/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Interface for Serengeti IOSRAM mailbox
 * OS <-> SC communication protocol
 */

#include <sys/types.h>
#include <sys/systm.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/kmem.h>
#include <sys/uadmin.h>
#include <sys/machsystm.h>
#include <sys/disp.h>
#include <sys/taskq.h>

#include <sys/sgevents.h>
#include <sys/sgsbbc_priv.h>
#include <sys/sgsbbc_iosram_priv.h>
#include <sys/sgsbbc_mailbox_priv.h>
#include <sys/plat_ecc_unum.h>
#include <sys/plat_ecc_dimm.h>
#include <sys/serengeti.h>
#include <sys/fm/util.h>
#include <sys/promif.h>
#include <sys/plat_datapath.h>

sbbc_mailbox_t  *master_mbox = NULL;

/*
 * Panic Shutdown event support
 */
static  kmutex_t        panic_hdlr_lock;

/*
 * The ID of the soft interrupt which triggers the bringing down of a Domain
 * when a PANIC_SHUTDOWN event is received.
 */
static ddi_softintr_t   panic_softintr_id = 0;

static sg_panic_shutdown_t      panic_payload;
static sbbc_msg_t               panic_payload_msg;

/*
 * A queue for making sure outgoing messages are in order as ScApp
 * does not support interleaving messages.
 */
static kcondvar_t       outbox_queue;
static kmutex_t         outbox_queue_lock;

/*
 * Handle unsolicited capability message.
 */
static plat_capability_data_t   cap_payload;
static sbbc_msg_t               cap_payload_msg;
static kmutex_t                 cap_msg_hdlr_lock;

/*
 * Datapath error and fault messages arrive unsolicited.  The message data
 * is contained in a plat_datapath_info_t structure.
 */
typedef struct {
        uint8_t         type;           /* CDS, DX, CP */
        uint8_t         pad;            /* for alignment */
        uint16_t        cpuid;          /* Safari ID of base CPU */
        uint32_t        t_value;        /* SERD timeout threshold (seconds) */
} plat_datapath_info_t;

/*
 * Unsolicited datapath error messages are processed via a soft interrupt,
 * triggered in unsolicited interrupt processing.
 */
static  ddi_softintr_t          dp_softintr_id = 0;
static  kmutex_t                dp_hdlr_lock;

static  plat_datapath_info_t    dp_payload;
static  sbbc_msg_t              dp_payload_msg;

static char *dperrtype[] = {
        DP_ERROR_CDS,
        DP_ERROR_DX,
        DP_ERROR_RP
};

/*
 * Variable indicating if we are already processing requests.
 * Setting this value must be protected by outbox_queue_lock.
 */
static int              outbox_busy = 0;

/*
 * local stuff
 */
static int sbbc_mbox_send_msg(sbbc_msg_t *, int, uint_t, time_t, clock_t);
static int sbbc_mbox_recv_msg();
static int mbox_write(struct sbbc_mbox_header *,
        struct sbbc_fragment *, sbbc_msg_t *);
static int mbox_read(struct sbbc_mbox_header *, struct sbbc_fragment *,
        sbbc_msg_t *);
static int mbox_has_free_space(struct sbbc_mbox_header *);
static void mbox_skip_next_msg(struct sbbc_mbox_header *);
static int mbox_read_header(uint32_t, struct sbbc_mbox_header *);
static void mbox_update_header(uint32_t, struct sbbc_mbox_header *);
static int mbox_read_frag(struct sbbc_mbox_header *, struct sbbc_fragment *);
static struct sbbc_msg_waiter *mbox_find_waiter(uint16_t, uint32_t);
static void wakeup_next(void);
static uint_t sbbc_panic_shutdown_handler(char *arg);
static uint_t sbbc_do_fast_shutdown(char *arg);
static void sbbc_mbox_post_reg(sbbc_softstate_t *softsp);
static uint_t cap_ecc_msg_handler(char *);
static uint_t sbbc_datapath_error_msg_handler(char *arg);
static uint_t sbbc_datapath_fault_msg_handler(char *arg);
static uint_t sbbc_dp_trans_event(char *arg);


/*
 * Interrupt handlers
 */
static int sbbc_mbox_msgin(void);
static int sbbc_mbox_msgout(void);
static int sbbc_mbox_spacein(void);
static int sbbc_mbox_spaceout(void);

/*
 * ECC event mailbox message taskq and parameters
 */
static taskq_t  *sbbc_ecc_mbox_taskq = NULL;
static int      sbbc_ecc_mbox_taskq_errs = 0;
static int      sbbc_ecc_mbox_send_errs = 0;
static int      sbbc_ecc_mbox_inval_errs = 0;
static int      sbbc_ecc_mbox_other_errs = 0;
int     sbbc_ecc_mbox_err_throttle = ECC_MBOX_TASKQ_ERR_THROTTLE;

/*
 * Called when SBBC driver is loaded
 * Initialise global mailbox stuff, etc
 */
void
sbbc_mbox_init()
{
        int     i;

        master_mbox = kmem_zalloc(sizeof (sbbc_mailbox_t), KM_NOSLEEP);
        if (master_mbox == NULL) {
                cmn_err(CE_PANIC, "Can't allocate memory for mailbox\n");
        }

        /*
         * mutex'es for the wait-lists
         */
        for (i = 0; i < SBBC_MBOX_MSG_TYPES; i++) {
                mutex_init(&master_mbox->mbox_wait_lock[i],
                        NULL, MUTEX_DEFAULT, NULL);
                master_mbox->mbox_wait_list[i] = NULL;
        }

        for (i = 0; i < SBBC_MBOX_MSG_TYPES; i++)
                master_mbox->intrs[i] = NULL;

        /*
         * Two mailbox channels SC -> OS , read-only
         *                      OS -> SC, read/write
         */
        master_mbox->mbox_in = kmem_zalloc(sizeof (sbbc_mbox_t), KM_NOSLEEP);
        if (master_mbox->mbox_in == NULL) {
                cmn_err(CE_PANIC,
                        "Can't allocate memory for inbound mailbox\n");
        }

        master_mbox->mbox_out = kmem_zalloc(sizeof (sbbc_mbox_t), KM_NOSLEEP);
        if (master_mbox->mbox_out == NULL) {
                cmn_err(CE_PANIC,
                        "Can't allocate memory for outbound mailbox\n");
        }

        mutex_init(&master_mbox->mbox_in->mb_lock, NULL,
                MUTEX_DEFAULT, NULL);
        mutex_init(&master_mbox->mbox_out->mb_lock, NULL,
                MUTEX_DEFAULT, NULL);

        /*
         * Add PANIC_SHUTDOWN Event mutex
         */
        mutex_init(&panic_hdlr_lock, NULL, MUTEX_DEFAULT, NULL);

        /* Initialize datapath error message handler mutex */
        mutex_init(&dp_hdlr_lock, NULL, MUTEX_DEFAULT, NULL);

        /* Initialize capability message handler event mutex */
        mutex_init(&cap_msg_hdlr_lock, NULL, MUTEX_DEFAULT, NULL);

        /*
         * NOT USED YET
         */
        master_mbox->mbox_in->mb_type =
                master_mbox->mbox_out->mb_type = 0;

        cv_init(&outbox_queue, NULL, CV_DEFAULT, NULL);
        mutex_init(&outbox_queue_lock, NULL, MUTEX_DEFAULT, NULL);

}

/*
 * called when the SBBC driver is unloaded
 */
void
sbbc_mbox_fini()
{
        int     i;
        int     err;

        /*
         * destroy ECC event mailbox taskq
         */
        if (sbbc_ecc_mbox_taskq != NULL) {
                taskq_destroy(sbbc_ecc_mbox_taskq);
                sbbc_ecc_mbox_taskq = NULL;
                sbbc_ecc_mbox_taskq_errs = 0;
        }

        /*
         * unregister interrupts
         */
        (void) iosram_unreg_intr(SBBC_MAILBOX_IN);
        (void) iosram_unreg_intr(SBBC_MAILBOX_IN);
        (void) iosram_unreg_intr(SBBC_MAILBOX_SPACE_IN);
        (void) iosram_unreg_intr(SBBC_MAILBOX_SPACE_OUT);

        /*
         * Remove Panic Shutdown and Datapath Error event support.
         *
         * NOTE: If we have not added the soft interrupt handlers for these
         * then we know that we have not registered the event handlers either.
         */
        if (panic_softintr_id != 0) {
                ddi_remove_softintr(panic_softintr_id);

                err = sbbc_mbox_unreg_intr(MBOX_EVENT_PANIC_SHUTDOWN,
                        sbbc_panic_shutdown_handler);
                if (err != 0) {
                        cmn_err(CE_WARN, "Failed to unreg Panic Shutdown "
                                "handler. Err=%d", err);
                }
        }
        if (dp_softintr_id != 0) {
                ddi_remove_softintr(dp_softintr_id);

                err = sbbc_mbox_unreg_intr(MBOX_EVENT_DP_ERROR,
                        sbbc_datapath_error_msg_handler);
                err |= sbbc_mbox_unreg_intr(MBOX_EVENT_DP_FAULT,
                        sbbc_datapath_fault_msg_handler);
                if (err != 0) {
                        cmn_err(CE_WARN, "Failed to unreg Datapath Error "
                                "handler. Err=%d", err);
                }
        }

        /*
         * destroy all its mutex'es, lists etc
         */

        /*
         * mutex'es for the wait-lists
         */
        for (i = 0; i < SBBC_MBOX_MSG_TYPES; i++) {
                mutex_destroy(&master_mbox->mbox_wait_lock[i]);
        }

        mutex_destroy(&master_mbox->mbox_in->mb_lock);
        mutex_destroy(&master_mbox->mbox_out->mb_lock);

        mutex_destroy(&panic_hdlr_lock);
        mutex_destroy(&dp_hdlr_lock);

        kmem_free(master_mbox->mbox_in, sizeof (sbbc_mbox_t));
        kmem_free(master_mbox->mbox_out, sizeof (sbbc_mbox_t));
        kmem_free(master_mbox, sizeof (sbbc_mailbox_t));

        cv_destroy(&outbox_queue);
        mutex_destroy(&outbox_queue_lock);

        err = sbbc_mbox_unreg_intr(INFO_MBOX, cap_ecc_msg_handler);
        if (err != 0) {
                cmn_err(CE_WARN, "Failed to unregister capability message "
                    "handler. Err=%d", err);
        }

        mutex_destroy(&cap_msg_hdlr_lock);
}

/*
 * Update iosram_sbbc to the new softstate after a tunnel switch.
 * Move software interrupts from the old dip to the new dip.
 */
int
sbbc_mbox_switch(sbbc_softstate_t *softsp)
{
        sbbc_intrs_t    *intr;
        int             msg_type;
        int             rc = 0;
        int             err;

        if (master_mbox == NULL)
                return (ENXIO);

        ASSERT(MUTEX_HELD(&master_iosram->iosram_lock));

        for (msg_type = 0; msg_type < SBBC_MBOX_MSG_TYPES; msg_type++) {

                for (intr = master_mbox->intrs[msg_type]; intr != NULL;
                        intr = intr->sbbc_intr_next) {

                        if (intr->sbbc_intr_id) {
                                ddi_remove_softintr(intr->sbbc_intr_id);

                                if (ddi_add_softintr(softsp->dip,
                                        DDI_SOFTINT_HIGH,
                                        &intr->sbbc_intr_id, NULL, NULL,
                                        intr->sbbc_handler, intr->sbbc_arg)
                                        != DDI_SUCCESS) {

                                        cmn_err(CE_WARN,
                                                "Can't add SBBC mailbox "
                                                "softint for msg_type %x\n",
                                                        msg_type);
                                        rc = ENXIO;
                                }
                        }
                }
        }

        /*
         * Add PANIC_SHUTDOWN Event handler
         */
        if (panic_softintr_id) {
                ddi_remove_softintr(panic_softintr_id);

                err = ddi_add_softintr(softsp->dip, DDI_SOFTINT_LOW,
                        &panic_softintr_id, NULL, NULL,
                        sbbc_do_fast_shutdown, NULL);

                if (err != DDI_SUCCESS) {
                        cmn_err(CE_WARN, "Failed to register Panic "
                                "Shutdown handler. Err=%d", err);
                        (void) sbbc_mbox_unreg_intr(MBOX_EVENT_PANIC_SHUTDOWN,
                                sbbc_panic_shutdown_handler);
                        rc = ENXIO;
                }

        }
        /*
         * Add Datapath Error Event handler
         */
        if (dp_softintr_id) {
                ddi_remove_softintr(dp_softintr_id);

                err = ddi_add_softintr(softsp->dip, DDI_SOFTINT_LOW,
                        &dp_softintr_id, NULL, NULL,
                        sbbc_dp_trans_event, NULL);

                if (err != DDI_SUCCESS) {
                        cmn_err(CE_WARN, "Failed to register Datapath "
                                "Error Event handler. Err=%d", err);
                        (void) sbbc_mbox_unreg_intr(MBOX_EVENT_DP_ERROR,
                                sbbc_datapath_error_msg_handler);
                        (void) sbbc_mbox_unreg_intr(MBOX_EVENT_DP_FAULT,
                                sbbc_datapath_fault_msg_handler);
                        rc = ENXIO;
                }

        }

        return (rc);
}

/*
 * Called when the IOSRAM tunnel is created for the 'chosen' node.
 *
 * Read the mailbox header from the IOSRAM
 * tunnel[SBBC_MAILBOX_KEY]
 * Register the mailbox interrupt handlers
 * for messages in/space etc
 */
int
sbbc_mbox_create(sbbc_softstate_t *softsp)
{
        struct sbbc_mbox_header header;

        int     i;
        int     err;
        int     rc = 0;

        /*
         * This function should only be called once when
         * the chosen node is initialized.
         */
        ASSERT(MUTEX_HELD(&chosen_lock));

        if (master_mbox == NULL)
                return (ENXIO);

        /*
         * read the header at offset 0
         * check magic/version etc
         */
        if (rc = iosram_read(SBBC_MAILBOX_KEY, 0, (caddr_t)&header,
            sizeof (struct sbbc_mbox_header))) {

                return (rc);
        }

        /*
         * add the interrupt handlers for the mailbox
         * interrupts
         */
        for (i = 0; i < MBOX_INTRS; i++) {
                sbbc_intrfunc_t         intr_handler;
                uint_t                  *state;
                kmutex_t                *lock;
                uint32_t                intr_num;

                switch (i) {
                case MBOX_MSGIN_INTR:
                        intr_handler = (sbbc_intrfunc_t)sbbc_mbox_msgin;
                        intr_num = SBBC_MAILBOX_IN;
                        break;
                case MBOX_MSGOUT_INTR:
                        intr_handler = (sbbc_intrfunc_t)sbbc_mbox_msgout;
                        intr_num = SBBC_MAILBOX_OUT;
                        break;
                case MBOX_SPACEIN_INTR:
                        intr_handler = (sbbc_intrfunc_t)sbbc_mbox_spacein;
                        intr_num = SBBC_MAILBOX_SPACE_IN;
                        break;
                case MBOX_SPACEOUT_INTR:
                        intr_handler = (sbbc_intrfunc_t)sbbc_mbox_spaceout;
                        intr_num = SBBC_MAILBOX_SPACE_OUT;
                        break;
                }
                state = (uint_t *)&master_mbox->intr_state[i].mbox_intr_state;
                lock = &master_mbox->intr_state[i].mbox_intr_lock;
                if (iosram_reg_intr(intr_num, intr_handler, (caddr_t)NULL,
                        state, lock)) {

                        cmn_err(CE_WARN,
                                "Can't register Mailbox interrupts \n");
                }
        }

        /*
         * Add PANIC_SHUTDOWN Event handler
         */
        panic_payload_msg.msg_buf = (caddr_t)&panic_payload;
        panic_payload_msg.msg_len = sizeof (panic_payload);

        err = ddi_add_softintr(softsp->dip, DDI_SOFTINT_LOW, &panic_softintr_id,
                NULL, NULL, sbbc_do_fast_shutdown, NULL);

        if (err == DDI_SUCCESS) {
                err = sbbc_mbox_reg_intr(MBOX_EVENT_PANIC_SHUTDOWN,
                        sbbc_panic_shutdown_handler, &panic_payload_msg,
                        NULL, &panic_hdlr_lock);
                if (err != 0) {
                        cmn_err(CE_WARN, "Failed to register Panic "
                                "Shutdown handler. Err=%d", err);
                }

        } else {
                cmn_err(CE_WARN, "Failed to add Panic Shutdown "
                        "softintr handler");
        }

        /*
         * Add Unsolicited Datapath Error Events handler
         */
        dp_payload_msg.msg_buf = (caddr_t)&dp_payload;
        dp_payload_msg.msg_len = sizeof (dp_payload);

        err = ddi_add_softintr(softsp->dip, DDI_SOFTINT_LOW, &dp_softintr_id,
                NULL, NULL, sbbc_dp_trans_event, NULL);

        if (err == DDI_SUCCESS) {
                err = sbbc_mbox_reg_intr(MBOX_EVENT_DP_ERROR,
                        sbbc_datapath_error_msg_handler, &dp_payload_msg,
                        NULL, &dp_hdlr_lock);
                err |= sbbc_mbox_reg_intr(MBOX_EVENT_DP_FAULT,
                        sbbc_datapath_fault_msg_handler, &dp_payload_msg,
                        NULL, &dp_hdlr_lock);
                if (err != 0) {
                        cmn_err(CE_WARN, "Failed to register Datapath "
                                "error handler. Err=%d", err);
                }

        } else {
                cmn_err(CE_WARN, "Failed to add Datapath error "
                        "softintr handler");
        }

        /*
         * Register an interrupt handler with the sgbbc driver for the
         * unsolicited INFO_MBOX response for the capability bitmap.
         * This message is expected whenever the SC is (re)booted or
         * failed over.
         */
        cap_payload_msg.msg_buf = (caddr_t)&cap_payload;
        cap_payload_msg.msg_len = sizeof (cap_payload);

        err = sbbc_mbox_reg_intr(INFO_MBOX, cap_ecc_msg_handler,
            &cap_payload_msg, NULL, &cap_msg_hdlr_lock);
        if (err != 0) {
                cmn_err(CE_WARN, "Failed to register capability message"
                    " handler with Err=%d", err);
        }

        /*
         * Now is the opportunity to register
         * the deferred mbox intrs.
         */
        sbbc_mbox_post_reg(softsp);

        return (rc);
}

/*
 * Called when chosen IOSRAM is initialized
 * to register the deferred mbox intrs.
 */
static void
sbbc_mbox_post_reg(sbbc_softstate_t *softsp)
{
        uint32_t msg_type;
        sbbc_intrs_t    *intr;

        ASSERT(master_mbox);
        for (msg_type = 0;  msg_type < SBBC_MBOX_MSG_TYPES; msg_type++) {
                intr = master_mbox->intrs[msg_type];
                while (intr != NULL) {
                        if (!intr->registered) {
                                SGSBBC_DBG_INTR(CE_CONT, "sbbc_mbox_post_reg: "
                                        "postreg for msgtype=%x\n", msg_type);
                                if (ddi_add_softintr(softsp->dip,
                                        DDI_SOFTINT_HIGH, &intr->sbbc_intr_id,
                                        NULL, NULL, intr->sbbc_handler,
                                        (caddr_t)intr->sbbc_arg)
                                                != DDI_SUCCESS) {
                                        cmn_err(CE_WARN, "Can't add SBBC "
                                                "deferred mailbox softint \n");
                                } else
                                        intr->registered = 1;
                        }
                        intr = intr->sbbc_intr_next;
                }
        }
}

/*
 * Register a handler for a message type
 * NB NB NB
 * arg must be either NULL or the address of a sbbc_fragment
 * pointer
 */
int
sbbc_mbox_reg_intr(uint32_t msg_type, sbbc_intrfunc_t intr_handler,
                sbbc_msg_t *arg, uint_t *state, kmutex_t *lock)
{
        sbbc_intrs_t    *intr, *previntr;
        int             rc = 0;

        /*
         * Validate arguments
         */
        if (msg_type >= SBBC_MBOX_MSG_TYPES)
                return (EINVAL);

        /*
         * Verify that we have already set up the master sbbc
         */
        if (master_iosram == NULL || master_mbox == NULL)
                return (ENXIO);

        mutex_enter(&master_iosram->iosram_lock);
        msg_type &= SBBC_MSG_TYPE_MASK;
        previntr = intr = master_mbox->intrs[msg_type];

        /* Find the end of the link list */
        while (intr != NULL && intr->sbbc_handler != intr_handler) {

                previntr = intr;
                intr = intr->sbbc_intr_next;
        }

        /* Return if the handler has been registered */
        if (intr != NULL) {
                mutex_exit(&master_iosram->iosram_lock);
                return (EBUSY);
        }

        /*
         * The requested handler has not been installed.
         * Allocate some memory.
         */
        intr = kmem_zalloc(sizeof (sbbc_intrs_t), KM_SLEEP);

        intr->sbbc_handler  = intr_handler;
        intr->sbbc_arg = (caddr_t)arg;
        intr->sbbc_intr_state = state;
        intr->sbbc_intr_lock = lock;
        intr->sbbc_intr_next = NULL;
        /* not registered yet */
        intr->registered = 0;

        if (previntr != NULL)
                previntr->sbbc_intr_next = intr;
        else
                master_mbox->intrs[msg_type] = intr;

        /*
         * register only if the chosen IOSRAM is
         * initialized, otherwise defer the registration
         * until IOSRAM initialization.
         */
        if (master_iosram->iosram_sbbc) {
                if (ddi_add_softintr(master_iosram->iosram_sbbc->dip,
                        DDI_SOFTINT_HIGH,
                        &intr->sbbc_intr_id, NULL, NULL,
                        intr_handler, (caddr_t)arg) != DDI_SUCCESS) {
                        cmn_err(CE_WARN, "Can't add SBBC mailbox softint \n");
                        rc = ENXIO;
                } else
                        intr->registered = 1;
        } else {
                SGSBBC_DBG_INTR(CE_CONT, "sbbc_mbox_reg_intr: "
                                "deferring msg=%x registration\n", msg_type);
        }

        mutex_exit(&master_iosram->iosram_lock);

        return (rc);
}

/*
 * Unregister a handler for a message type
 */
int
sbbc_mbox_unreg_intr(uint32_t msg_type, sbbc_intrfunc_t intr_handler)
{
        sbbc_intrs_t            *intr, *previntr, *nextintr;

        /*
         * Verify that we have already set up the master sbbc
         */
        if (master_iosram == NULL || master_mbox == NULL)
                return (ENXIO);

        msg_type &= SBBC_MSG_TYPE_MASK;

        if (msg_type >= SBBC_MBOX_MSG_TYPES ||
                intr_handler == (sbbc_intrfunc_t)NULL) {

                return (EINVAL);
        }

        mutex_enter(&master_iosram->iosram_lock);

        previntr = intr = master_mbox->intrs[msg_type];

        /*
         * No handlers installed
         */
        if (intr == NULL) {
                mutex_exit(&master_iosram->iosram_lock);
                return (EINVAL);
        }

        while (intr != NULL) {

                /* Save the next pointer */
                nextintr = intr->sbbc_intr_next;

                /* Found a match.  Remove it from the link list */
                if (intr->sbbc_handler == intr_handler) {

                        if (intr->sbbc_intr_id)
                                ddi_remove_softintr(intr->sbbc_intr_id);

                        kmem_free(intr, sizeof (sbbc_intrs_t));

                        if (previntr != master_mbox->intrs[msg_type])
                                previntr->sbbc_intr_next = nextintr;
                        else
                                master_mbox->intrs[msg_type] = nextintr;

                        break;
                }

                /* update pointers */
                previntr = intr;
                intr = nextintr;
        }

        mutex_exit(&master_iosram->iosram_lock);

        return (0);
}
/*
 * Interrupt handlers - one for each mailbox
 * interrupt type
 */

/*
 * mailbox message received
 */
static int
sbbc_mbox_msgin()
{
        mutex_enter(&master_mbox->intr_state[MBOX_MSGIN_INTR].mbox_intr_lock);
        master_mbox->intr_state[MBOX_MSGIN_INTR].mbox_intr_state =
                SBBC_INTR_RUNNING;
        mutex_exit(&master_mbox->intr_state[MBOX_MSGIN_INTR].mbox_intr_lock);

        /*
         * We are only locking the InBox here, not the whole
         * mailbox. This is based on the assumption of
         * complete separation of mailboxes - outbox is
         * read/write, inbox is read-only.
         * We only ever update the producer for the
         * outbox and the consumer for the inbox.
         */
        mutex_enter(&master_mbox->mbox_in->mb_lock);

        for (;;) {
                /*
                 * Get as many incoming messages as possible
                 */
                while (sbbc_mbox_recv_msg() == 0)
                        /* empty */;

                /*
                 * send interrupt to SC to let it know that
                 * space is available over here
                 */
                (void) iosram_send_intr(SBBC_MAILBOX_SPACE_IN);

                mutex_enter(&master_mbox->intr_state[MBOX_MSGIN_INTR].
                        mbox_intr_lock);
                /*
                 * Read the inbox one more time to see if new messages
                 * has come in after we exit the loop.
                 */
                if (sbbc_mbox_recv_msg() == 0) {
                        mutex_exit(&master_mbox->intr_state[MBOX_MSGIN_INTR].
                                mbox_intr_lock);
                } else {
                        master_mbox->intr_state[MBOX_MSGIN_INTR].
                                mbox_intr_state = SBBC_INTR_IDLE;
                        mutex_exit(&master_mbox->intr_state[MBOX_MSGIN_INTR].
                                mbox_intr_lock);
                        break;
                }
        }

        mutex_exit(&master_mbox->mbox_in->mb_lock);

        return (DDI_INTR_CLAIMED);
}

/*
 * mailbox message sent
 */
static int
sbbc_mbox_msgout()
{
        /*
         * Should never get this
         */

        return (DDI_INTR_CLAIMED);
}

/*
 * space in the inbox
 */
static int
sbbc_mbox_spacein()
{
        /*
         * Should never get this
         */

        return (DDI_INTR_CLAIMED);
}

/*
 * space in the outbox
 */
static int
sbbc_mbox_spaceout()
{
        /*
         * cv_broadcast() the threads waiting on the
         * outbox's mb_full
         */

        mutex_enter(&master_mbox->mbox_out->mb_lock);

        cv_broadcast(&master_mbox->mbox_out->mb_full);

        mutex_exit(&master_mbox->mbox_out->mb_lock);

        return (DDI_INTR_CLAIMED);
}

/*
 * Client Interface
 *
 * The main interface will be
 *
 * sbbc_mbox_request_response(sbbc_msg_t *request,
 *                      sbbc_msg_t *response, time_t wait_time)
 *
 * 1) the client calls request_response
 * 2) a new unique msg ID is assigned for that msg
 * 3) if there is space available in the outbox
 *    - the request msg is written to the mbox_out mailbox
 *      and the mailbox info updated.
 *    - allocate a sbbc_msg_waiter struct for this
 *      message, initialise the w_cv condvar.
 *    - get the mailbox mbox_wait_lock mutex for this
 *      message type
 *    - the response msg is put on the mbox_wait_list for
 *      that message type to await the SC's response
 *    - wait on the w_cv condvar protected by the
 *      mbox_wait_lock
 *    - SBBC_MAILBOX_OUT interrupt is sent to the SC
 *
 * 4) if no space in the outbox,
 *    - the request message blocks waiting
 *      for a SBBC_MAILBOX_SPACE_OUT interrupt
 *      It will block on the mailbox mb_full condvar.
 *    - go to (3) above
 * 5) When we get a SBBC_MAILBOX_IN interrupt.
 *    - read the message ID of the next message (FIFO)
 *    - find that ID on the wait list
 *    - no wait list entry => unsolicited message. If theres
 *      a handler, trigger it
 *    - if someone is waiting, read the message in from
 *      SRAM, handling fragmentation, wraparound, etc
 *    - if the whole message has been read, signal
 *      the waiter
 *    - read next message until mailbox empty
 *    - send SBBC_MAILBOX_SPACE_IN interrupt to the SC
 *
 * 6) If a response is required and none is received, the client
 *      will timeout after <wait_time> seconds and the message
 *      status will be set to ETIMEDOUT.
 */
int
sbbc_mbox_request_response(sbbc_msg_t *request,
                sbbc_msg_t *response, time_t wait_time)
{

        struct sbbc_msg_waiter  *waiter;
        uint_t                  msg_id;
        int                     rc = 0;
        int                     flags;
        uint16_t                msg_type;
        clock_t                 stop_time;
        clock_t                 clockleft;
        kmutex_t                *mbox_wait_lock;
        kmutex_t                *mb_lock;
        static fn_t             f = "sbbc_mbox_request_response";

        if ((request == NULL) ||
                (request->msg_type.type >= SBBC_MBOX_MSG_TYPES) ||
                ((response != NULL) &&
                (response->msg_type.type >= SBBC_MBOX_MSG_TYPES)))
                return (EINVAL);

        msg_type = request->msg_type.type;

        /*
         * Verify that we have already set up the master sbbc
         */
        if (master_mbox == NULL)
                return (ENXIO);
        mbox_wait_lock = &master_mbox->mbox_wait_lock[msg_type];

        flags = WAIT_FOR_REPLY|WAIT_FOR_SPACE;

        /*
         * We want to place a lower limit on the shortest amount of time we
         * will wait before timing out while communicating with the SC via
         * the mailbox.
         */
        if (wait_time < sbbc_mbox_min_timeout)
                wait_time = sbbc_mbox_default_timeout;

        stop_time = ddi_get_lbolt() + wait_time * drv_usectohz(MICROSEC);

        /*
         * If there is a message being processed, sleep until it is our turn.
         */
        mutex_enter(&outbox_queue_lock);

        /*
         * allocate an ID for this message, let it wrap
         * around transparently.
         * msg_id == 0 is unsolicited message
         */
        msg_id = ++(master_mbox->mbox_msg_id);
        if (msg_id == 0)
                msg_id = ++(master_mbox->mbox_msg_id);

        SGSBBC_DBG_MBOX("%s: msg_id = 0x%x, msg_len = 0x%x\n",
                f, msg_id, request->msg_len);

        /*
         * A new message can actually grab the lock before the thread
         * that has just been signaled.  Therefore, we need to double
         * check to make sure that outbox_busy is not already set
         * after we wake up.
         *
         * Potentially this could mean starvation for certain unfortunate
         * threads that keep getting woken up and putting back to sleep.
         * But the window of such contention is very small to begin with.
         */
        while (outbox_busy) {

                clockleft = cv_timedwait(&outbox_queue, &outbox_queue_lock,
                        stop_time);

                SGSBBC_DBG_MBOX("%s: msg_id = 0x%x is woken up\n", f, msg_id);

                /*
                 * If we have timed out, set status to ETIMEOUT and return.
                 */
                if (clockleft < 0) {
                        SGSBBC_DBG_MBOX("%s: msg_id = 0x%x has timed out\n",
                                f, msg_id);
                        cmn_err(CE_NOTE,
                                "Timed out obtaining SBBC outbox lock");
                        request->msg_status = ETIMEDOUT;
                        if (response != NULL)
                                response->msg_status = ETIMEDOUT;
                        mutex_exit(&outbox_queue_lock);
                        return (ETIMEDOUT);
                }
        }

        outbox_busy = 1;
        mutex_exit(&outbox_queue_lock);

        /*
         * We are only locking the OutBox from here, not the whole
         * mailbox. This is based on the assumption of
         * complete separation of mailboxes - outbox is
         * read/write, inbox is read-only.
         * We only ever update the producer for the
         * outbox and the consumer for the inbox.
         */
        mb_lock = &master_mbox->mbox_out->mb_lock;
        mutex_enter(mb_lock);

        /*
         * No response expected ? Just send the message and return
         */
        if (response == NULL) {
                rc = sbbc_mbox_send_msg(request, flags, msg_id, wait_time,
                        stop_time);
                SGSBBC_DBG_MBOX("%s: msg_id = 0x%x send rc = %d\n",
                    f, msg_id, rc);

                wakeup_next();

                mutex_exit(mb_lock);
                request->msg_status = rc;
                return (rc);
        }

        /*
         * allocate/initialise a waiter
         */
        waiter = kmem_zalloc(sizeof (struct sbbc_msg_waiter), KM_NOSLEEP);

        if (waiter == (struct sbbc_msg_waiter *)NULL) {
                cmn_err(CE_WARN, "SBBC Mailbox can't allocate waiter\n");

                wakeup_next();

                mutex_exit(mb_lock);
                return (ENOMEM);
        }

        waiter->w_id = 0;       /* Until we get an ID from the send */
        waiter->w_msg = response;
        waiter->w_msg->msg_status = EINPROGRESS;

        cv_init(&waiter->w_cv, NULL, CV_DEFAULT, NULL);

        rc = sbbc_mbox_send_msg(request, flags, msg_id, wait_time, stop_time);

        wakeup_next();

        if (rc != 0) {

                request->msg_status = response->msg_status = rc;
                mutex_exit(mb_lock);

                /* Free the waiter */
                cv_destroy(&waiter->w_cv);
                kmem_free(waiter, sizeof (struct sbbc_msg_waiter));

                SGSBBC_DBG_MBOX("%s: msg_id = 0x%x send rc = %d\n",
                    f, msg_id, rc);

                return (rc);
        }

        waiter->w_id = msg_id;

        /*
         * Lock this waiter list and add the waiter
         */
        mutex_enter(mbox_wait_lock);

        if (master_mbox->mbox_wait_list[msg_type] == NULL) {
                master_mbox->mbox_wait_list[msg_type] = waiter;
                waiter->w_next = NULL;
        } else {
                struct sbbc_msg_waiter  *tmp;
                tmp = master_mbox->mbox_wait_list[msg_type];
                master_mbox->mbox_wait_list[msg_type] = waiter;
                waiter->w_next = tmp;
        }

        mutex_exit(mb_lock);

        /*
         * wait here for a response to our message
         * holding the mbox_wait_lock for the list ensures
         * that the interrupt handler can't get in before
         * we block.
         * NOTE: We use the request msg_type for the
         *       the wait_list. This ensures that  the
         *       msg_type won't change.
         */
        clockleft = cv_timedwait(&waiter->w_cv, mbox_wait_lock, stop_time);

        SGSBBC_DBG_MBOX("%s: msg_id = 0x%x is woken up for response\n",
                f, msg_id);

        /*
         * If we have timed out, set msg_status to ETIMEDOUT,
         * and remove the waiter from the waiter list.
         */
        if (clockleft < 0) {
                /*
                 * Remove the waiter from the waiter list.
                 * If we can't find the waiter in the list,
                 * 1. msg_status == EINPROGRESS
                 *    It is being processed.  We will give it
                 *    a chance to finish.
                 * 2. msg_status != EINPROGRESS
                 *    It is done processing.  We can safely
                 *    remove it.
                 * If we can find the waiter, it has timed out.
                 */
                SGSBBC_DBG_MBOX("%s: msg_id = 0x%x has timed out\n",
                        f, msg_id);
                if (mbox_find_waiter(msg_type, msg_id) == NULL) {
                        if (waiter->w_msg->msg_status == EINPROGRESS) {
                                SGSBBC_DBG_MBOX("%s: Waiting for msg_id = 0x%x "
                                        "complete.\n", f, msg_id);
                                cv_wait(&waiter->w_cv, mbox_wait_lock);
                        }
                } else {
                        SGSBBC_DBG_MBOX("%s: setting msg_id = 0x%x "
                                "to ETIMEDOUT\n", f, msg_id);
                        cmn_err(CE_NOTE, "Timed out waiting for SC response");
                        rc = waiter->w_msg->msg_status = ETIMEDOUT;
                }
        }

        /*
         * lose the waiter
         */
        cv_destroy(&waiter->w_cv);
        kmem_free(waiter, sizeof (struct sbbc_msg_waiter));

        mutex_exit(mbox_wait_lock);

        return (rc);

}

static void
wakeup_next()
{
        /*
         * Done sending the current message or encounter an error.
         * Wake up the one request in the outbox_queue.
         */
        mutex_enter(&outbox_queue_lock);
        outbox_busy = 0;
        cv_signal(&outbox_queue);
        mutex_exit(&outbox_queue_lock);
}


/* ARGSUSED */
int
sbbc_mbox_send_msg(sbbc_msg_t *msg, int flags, uint_t msg_id,
        time_t wait_time, clock_t stop_time)
{
        struct sbbc_mbox_header header;
        struct sbbc_fragment    frag;
        int                     rc = 0;
        int                     bytes_written;
        uint32_t                intr_enabled;
        clock_t                 clockleft;
        static fn_t             f = "sbbc_mbox_send_msg";

        /*
         * First check that the SC has enabled its mailbox
         */
        rc = iosram_read(SBBC_INTR_SC_ENABLED_KEY, 0,
                (caddr_t)&intr_enabled, sizeof (intr_enabled));

        if (rc)
                return (rc);

        if (!(intr_enabled & SBBC_MAILBOX_OUT))
                return (ENOTSUP);

        /*
         * read the mailbox header
         */
        if (rc = mbox_read_header(SBBC_OUTBOX, &header))
                return (rc);

        /*
         * Allocate/initialise a fragment for this message
         */
        frag.f_id = msg_id;
        frag.f_type = msg->msg_type;
        frag.f_status = 0;
        frag.f_total_len = msg->msg_len;
        frag.f_frag_offset = 0;
        /*
         * Throw in the message data
         */
        bcopy(&msg->msg_data, &frag.f_data, sizeof (msg->msg_data));

        /*
         * If not enough space is available
         * write what we can and wait for
         * an interrupt to tell us that more
         * space is available
         */

        bytes_written = 0;
        do {
                rc = mbox_write(&header, &frag, msg);

                if (rc != 0 && rc != ENOSPC) {
                        return (rc);
                }

                if (rc == 0) {
                        /*
                         * Always tell the SC when there is a message.
                         * Ignore returned value as not being able to
                         * signal the SC about space available does
                         * not stop the SC from processing input.
                         */
                        (void) iosram_send_intr(SBBC_MAILBOX_OUT);
                }

                bytes_written += frag.f_frag_len;
                frag.f_frag_offset += frag.f_frag_len;
                if ((bytes_written < msg->msg_len) || (rc == ENOSPC)) {

                        if (mbox_has_free_space(&header) <=
                                sizeof (struct sbbc_fragment)) {

                                int tmprc;

                                clockleft = cv_timedwait(
                                        &master_mbox->mbox_out->mb_full,
                                        &master_mbox->mbox_out->mb_lock,
                                        stop_time);

                                /* Return ETIMEDOUT if we timed out */
                                if (clockleft < 0) {
                                        SGSBBC_DBG_MBOX("%s: msg_id = 0x%x "
                                                "has timed out\n", f, msg_id);
                                        cmn_err(CE_NOTE,
                                                "Timed out sending message "
                                                "to SC");
                                        return (ETIMEDOUT);
                                }

                                /* Read updated header from IOSRAM */
                                if (tmprc = mbox_read_header(SBBC_OUTBOX,
                                    &header)) {

                                        return (tmprc);
                                }
                        }
                }

                SGSBBC_DBG_MBOX("%s: msg_id = 0x%x, bytes_written = 0x%x, "
                        "msg_len = 0x%x\n", f,
                                msg_id, bytes_written, msg->msg_len);
        } while ((bytes_written < msg->msg_len) || (rc == ENOSPC));

        /*
         * this could be a spurious interrupt
         * as the SC may be merrily readings its
         * mail even as send, but what can you do ? No
         * synchronization method between SC <-> OS
         * SRAM data eaters means that this is inevitable.
         * It would take a bigger brain to fix this.
         *
         */
        (void) iosram_send_intr(SBBC_MAILBOX_OUT);

        return (rc);
}


/*
 * get next message
 * Read the next message from SRAM
 * Check if theres an entry on the wait queue
 * for this message
 * If yes, read the message in and signal
 * the waiter (if all the message has been received)
 * No, its unsolicited, if theres a handler installed for
 * this message type trigger it, otherwise toss
 * the message
 */
int
sbbc_mbox_recv_msg()
{
        struct sbbc_mbox_header header;
        struct sbbc_fragment    frag;
        sbbc_msg_t              tmpmsg; /* Temporary msg storage */
        int                     rc = 0, i, first_hdlr, last_hdlr;
        uint32_t                intr_enabled;
        sbbc_intrs_t            *intr;
        struct sbbc_msg_waiter  *waiter;
        uint16_t                type;   /* frag.f_type.type */
        uint32_t                f_id;   /* frag.f_id */
        uint32_t                f_frag_offset, f_frag_len;
        kmutex_t                *mbox_wait_lock;
        static fn_t             f = "sbbc_mbox_recv_msg";

        /*
         * First check that the OS has enabled its mailbox
         */
        rc = iosram_read(SBBC_SC_INTR_ENABLED_KEY, 0,
                (caddr_t)&intr_enabled, sizeof (intr_enabled));

        if (rc) {
                return (rc);
        }

        if (!(intr_enabled & SBBC_MAILBOX_IN))
                return (ENOTSUP);

        /*
         * read the mailbox header
         */
        if (rc = mbox_read_header(SBBC_INBOX, &header))
                return (rc);

        /*
         * check if any messages available. If
         * consumer == producer then no more
         * messages
         */
        if ((header.mailboxes[SBBC_INBOX].mbox_consumer ==
                header.mailboxes[SBBC_INBOX].mbox_producer)) {

                return (-1);
        }

        /*
         * read the fragment header for this message
         */
        if (rc = mbox_read_frag(&header, &frag)) {

                return (rc);
        }

        /* Save to local variable for easy reading */
        type = frag.f_type.type;
        f_id = frag.f_id;

        SGSBBC_DBG_MBOX("%s: f_id = 0x%x\n", f, f_id);

        /*
         * check the message type. If its invalid, we will
         * just toss the message
         */
        if (type >= SBBC_MBOX_MSG_TYPES) {
                goto done;
        }

        /*
         * if theres no waiters for this message type, and theres
         * no message handler installed, toss it.
         *
         * Unsolicited messages (f_id == 0) are tricky because we won't know
         * when the handler has finished so that we can
         * remove the message, so, given the small brains in operation
         * here, what we do is restrict junk mail to zero-length
         * messages, then we allocate a fragment using kmem,
         * make a copy of the fragment in this memory,
         * pass this pointer to the fragment, then skip the message.
         * So even if there is data associated with the junkmail,
         * the message handler doesn't get to see it
         * We expect the mesaage handler to free the memory.
         */
        if (type == SBBC_BROADCAST_MSG) {
                /*
                 * Broadcast message, trigger all handlers
                 */
                first_hdlr = 0;
                last_hdlr = SBBC_MBOX_MSG_TYPES - 1;
        } else if ((master_mbox->mbox_wait_list[type] == NULL) || (f_id == 0)) {
                /*
                 * Theres no waiters, or its unsolicited anyway
                 */
                first_hdlr = last_hdlr = type;
        } else {
                /*
                 * check the fragment message type, look at the wait list for
                 * that type to find its associated message
                 *
                 * First find the message. If we get it, take it off
                 * the waiter list and read the data. We will
                 * put it back on the list if necessary.
                 * This avoids the problem of a second message-in
                 * interrupt playing with this waiter.
                 * This will cut down on mutex spinning on the wait
                 * list locks, also, expect the next fragment to be
                 * for this messageso we might as well have it at the
                 * start of the list.
                 *
                 * its possible that a return message has a different type,
                 * (possible but not recommended!). So, if we don't find
                 * it on the list pointed to by the request type,
                 * go look at all the other lists
                 */

                mbox_wait_lock = &master_mbox->mbox_wait_lock[type];

                mutex_enter(mbox_wait_lock);
                if ((waiter = mbox_find_waiter(type, f_id)) == NULL) {
                        for (i = 0; i < SBBC_MBOX_MSG_TYPES; i++) {
                                if (i == type)
                                        continue;
                                if ((waiter = mbox_find_waiter(i, f_id))
                                        != NULL)
                                        break;
                        }
                }
                mutex_exit(mbox_wait_lock);

                if (waiter == NULL) {
                        rc = -1;
                        /*
                         * there's no waiter for this message, but that
                         * could mean that this message is the start of
                         * a send/receive to us, and every 'first' request
                         * must by definition be unsolicited,
                         * so trigger the handler
                         */
                        first_hdlr = last_hdlr = type;
                } else {
                        SGSBBC_DBG_MBOX("%s: f_id = 0x%x, msg_id = 0x%x, "
                                "msg_len = 0x%x\n",
                                        f, f_id, waiter->w_id,
                                        waiter->w_msg->msg_len);

                        rc = mbox_read(&header, &frag, waiter->w_msg);

                        SGSBBC_DBG_MBOX("%s: f_id = 0x%x, offset = 0x%x, "
                                "len = 0x%x, total_len = 0x%x\n",
                                        f, frag.f_id, frag.f_frag_offset,
                                        frag.f_frag_len, frag.f_total_len);

                        if (rc || ((frag.f_frag_offset + frag.f_frag_len) ==
                                frag.f_total_len)) {
                                /*
                                 * failed or all the message has been read in
                                 */
                                mutex_enter(mbox_wait_lock);
                                waiter->w_msg->msg_status = (rc == ENOMEM)?
                                        rc : frag.f_status;
                                SGSBBC_DBG_MBOX("%s: msg_status = %d\n",
                                        f, waiter->w_msg->msg_status);
                                cv_signal(&waiter->w_cv);
                                mutex_exit(mbox_wait_lock);

                        } else {
                                /*
                                 * back on the wait list
                                 */
                                mutex_enter(mbox_wait_lock);
                                if (waiter->w_msg->msg_status == ETIMEDOUT) {
                                        cv_signal(&waiter->w_cv);
                                        mutex_exit(mbox_wait_lock);
                                        goto done;
                                }

                                if (master_mbox->mbox_wait_list[type] == NULL) {
                                        master_mbox->mbox_wait_list[type] =
                                                waiter;
                                        waiter->w_next = NULL;
                                } else {
                                        struct sbbc_msg_waiter  *tmp;
                                        tmp = master_mbox->mbox_wait_list[type];
                                        master_mbox->mbox_wait_list[type] =
                                                waiter;
                                        waiter->w_next = tmp;
                                }
                                mutex_exit(mbox_wait_lock);
                        }
                        goto done;
                }
        }

        /*
         * Set msg_len to f_frag_len so msg_buf will be large enough
         * to contain what is in the fragment.
         */
        f_frag_len = tmpmsg.msg_len = frag.f_frag_len;
        /*
         * Save the f_frag_offset for copying into client's space.
         * Set frag.f_frag_offset to 0 so we don't have to allocate
         * too much space for reading in the message.
         */
        f_frag_offset = frag.f_frag_offset;
        frag.f_frag_offset = 0;

        /* Allocate space for msg_buf */
        if (f_frag_len != 0 && (tmpmsg.msg_buf =
                kmem_alloc(f_frag_len, KM_NOSLEEP)) == NULL) {

                rc = ENOMEM;
                cmn_err(CE_WARN, "Can't allocate memory"
                        " for unsolicited messages\n");
        } else {
                /* Save the incoming message in tmpmsg */
                rc = mbox_read(&header, &frag, &tmpmsg);

                for (i = first_hdlr; rc == 0 && i <= last_hdlr; i++) {

                        intr = master_mbox->intrs[i];
                        if ((intr == NULL) || (intr->sbbc_intr_id == 0)) {
                                continue;
                        }

                        while (intr != NULL) {
                                /*
                                 * If the client has allocated enough space
                                 * for incoming message, copy into the
                                 * client buffer.
                                 */
                                sbbc_msg_t *arg = (sbbc_msg_t *)intr->sbbc_arg;
                                if (arg != (void *)NULL) {
                                        if (arg->msg_len >= frag.f_total_len) {
                                                if (f_frag_len > 0)
                                                        bcopy(tmpmsg.msg_buf,
                                                                arg->msg_buf +
                                                                f_frag_offset,
                                                                f_frag_len);
                                        } else {
                                                arg->msg_status = ENOMEM;
                                        }
                                }

                                /*
                                 * Only trigger the interrupt when we
                                 * have received the whole message.
                                 */
                                if (f_frag_offset + f_frag_len ==
                                        frag.f_total_len) {

                                        ddi_trigger_softintr(
                                                intr->sbbc_intr_id);
                                }
                                intr = intr->sbbc_intr_next;
                        }
                }

                if (f_frag_len != 0) {
                        /* Don't forget to free the buffer */
                        kmem_free(tmpmsg.msg_buf, f_frag_len);
                }
        }
done:
        mbox_skip_next_msg(&header);
        return (rc);
}

/*
 * available free space in the outbox
 */
static int
mbox_has_free_space(struct sbbc_mbox_header *header)
{
        uint32_t        space = 0;

        ASSERT(MUTEX_HELD(&master_mbox->mbox_out->mb_lock));

        if (header->mailboxes[SBBC_OUTBOX].mbox_producer ==
                header->mailboxes[SBBC_OUTBOX].mbox_consumer) {
                /*
                 * mailbox is empty
                 */
                space += header->mailboxes[SBBC_OUTBOX].mbox_len -
                        header->mailboxes[SBBC_OUTBOX].mbox_producer;
                space +=
                        header->mailboxes[SBBC_OUTBOX].mbox_producer;
        } else if (header->mailboxes[SBBC_OUTBOX].mbox_producer >
                header->mailboxes[SBBC_OUTBOX].mbox_consumer) {
                space += header->mailboxes[SBBC_OUTBOX].mbox_len -
                        header->mailboxes[SBBC_OUTBOX].mbox_producer;
                space += header->mailboxes[SBBC_OUTBOX].mbox_consumer;
        } else {
                /*
                 * mailbox wrapped around
                 */
                space += header->mailboxes[SBBC_OUTBOX].mbox_consumer -
                        header->mailboxes[SBBC_OUTBOX].mbox_producer;
        }

        /*
         * Need to make sure that the mailbox never
         * gets completely full, as consumer == producer is
         * our test for empty, so we drop MBOX_ALIGN_BYTES.
         */

        if (space >= MBOX_ALIGN_BYTES)
                space -= MBOX_ALIGN_BYTES;
        else
                space = 0;

        return (space);

}
/*
 * Write the data to IOSRAM
 * Update the SRAM mailbox header
 * Update the local mailbox pointers
 * Only write a single fragment. If possible,
 * put the whole message into a fragment.
 *
 * Note: We assume that there is no 'max' message
 *       size. We will just keep fragmenting.
 * Note: We always write to SBBC_OUTBOX and
 *       read from SBBC_INBOX
 *
 * If we get an error at any time, return immediately
 * without updating the mailbox header in SRAM
 */
static int
mbox_write(struct sbbc_mbox_header *header,
        struct sbbc_fragment *frag, sbbc_msg_t *msg)
{
        int             bytes_written, bytes_remaining, free_space;
        int             rc = 0;
        caddr_t         src;
        uint32_t        sram_dst;
        int             space_at_end, space_at_start;
        uint32_t        mbox_offset, mbox_len;
        uint32_t        mbox_producer, mbox_consumer;
        uint32_t        f_total_len, f_frag_offset;
        uint32_t        frag_header_size;
        static fn_t     f = "mbox_write";

        ASSERT(MUTEX_HELD(&master_mbox->mbox_out->mb_lock));

        /*
         * Save to local variables to make code more readable
         */
        mbox_offset = header->mailboxes[SBBC_OUTBOX].mbox_offset;
        mbox_len = header->mailboxes[SBBC_OUTBOX].mbox_len;
        mbox_producer = header->mailboxes[SBBC_OUTBOX].mbox_producer;
        mbox_consumer = header->mailboxes[SBBC_OUTBOX].mbox_consumer;
        f_total_len = frag->f_total_len;
        f_frag_offset = frag->f_frag_offset;
        frag_header_size = sizeof (struct sbbc_fragment);

        SGSBBC_DBG_MBOX("%s: mbox_consumer = 0x%x, "
                "mbox_producer = 0x%x\n", f, mbox_consumer, mbox_producer);

        /*
         * Write pointer in SRAM
         */
        sram_dst = mbox_offset + mbox_producer;

        /*
         * NB We assume that the consumer stays constant
         *    during the write. It may not necessarily
         *    be the case but it won't cause us any problems, just means
         *    we fragment more than is absolutely necessary
         *
         * possible cases
         * 1) consumer == producer, mailbox empty
         *      space_at_end == mailbox end - producer
         *      space_at_start == producer - MBOX_ALIGN_BYTES
         * 2) producer < consumer
         *      space_at_end = (consumer - producer - MBOX_ALIGN_BYTES)
         *      space_at_start == 0
         * 3) producer > consumer
         *      space_at_end = mailbox end - producer
         *      space_at_start = consumer - MBOX_ALIGN_BYTES
         *
         * (space - MBOX_ALIGN_BYTES) because we need to avoid the
         * scenario where the producer wraps around completely and
         * producer == consumer, as this is our test for 'empty'.
         * Also we want it to be 8-byte aligned.
         * Note: start is assumed = 0
         */
        if (mbox_producer < mbox_consumer) {
                space_at_end = mbox_consumer - mbox_producer - MBOX_ALIGN_BYTES;
                if (space_at_end < 0)
                        space_at_end = 0;
                space_at_start = 0;
        } else {
                space_at_end = mbox_len - mbox_producer;
                if (mbox_consumer == 0)
                        space_at_end -= MBOX_ALIGN_BYTES;
                space_at_start = mbox_consumer - MBOX_ALIGN_BYTES;
                if (space_at_start < 0)
                        space_at_start = 0;
        }

        SGSBBC_DBG_MBOX("%s: space_at_end = 0x%x, space_at_start = 0x%x\n",
                f, space_at_end, space_at_start);

        free_space = space_at_end + space_at_start;

        if (free_space < frag_header_size) {
                /*
                 * can't even write a fragment header, so just return
                 * the caller will block waiting for space
                 */
                frag->f_frag_len = 0;
                return (ENOSPC);
        }

        /*
         * How many bytes will be in the fragment ?
         */
        bytes_remaining = f_total_len - f_frag_offset;
        frag->f_frag_len = min(bytes_remaining, free_space - frag_header_size);

        SGSBBC_DBG_MBOX("%s: writing header:sram_dst = 0x%x\n",
                f, sram_dst);

        /*
         * we can write the fragment header and some data
         * First, the fragment header
         */
        if (space_at_end >=  frag_header_size) {
                rc = iosram_write(SBBC_MAILBOX_KEY, sram_dst, (caddr_t)frag,
                        frag_header_size);
                if (rc)
                        return (rc);

                sram_dst = (uint32_t)(sram_dst + frag_header_size);
                /*
                 * Wrap around if we reach the end
                 */
                if (sram_dst >= (mbox_len + mbox_offset)) {
                        sram_dst = mbox_offset;
                }
                space_at_end -= frag_header_size;
        } else {
                /* wraparound */
                if (space_at_end) {
                        rc = iosram_write(SBBC_MAILBOX_KEY, sram_dst,
                                (caddr_t)frag, space_at_end);
                        if (rc)
                                return (rc);
                        sram_dst = (uint32_t)mbox_offset;
                }
                rc = iosram_write(SBBC_MAILBOX_KEY, sram_dst,
                        (caddr_t)((caddr_t)frag + space_at_end),
                        (frag_header_size - space_at_end));
                if (rc)
                        return (rc);
                sram_dst += frag_header_size - space_at_end;
                space_at_start -= (frag_header_size - space_at_end);
                space_at_end = 0;
        }

        SGSBBC_DBG_MBOX("%s: space_at_end = 0x%x, space_at_start = 0x%x\n",
                f, space_at_end, space_at_start);

        /*
         * Now the fragment data
         */
        free_space -= frag_header_size;
        src = (caddr_t)(msg->msg_buf + f_frag_offset);
        bytes_written = 0;
        if (space_at_end) {
                SGSBBC_DBG_MBOX("%s: writing data:sram_dst = 0x%x, "
                        "bytes_remaining = 0x%x\n",
                                f, sram_dst, bytes_remaining);

                if (space_at_end < bytes_remaining)
                        bytes_written = space_at_end;
                else
                        bytes_written = bytes_remaining;
                rc = iosram_write(SBBC_MAILBOX_KEY, sram_dst, src,
                        bytes_written);
                if (rc)
                        return (rc);

                sram_dst = (uint32_t)(sram_dst + bytes_written);
                /*
                 * Wrap around if we reach the end
                 */
                if (sram_dst >= (mbox_len + mbox_offset)) {
                        sram_dst = mbox_offset;
                }
                src = (caddr_t)(src + bytes_written);
                bytes_remaining -= bytes_written;
        }

        if ((bytes_remaining > 0) && space_at_start) {
                SGSBBC_DBG_MBOX("%s: writing the rest:sram_dst = 0x%x, "
                        "bytes_remaining = 0x%x\n",
                                f, sram_dst, bytes_remaining);
                if (space_at_start < bytes_remaining) {
                        rc = iosram_write(SBBC_MAILBOX_KEY, sram_dst, src,
                                space_at_start);
                        bytes_written += space_at_start;
                } else {
                        rc = iosram_write(SBBC_MAILBOX_KEY, sram_dst, src,
                                bytes_remaining);
                        bytes_written += bytes_remaining;
                }
                if (rc)
                        return (rc);
        }

        frag->f_frag_len = bytes_written;

        /*
         * update header->mbox_producer (bytes_written + frag_size)
         */
        sram_dst = mbox_producer + bytes_written + frag_header_size;
        if (sram_dst >= mbox_len) {
                sram_dst = sram_dst % mbox_len;
        }

        SGSBBC_DBG_MBOX("%s: after writing data:sram_dst = 0x%x, "
                "bytes_written = 0x%x\n", f, sram_dst, bytes_written);

        header->mailboxes[SBBC_OUTBOX].mbox_producer = sram_dst;

        mbox_update_header(SBBC_OUTBOX, header);


        return (rc);
}


/*
 * Get the next frag from IOSRAM.
 * Write it to the corresponding msg buf.
 * The caller must update the SRAM pointers etc.
 */
static int
mbox_read(struct sbbc_mbox_header *header,
        struct sbbc_fragment *frag, sbbc_msg_t *msg)
{
        int                     rc = 0;
        uint32_t                sram_src, sram_end;
        caddr_t                 msg_buf;
        int                     bytes_at_start, bytes_at_end;
        int                     bytes_to_read;
        uint32_t                frag_header_size, frag_total_size;
        uint32_t                f_frag_offset, f_frag_len;
        uint32_t                mbox_producer, mbox_consumer;
        uint32_t                mbox_len, mbox_offset;
        static fn_t             f = "mbox_read";

        ASSERT(MUTEX_HELD(&master_mbox->mbox_in->mb_lock));

        /*
         * Save to local variables to make code more readable
         */
        mbox_producer = header->mailboxes[SBBC_INBOX].mbox_producer;
        mbox_consumer = header->mailboxes[SBBC_INBOX].mbox_consumer;
        mbox_len = header->mailboxes[SBBC_INBOX].mbox_len;
        mbox_offset = header->mailboxes[SBBC_INBOX].mbox_offset;
        frag_header_size = sizeof (struct sbbc_fragment);
        f_frag_offset = frag->f_frag_offset;
        f_frag_len = frag->f_frag_len;
        frag_total_size = frag_header_size + f_frag_len;

        /*
         * If the message buffer size is smaller than the fragment
         * size, return an error.
         */
        if (msg->msg_len < f_frag_len)  {
                rc = ENOMEM;
                goto done;
        }

        msg_buf = (caddr_t)(msg->msg_buf + f_frag_offset);

        /*
         * Throw in the message data
         */
        bcopy(&frag->f_data, &msg->msg_data, sizeof (msg->msg_data));

        /*
         * We have it all, waiter, message, so lets
         * go get that puppy!
         * Message could be in one or two chunks -
         * consumer < producer: 1 chunk, (producer - consumer)
         * consumer > producer: 2 chunks, (end - consumer)
         *                               (producer - start)
         */
        sram_end =  (uint32_t)(mbox_offset + mbox_len);
        sram_src = (uint32_t)(mbox_offset + mbox_consumer + frag_header_size);

        /*
         * wraparound
         */
        if (sram_src >= sram_end)
                sram_src -= mbox_len;

        /*
         * find where the data is
         * possible cases
         * 1) consumer == producer, mailbox empty
         *      error
         * 2) producer < consumer
         *      bytes_at_end =  mailbox end - consumer
         *      bytes_at_start = producer
         * 3) producer > consumer
         *      bytes_at_end =  producer - consumer
         *      bytes_at_start = 0
         */

        SGSBBC_DBG_MBOX("%s: mbox_consumer = 0x%x, mbox_producer = 0x%x, "
                "frag_len = 0x%x\n",
                        f, mbox_consumer, mbox_producer, f_frag_len);

        if (mbox_producer == mbox_consumer) {
                bytes_at_end = bytes_at_start = 0;
        } else if (mbox_producer < mbox_consumer) {
                bytes_at_end = mbox_len - mbox_consumer;
                bytes_at_start = mbox_producer;
        } else {
                bytes_at_end = mbox_producer - mbox_consumer;
                bytes_at_start = 0;
        }

        SGSBBC_DBG_MBOX("%s: bytes_at_end = 0x%x, "
                "bytes_at_start = 0x%x\n", f, bytes_at_end, bytes_at_start);

        if ((bytes_at_end + bytes_at_start) < frag_total_size) {

                /*
                 * mailbox is corrupt
                 * but what to do ?
                 */
                cmn_err(CE_PANIC, "Corrupt INBOX!\n"
                    "producer = %x, consumer = %x, bytes_at_start = %x, "
                    "bytes_at_end = %x\n", mbox_producer, mbox_consumer,
                    bytes_at_start, bytes_at_end);
        }

        /*
         * If bytes_at_end is greater than header size, read the
         * part at the end of the mailbox, and then update the
         * pointers and bytes_to_read.
         */
        if (bytes_at_end > frag_header_size) {
                /*
                 * We are only interested in the data segment.
                 */
                bytes_at_end -= frag_header_size;
                bytes_to_read = (bytes_at_end >= f_frag_len)?
                        f_frag_len : bytes_at_end;
                SGSBBC_DBG_MBOX("%s: reading data: sram_src = 0x%x, "
                        "bytes_to_read = 0x%x\n", f, sram_src, bytes_to_read);
                rc = iosram_read(SBBC_MAILBOX_KEY, sram_src, msg_buf,
                        bytes_to_read);
                if (rc) {
                        goto done;
                }

                /*
                 * Update pointers in SRAM and message buffer.
                 */
                sram_src = (uint32_t)mbox_offset;
                msg_buf = (caddr_t)(msg_buf + bytes_to_read);
                bytes_to_read = f_frag_len - bytes_to_read;
        } else {
                bytes_to_read = f_frag_len;
        }

        /*
         * wraparound to start of mailbox
         */
        if (bytes_to_read > 0) {
                SGSBBC_DBG_MBOX("%s: reading the rest: sram_src = 0x%x, "
                        "bytes_to_read = 0x%x\n", f, sram_src, bytes_to_read);
                rc = iosram_read(SBBC_MAILBOX_KEY, sram_src, msg_buf,
                        bytes_to_read);
        }

done:
        msg->msg_bytes += f_frag_len;

        return (rc);
}

/*
 * move past the next message in the inbox
 */
static void
mbox_skip_next_msg(struct sbbc_mbox_header *header)
{
        struct sbbc_fragment    frag;
        uint32_t                next_msg;

        ASSERT(MUTEX_HELD(&master_mbox->mbox_in->mb_lock));

        if (mbox_read_frag(header, &frag)) {
                cmn_err(CE_PANIC, "INBOX is Corrupt !\n");
        }

        /*
         * Move on to the next message
         */
        next_msg = header->mailboxes[SBBC_INBOX].mbox_consumer;
        next_msg += sizeof (struct sbbc_fragment);
        next_msg += frag.f_frag_len;
        if (next_msg >= header->mailboxes[SBBC_INBOX].mbox_len) {
                next_msg = (next_msg +
                        header->mailboxes[SBBC_INBOX].mbox_len) %
                        header->mailboxes[SBBC_INBOX].mbox_len;
        }
        header->mailboxes[SBBC_INBOX].mbox_consumer =
                next_msg;

        mbox_update_header(SBBC_INBOX, header);

        return;

}

static struct sbbc_msg_waiter *
mbox_find_waiter(uint16_t msg_type, uint32_t msg_id)
{
        struct  sbbc_msg_waiter *waiter, *prev;

        prev = NULL;
        for (waiter = master_mbox->mbox_wait_list[msg_type];
                waiter != NULL; waiter = waiter->w_next) {

                if (waiter->w_id == msg_id) {
                        if (prev != NULL) {
                                prev->w_next = waiter->w_next;
                        } else {
                                master_mbox->mbox_wait_list[msg_type] =
                                        waiter->w_next;
                        }
                        break;
                }
                prev = waiter;
        }

        return (waiter);
}

static int
mbox_read_header(uint32_t mailbox, struct sbbc_mbox_header *header)
{
        struct sbbc_mbox_header *hd;
        uint32_t        offset;
        int             rc;

        /*
         * Initialize a sbbc_mbox_header pointer to 0 so that we
         * can use it to calculate the offsets of fields inside
         * the structure.
         */
        hd = (struct sbbc_mbox_header *)0;

        if (rc = iosram_read(SBBC_MAILBOX_KEY, 0, (caddr_t)header,
            sizeof (struct sbbc_mbox_header)))
                return (rc);

        /*
         * Since the header is read in a byte-by-byte fashion
         * using ddi_rep_get8, we need to re-read the producer
         * or consumer pointer as integer in case it has changed
         * after part of the previous value has been read.
         */
        switch (mailbox) {

        case SBBC_INBOX:
                offset = (uint32_t)(uintptr_t)
                    (&hd->mailboxes[SBBC_INBOX].mbox_producer);
                rc = iosram_read(SBBC_MAILBOX_KEY, offset,
                    (caddr_t)&header->mailboxes[SBBC_INBOX].mbox_producer,
                    sizeof (uint32_t));
                break;
        case SBBC_OUTBOX:
                offset = (uint32_t)(uintptr_t)
                    (&hd->mailboxes[SBBC_OUTBOX].mbox_consumer);
                rc = iosram_read(SBBC_MAILBOX_KEY, offset,
                    (caddr_t)&header->mailboxes[SBBC_OUTBOX].mbox_consumer,
                    sizeof (uint32_t));
                break;
        default:
                cmn_err(CE_PANIC, "Invalid Mbox header type\n");
                break;

        }

        return (rc);
}

/*
 * There are only two fields updated by the  domain,
 * the inbox consumer field and the outbox producer
 * field. These fields are protected by the respective
 * mbox_{in|out}->mb_lock so that accesses will
 * be serialised. The only coherency issue is writing
 * back the header, so we do it here after grabbing
 * the global mailbox lock.
 */
static void
mbox_update_header(uint32_t mailbox, struct sbbc_mbox_header *header)
{
        struct sbbc_mbox_header *hd;
        uint32_t                value, offset, mbox_len;

        /*
         * Initialize a sbbc_mbox_header pointer to 0 so that we
         * can use it to calculate the offsets of fields inside
         * the structure.
         */
        hd = (struct sbbc_mbox_header *)0;

        switch (mailbox) {

        case SBBC_INBOX:
                value = header->mailboxes[SBBC_INBOX].mbox_consumer;
                offset = (uint32_t)(uintptr_t)
                        (&hd->mailboxes[SBBC_INBOX].mbox_consumer);

                mbox_len = header->mailboxes[SBBC_INBOX].mbox_len;
                break;
        case SBBC_OUTBOX:
                value = header->mailboxes[SBBC_OUTBOX].mbox_producer;
                offset = (uint32_t)(uintptr_t)
                        (&hd->mailboxes[SBBC_OUTBOX].mbox_producer);
                mbox_len = header->mailboxes[SBBC_OUTBOX].mbox_len;
                break;
        default:
                cmn_err(CE_PANIC, "Invalid Mbox header type\n");
                break;

        }

        /*
         * If the last read/write would cause the next read/write
         * to be unaligned, we skip on modulo MBOX_ALIGN_BYTES.
         * This is OK because all the mailbox handlers will
         * conform to this.
         */
        if (value % MBOX_ALIGN_BYTES) {
                value += (MBOX_ALIGN_BYTES - (value % MBOX_ALIGN_BYTES));
                value %= mbox_len;
        }

        if (iosram_write(SBBC_MAILBOX_KEY, offset, (caddr_t)&value,
                sizeof (uint32_t))) {
                cmn_err(CE_PANIC, "Mailbox Corrupt ! \n");
        }

        /*
         * Update internal pointers so they won't be out of sync with
         * the values in IOSRAM.
         */
        switch (mailbox) {

        case SBBC_INBOX:
                header->mailboxes[SBBC_INBOX].mbox_consumer = value;
                break;
        case SBBC_OUTBOX:
                header->mailboxes[SBBC_OUTBOX].mbox_producer = value;
                break;
        }
}

static int
mbox_read_frag(struct sbbc_mbox_header *header,
        struct sbbc_fragment *frag)
{
        int                     rc = 0;
        uint32_t                sram_src, bytes;
        caddr_t                 dst;

        ASSERT(MUTEX_HELD(&master_mbox->mbox_in->mb_lock));
        /*
         * read the fragment header for this message
         */
        sram_src = (uint32_t)(header->mailboxes[SBBC_INBOX].mbox_offset +
                header->mailboxes[SBBC_INBOX].mbox_consumer);

        /*
         * wraparound ?
         */
        if ((header->mailboxes[SBBC_INBOX].mbox_consumer +
                sizeof (struct sbbc_fragment)) >=
                header->mailboxes[SBBC_INBOX].mbox_len) {

                dst = (caddr_t)frag;
                bytes = header->mailboxes[SBBC_INBOX].mbox_len -
                        header->mailboxes[SBBC_INBOX].mbox_consumer;

                if (rc = iosram_read(SBBC_MAILBOX_KEY, sram_src, dst, bytes)) {
                        return (rc);
                }

                dst += bytes;
                sram_src = header->mailboxes[SBBC_INBOX].mbox_offset;
                bytes = (header->mailboxes[SBBC_INBOX].mbox_consumer +
                        sizeof (struct sbbc_fragment)) %
                        header->mailboxes[SBBC_INBOX].mbox_len;

                if (rc = iosram_read(SBBC_MAILBOX_KEY, sram_src,
                        dst, bytes)) {
                        return (rc);
                }
        } else {
                if (rc = iosram_read(SBBC_MAILBOX_KEY, sram_src, (caddr_t)frag,
                        sizeof (struct sbbc_fragment))) {
                        return (rc);
                }
        }

        return (0);
}


/*
 * This function is triggered by a soft interrupt and it's purpose is to call
 * to kadmin() to shutdown the Domain.
 */
/*ARGSUSED0*/
static uint_t
sbbc_do_fast_shutdown(char *arg)
{
        (void) kadmin(A_SHUTDOWN, AD_POWEROFF, NULL, kcred);

        /*
         * If kadmin fails for some reason then we bring the system down
         * via power_down(), or failing that using halt().
         */
        power_down("kadmin() failed, trying power_down()");

        halt("power_down() failed, trying halt()");

        /*
         * We should never make it this far, so something must have gone
         * horribly, horribly wrong.
         */
        /*NOTREACHED*/
        return (DDI_INTR_UNCLAIMED);
}


/*
 * This function handles unsolicited PANIC_SHUTDOWN events
 */
static uint_t
sbbc_panic_shutdown_handler(char *arg)
{
        static fn_t     f = "sbbc_panic_shutdown_handler()";

        sg_panic_shutdown_t     *payload = NULL;
        sbbc_msg_t              *msg = NULL;

        if (arg == NULL) {
                SGSBBC_DBG_EVENT(CE_NOTE, "%s: arg == NULL", f);
                return (DDI_INTR_UNCLAIMED);
        }

        msg = (sbbc_msg_t *)arg;

        if (msg->msg_buf == NULL) {
                SGSBBC_DBG_EVENT(CE_NOTE, "%s: msg_buf == NULL", f);
                return (DDI_INTR_UNCLAIMED);
        }

        payload = (sg_panic_shutdown_t *)msg->msg_buf;

        switch (*payload) {
        case SC_EVENT_PANIC_ENV:

                /*
                 * Let the user know why the domain is going down.
                 */
                cmn_err(CE_WARN, "%s", PANIC_ENV_EVENT_MSG);

                /*
                 * trigger sbbc_do_fast_shutdown().
                 */
                ddi_trigger_softintr(panic_softintr_id);

                /*NOTREACHED*/
                break;

        case SC_EVENT_PANIC_KEYSWITCH:
                /*
                 * The SC warns a user if they try a destructive keyswitch
                 * command on a Domain which is currently running Solaris.
                 * If the user chooses to continue despite our best advise
                 * then we bring down the Domain immediately without trying
                 * to shut the system down gracefully.
                 */
                break;

        default:
                SGSBBC_DBG_EVENT(CE_NOTE, "%s: Unknown payload:%d", f,
                        *payload);
                return (DDI_INTR_UNCLAIMED);
        }

        return (DDI_INTR_CLAIMED);
}

/*
 * dp_get_cores()
 *
 * Checks cpu implementation for the input cpuid and returns
 * the number of cores.
 * If implementation cannot be determined, returns 1
 */
static int
dp_get_cores(uint16_t cpuid)
{
        int     bd, ii, impl, nc;

        bd = cpuid / 4;
        nc = SG_MAX_CPUS_PER_BD;

        /* find first with valid implementation */
        for (ii = 0; ii < nc; ii++)
                if (cpu[MAKE_CPUID(bd, ii)]) {
                        impl = cpunodes[MAKE_CPUID(bd, ii)].implementation;
                        break;
                }

        if (IS_JAGUAR(impl) || IS_PANTHER(impl))
                return (2);
        else
                return (1);
}

/*
 * dp_payload_add_cpus()
 *
 * From datapath mailbox message, determines the number of and safari IDs
 * for affected cpus, then adds this info to the datapath ereport.
 *
 */
static int
dp_payload_add_cpus(plat_datapath_info_t *dpmsg, nvlist_t *erp)
{
        int             jj = 0, numcpus = 0;
        int             bd, procpos, ii, num, ncores, ret;
        uint16_t        *dparray, cpuid;
        uint64_t        *snarray;

        /* check for multiple core architectures */
        ncores = dp_get_cores(dpmsg->cpuid);

        switch (dpmsg->type) {
                case DP_CDS_TYPE:
                        numcpus = ncores;
                        break;

                case DP_DX_TYPE:
                        numcpus = 2 * ncores;
                        break;

                case DP_RP_TYPE:
                        numcpus = SG_MAX_CPUS_PER_BD;
                        break;

                default:
                        ASSERT(0);
                        return (-1);
        }

        num = numcpus;

        /*
         * populate dparray with impacted cores (only those present)
         */
        dparray = kmem_zalloc(num * sizeof (uint16_t *), KM_SLEEP);
        bd = SG_PORTID_TO_BOARD_NUM(SG_CPUID_TO_PORTID(dpmsg->cpuid));
        procpos = SG_CPUID_TO_PORTID(dpmsg->cpuid) & 0x3;

        mutex_enter(&cpu_lock);

        switch (dpmsg->type) {

                case DP_CDS_TYPE:
                        /*
                         * For a CDS error, it's the reporting cpuid
                         * and it's other core (if present)
                         */
                        cpuid = dpmsg->cpuid & 0x1FF;   /* core 0 */
                        if (cpu[cpuid])
                                dparray[jj++] = cpuid;

                        cpuid = dpmsg->cpuid | SG_CORE_ID_MASK; /* core 1 */
                        if (cpu[cpuid])
                                dparray[jj++] = cpuid;
                        break;

                case DP_DX_TYPE:
                        /*
                         * For a DX error, it's the reporting cpuid (all
                         * cores) and the other CPU sharing the same
                         * DX<-->DCDS interface (all cores)
                         */

                        /* reporting cpuid */
                        cpuid = dpmsg->cpuid & 0x1FF;   /* core 0 */
                        if (cpu[cpuid])
                                dparray[jj++] = cpuid;

                        cpuid = dpmsg->cpuid | SG_CORE_ID_MASK; /* core 1 */
                        if (cpu[cpuid])
                                dparray[jj++] = cpuid;

                        /* find partner cpuid */
                        if (procpos == 0 || procpos == 2)
                                cpuid = dpmsg->cpuid + 1;
                        else
                                cpuid = dpmsg->cpuid - 1;

                        /* add partner cpuid */
                        cpuid &= 0x1FF;                 /* core 0 */
                        if (cpu[cpuid])
                                dparray[jj++] = cpuid;

                        cpuid |= SG_CORE_ID_MASK;       /* core 1 */
                        if (cpu[cpuid])
                                dparray[jj++] = cpuid;
                        break;

                case DP_RP_TYPE:
                        /*
                         * For a RP error, it's all cpuids (all cores) on
                         * the reporting board
                         */
                        for (ii = 0; ii < SG_MAX_CMPS_PER_BD; ii++) {
                                cpuid = MAKE_CPUID(bd, ii);
                                if (cpu[cpuid])         /* core 0 */
                                        dparray[jj++] = cpuid;
                                cpuid |= SG_CORE_ID_MASK;
                                if (cpu[cpuid])         /* core 1 */
                                        dparray[jj++] = cpuid;
                        }
                        break;
        }

        mutex_exit(&cpu_lock);

        /*
         * The datapath message could not be associated with any
         * configured CPU.
         */
        if (!jj) {
                kmem_free(dparray, num * sizeof (uint16_t *));
                ret = nvlist_add_uint32(erp, DP_LIST_SIZE, jj);
                ASSERT(ret == 0);
                return (-1);
        }

        snarray = kmem_zalloc(jj * sizeof (uint64_t), KM_SLEEP);
        for (ii = 0; ii < jj; ii++)
                snarray[ii] = cpunodes[dparray[ii]].device_id;

        ret = nvlist_add_uint32(erp, DP_LIST_SIZE, jj);
        ret |= nvlist_add_uint16_array(erp, DP_LIST, dparray, jj);
        ret |= nvlist_add_uint64_array(erp, SN_LIST, snarray, jj);
        ASSERT(ret == 0);

        kmem_free(dparray, num * sizeof (uint16_t *));
        kmem_free(snarray, jj * sizeof (uint64_t *));

        return (0);
}

/*
 * sbbc_dp_trans_event() - datapath message handler.
 *
 * Process datapath error and fault messages received from the SC.  Checks
 * for, and disregards, messages associated with I/O boards.  Otherwise,
 * extracts message info to produce a datapath ereport.
 */
/*ARGSUSED*/
static uint_t
sbbc_dp_trans_event(char *arg)
{
        const char      *f = "sbbc_dp_trans_event()";
        nvlist_t        *erp, *detector, *hcelem;
        char            buf[FM_MAX_CLASS];
        int             board;
        plat_datapath_info_t    *dpmsg;
        sbbc_msg_t      *msg;
        int             msgtype;

        /* set i/f message and payload pointers */
        msg = &dp_payload_msg;
        dpmsg = &dp_payload;
        msgtype = msg->msg_type.type;

        cmn_err(CE_NOTE, "%s: msgtype=0x%x\n", f, msgtype);
        cmn_err(CE_NOTE, "type=0x%x cpuid=0x%x t_value=0x%x\n", dpmsg->type,
                dpmsg->cpuid, dpmsg->t_value);

        /* check for valid type */
        if (dpmsg->type > DP_RP_TYPE) {
                cmn_err(CE_WARN, "%s: dpmsg type 0x%x invalid\n",
                        f, dpmsg->type);
                return (DDI_INTR_CLAIMED);
        }

        /* check for I/O board message -  Schizo AIDs are 25 - 30 */
        if (dpmsg->cpuid > 23) {
                cmn_err(CE_NOTE, "%s: ignore I/O board msg\n", f);
                return (DDI_INTR_CLAIMED);
        }

        /* allocate space for ereport */
        erp = fm_nvlist_create(NULL);

/*
 * Member Name  Data Type          Comments
 * -----------  ---------          -----------
 * version      uint8              0
 * class        string             "asic"
 * ENA          uint64             ENA Format 1
 * detector     fmri               aggregated ID data for SC-DE
 *
 * Datapath ereport subclasses and data payloads:
 * There will be two types of ereports (error and fault) which will be
 * identified by the "type" member.
 *
 * ereport.asic.serengeti.cds.cds-dp
 * ereport.asic.serengeti.dx.dx-dp      (board)
 * ereport.asic.serengeti.rp.rp-dp      (centerplane)
 *
 * Member Name  Data Type         Comments
 * -----------  ---------         -----------
 * erptype      uint16            derived from message type: error or
 *                                fault
 * t-value      uint32            SC's datapath SERD timeout threshold
 * dp-list-sz   uint8             number of dp-list array elements
 * dp-list      array of uint16   Safari IDs of affected cpus
 * sn-list      array of uint64   Serial numbers of affected cpus
 */

        /* compose common ereport elements */
        detector = fm_nvlist_create(NULL);

        /*
         *  Create legacy FMRI for the detector
         */
        board = SG_PORTID_TO_BOARD_NUM(SG_CPUID_TO_PORTID(dpmsg->cpuid));
        switch (dpmsg->type) {
                case DP_CDS_TYPE:
                case DP_DX_TYPE:
                        (void) snprintf(buf, FM_MAX_CLASS, "SB%d", board);
                        break;
                case DP_RP_TYPE:
                        (void) snprintf(buf, FM_MAX_CLASS, "RP");
                        break;
                default:
                        (void) snprintf(buf, FM_MAX_CLASS, "UNKNOWN");
                        break;
        }

        hcelem = fm_nvlist_create(NULL);

        (void) nvlist_add_string(hcelem, FM_FMRI_HC_NAME, FM_FMRI_LEGACY_HC);
        (void) nvlist_add_string(hcelem, FM_FMRI_HC_ID, buf);

        (void) nvlist_add_uint8(detector, FM_VERSION, FM_HC_SCHEME_VERSION);
        (void) nvlist_add_string(detector, FM_FMRI_SCHEME, FM_FMRI_SCHEME_HC);
        (void) nvlist_add_string(detector, FM_FMRI_HC_ROOT, "");
        (void) nvlist_add_uint32(detector, FM_FMRI_HC_LIST_SZ, 1);
        (void) nvlist_add_nvlist_array(detector, FM_FMRI_HC_LIST, &hcelem, 1);

        /* build ereport class name */
        (void) snprintf(buf, FM_MAX_CLASS, "asic.serengeti.%s.%s-%s",
                dperrtype[dpmsg->type], dperrtype[dpmsg->type],
                FM_ERROR_DATAPATH);

        fm_ereport_set(erp, FM_EREPORT_VERSION, buf,
                fm_ena_generate(0, FM_ENA_FMT1), detector, NULL);

        /* add payload elements */
        if (msgtype == MBOX_EVENT_DP_ERROR)
                fm_payload_set(erp,
                        DP_EREPORT_TYPE, DATA_TYPE_UINT16, DP_ERROR, NULL);
        else
                fm_payload_set(erp,
                        DP_EREPORT_TYPE, DATA_TYPE_UINT16, DP_FAULT, NULL);

        fm_payload_set(erp, DP_TVALUE, DATA_TYPE_UINT32, dpmsg->t_value, NULL);

        (void) dp_payload_add_cpus(dpmsg, erp);

        /* post ereport */
        fm_ereport_post(erp, EVCH_SLEEP);

        /* free ereport memory */
        fm_nvlist_destroy(erp, FM_NVA_FREE);
        fm_nvlist_destroy(detector, FM_NVA_FREE);

        return (DDI_INTR_CLAIMED);
}

static uint_t
sbbc_datapath_error_msg_handler(char *arg)
{
        static fn_t     f = "sbbc_datapath_error_msg_handler()";
        sbbc_msg_t      *msg = NULL;

        if (arg == NULL) {
                SGSBBC_DBG_EVENT(CE_NOTE, "%s: arg == NULL", f);
                return (DDI_INTR_UNCLAIMED);
        }

        msg = (sbbc_msg_t *)arg;

        if (msg->msg_buf == NULL) {
                SGSBBC_DBG_EVENT(CE_NOTE, "%s: msg_buf == NULL", f);
                return (DDI_INTR_UNCLAIMED);
        }

        msg->msg_type.type = MBOX_EVENT_DP_ERROR;

        /* trigger sbbc_dp_trans_event() */
        ddi_trigger_softintr(dp_softintr_id);

        return (DDI_INTR_CLAIMED);
}

static uint_t
sbbc_datapath_fault_msg_handler(char *arg)
{

        static fn_t     f = "sbbc_datapath_fault_msg_handler()";

        sbbc_msg_t              *msg = NULL;

        if (arg == NULL) {
                SGSBBC_DBG_EVENT(CE_NOTE, "%s: arg == NULL", f);
                return (DDI_INTR_UNCLAIMED);
        }

        msg = (sbbc_msg_t *)arg;

        if (msg->msg_buf == NULL) {
                SGSBBC_DBG_EVENT(CE_NOTE, "%s: msg_buf == NULL", f);
                return (DDI_INTR_UNCLAIMED);
        }

        msg->msg_type.type = MBOX_EVENT_DP_FAULT;

        /* trigger sbbc_dp_trans_event() */
        ddi_trigger_softintr(dp_softintr_id);

        return (DDI_INTR_CLAIMED);
}

/*
 * Log an ECC event message to the SC.  This is called from the
 * sbbc_ecc_mbox_taskq or directly from plat_send_ecc_mailbox_msg
 * for indictment messages.
 */
int
sbbc_mbox_ecc_output(sbbc_ecc_mbox_t *msgp)
{
        int                             rv;
        plat_capability_data_t          *cap;
        plat_dimm_sid_board_data_t      *ddata;
        plat_ecc_msg_hdr_t              *hdr;

        rv = sbbc_mbox_request_response(&msgp->ecc_req, &msgp->ecc_resp,
                sbbc_mbox_default_timeout);

        if (rv != 0) {
                /*
                 * Indictment messages use the return value to indicate a
                 * problem in the mailbox.  For Error mailbox messages, we'll
                 * have to use a syslog message.
                 */
                if (msgp->ecc_log_error) {
                        if (sbbc_ecc_mbox_send_errs == 0) {
                                cmn_err(CE_NOTE, "!Solaris failed to send a "
                                    "message (0x%x/0x%x) to the System "
                                    "Controller. Error: %d, Message Status: %d",
                                    msgp->ecc_resp.msg_type.type,
                                    msgp->ecc_resp.msg_type.sub_type,
                                    rv, msgp->ecc_resp.msg_status);
                        }

                        if (++sbbc_ecc_mbox_send_errs >=
                            sbbc_ecc_mbox_err_throttle) {
                                sbbc_ecc_mbox_send_errs = 0;
                        }
                }

        } else if (msgp->ecc_resp.msg_status != 0) {
                if (msgp->ecc_resp.msg_type.type == INFO_MBOX) {
                        switch (msgp->ecc_resp.msg_type.sub_type) {
                        case INFO_MBOX_ECC:
                                hdr = (plat_ecc_msg_hdr_t *)
                                    msgp->ecc_req.msg_buf;
                                if (hdr->emh_msg_type ==
                                    PLAT_ECC_DIMM_SID_MESSAGE) {
                                        rv = msgp->ecc_resp.msg_status;
                                        break;
                                }
                        /*FALLTHROUGH*/
                        case INFO_MBOX_ECC_CAP:
                                /*
                                 * The positive response comes only
                                 * from the AVL FS1 updated SC.
                                 * If the firmware is either downgraded
                                 * or failover to an older version, then
                                 * lets reset the SC capability to
                                 * default.
                                 */
                                plat_ecc_capability_sc_set
                                    (PLAT_ECC_CAPABILITY_SC_DEFAULT);
                                break;
                        default:
                                break;
                        }
                }
                if (msgp->ecc_log_error) {
                        if (sbbc_ecc_mbox_inval_errs == 0) {
                                cmn_err(CE_NOTE, "!An internal error (%d) "
                                    "occurred in the System Controller while "
                                    "processing this message (0x%x/0x%x)",
                                    msgp->ecc_resp.msg_status,
                                    msgp->ecc_resp.msg_type.type,
                                    msgp->ecc_resp.msg_type.sub_type);
                        }
                        if (msgp->ecc_resp.msg_status == EINVAL) {
                                if (++sbbc_ecc_mbox_inval_errs >=
                                    sbbc_ecc_mbox_err_throttle) {
                                        sbbc_ecc_mbox_inval_errs = 0;
                                }
                                rv = ENOMSG;
                        } else {
                                if (++sbbc_ecc_mbox_other_errs >=
                                    sbbc_ecc_mbox_err_throttle) {
                                        sbbc_ecc_mbox_other_errs = 0;
                                }
                                rv = msgp->ecc_resp.msg_status;
                        }
                }

        } else {
                if (msgp->ecc_resp.msg_type.type == INFO_MBOX) {
                        switch (msgp->ecc_resp.msg_type.sub_type) {
                        case INFO_MBOX_ECC_CAP:
                                /*
                                 * Successfully received the response
                                 * for the capability message, so updating
                                 * the SC ECC messaging capability.
                                 */
                                cap = (plat_capability_data_t *)
                                    msgp->ecc_resp.msg_buf;
                                plat_ecc_capability_sc_set
                                    (cap->capd_capability);
                                break;

                        case INFO_MBOX_ECC:
                                hdr = (plat_ecc_msg_hdr_t *)
                                    msgp->ecc_resp.msg_buf;
                                if (hdr && (hdr->emh_msg_type ==
                                    PLAT_ECC_DIMM_SID_MESSAGE)) {
                                        /*
                                         * Successfully received a response
                                         * to a request for DIMM serial ids.
                                         */
                                        ddata = (plat_dimm_sid_board_data_t *)
                                            msgp->ecc_resp.msg_buf;
                                        (void) plat_store_mem_sids(ddata);
                                }
                                break;

                        default:
                                break;
                        }
                }
        }

        if (msgp->ecc_resp.msg_buf)
                kmem_free((void *)msgp->ecc_resp.msg_buf,
                    (size_t)msgp->ecc_resp.msg_len);

        kmem_free((void *)msgp->ecc_req.msg_buf, (size_t)msgp->ecc_req.msg_len);
        kmem_free(msgp, sizeof (sbbc_ecc_mbox_t));
        return (rv);
}

/*
 * Enqueue ECC event message on taskq to SC.  This is invoked from
 * plat_send_ecc_mailbox_msg() for each ECC event generating a message.
 */
void
sbbc_mbox_queue_ecc_event(sbbc_ecc_mbox_t *sbbc_ecc_msgp)
{
        /*
         * Create the ECC event mailbox taskq, if it does not yet exist.
         * This must be done here rather than in sbbc_mbox_init().  The
         * sgsbbc driver is loaded very early in the boot flow.  Calling
         * taskq_create() from sbbc_mbox_init could lead to a boot deadlock.
         *
         * There might be a tiny probability that two ECC handlers on
         * different processors could arrive here simultaneously.  If
         * the taskq has not been created previously, then these two
         * simultaneous events could cause the creation of an extra taskq.
         * Given the extremely small likelihood (if not outright impossibility)
         * of this occurrence, sbbc_ecc_mbox_taskq is not protected by a lock.
         */

        if (sbbc_ecc_mbox_taskq == NULL) {
                sbbc_ecc_mbox_taskq = taskq_create("ECC_event_mailbox", 1,
                    minclsyspri, ECC_MBOX_TASKQ_MIN, ECC_MBOX_TASKQ_MAX,
                    TASKQ_PREPOPULATE);
                if (sbbc_ecc_mbox_taskq == NULL) {
                        if (sbbc_ecc_mbox_taskq_errs == 0) {
                                cmn_err(CE_NOTE, "Unable to create mailbox "
                                    "task queue for ECC event logging to "
                                    "System Controller");
                        }
                        if (++sbbc_ecc_mbox_taskq_errs >=
                            sbbc_ecc_mbox_err_throttle) {
                                sbbc_ecc_mbox_taskq_errs = 0;
                        }

                        kmem_free((void *)sbbc_ecc_msgp->ecc_req.msg_buf,
                                (size_t)sbbc_ecc_msgp->ecc_req.msg_len);
                        kmem_free((void *)sbbc_ecc_msgp,
                                sizeof (sbbc_ecc_mbox_t));
                        return;
                }

                /*
                 * Reset error counter so that first taskq_dispatch
                 * error will be output
                 */
                sbbc_ecc_mbox_taskq_errs = 0;
        }

        /*
         * Enqueue the message
         */

        if (taskq_dispatch(sbbc_ecc_mbox_taskq,
            (task_func_t *)sbbc_mbox_ecc_output, sbbc_ecc_msgp,
            TQ_NOSLEEP) == TASKQID_INVALID) {

                if (sbbc_ecc_mbox_taskq_errs == 0) {
                        cmn_err(CE_NOTE, "Unable to send ECC event "
                                "message to System Controller");
                }
                if (++sbbc_ecc_mbox_taskq_errs >= sbbc_ecc_mbox_err_throttle) {
                        sbbc_ecc_mbox_taskq_errs = 0;
                }

                kmem_free((void *)sbbc_ecc_msgp->ecc_req.msg_buf,
                                (size_t)sbbc_ecc_msgp->ecc_req.msg_len);
                kmem_free((void *)sbbc_ecc_msgp, sizeof (sbbc_ecc_mbox_t));
        }
}

static uint_t
cap_ecc_msg_handler(char *addr)
{
        sbbc_msg_t *msg = NULL;
        plat_capability_data_t *cap = NULL;
        static fn_t f = "cap_ecc_msg_handler";

        msg = (sbbc_msg_t *)addr;

        if (msg == NULL) {
                SGSBBC_DBG_EVENT(CE_WARN, "cap_ecc_msg_handler() called with "
                    "null addr");
                return (DDI_INTR_CLAIMED);
        }

        if (msg->msg_buf == NULL) {
                SGSBBC_DBG_EVENT(CE_WARN, "cap_ecc_msg_handler() called with "
                    "null data buffer");
                return (DDI_INTR_CLAIMED);
        }

        cap = (plat_capability_data_t *)msg->msg_buf;
        switch (cap->capd_msg_type) {
        case PLAT_ECC_CAPABILITY_MESSAGE:
                SGSBBC_DBG_MBOX("%s: capability  0x%x\n", f,
                    cap->capd_capability);
                plat_ecc_capability_sc_set(cap->capd_capability);
                break;
        default:
                SGSBBC_DBG_MBOX("%s: Unknown message type = 0x%x\n", f,
                    cap->capd_msg_type);
                break;
        }

        return (DDI_INTR_CLAIMED);
}