBlock {
+	uint8_t CDBLen;
+	struct {
+		uint8_t Type:3;
+		uint8_t Attribute:3;
+		uint8_t Direction:2;
+	} Type;
+	uint16_t Timeout;
+	uint8_t CDB[CISS_CDBLEN];
+} RequestBlock_t;
+
+typedef struct ErrDescriptor {
+	uint64_t Addr;
+	uint32_t Len;
+} ErrDescriptor_t;
+
+typedef struct SGDescriptor {
+	uint64_t Addr;
+	uint32_t Len;
+	uint32_t Ext;
+} SGDescriptor_t;
+
+typedef struct CommandList {
+	CommandListHeader_t Header;
+	RequestBlock_t Request;
+	ErrDescriptor_t ErrDesc;
+	SGDescriptor_t SG[CISS_MAXSGENTRIES];
+} CommandList_t;
+
+typedef union MoreErrInfo {
+	struct {
+		uint8_t Reserved[3];
+		uint8_t Type;
+		uint32_t ErrorInfo;
+	} Common_Info;
+	struct {
+		uint8_t Reserved[2];
+		uint8_t offense_size;
+		uint8_t offense_num;
+		uint32_t offense_value;
+	} Invalid_Cmd;
+} MoreErrInfo_t;
+
+typedef struct ErrorInfo {
+	uint8_t ScsiStatus;
+	uint8_t SenseLen;
+	uint16_t CommandStatus;
+	uint32_t ResidualCnt;
+	MoreErrInfo_t MoreErrInfo;
+	uint8_t SenseInfo[MAX_SENSE_LENGTH];
+} ErrorInfo_t;
+
+typedef struct CfgTable {
+	uint8_t Signature[4];
+	uint32_t SpecValence;
+	uint32_t TransportSupport;
+	uint32_t TransportActive;
+	uint32_t TransportRequest;
+	uint32_t Upper32Addr;
+	uint32_t CoalIntDelay;
+	uint32_t CoalIntCount;
+	uint32_t CmdsOutMax;
+	uint32_t BusTypes;
+	uint32_t TransportMethodOffset;
+	uint8_t ServerName[16];
+	uint32_t HeartBeat;
+	uint32_t HostDrvrSupport;
+	uint32_t MaxSGElements;
+	uint32_t MaxLunSupport;
+	uint32_t MaxPhyDevSupport;
+	uint32_t MaxPhyDrvPerLun;
+	uint32_t MaxPerfModeCmdsOutMax;
+	uint32_t MaxBlockFetchCount;
+} CfgTable_t;
+
+#pragma pack()
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif /* _SMRT_CISS_H */
diff --git a/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_scsi.h b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_scsi.h
new file mode 100644
index 0000000000..45c4c84407
--- /dev/null
+++ b/usr/src/uts/common/sys/scsi/adapters/smrt/smrt_scsi.h
@@ -0,0 +1,371 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/*
+ * Copyright (C) 2013 Hewlett-Packard Development Company, L.P.
+ * Copyright (c) 2017 Joyent, Inc.
+ */
+
+#ifndef	_SMRT_SCSI_H
+#define	_SMRT_SCSI_H
+
+#include <sys/types.h>
+
+#include <sys/scsi/adapters/smrt/smrt_ciss.h>
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/* CISS LUN Addressing MODEs */
+#define	PERIPHERIAL_DEV_ADDR			0x0
+#define	LOGICAL_VOL_ADDR			0x1
+#define	MASK_PERIPHERIAL_DEV_ADDR		0x3
+#define	CISS_PHYS_MODE				0x0
+
+/*
+ * Vendor-specific SCSI Commands
+ *
+ * These command opcodes are for use in the opcode byte of the CDB in a request
+ * of type CISS_TYPE_CMD.  They are custom SCSI commands, using the
+ * vendor-specific part of the opcode space; i.e., 0xC0 through 0xFF.
+ */
+#define	CISS_SCMD_READ				0xC0
+#define	CISS_SCMD_WRITE				0xC1
+#define	CISS_SCMD_REPORT_LOGICAL_LUNS		0xC2
+#define	CISS_SCMD_REPORT_PHYSICAL_LUNS		0xC3
+
+/*
+ * These command opcodes are _not_ in the usual vendor-specific space, but are
+ * nonetheless vendor-specific.  They allow BMIC commands to be written to and
+ * read from the controller.  If a command transfers no data, the specification
+ * suggests that BMIC_WRITE (0x27) is appropriate.
+ */
+#define	CISS_SCMD_BMIC_READ			0x26
+#define	CISS_SCMD_BMIC_WRITE			0x27
+
+/*
+ * CISS Messages
+ *
+ * The CISS specification describes several directives that do not behave like
+ * SCSI commands.  They are sent in requests of type CISS_TYPE_MSG.
+ *
+ * The Abort, Reset, and Nop, messages are defined in "8. Messages" in the CISS
+ * Specification.
+ */
+#define	CISS_MSG_ABORT				0x0
+#define	CISS_ABORT_TASK				0x0
+#define	CISS_ABORT_TASKSET			0x1
+
+#define	CISS_MSG_RESET				0x1
+#define	CISS_RESET_CTLR				0x0
+#define	CISS_RESET_BUS				0x1
+#define	CISS_RESET_TGT				0x3
+#define	CISS_RESET_LUN				0x4
+
+#define	CISS_MSG_NOP				0x3
+
+/*
+ * BMIC Commands
+ *
+ * These commands allow for the use of non-standard facilities specific to the
+ * Smart Array firmware.  They are sent to the controller through a specially
+ * constructed CDB with the CISS_SCMD_BMIC_READ or CISS_SCMD_BMIC_WRITE opcode.
+ */
+#define	CISS_BMIC_IDENTIFY_CONTROLLER		0x11
+#define	CISS_BMIC_IDENTIFY_PHYSICAL_DEVICE	0x15
+#define	CISS_BMIC_NOTIFY_ON_EVENT		0xD0
+#define	CISS_BMIC_NOTIFY_ON_EVENT_CANCEL	0xD1
+
+/*
+ * Device and Phy type codes.  These are used across many commands, including
+ * IDENTIFY PHYSICAL DEVICE and the REPORT PHYSICAL LUN extended reporting.
+ */
+#define	SMRT_DTYPE_PSCSI			0x00
+#define	SMRT_DTYPE_SATA				0x01
+#define	SMRT_DTYPE_SAS				0x02
+#define	SMRT_DTYPE_SATA_BW			0x03
+#define	SMRT_DTYPE_SAS_BW			0x04
+#define	SMRT_DTYPE_EXPANDER			0x05
+#define	SMRT_DTYPE_SES				0x06
+#define	SMRT_DTYPE_CONTROLLER			0x07
+#define	SMRT_DTYPE_SGPIO			0x08
+#define	SMRT_DTYPE_NVME				0x09
+#define	SMRT_DTYPE_NOPHY			0xFF
+
+/*
+ * The following packed structures are used to ease the manipulation of SCSI
+ * and BMIC commands sent to, and status information returned from, the
+ * controller.
+ */
+#pragma pack(1)
+
+typedef struct smrt_report_logical_lun_ent {
+	LogDevAddr_t smrle_addr;
+} smrt_report_logical_lun_ent_t;
+
+typedef struct smrt_report_logical_lun_extent {
+	LogDevAddr_t smrle_addr;
+	uint8_t smrle_wwn[16];
+} smrt_report_logical_lun_extent_t;
+
+typedef struct smrt_report_logical_lun {
+	uint32_t smrll_datasize; /* Big Endian */
+	uint8_t smrll_extflag;
+	uint8_t smrll_reserved1[3];
+	union {
+		smrt_report_logical_lun_ent_t ents[SMRT_MAX_LOGDRV];
+		smrt_report_logical_lun_extent_t extents[SMRT_MAX_LOGDRV];
+	} smrll_data;
+} smrt_report_logical_lun_t;
+
+typedef struct smrt_report_logical_lun_req {
+	uint8_t smrllr_opcode;
+	uint8_t smrllr_extflag;
+	uint8_t smrllr_reserved1[4];
+	uint32_t smrllr_datasize; /* Big Endian */
+	uint8_t smrllr_reserved2;
+	uint8_t smrllr_control;
+} smrt_report_logical_lun_req_t;
+
+typedef struct smrt_report_physical_lun_ent {
+	PhysDevAddr_t srple_addr;
+} smrt_report_physical_lun_ent_t;
+
+/*
+ * This structure represents the 'physical node identifier' extended option for
+ * REPORT PHYSICAL LUNS.  This is triggered when the extended flags is set to
+ * 0x1.  Note that for SAS the other structure should always be used.
+ */
+typedef struct smrt_report_physical_pnid {
+	uint8_t srpp_node[8];
+	uint8_t srpp_port[8];
+} smrt_report_physical_pnid_t;
+
+/*
+ * This structure represents the 'other physical device info' extended option
+ * for report physical luns.  This is triggered when the extended flags is set
+ * to 0x2.
+ */
+typedef struct smrt_report_physical_opdi {
+	uint8_t srpo_wwid[8];
+	uint8_t srpo_dtype;
+	uint8_t srpo_flags;
+	uint8_t srpo_multilun;
+	uint8_t srpo_paths;
+	uint32_t srpo_iohdl;
+} smrt_report_physical_opdi_t;
+
+typedef struct smrt_report_physical_lun_extent {
+	PhysDevAddr_t srple_addr;
+	union {
+		smrt_report_physical_pnid_t srple_pnid;
+		smrt_report_physical_opdi_t srple_opdi;
+	} srple_extdata;
+} smrt_report_physical_lun_extent_t;
+
+/*
+ * Values that can be ORed together into smrllr_extflag. smprl_extflag indicates
+ * if any extended processing was done or not.
+ */
+#define	SMRT_REPORT_PHYSICAL_LUN_EXT_NONE	0x00
+#define	SMRT_REPORT_PHYSICAL_LUN_EXT_PNID	0x01
+#define	SMRT_REPORT_PHYSICAL_LUN_EXT_OPDI	0x02
+#define	SMRT_REPORT_PHYSICAL_LUN_EXT_MASK	0x0f
+#define	SMRT_REPORT_PHYSICAL_LUN_CTRL_ONLY	(1 << 6)
+#define	SMRT_REPORT_PHYSICAL_LUN_ALL_PATHS	(1 << 7)
+
+typedef struct smrt_report_physical_lun {
+	uint32_t smrpl_datasize; /* Big Endian */
+	uint8_t smrpl_extflag;
+	uint8_t smrpl_reserved1[3];
+	union {
+		smrt_report_physical_lun_ent_t ents[SMRT_MAX_PHYSDEV];
+		smrt_report_physical_lun_extent_t extents[SMRT_MAX_PHYSDEV];
+	} smrpl_data;
+} smrt_report_physical_lun_t;
+
+
+typedef struct smrt_report_physical_lun_req {
+	uint8_t smrplr_opcode;
+	uint8_t smrplr_extflag;
+	uint8_t smrplr_reserved[1];
+	uint32_t smrplr_datasize; /* Big Endian */
+	uint8_t smrplr_reserved2;
+	uint8_t smrplr_control;
+} smrt_report_physical_lun_req_t;
+
+/*
+ * Request structure for the BMIC command IDENTIFY CONTROLLER.  This structure
+ * is written into the CDB with the CISS_SCMD_BMIC_READ SCSI opcode.  Reserved
+ * fields should be filled with zeroes.
+ */
+typedef struct smrt_identify_controller_req {
+	uint8_t smicr_opcode;
+	uint8_t smicr_lun;
+	uint8_t smicr_reserved1[4];
+	uint8_t smicr_command;
+	uint8_t smicr_reserved2[2];
+	uint8_t smicr_reserved3[1];
+	uint8_t smicr_reserved4[6];
+} smrt_identify_controller_req_t;
+
+/*
+ * Response structure for IDENTIFY CONTROLLER.  This structure is used to
+ * interpret the response the controller will write into the data buffer.
+ */
+typedef struct smrt_identify_controller {
+	uint8_t smic_logical_drive_count;
+	uint32_t smic_config_signature;
+	uint8_t smic_firmware_rev[4];
+	uint8_t smic_recovery_rev[4];
+	uint8_t smic_hardware_version;
+	uint8_t smic_bootblock_rev[4];
+
+	/*
+	 * These are obsolete for SAS controllers:
+	 */
+	uint32_t smic_drive_present_map;
+	uint32_t smic_external_drive_map;
+
+	uint32_t smic_board_id;
+} smrt_identify_controller_t;
+
+/*
+ * Request structure for IDENTIFY PHYSICAL DEVICE.  This structure is written
+ * into the CDB with the CISS_SCMD_BMIC_READ SCSI opcode.  Reserved fields
+ * should be filled with zeroes.  Note, the lower 8 bits of the BMIC ID are in
+ * index1, whereas the upper 8 bites are in index2; however, the controller may
+ * only support 8 bits worth of devices (and this driver does not support that
+ * many devices).
+ */
+typedef struct smrt_identify_physical_drive_req {
+	uint8_t sipdr_opcode;
+	uint8_t sipdr_lun;
+	uint8_t	sipdr_bmic_index1;
+	uint8_t sipdr_reserved1[3];
+	uint8_t sipdr_command;
+	uint8_t sipdr_reserved2[2];
+	uint8_t sipdr_bmic_index2;
+	uint8_t sipdr_reserved4[6];
+} smrt_identify_physical_drive_req_t;
+
+/*
+ * Relevant values for the sipd_more_flags member.
+ */
+#define	SMRT_MORE_FLAGS_LOGVOL	(1 << 5)
+#define	SMRT_MORE_FLAGS_SPARE	(1 << 6)
+
+/*
+ * Response structure for IDENTIFY PHYSICAL DEVICE.  This structure is used to
+ * describe aspects of a physical drive. Note, not all fields are valid in all
+ * firmware revisions.
+ */
+typedef struct smrt_identify_physical_drive {
+	uint8_t		sipd_scsi_bus;	/* Invalid for SAS */
+	uint8_t		sipd_scsi_id;	/* Invalid for SAS */
+	uint16_t	sipd_lblk_size;
+	uint32_t	sipd_nblocks;
+	uint32_t	sipd_rsrvd_blocsk;
+	uint8_t		sipd_model[40];
+	uint8_t		sipd_serial[40];
+	uint8_t		sipd_firmware[8];
+	uint8_t		sipd_scsi_inquiry;
+	uint8_t		sipd_compaq_stamp;
+	uint8_t		sipd_last_failure;
+	uint8_t		sipd_flags;
+	uint8_t		sipd_more_flags;
+	uint8_t		sipd_scsi_lun;	/* Invalid for SAS */
+	uint8_t		sipd_yet_more_flags;
+	uint8_t		sipd_even_more_flags;
+	uint32_t	sipd_spi_speed_rules;
+	uint8_t		sipd_phys_connector[2];
+	uint8_t		sipd_phys_box_on_bus;
+	uint8_t		sipd_phys_bay_in_box;
+	uint32_t	sipd_rpm;
+	uint8_t		sipd_device_type;
+	uint8_t		sipd_sata_version;
+	uint64_t	sipd_big_nblocks;
+	uint64_t	sipd_ris_slba;
+	uint32_t	sipd_ris_size;
+	uint8_t		sipd_wwid[20];
+	uint8_t		sipd_controller_phy_map[32];
+	uint16_t	sipd_phy_count;
+	uint8_t		sipd_phy_connected_dev_type[256];
+	uint8_t		sipd_phy_to_drive_bay[256];
+	uint16_t	sipd_phy_to_attached_dev[256];
+	uint8_t		sipd_box_index;
+	uint8_t		sipd_drive_support;
+	uint16_t	sipd_extra_flags;
+	uint8_t		sipd_neogiated_link_rate[256];
+	uint8_t		sipd_phy_to_phy_map[256];
+	uint8_t		sipd_pad[312];
+} smrt_identify_physical_drive_t;
+
+/*
+ * Note that this structure describes the CISS version of the command. There
+ * also exists a BMIC version, but it has a slightly different structure.  This
+ * structure is also used for the cancellation request; however, in that case,
+ * the senr_flags field is reserved.
+ */
+typedef struct smrt_event_notify_req {
+	uint8_t		senr_opcode;
+	uint8_t		senr_subcode;
+	uint8_t		senr_reserved1[2];
+	uint32_t	senr_flags;	/* Big Endian */
+	uint32_t	senr_size;	/* Big Endian */
+	uint8_t		senr_control;
+} smrt_event_notify_req_t;
+
+/*
+ * When receiving event notifications, the buffer size must be 512 bytes large.
+ * We make sure that we always allocate a buffer of this size, even though we
+ * define a structure that is much shorter and only uses the fields that we end
+ * up caring about.  This size requirement comes from the specification.
+ */
+#define	SMRT_EVENT_NOTIFY_BUFLEN	512
+
+#define	SMRT_EVENT_CLASS_PROTOCOL		0
+#define	SMRT_EVENT_PROTOCOL_SUBCLASS_ERROR	1
+
+#define	SMRT_EVENT_CLASS_HOTPLUG		1
+#define	SMRT_EVENT_HOTPLUG_SUBCLASS_DRIVE	0
+
+#define	SMRT_EVENT_CLASS_HWERROR		2
+#define	SMRT_EVENT_CLASS_ENVIRONMENT		3
+
+#define	SMRT_EVENT_CLASS_PHYS			4
+#define	SMRT_EVENT_PHYS_SUBCLASS_STATE		0
+
+#define	SMRT_EVENT_CLASS_LOGVOL			5
+
+typedef struct smrt_event_notify {
+	uint32_t	sen_timestamp;
+	uint16_t	sen_class;
+	uint16_t	sen_subclass;
+	uint16_t	sen_detail;
+	uint8_t		sen_data[64];
+	char		sen_message[80];
+	uint32_t	sen_tag;
+	uint16_t	sen_date;
+	uint16_t	sen_year;
+	uint32_t	sen_time;
+	uint16_t	sen_pre_power_time;
+	LUNAddr_t	sen_addr;
+} smrt_event_notify_t;
+
+#pragma pack()
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SMRT_SCSI_H */
diff --git a/usr/src/uts/intel/Makefile.intel b/usr/src/uts/intel/Makefile.intel
index 3fafc22c66..b586675d85 100644
--- a/usr/src/uts/intel/Makefile.intel
+++ b/usr/src/uts/intel/Makefile.intel
@@ -360,6 +360,7 @@ DRV_KMODS	+= yge
 DRV_KMODS	+= zcons
 DRV_KMODS	+= zyd
 DRV_KMODS	+= simnet
+DRV_KMODS	+= smrt
 DRV_KMODS	+= stmf
 DRV_KMODS	+= stmf_sbd
 DRV_KMODS	+= fct
diff --git a/usr/src/uts/intel/smrt/Makefile b/usr/src/uts/intel/smrt/Makefile
new file mode 100644
index 0000000000..37d47e1395
--- /dev/null
+++ b/usr/src/uts/intel/smrt/Makefile
@@ -0,0 +1,64 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright (c) 2017, Joyent, Inc.
+#
+
+#
+#	Path to the base of the uts directory tree
+#
+UTSBASE	= ../..
+
+#
+#	Define the module and object file sets.
+#
+MODULE		= smrt
+OBJECTS		= $(SMRT_OBJS:%=$(OBJS_DIR)/%)
+ROOTMODULE	= $(ROOT_DRV_DIR)/$(MODULE)
+CONF_SRCDIR     = $(UTSBASE)/common/io/scsi/adapters/smrt
+
+#
+#	Include common rules.
+#
+include $(UTSBASE)/intel/Makefile.intel
+
+#
+#	Define targets
+#
+ALL_TARGET	= $(BINARY) $(CONFMOD)
+INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
+
+#
+#	Kernel Module Dependencies
+#
+LDFLAGS		+= -Nmisc/scsi
+
+
+#
+#	Default build targets.
+#
+.KEEP_STATE:
+
+def:		$(DEF_DEPS)
+
+all:		$(ALL_DEPS)
+
+clean:		$(CLEAN_DEPS)
+
+clobber:	$(CLOBBER_DEPS)
+
+install:	$(INSTALL_DEPS)
+
+#
+#	Include common targets.
+#
+include $(UTSBASE)/intel/Makefile.targ