Home | History | Annotate | Line # | Download | only in pci
      1 /*	$NetBSD: veritefb.c,v 1.3 2026/11/07 22:20:14 thorpej Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2026 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Radoslaw Kujawa.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     29  */
     30 
     31 /*
     32  * Rendition Verite V2100/V2200 driver.
     33  *
     34  * Influenced by xf86-video-rendition.
     35  *
     36  * The on-board RISC boots from the card ROM at PCI reset and parks in
     37  * a loop. We reset it and hold before any other access to the card.
     38  * The console runs unaccelerated from autoconf on until 2D microcode is
     39  * loaded.
     40  */
     41 
     42 #include <sys/cdefs.h>
     43 __KERNEL_RCSID(0, "$NetBSD: veritefb.c,v 1.3 2026/11/07 22:20:14 thorpej Exp $");
     44 
     45 #include <sys/param.h>
     46 #include <sys/systm.h>
     47 #include <sys/kernel.h>
     48 #ifdef VERITEFB_DEBUG
     49 #include <sys/callout.h>
     50 #endif
     51 #include <sys/kmem.h>
     52 #include <sys/device.h>
     53 #include <sys/endian.h>
     54 #include <sys/conf.h>
     55 #include <sys/extent.h>
     56 
     57 #include <sys/exec_elf.h>
     58 
     59 #include <dev/firmload.h>
     60 
     61 #include <dev/pci/pcivar.h>
     62 #include <dev/pci/pcireg.h>
     63 #include <dev/pci/pcidevs.h>
     64 #include <dev/pci/pciio.h>
     65 
     66 #include <dev/pci/veritefbreg.h>
     67 #include <dev/pci/veritefb_ucode.h>
     68 #include <dev/pci/veritefbio.h>
     69 #include <dev/pci/verite3dio.h>
     70 
     71 #include <dev/wscons/wsdisplayvar.h>
     72 #include <dev/wscons/wsconsio.h>
     73 #include <dev/wsfont/wsfont.h>
     74 #include <dev/rasops/rasops.h>
     75 #include <dev/wscons/wsdisplay_vconsvar.h>
     76 #include <dev/wscons/wsdisplay_glyphcachevar.h>
     77 #include <dev/pci/wsdisplay_pci.h>
     78 
     79 #include "opt_wsemul.h"
     80 #include "opt_veritefb.h"
     81 #include "opt_ddb.h"
     82 
     83 #include <dev/videomode/videomode.h>
     84 #include <dev/videomode/edidvar.h>
     85 
     86 #include <dev/i2c/i2cvar.h>
     87 #include <dev/i2c/i2c_bitbang.h>
     88 #include <dev/i2c/ddcvar.h>
     89 
     90 #ifdef DDB
     91 #include <machine/db_machdep.h>
     92 #include <ddb/db_command.h>
     93 #include <ddb/db_output.h>
     94 #endif
     95 
     96 #define VFB_MAXPOLL	100000	/* status/hold polls */
     97 #define VFB_VSYNCPOLL	40000	/* vsync wait, ~2 frames in us */
     98 #define VFB_SHORTPOLL	100	/* polls in the RISC debug port */
     99 #define VFB_FIFOPOLL	100000	/* FIFO waits, us */
    100 #define VFB_DRAINPOLL	10000	/* output FIFO drains */
    101 #define VFB_LAZY_LIMIT	16	/* queued ops between forced syncs */
    102 
    103 #define VFB_LAZY_AREA	307200	/* fill at the engine's pixel rate */
    104 
    105 #define VFB_PROBE_PATTERN	0xf5faaf5fU
    106 #define VFB_PROBE_START		0x12345678U
    107 #define VFB_MAXVRAM		(16 * 1024 * 1024)
    108 #define VFB_MAXUCODE		(1024 * 1024)	/* sanity cap for firmware */
    109 
    110 #define VFB_PLL_REF		1431818	/* 14.31818 MHz in units of 10 Hz */
    111 
    112 #define VFB_FIRMWARE_NAME	"v20002d.uc"
    113 
    114 #define VFB_GC_GAP		5	/* scanlines between fb and glyph cache */
    115 #define VFB_UNDERLINE_OFF	2	/* underline offset from cell bottom */
    116 #define VFB_GETPIXEL_PATTERN	0x5a5a5a5aU /* handshake test pixels */
    117 #define VFB_CMD_BOGUS		50	/* unassigned cmd for fault injection */
    118 
    119 #define VFB_ACCEL_OFF	0	/* no microcode loaded */
    120 #define VFB_ACCEL_SW	1	/* degraded after a fault; never retried */
    121 #define VFB_ACCEL_ON	2	/* RISC running, handshake passed */
    122 
    123 #define VFB_OWNER_CONSOLE	VERITEFB_OWNER_CONSOLE
    124 #define VFB_OWNER_PARKED	VERITEFB_OWNER_PARKED
    125 #define VFB_OWNER_FOREIGN	VERITEFB_OWNER_FOREIGN
    126 
    127 struct veritefb_softc {
    128 	device_t		sc_dev;
    129 	pci_chipset_tag_t	sc_pc;
    130 	pcitag_t		sc_pcitag;
    131 
    132 	bus_space_tag_t		sc_iot;		/* I/O registers (BAR1) */
    133 	bus_space_handle_t	sc_ioh;
    134 	bus_addr_t		sc_io_paddr;
    135 	bus_size_t		sc_ios;
    136 	bus_space_tag_t		sc_mmiot;	/* MMIO registers (BAR2) */
    137 	bus_space_handle_t	sc_mmioh;
    138 	bus_addr_t		sc_mmio_paddr;
    139 	bus_size_t		sc_mmios;
    140 
    141 	bus_space_tag_t		sc_regt;
    142 	bus_space_handle_t	sc_regh;
    143 	bus_size_t		sc_regoff;
    144 	bus_space_tag_t		sc_memt;	/* fb aperture (BAR0) */
    145 	bus_space_handle_t	sc_memh;
    146 	bus_addr_t		sc_fb_paddr;
    147 	bus_size_t		sc_apsize;	/* mapped aperture size */
    148 	bus_size_t		sc_memsize;	/* probed VRAM size */
    149 	bus_size_t		sc_fb_offset;	/* fb start (microcode area) */
    150 
    151 	/* RISC / acceleration state */
    152 	int			sc_accel;	/* VFB_ACCEL_* */
    153 	int			sc_risc_owner;	/* VFB_OWNER_* */
    154 	int			sc_unsynced;	/* ops queued since last sync */
    155 	uint32_t		sc_unsynced_area; /* pixels queued likewise */
    156 	uint32_t		sc_ucode_entry;
    157 	uint8_t			*sc_ucode;	/* firmware image copy */
    158 	size_t			sc_ucode_size;
    159 
    160 	glyphcache		sc_gc;		/* VRAM glyph cache */
    161 	bool			sc_gc_initted;
    162 	/* bus-master FIFO feed (descriptor list page + bounce buffer) */
    163 #define VFB_DMA_BOUNCE		65536
    164 #define VFB_DMA_TIMEOUT_US	200000
    165 	bus_dma_tag_t		sc_dmat;
    166 	bus_dmamap_t		sc_dma_list_map;
    167 	bus_dmamap_t		sc_dma_buf_map;
    168 	bus_dma_segment_t	sc_dma_list_seg;
    169 	bus_dma_segment_t	sc_dma_buf_seg;
    170 	uint32_t		*sc_dma_list;	/* data entry + stop entry */
    171 	uint8_t			*sc_dma_buf;
    172 	/*
    173 	 * Async submit
    174 	 */
    175 	bool			sc_dma_pending;
    176 	bus_dmamap_t		sc_dma_pending_map; /* owed POSTWRITE */
    177 	uint32_t		sc_dma_pending_len;
    178 
    179 	/*
    180 	 * Vblank-queued flip
    181 	 */
    182 	void			*sc_ih;
    183 	bool			sc_flip_intr_ok;
    184 	volatile bool		sc_flip_pending;
    185 	volatile uint32_t	sc_flip_base;
    186 
    187 	/* /dev/verite3d: exclusive 3D client state */
    188 	bool			sc_v3d_open;
    189 	bool			sc_v3d_dead;	/* EIO until close */
    190 	bool			sc_v3d_inited;	/* client ucode running */
    191 	struct extent		*sc_v3d_ext;	/* VRAM pool */
    192 	uint32_t		sc_v3d_pool_base;
    193 #define V3D_MAX_REGIONS	1024
    194 	struct {
    195 		uint32_t	addr;
    196 		uint32_t	size;
    197 	}			*sc_v3d_reg;	/* live allocations */
    198 	int			sc_v3d_nreg;
    199 	bus_dmamap_t		sc_v3d_slot_map[V3D_RING_SLOTS];
    200 	bus_dma_segment_t	sc_v3d_slot_seg[V3D_RING_SLOTS];
    201 	uint8_t			*sc_v3d_slot[V3D_RING_SLOTS];
    202 
    203 #ifdef VERITEFB_DEBUG
    204 	/* last words written to the input FIFO */
    205 #define VFB_RING_SIZE	128		/* power of two */
    206 	uint32_t		sc_ring[VFB_RING_SIZE];
    207 	unsigned		sc_ring_count;
    208 	struct veritefb_dbg_stats sc_stats;
    209 
    210 	/* RISC PC sampling profiler (veritefb_pcsample_tick) */
    211 	struct callout		sc_pcsample_ch;
    212 	bool			sc_pcsample_on;
    213 	uint32_t		sc_pcsample_hz;
    214 	uint32_t		sc_pchist_base;
    215 	uint32_t		sc_pchist_shift;
    216 	uint32_t		sc_pchist_min;
    217 	uint32_t		sc_pchist_max;
    218 	uint64_t		sc_pchist_samples;
    219 	uint64_t		sc_pchist_missed;
    220 	uint32_t		sc_pchist[VFB_PCHIST_BUCKETS];
    221 #endif
    222 
    223 	/* software rendering ops, the permanent fallback */
    224 	void (*sc_orig_eraserows)(void *, int, int, long);
    225 	void (*sc_orig_erasecols)(void *, int, int, int, long);
    226 	void (*sc_orig_copyrows)(void *, int, int, int);
    227 	void (*sc_orig_copycols)(void *, int, int, int, int);
    228 	void (*sc_orig_putchar)(void *, int, int, u_int, long);
    229 
    230 	int			sc_width;
    231 	int			sc_height;
    232 	int			sc_depth;
    233 	int			sc_linebytes;
    234 	uint8_t			sc_stride0;	/* pixel engine stride */
    235 	uint8_t			sc_stride1;
    236 	const struct videomode	*sc_videomode;	/* the mode in use */
    237 
    238 	/* DDC/EDID */
    239 	struct i2c_controller	sc_i2c;
    240 	uint32_t		sc_ddc_base;	/* CRTCCTL sans DDC bits */
    241 	uint8_t			sc_edid[128];
    242 	struct edid_info	sc_ei;
    243 	bool			sc_edid_valid;
    244 
    245 	int			sc_mode;	/* WSDISPLAYIO_MODE_* */
    246 	struct vcons_data	vd;
    247 	struct vcons_screen	sc_console_screen;
    248 	struct wsscreen_descr	sc_defaultscreen_descr;
    249 	const struct wsscreen_descr *sc_screens[1];
    250 	struct wsscreen_list	sc_screenlist;
    251 	u_char			sc_cmap_red[256];
    252 	u_char			sc_cmap_green[256];
    253 	u_char			sc_cmap_blue[256];
    254 };
    255 
    256 static const struct veritefb_stride {
    257 	uint16_t linebytes;
    258 	uint8_t stride0, stride1;
    259 } veritefb_stride_table[] = {
    260 	{  640, 2, 4 },
    261 	{  704, 6, 4 },
    262 	{  768, 5, 0 },
    263 	{  784, 5, 1 },
    264 	{  800, 5, 2 },
    265 	{  832, 5, 3 },
    266 	{  896, 5, 4 },
    267 	{ 1024, 3, 0 },
    268 	{ 1040, 3, 1 },
    269 	{ 1056, 3, 2 },
    270 	{ 1088, 3, 3 },
    271 	{ 1152, 3, 4 },
    272 	{ 1168, 7, 1 },
    273 	{ 1184, 7, 2 },
    274 	{ 1216, 7, 3 },
    275 	{ 1280, 1, 5 },
    276 	{ 1536, 2, 5 },
    277 	{ 1600, 6, 5 },
    278 	{ 1792, 5, 5 },
    279 	{ 2048, 0, 6 },
    280 	{ 0, 0, 0 }
    281 };
    282 
    283 static int	veritefb_match(device_t, cfdata_t, void *);
    284 static void	veritefb_attach(device_t, device_t, void *);
    285 
    286 static void	veritefb_risc_softreset(struct veritefb_softc *);
    287 static void	veritefb_risc_hold(struct veritefb_softc *);
    288 static void	veritefb_risc_continue(struct veritefb_softc *);
    289 static void	veritefb_risc_forcestep(struct veritefb_softc *, uint32_t);
    290 static void	veritefb_risc_writerf(struct veritefb_softc *, uint8_t,
    291 		    uint32_t);
    292 static uint32_t	veritefb_risc_readrf(struct veritefb_softc *, uint8_t);
    293 static uint32_t	veritefb_risc_readmem(struct veritefb_softc *, uint32_t);
    294 static void	veritefb_risc_writemem(struct veritefb_softc *, uint32_t,
    295 		    uint32_t);
    296 static void	veritefb_risc_flushicache(struct veritefb_softc *);
    297 static void	veritefb_risc_start(struct veritefb_softc *, uint32_t);
    298 
    299 static uint32_t	veritefb_risc_samplepc(struct veritefb_softc *);
    300 #ifdef VERITEFB_DEBUG
    301 static void	veritefb_pcsample_tick(void *);
    302 #endif
    303 static void	veritefb_accel_fail(struct veritefb_softc *, const char *);
    304 static int	veritefb_waitfifo(struct veritefb_softc *, int);
    305 static int	veritefb_drain_outfifo(struct veritefb_softc *);
    306 static int	veritefb_read_outfifo(struct veritefb_softc *, uint32_t *);
    307 static void	veritefb_load_firmware(device_t);
    308 static bool	veritefb_ucode_load(struct veritefb_softc *, const uint8_t *,
    309 		    size_t, uint32_t, uint32_t, bool, uint32_t *);
    310 static bool	veritefb_2d_handshake(struct veritefb_softc *);
    311 static int	veritefb_waitfifo_raw(struct veritefb_softc *, int, uint32_t);
    312 static int	veritefb_read_outfifo_raw(struct veritefb_softc *, uint32_t *,
    313 		    uint32_t);
    314 static int	veritefb_suspend2d(struct veritefb_softc *);
    315 static int	veritefb_resume2d(struct veritefb_softc *);
    316 static void	veritefb_mux_redraw(struct veritefb_softc *);
    317 static int	veritefb_set_scan_depth(struct veritefb_softc *, int);
    318 static int	veritefb_dma_alloc(struct veritefb_softc *);
    319 static int	veritefb_dma_drain(struct veritefb_softc *);
    320 static int	veritefb_intr(void *);
    321 static void	veritefb_flip_cancel(struct veritefb_softc *);
    322 static void	veritefb_flip_wait(struct veritefb_softc *);
    323 static int	veritefb_dma_submit(struct veritefb_softc *, bus_dmamap_t,
    324 		    uint32_t, uint32_t);
    325 
    326 dev_type_open(verite3d_open);
    327 dev_type_close(verite3d_close);
    328 dev_type_ioctl(verite3d_ioctl);
    329 dev_type_mmap(verite3d_mmap);
    330 static void	verite3d_teardown(struct veritefb_softc *);
    331 static int	verite3d_ring_alloc(struct veritefb_softc *);
    332 static bool	veritefb_risc_init(struct veritefb_softc *);
    333 static size_t	veritefb_mem_size(struct veritefb_softc *);
    334 
    335 static bool	veritefb_calc_pclk(int, int *, int *, int *);
    336 static const struct veritefb_stride *veritefb_stride_for(int);
    337 static bool	veritefb_set_mode(struct veritefb_softc *,
    338 		    const struct videomode *);
    339 
    340 static void	veritefb_i2cbb_set_bits(void *, uint32_t);
    341 static void	veritefb_i2cbb_set_dir(void *, uint32_t);
    342 static uint32_t	veritefb_i2cbb_read_bits(void *);
    343 static int	veritefb_i2c_send_start(void *, int);
    344 static int	veritefb_i2c_send_stop(void *, int);
    345 static int	veritefb_i2c_initiate_xfer(void *, i2c_addr_t, int);
    346 static int	veritefb_i2c_read_byte(void *, uint8_t *, int);
    347 static int	veritefb_i2c_write_byte(void *, uint8_t, int);
    348 static void	veritefb_ddc_read(struct veritefb_softc *);
    349 static void	veritefb_pick_mode(struct veritefb_softc *);
    350 static void	veritefb_init_dac(struct veritefb_softc *);
    351 static void	veritefb_wait_vsync(struct veritefb_softc *);
    352 static void	veritefb_set_dac_entry(struct veritefb_softc *, int, uint8_t,
    353 		    uint8_t, uint8_t);
    354 static void	veritefb_init_palette(struct veritefb_softc *);
    355 static int	veritefb_getcmap(struct veritefb_softc *,
    356 		    struct wsdisplay_cmap *);
    357 static int	veritefb_putcmap(struct veritefb_softc *,
    358 		    struct wsdisplay_cmap *);
    359 
    360 static void	veritefb_init_screen(void *, struct vcons_screen *, int,
    361 		    long *);
    362 static paddr_t	veritefb_mmap(void *, void *, off_t, int);
    363 static int	veritefb_ioctl(void *, void *, u_long, void *, int,
    364 		    struct lwp *);
    365 
    366 static void	veritefb_sync(struct veritefb_softc *);
    367 static bool	veritefb_rectfill(struct veritefb_softc *, int, int, int,
    368 		    int, uint32_t);
    369 static bool	veritefb_bitblt(struct veritefb_softc *, int, int, int, int,
    370 		    int, int);
    371 static void	veritefb_eraserows(void *, int, int, long);
    372 static void	veritefb_erasecols(void *, int, int, int, long);
    373 static void	veritefb_copyrows(void *, int, int, int);
    374 static void	veritefb_copycols(void *, int, int, int, int);
    375 static void	veritefb_putchar(void *, int, int, u_int, long);
    376 static void	veritefb_gc_bitblt(void *, int, int, int, int, int, int,
    377 		    int);
    378 
    379 #if defined(DDB) && defined(VERITEFB_DEBUG)
    380 static void	veritefb_ddb_attach(struct veritefb_softc *);
    381 #endif
    382 
    383 extern struct cfdriver veritefb_cd;
    384 
    385 CFATTACH_DECL_NEW(veritefb, sizeof(struct veritefb_softc),
    386     veritefb_match, veritefb_attach, NULL, NULL);
    387 
    388 static struct wsdisplay_accessops veritefb_accessops = {
    389 	.ioctl = veritefb_ioctl,
    390 	.mmap = veritefb_mmap,
    391 };
    392 
    393 static inline uint8_t
    394 vfb_read1(struct veritefb_softc *sc, bus_size_t reg)
    395 {
    396 	if (reg >= VFB_IOONLY_BASE)
    397 		return bus_space_read_1(sc->sc_iot, sc->sc_ioh, reg);
    398 	return bus_space_read_1(sc->sc_regt, sc->sc_regh,
    399 	    sc->sc_regoff + reg);
    400 }
    401 
    402 static inline void
    403 vfb_write1(struct veritefb_softc *sc, bus_size_t reg, uint8_t val)
    404 {
    405 	if (reg >= VFB_IOONLY_BASE) {
    406 		bus_space_write_1(sc->sc_iot, sc->sc_ioh, reg, val);
    407 		return;
    408 	}
    409 	bus_space_write_1(sc->sc_regt, sc->sc_regh, sc->sc_regoff + reg,
    410 	    val);
    411 }
    412 
    413 static inline uint32_t
    414 vfb_read4(struct veritefb_softc *sc, bus_size_t reg)
    415 {
    416 	if (reg >= VFB_IOONLY_BASE)
    417 		return bus_space_read_4(sc->sc_iot, sc->sc_ioh, reg);
    418 	return bus_space_read_4(sc->sc_regt, sc->sc_regh,
    419 	    sc->sc_regoff + reg);
    420 }
    421 
    422 static inline void
    423 vfb_write4(struct veritefb_softc *sc, bus_size_t reg, uint32_t val)
    424 {
    425 	if (reg >= VFB_IOONLY_BASE) {
    426 		bus_space_write_4(sc->sc_iot, sc->sc_ioh, reg, val);
    427 		return;
    428 	}
    429 	bus_space_write_4(sc->sc_regt, sc->sc_regh, sc->sc_regoff + reg,
    430 	    val);
    431 }
    432 
    433 static inline uint32_t
    434 vfb_fb_read4(struct veritefb_softc *sc, bus_size_t off)
    435 {
    436 	return bus_space_read_4(sc->sc_memt, sc->sc_memh, off);
    437 }
    438 
    439 static inline void
    440 vfb_fb_write4(struct veritefb_softc *sc, bus_size_t off, uint32_t val)
    441 {
    442 	bus_space_write_4(sc->sc_memt, sc->sc_memh, off, val);
    443 }
    444 
    445 /*
    446  * The FIFO window: input FIFO on write, output FIFO on read.
    447  */
    448 static void
    449 vfb_fifo_write(struct veritefb_softc *sc, uint32_t word)
    450 {
    451 #ifdef VERITEFB_DEBUG
    452 	sc->sc_ring[sc->sc_ring_count++ & (VFB_RING_SIZE - 1)] = word;
    453 #endif
    454 	bus_space_write_4(sc->sc_regt, sc->sc_regh, VFB_FIFO_SWAP_NO, word);
    455 }
    456 
    457 static inline uint32_t
    458 vfb_fifo_read(struct veritefb_softc *sc)
    459 {
    460 	return bus_space_read_4(sc->sc_regt, sc->sc_regh, VFB_FIFO_SWAP_NO);
    461 }
    462 
    463 static void
    464 vfb_pacepoll4(struct veritefb_softc *sc, bus_size_t reg, uint32_t data,
    465     uint32_t mask)
    466 {
    467 	int i;
    468 
    469 	for (i = 0; i < VFB_SHORTPOLL; i++)
    470 		if ((vfb_read4(sc, reg) & mask) == (data & mask))
    471 			break;
    472 }
    473 
    474 static void
    475 vfb_pacepoll1(struct veritefb_softc *sc, bus_size_t reg, uint8_t data,
    476     uint8_t mask)
    477 {
    478 	int i;
    479 
    480 	for (i = 0; i < VFB_SHORTPOLL; i++)
    481 		if ((vfb_read1(sc, reg) & mask) == (data & mask))
    482 			break;
    483 }
    484 
    485 static int
    486 veritefb_match(device_t parent, cfdata_t match, void *aux)
    487 {
    488 	const struct pci_attach_args *pa = aux;
    489 
    490 	if (PCI_VENDOR(pa->pa_id) == PCI_VENDOR_RENDITION &&
    491 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_RENDITION_V2X00)
    492 		return 100;	/* ahead of genfb(4) */
    493 
    494 	return 0;
    495 }
    496 
    497 static void
    498 veritefb_attach(device_t parent, device_t self, void *aux)
    499 {
    500 	struct veritefb_softc *sc = device_private(self);
    501 	struct wsemuldisplaydev_attach_args ws_aa;
    502 	struct rasops_info *ri;
    503 	const struct pci_attach_args *pa = aux;
    504 	pcireg_t screg;
    505 	bool console;
    506 	long defattr;
    507 
    508 #ifdef VERITEFB_CONSOLE
    509 	console = true;
    510 #else
    511 	console = false;
    512 	prop_dictionary_get_bool(device_properties(self), "is_console",
    513 	    &console);
    514 #endif
    515 
    516 	sc->sc_dev = self;
    517 	sc->sc_pc = pa->pa_pc;
    518 	sc->sc_pcitag = pa->pa_tag;
    519 	sc->sc_dmat = pa->pa_dmat;
    520 
    521 	screg = pci_conf_read(sc->sc_pc, sc->sc_pcitag,
    522 	    PCI_COMMAND_STATUS_REG);
    523 	screg |= PCI_COMMAND_IO_ENABLE | PCI_COMMAND_MEM_ENABLE;
    524 	pci_conf_write(sc->sc_pc, sc->sc_pcitag, PCI_COMMAND_STATUS_REG,
    525 	    screg);
    526 
    527 	pci_aprint_devinfo(pa, NULL);
    528 
    529 	if (pci_mapreg_map(pa, VFB_IO_BAR, PCI_MAPREG_TYPE_IO, 0,
    530 	    &sc->sc_iot, &sc->sc_ioh, &sc->sc_io_paddr, &sc->sc_ios) != 0) {
    531 		aprint_error_dev(sc->sc_dev, "unable to map I/O registers\n");
    532 		return;
    533 	}
    534 	sc->sc_regt = sc->sc_iot;
    535 	sc->sc_regh = sc->sc_ioh;
    536 	sc->sc_regoff = 0;
    537 
    538 	/*
    539 	 * Reset and hold it the RISC before touching the rest of the card.
    540 	 */
    541 	veritefb_risc_softreset(sc);
    542 	veritefb_risc_hold(sc);
    543 
    544 	if (pci_mapreg_map(pa, VFB_MMIO_BAR, PCI_MAPREG_TYPE_MEM, 0,
    545 	    &sc->sc_mmiot, &sc->sc_mmioh, &sc->sc_mmio_paddr,
    546 	    &sc->sc_mmios) == 0) {
    547 		sc->sc_regt = sc->sc_mmiot;
    548 		sc->sc_regh = sc->sc_mmioh;
    549 		sc->sc_regoff = VFB_MMIO_REG_BASE;
    550 	} else {
    551 		aprint_normal_dev(sc->sc_dev,
    552 		    "MMIO BAR unmappable, all registers via I/O\n");
    553 	}
    554 
    555 	if (pci_mapreg_map(pa, VFB_FB_BAR, PCI_MAPREG_TYPE_MEM,
    556 	    BUS_SPACE_MAP_LINEAR, &sc->sc_memt, &sc->sc_memh,
    557 	    &sc->sc_fb_paddr, &sc->sc_apsize) != 0) {
    558 		aprint_error_dev(sc->sc_dev,
    559 		    "unable to map framebuffer aperture\n");
    560 		return;
    561 	}
    562 
    563 	if (sc->sc_regoff != 0)
    564 		aprint_normal_dev(sc->sc_dev,
    565 		    "fb at 0x%08x, MMIO registers at 0x%08x, "
    566 		    "I/O registers at 0x%04x\n",
    567 		    (uint32_t)sc->sc_fb_paddr, (uint32_t)sc->sc_mmio_paddr,
    568 		    (uint32_t)sc->sc_io_paddr);
    569 	else
    570 		aprint_normal_dev(sc->sc_dev,
    571 		    "fb at 0x%08x, I/O registers at 0x%04x\n",
    572 		    (uint32_t)sc->sc_fb_paddr, (uint32_t)sc->sc_io_paddr);
    573 
    574 	sc->sc_memsize = veritefb_mem_size(sc);
    575 	if (sc->sc_memsize == 0) {
    576 		aprint_error_dev(sc->sc_dev, "VRAM probe failed\n");
    577 		return;
    578 	}
    579 
    580 	aprint_normal_dev(sc->sc_dev, "%zu MB video memory present\n",
    581 	    sc->sc_memsize / 1024 / 1024);
    582 
    583 	/*
    584 	 * The first VFB_MC_SIZE bytes of VRAM are reserved for the 2D
    585 	 * microcode, the framebuffer lives above it.
    586 	 */
    587 	sc->sc_fb_offset = VFB_MC_SIZE;
    588 	sc->sc_accel = VFB_ACCEL_OFF;
    589 	sc->sc_risc_owner = VFB_OWNER_CONSOLE;
    590 #ifdef VERITEFB_DEBUG
    591 	callout_init(&sc->sc_pcsample_ch, 0);
    592 	callout_setfunc(&sc->sc_pcsample_ch, veritefb_pcsample_tick, sc);
    593 #endif
    594 
    595 	veritefb_ddc_read(sc);
    596 	veritefb_pick_mode(sc);
    597 
    598 	sc->sc_width = sc->sc_videomode->hdisplay;
    599 	sc->sc_height = sc->sc_videomode->vdisplay;
    600 	sc->sc_depth = 8;
    601 
    602 	{
    603 		const struct veritefb_stride *st;
    604 
    605 		st = veritefb_stride_for(sc->sc_width * (sc->sc_depth / 8));
    606 		if (st == NULL) {
    607 			aprint_error_dev(sc->sc_dev,
    608 			    "no stride encoding for %d bytes/line\n",
    609 			    sc->sc_width * (sc->sc_depth / 8));
    610 			return;
    611 		}
    612 		sc->sc_linebytes = st->linebytes;
    613 		sc->sc_stride0 = st->stride0;
    614 		sc->sc_stride1 = st->stride1;
    615 	}
    616 
    617 	aprint_normal_dev(sc->sc_dev, "setting %dx%d %d bpp resolution\n",
    618 	    sc->sc_width, sc->sc_height, sc->sc_depth);
    619 
    620 	if (!veritefb_set_mode(sc, sc->sc_videomode)) {
    621 		aprint_error_dev(sc->sc_dev, "mode set failed\n");
    622 		return;
    623 	}
    624 
    625 	bus_space_set_region_4(sc->sc_memt, sc->sc_memh, sc->sc_fb_offset, 0,
    626 	    (sc->sc_linebytes * sc->sc_height) / 4);
    627 
    628 	veritefb_init_palette(sc);
    629 
    630 	sc->sc_defaultscreen_descr = (struct wsscreen_descr){
    631 		"default",
    632 		0, 0,
    633 		NULL,
    634 		8, 16,
    635 		WSSCREEN_WSCOLORS | WSSCREEN_HILIT,
    636 		NULL
    637 	};
    638 	sc->sc_screens[0] = &sc->sc_defaultscreen_descr;
    639 	sc->sc_screenlist = (struct wsscreen_list){1, sc->sc_screens};
    640 	sc->sc_mode = WSDISPLAYIO_MODE_EMUL;
    641 
    642 	vcons_init(&sc->vd, sc, &sc->sc_defaultscreen_descr,
    643 	    &veritefb_accessops);
    644 	sc->vd.init_screen = veritefb_init_screen;
    645 
    646 	/* Glyph cache in the VRAM above the visible framebuffer. */
    647 	sc->sc_gc.gc_bitblt = veritefb_gc_bitblt;
    648 	sc->sc_gc.gc_rectfill = NULL;
    649 	sc->sc_gc.gc_blitcookie = sc;
    650 	sc->sc_gc.gc_rop = VFB_ROP_COPY;
    651 	sc->vd.show_screen_cookie = &sc->sc_gc;
    652 	sc->vd.show_screen_cb = glyphcache_adapt;
    653 
    654 	ri = &sc->sc_console_screen.scr_ri;
    655 
    656 	vcons_init_screen(&sc->vd, &sc->sc_console_screen, 1, &defattr);
    657 	sc->sc_console_screen.scr_flags |= VCONS_SCREEN_IS_STATIC;
    658 
    659 	sc->sc_gc_initted = glyphcache_init(&sc->sc_gc,
    660 	    sc->sc_height + VFB_GC_GAP,
    661 	    (int)((sc->sc_memsize - sc->sc_fb_offset) / sc->sc_linebytes) -
    662 		sc->sc_height - VFB_GC_GAP,
    663 	    sc->sc_width,
    664 	    ri->ri_font->fontwidth,
    665 	    ri->ri_font->fontheight,
    666 	    defattr) == 0;
    667 	if (!sc->sc_gc_initted)
    668 		aprint_error_dev(sc->sc_dev, "glyph cache init failed\n");
    669 
    670 	sc->sc_defaultscreen_descr.textops = &ri->ri_ops;
    671 	sc->sc_defaultscreen_descr.capabilities = ri->ri_caps;
    672 	sc->sc_defaultscreen_descr.nrows = ri->ri_rows;
    673 	sc->sc_defaultscreen_descr.ncols = ri->ri_cols;
    674 
    675 	vcons_redraw_screen(&sc->sc_console_screen);
    676 
    677 	if (console) {
    678 		wsdisplay_cnattach(&sc->sc_defaultscreen_descr, ri, 0, 0,
    679 		    defattr);
    680 		vcons_replay_msgbuf(&sc->sc_console_screen);
    681 	}
    682 
    683 	/*
    684 	 * Interrupt for the vblank flip.
    685 	 */
    686 	{
    687 		pci_intr_handle_t ih;
    688 		char intrbuf[PCI_INTRSTR_LEN];
    689 		const char *intrstr;
    690 
    691 		vfb_write1(sc, VFB_INTREN, 0);
    692 		vfb_write1(sc, VFB_INTR, 0xff);
    693 		if (pci_intr_map(pa, &ih) == 0) {
    694 			intrstr = pci_intr_string(sc->sc_pc, ih, intrbuf,
    695 			    sizeof(intrbuf));
    696 			sc->sc_ih = pci_intr_establish_xname(sc->sc_pc, ih,
    697 			    IPL_VM, veritefb_intr, sc,
    698 			    device_xname(sc->sc_dev));
    699 			if (sc->sc_ih != NULL) {
    700 				sc->sc_flip_intr_ok = true;
    701 				aprint_normal_dev(sc->sc_dev,
    702 				    "interrupting at %s\n", intrstr);
    703 			}
    704 		}
    705 		if (!sc->sc_flip_intr_ok)
    706 			aprint_normal_dev(sc->sc_dev,
    707 			    "no interrupt, flips will poll\n");
    708 	}
    709 
    710 	ws_aa.console = console;
    711 	ws_aa.scrdata = &sc->sc_screenlist;
    712 	ws_aa.accessops = &veritefb_accessops;
    713 	ws_aa.accesscookie = &sc->vd;
    714 
    715 	config_found(sc->sc_dev, &ws_aa, wsemuldisplaydevprint, CFARGS_NONE);
    716 
    717 #if defined(DDB) && defined(VERITEFB_DEBUG)
    718 	veritefb_ddb_attach(sc);
    719 #endif
    720 
    721 	/* Firmware needs a mounted root filesystem. */
    722 	config_mountroot(self, veritefb_load_firmware);
    723 }
    724 
    725 /*
    726  * Reset the chip, leaving the RISC held.
    727  */
    728 static void
    729 veritefb_risc_softreset(struct veritefb_softc *sc)
    730 {
    731 	int i;
    732 
    733 	vfb_write1(sc, VFB_DEBUG, VFB_DEBUG_SOFTRESET | VFB_DEBUG_HOLDRISC);
    734 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC);
    735 	for (i = 0; i < 3; i++)
    736 		(void)vfb_read4(sc, VFB_STATEDATA);
    737 
    738 	vfb_write1(sc, VFB_DEBUG, VFB_DEBUG_HOLDRISC);
    739 	for (i = 0; i < 3; i++)
    740 		(void)vfb_read4(sc, VFB_STATEDATA);
    741 
    742 	/* Clear any pending interrupts, no byte swapping. */
    743 	vfb_write1(sc, VFB_INTR, 0xff);
    744 	vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
    745 }
    746 
    747 /*
    748  * Make sure the RISC is held.
    749  */
    750 static void
    751 veritefb_risc_hold(struct veritefb_softc *sc)
    752 {
    753 	uint8_t debugreg;
    754 	int i;
    755 
    756 	for (i = 0; i < VFB_MAXPOLL; i++) {
    757 		if ((vfb_read1(sc, VFB_STATUS) & VFB_STATUS_HOLD_MASK) ==
    758 		    VFB_STATUS_HOLD_MASK)
    759 			break;
    760 		delay(1);
    761 	}
    762 	if (i == VFB_MAXPOLL)
    763 		aprint_debug_dev(sc->sc_dev,
    764 		    "timeout waiting for idle status before hold\n");
    765 
    766 	debugreg = vfb_read1(sc, VFB_DEBUG);
    767 	vfb_write1(sc, VFB_DEBUG, debugreg | VFB_DEBUG_HOLDRISC);
    768 
    769 	for (i = 0; i < VFB_MAXPOLL; i++) {
    770 		if (vfb_read1(sc, VFB_STATUS) & VFB_STATUS_HELD)
    771 			break;
    772 		delay(1);
    773 	}
    774 	if (i == VFB_MAXPOLL)
    775 		aprint_debug_dev(sc->sc_dev,
    776 		    "timeout waiting for hold confirmation\n");
    777 }
    778 
    779 /*
    780  * Probe the amount of VRAM by write/readback at 1 MB steps...
    781  */
    782 static size_t
    783 veritefb_mem_size(struct veritefb_softc *sc)
    784 {
    785 	const bus_size_t onemeg = 1024 * 1024;
    786 	bus_size_t offset, maxvram;
    787 	uint32_t pattern, start;
    788 	uint8_t modereg, memendian;
    789 	size_t memsize;
    790 
    791 	maxvram = MIN(VFB_MAXVRAM, sc->sc_apsize);
    792 
    793 	modereg = vfb_read1(sc, VFB_MODE);
    794 	vfb_write1(sc, VFB_MODE, VFB_MODE_NATIVE);
    795 	memendian = vfb_read1(sc, VFB_MEMENDIAN);
    796 	vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
    797 
    798 	start = vfb_fb_read4(sc, 0);
    799 	vfb_fb_write4(sc, 0, VFB_PROBE_START);
    800 	for (offset = onemeg; offset < maxvram; offset += onemeg) {
    801 		pattern = vfb_fb_read4(sc, offset);
    802 		if (pattern == VFB_PROBE_START)
    803 			break;	/* wrapped around, back at offset 0 */
    804 
    805 		pattern ^= VFB_PROBE_PATTERN;
    806 		vfb_fb_write4(sc, offset, pattern);
    807 		if (vfb_fb_read4(sc, offset) != pattern) {
    808 			offset -= onemeg;
    809 			break;
    810 		}
    811 		vfb_fb_write4(sc, offset, pattern ^ VFB_PROBE_PATTERN);
    812 	}
    813 	vfb_fb_write4(sc, 0, start);
    814 
    815 	if (offset >= maxvram)
    816 		memsize = 4 * onemeg;
    817 	else
    818 		memsize = offset;
    819 
    820 	vfb_write1(sc, VFB_MEMENDIAN, memendian);
    821 	vfb_write1(sc, VFB_MODE, modereg);
    822 
    823 	return memsize;
    824 }
    825 
    826 /*
    827  * Find PLL parameters for the requested pixel clock
    828  */
    829 static bool
    830 veritefb_calc_pclk(int kHz, int *m, int *n, int *p)
    831 {
    832 	int64_t target, vco, pcf, freq, diff, mindiff;
    833 	int mm, nn, pp;
    834 
    835 	target = (int64_t)kHz * 100;
    836 	mindiff = INT64_MAX;
    837 	*m = *n = *p = 0;
    838 
    839 	for (pp = 1; pp <= VFB_PLL_P_MAX; pp++) {
    840 		for (nn = 1; nn <= VFB_PLL_N_MAX; nn++) {
    841 			pcf = VFB_PLL_REF / nn;
    842 			if (pcf < VFB_PLL_PCF_MIN || pcf > VFB_PLL_PCF_MAX)
    843 				continue;
    844 			for (mm = 1; mm <= VFB_PLL_M_MAX; mm++) {
    845 				vco = (int64_t)VFB_PLL_REF * mm / nn;
    846 				if (vco < VFB_PLL_VCO_MIN ||
    847 				    vco > VFB_PLL_VCO_MAX)
    848 					continue;
    849 				freq = vco / pp;
    850 				diff = freq > target ?
    851 				    freq - target : target - freq;
    852 				if (diff < mindiff) {
    853 					*m = mm;
    854 					*n = nn;
    855 					*p = pp;
    856 					mindiff = diff;
    857 				}
    858 			}
    859 		}
    860 	}
    861 
    862 	return *m != 0;
    863 }
    864 
    865 /*
    866  * Smallest pixel-engine stride encoding that fits a line of the given
    867  * width... widths with no dense encoding get a padded framebuffer.
    868  */
    869 static const struct veritefb_stride *
    870 veritefb_stride_for(int linebytes)
    871 {
    872 	const struct veritefb_stride *st;
    873 
    874 	for (st = veritefb_stride_table; st->linebytes != 0; st++)
    875 		if (st->linebytes >= linebytes)
    876 			return st;
    877 	return NULL;
    878 }
    879 
    880 /*
    881  * Program a native (non-VGA) mode: memory/system clocks, pixel clock
    882  * PLL, RAMDAC, CRTC timing, frame base and stride, then enable video.
    883  */
    884 static bool
    885 veritefb_set_mode(struct veritefb_softc *sc, const struct videomode *vm)
    886 {
    887 	uint32_t memctl, crtcctl, offset, screenwidth;
    888 	int m, n, p;
    889 
    890 	if (!veritefb_calc_pclk(vm->dot_clock, &m, &n, &p)) {
    891 		aprint_error_dev(sc->sc_dev, "no PLL solution for %d kHz\n",
    892 		    vm->dot_clock);
    893 		return false;
    894 	}
    895 	aprint_debug_dev(sc->sc_dev, "PLL M=%d N=%d P=%d for %d kHz\n",
    896 	    m, n, p, vm->dot_clock);
    897 
    898 	/* Leave VGA emulation; no legacy 0xA0000 window. */
    899 	vfb_write1(sc, VFB_MODE, VFB_MODE_NATIVE);
    900 
    901 	/*
    902 	 * 8bpp this does not matter...
    903 	 * TODO: Revisit for 16/32bpp.
    904 	 */
    905 	switch (sc->sc_depth) {
    906 	case 8:
    907 		vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_END);
    908 		break;
    909 	case 16:
    910 		vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_HW);
    911 		break;
    912 	case 32:
    913 		vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
    914 		break;
    915 	}
    916 
    917 	/* System/memory clock: MClk 110 MHz, SClk 55 MHz. */
    918 	vfb_write4(sc, VFB_SCLKPLL, VFB_SCLKPLL_DEFAULT);
    919 	delay(VFB_PLL_STABILIZE_US);
    920 
    921 	/* Resume memory refresh, default write refresh period. */
    922 	memctl = vfb_read4(sc, VFB_MEMCTL) & ~VFB_MEMCTL_HOLDREFRESH;
    923 	vfb_write4(sc, VFB_MEMCTL, memctl | VFB_MEMCTL_WREFRESH_DEFAULT);
    924 
    925 	/* Native mode wants swizzled memory addressing. */
    926 	memctl = vfb_read4(sc, VFB_MEMCTL) & ~VFB_MEMCTL_ADRSWIZZLE_MASK;
    927 	vfb_write4(sc, VFB_MEMCTL, memctl);
    928 
    929 	vfb_write4(sc, VFB_PCLKPLL,
    930 	    __SHIFTIN((uint32_t)n, VFB_PCLKPLL_N_MASK) |
    931 	    __SHIFTIN((uint32_t)p, VFB_PCLKPLL_P_MASK) |
    932 	    __SHIFTIN((uint32_t)m, VFB_PCLKPLL_M_MASK));
    933 	delay(VFB_PLL_STABILIZE_US);
    934 
    935 	veritefb_init_dac(sc);
    936 
    937 	vfb_write4(sc, VFB_CRTCHORZ,
    938 	    __SHIFTIN((uint32_t)(vm->hsync_start - vm->hdisplay) / 8 - 1,
    939 		VFB_CRTCHORZ_FRONTPORCH_MASK) |
    940 	    __SHIFTIN((uint32_t)(vm->hsync_end - vm->hsync_start) / 8 - 1,
    941 		VFB_CRTCHORZ_SYNC_MASK) |
    942 	    __SHIFTIN((uint32_t)(vm->htotal - vm->hsync_end) / 8 - 1,
    943 		VFB_CRTCHORZ_BACKPORCH_MASK) |
    944 	    __SHIFTIN((uint32_t)vm->hdisplay / 8 - 1,
    945 		VFB_CRTCHORZ_ACTIVE_MASK));
    946 	vfb_write4(sc, VFB_CRTCVERT,
    947 	    __SHIFTIN((uint32_t)(vm->vsync_start - vm->vdisplay) - 1,
    948 		VFB_CRTCVERT_FRONTPORCH_MASK) |
    949 	    __SHIFTIN((uint32_t)(vm->vsync_end - vm->vsync_start) - 1,
    950 		VFB_CRTCVERT_SYNC_MASK) |
    951 	    __SHIFTIN((uint32_t)(vm->vtotal - vm->vsync_end) - 1,
    952 		VFB_CRTCVERT_BACKPORCH_MASK) |
    953 	    __SHIFTIN((uint32_t)vm->vdisplay - 1,
    954 		VFB_CRTCVERT_ACTIVE_MASK));
    955 
    956 	screenwidth = (uint32_t)sc->sc_width * (sc->sc_depth / 8);
    957 	offset = sc->sc_linebytes - screenwidth +
    958 	    screenwidth % VFB_VIDEOFIFO_BYTES;
    959 	if (screenwidth % VFB_VIDEOFIFO_BYTES == 0)
    960 		offset += VFB_VIDEOFIFO_BYTES;
    961 	vfb_write4(sc, VFB_FRAMEBASEA, (uint32_t)sc->sc_fb_offset);
    962 	vfb_write4(sc, VFB_CRTCOFFSET, offset & VFB_CRTCOFFSET_MASK);
    963 
    964 	crtcctl = (sc->sc_depth == 16 ? VFB_PIXFMT_565 : VFB_PIXFMT_8I) |
    965 	    VFB_CRTCCTL_VIDEOFIFOSIZE128 |
    966 	    ((vm->flags & VID_PHSYNC) ? VFB_CRTCCTL_HSYNCHI : 0) |
    967 	    ((vm->flags & VID_PVSYNC) ? VFB_CRTCCTL_VSYNCHI : 0) |
    968 	    VFB_CRTCCTL_HSYNCENABLE |
    969 	    VFB_CRTCCTL_VSYNCENABLE |
    970 	    VFB_CRTCCTL_VIDEOENABLE;
    971 	vfb_write4(sc, VFB_CRTCCTL, crtcctl);
    972 
    973 	return true;
    974 }
    975 
    976 #define VFB_DDC_PACE_US		5	/* between line transitions */
    977 #define VFB_DDC_STRETCH_US	1000	/* max tolerated clock stretch */
    978 
    979 static const struct i2c_bitbang_ops veritefb_i2cbb_ops = {
    980 	veritefb_i2cbb_set_bits,
    981 	veritefb_i2cbb_set_dir,
    982 	veritefb_i2cbb_read_bits,
    983 	{
    984 		VFB_CRTCCTL_DDCDATA,	/* SDA */
    985 		VFB_CRTCCTL_DDCOUTPUT,	/* SCL */
    986 		0,			/* open-drain: no direction flip */
    987 		0
    988 	}
    989 };
    990 
    991 /*
    992  * SDA in output mode is push-pull, so open-drain is emulated
    993  */
    994 static void
    995 veritefb_i2cbb_set_bits(void *cookie, uint32_t bits)
    996 {
    997 	struct veritefb_softc *sc = cookie;
    998 	uint32_t v;
    999 
   1000 	v = sc->sc_ddc_base & ~(VFB_CRTCCTL_DDCDATA |
   1001 	    VFB_CRTCCTL_DDCOUTPUT | VFB_CRTCCTL_ENABLEDDC);
   1002 	if (bits & VFB_CRTCCTL_DDCOUTPUT)
   1003 		v |= VFB_CRTCCTL_DDCOUTPUT;	/* SCL: release */
   1004 	if (bits & VFB_CRTCCTL_DDCDATA)
   1005 		v |= VFB_CRTCCTL_DDCDATA;	/* SDA high: mirror to latch */
   1006 	else
   1007 		v |= VFB_CRTCCTL_ENABLEDDC;	/* SDA: drive low (b7=0) */
   1008 
   1009 	sc->sc_ddc_base = v;
   1010 	vfb_write4(sc, VFB_CRTCCTL, v);
   1011 	delay(VFB_DDC_PACE_US);
   1012 }
   1013 
   1014 static void
   1015 veritefb_i2cbb_set_dir(void *cookie, uint32_t dir)
   1016 {
   1017 	/* open-drain emulation: direction is part of set_bits */
   1018 }
   1019 
   1020 static uint32_t
   1021 veritefb_i2cbb_read_bits(void *cookie)
   1022 {
   1023 	struct veritefb_softc *sc = cookie;
   1024 
   1025 	return vfb_read4(sc, VFB_CRTCCTL);
   1026 }
   1027 
   1028 /*
   1029  * I2C START, including a properly shaped repeated START.
   1030  */
   1031 static int
   1032 veritefb_i2c_send_start(void *cookie, int flags)
   1033 {
   1034 	struct veritefb_softc *sc = cookie;
   1035 	int bail;
   1036 
   1037 	if ((veritefb_i2cbb_read_bits(sc) & VFB_CRTCCTL_DDCOUTPUT) == 0) {
   1038 		veritefb_i2cbb_set_bits(sc, VFB_CRTCCTL_DDCDATA);
   1039 		delay(VFB_DDC_PACE_US);	/* SDA settle while SCL still low */
   1040 		veritefb_i2cbb_set_bits(sc,
   1041 		    VFB_CRTCCTL_DDCDATA | VFB_CRTCCTL_DDCOUTPUT);
   1042 		for (bail = 0; bail < VFB_DDC_STRETCH_US; bail++) {
   1043 			if (veritefb_i2cbb_read_bits(sc) &
   1044 			    VFB_CRTCCTL_DDCOUTPUT)
   1045 				break;
   1046 			delay(1);
   1047 		}
   1048 		delay(VFB_DDC_PACE_US);	/* START setup time (4.7 us) */
   1049 	}
   1050 	return i2c_bitbang_send_start(cookie, flags, &veritefb_i2cbb_ops);
   1051 }
   1052 
   1053 static int
   1054 veritefb_i2c_send_stop(void *cookie, int flags)
   1055 {
   1056 	return i2c_bitbang_send_stop(cookie, flags, &veritefb_i2cbb_ops);
   1057 }
   1058 
   1059 static int
   1060 veritefb_i2c_initiate_xfer(void *cookie, i2c_addr_t addr, int flags)
   1061 {
   1062 	return i2c_bitbang_initiate_xfer(cookie, addr, flags,
   1063 	    &veritefb_i2cbb_ops);
   1064 }
   1065 
   1066 static int
   1067 veritefb_i2c_read_byte(void *cookie, uint8_t *valp, int flags)
   1068 {
   1069 	return i2c_bitbang_read_byte(cookie, valp, flags,
   1070 	    &veritefb_i2cbb_ops);
   1071 }
   1072 
   1073 static int
   1074 veritefb_i2c_write_byte(void *cookie, uint8_t val, int flags)
   1075 {
   1076 	return i2c_bitbang_write_byte(cookie, val, flags,
   1077 	    &veritefb_i2cbb_ops);
   1078 }
   1079 
   1080 static void
   1081 veritefb_ddc_read(struct veritefb_softc *sc)
   1082 {
   1083 	int i;
   1084 
   1085 	/*
   1086 	 * Release both lines (SDA as input, SCL high-Z) before
   1087 	 * starting the controller.
   1088 	 */
   1089 	sc->sc_ddc_base = vfb_read4(sc, VFB_CRTCCTL) &
   1090 	    ~(VFB_CRTCCTL_DDCDATA | VFB_CRTCCTL_DDCOUTPUT |
   1091 	      VFB_CRTCCTL_ENABLEDDC);
   1092 	vfb_write4(sc, VFB_CRTCCTL,
   1093 	    sc->sc_ddc_base | VFB_CRTCCTL_DDCOUTPUT);
   1094 	sc->sc_ddc_base |= VFB_CRTCCTL_DDCOUTPUT;
   1095 
   1096 	iic_tag_init(&sc->sc_i2c);
   1097 	sc->sc_i2c.ic_cookie = sc;
   1098 	sc->sc_i2c.ic_send_start = veritefb_i2c_send_start;
   1099 	sc->sc_i2c.ic_send_stop = veritefb_i2c_send_stop;
   1100 	sc->sc_i2c.ic_initiate_xfer = veritefb_i2c_initiate_xfer;
   1101 	sc->sc_i2c.ic_read_byte = veritefb_i2c_read_byte;
   1102 	sc->sc_i2c.ic_write_byte = veritefb_i2c_write_byte;
   1103 
   1104 	/* Some monitors do not respond on the first attempt. */
   1105 	sc->sc_edid_valid = false;
   1106 	memset(sc->sc_edid, 0, sizeof(sc->sc_edid));
   1107 	for (i = 0; i < 3; i++) {
   1108 		if (ddc_read_edid(&sc->sc_i2c, sc->sc_edid,
   1109 		    sizeof(sc->sc_edid)) == 0 && sc->sc_edid[1] != 0)
   1110 			break;
   1111 		memset(sc->sc_edid, 0, sizeof(sc->sc_edid));
   1112 	}
   1113 
   1114 	if (sc->sc_edid[1] == 0) {
   1115 		aprint_normal_dev(sc->sc_dev, "DDC: no EDID response\n");
   1116 		return;
   1117 	}
   1118 
   1119 	if (edid_parse(sc->sc_edid, &sc->sc_ei) != 0) {
   1120 		aprint_error_dev(sc->sc_dev, "DDC: EDID parse failed\n");
   1121 		return;
   1122 	}
   1123 	sc->sc_edid_valid = true;
   1124 #ifdef VERITEFB_DEBUG
   1125 	edid_print(&sc->sc_ei);
   1126 #endif
   1127 }
   1128 
   1129 /*
   1130  * Can the hardware and this driver do the given mode?
   1131  */
   1132 static bool
   1133 veritefb_mode_usable(struct veritefb_softc *sc, const struct videomode *m)
   1134 {
   1135 	const struct veritefb_stride *st;
   1136 
   1137 	if (m->dot_clock > 170000)
   1138 		return false;
   1139 	if (m->flags & (VID_INTERLACE | VID_DBLSCAN))
   1140 		return false;
   1141 	if (m->hdisplay > 2048 || (m->hdisplay & 7) != 0 ||
   1142 	    m->vdisplay > 2047)
   1143 		return false;
   1144 	if ((m->hsync_start - m->hdisplay) / 8 - 1 > 0x7 ||
   1145 	    (m->hsync_end - m->hsync_start) / 8 - 1 > 0x1f ||
   1146 	    (m->htotal - m->hsync_end) / 8 - 1 > 0x3f ||
   1147 	    ((m->hsync_start - m->hdisplay) & 7) != 0 ||
   1148 	    ((m->hsync_end - m->hsync_start) & 7) != 0 ||
   1149 	    ((m->htotal - m->hsync_end) & 7) != 0)
   1150 		return false;
   1151 	if (m->vsync_start - m->vdisplay < 1 ||
   1152 	    m->vsync_start - m->vdisplay - 1 > 0x3f ||
   1153 	    m->vsync_end - m->vsync_start - 1 > 0x7 ||
   1154 	    m->vtotal - m->vsync_end - 1 > 0x3f)
   1155 		return false;
   1156 	/* one byte per pixel at 8bpp, the stride may be padded */
   1157 	st = veritefb_stride_for(m->hdisplay);
   1158 	if (st == NULL)
   1159 		return false;
   1160 	if ((bus_size_t)st->linebytes * m->vdisplay >
   1161 	    sc->sc_memsize - sc->sc_fb_offset)
   1162 		return false;
   1163 	return true;
   1164 }
   1165 
   1166 /*
   1167  * Choose the mode: the monitor's EDID preferred mode when usable,
   1168  * 640x480@60 from the modes database otherwise.
   1169  */
   1170 static void
   1171 veritefb_pick_mode(struct veritefb_softc *sc)
   1172 {
   1173 	const struct videomode *m;
   1174 
   1175 	sc->sc_videomode = pick_mode_by_ref(640, 480, 60);
   1176 	KASSERT(sc->sc_videomode != NULL);
   1177 
   1178 	if (!sc->sc_edid_valid || sc->sc_ei.edid_preferred_mode == NULL)
   1179 		return;
   1180 
   1181 	m = sc->sc_ei.edid_preferred_mode;
   1182 	if (!veritefb_mode_usable(sc, m)) {
   1183 		aprint_normal_dev(sc->sc_dev,
   1184 		    "EDID preferred mode %dx%d (%d kHz) not usable, "
   1185 		    "using default\n",
   1186 		    m->hdisplay, m->vdisplay, m->dot_clock);
   1187 		return;
   1188 	}
   1189 
   1190 	aprint_normal_dev(sc->sc_dev, "using EDID mode %dx%d (%d kHz)\n",
   1191 	    m->hdisplay, m->vdisplay, m->dot_clock);
   1192 	sc->sc_videomode = m;
   1193 }
   1194 
   1195 /*
   1196  * Initialize the Bt485-compatible RAMDAC core
   1197  */
   1198 static void
   1199 veritefb_init_dac(struct veritefb_softc *sc)
   1200 {
   1201 	uint8_t cmd1;
   1202 
   1203 	if (sc->sc_depth == 16)
   1204 		cmd1 = VFB_DACCMD1_16BPP | VFB_DACCMD1_BYPASS_CLUT |
   1205 		    VFB_DACCMD1_565 | VFB_DACCMD1_PORT_AB;
   1206 	else
   1207 		cmd1 = VFB_DACCMD1_8BPP | VFB_DACCMD1_PORT_AB;
   1208 
   1209 	vfb_write1(sc, VFB_DACCOMMAND0,
   1210 	    VFB_DACCMD0_EXTENDED | VFB_DACCMD0_8BITDAC);
   1211 	vfb_write1(sc, VFB_DACCOMMAND1, cmd1);
   1212 	vfb_write1(sc, VFB_DACCOMMAND2,
   1213 	    VFB_DACCMD2_PIXEL_INPUT_GATE | VFB_DACCMD2_DISABLE_CURSOR);
   1214 
   1215 	/* Command register 3 is indexed through the write address. */
   1216 	vfb_write1(sc, VFB_DACRAMWRITEADR, VFB_DACCMD3_INDEX);
   1217 	vfb_write1(sc, VFB_DACCOMMAND3, 0);
   1218 
   1219 	vfb_write1(sc, VFB_DACPIXELMSK, 0xff);
   1220 }
   1221 
   1222 /*
   1223  * Wait for vertical sync so palette updates do not tear.
   1224  */
   1225 static void
   1226 veritefb_wait_vsync(struct veritefb_softc *sc)
   1227 {
   1228 	int i;
   1229 
   1230 	for (i = 0; i < VFB_VSYNCPOLL; i++) {
   1231 		if ((vfb_read4(sc, VFB_CRTCSTATUS) &
   1232 		    VFB_CRTCSTATUS_VERT_MASK) == VFB_CRTCSTATUS_VERT_SYNC)
   1233 			break;
   1234 		delay(1);
   1235 	}
   1236 }
   1237 
   1238 static void
   1239 veritefb_set_dac_entry(struct veritefb_softc *sc, int index,
   1240     uint8_t r, uint8_t g, uint8_t b)
   1241 {
   1242 	vfb_write1(sc, VFB_DACRAMWRITEADR, index);
   1243 	vfb_write1(sc, VFB_DACRAMDATA, r);
   1244 	vfb_write1(sc, VFB_DACRAMDATA, g);
   1245 	vfb_write1(sc, VFB_DACRAMDATA, b);
   1246 }
   1247 
   1248 static void
   1249 veritefb_init_palette(struct veritefb_softc *sc)
   1250 {
   1251 	int i, j;
   1252 
   1253 	j = 0;
   1254 	veritefb_wait_vsync(sc);
   1255 	for (i = 0; i < 256; i++) {
   1256 		sc->sc_cmap_red[i] = rasops_cmap[j];
   1257 		sc->sc_cmap_green[i] = rasops_cmap[j + 1];
   1258 		sc->sc_cmap_blue[i] = rasops_cmap[j + 2];
   1259 		veritefb_set_dac_entry(sc, i, rasops_cmap[j],
   1260 		    rasops_cmap[j + 1], rasops_cmap[j + 2]);
   1261 		j += 3;
   1262 	}
   1263 }
   1264 
   1265 static int
   1266 veritefb_getcmap(struct veritefb_softc *sc, struct wsdisplay_cmap *cm)
   1267 {
   1268 	u_int index = cm->index;
   1269 	u_int count = cm->count;
   1270 	int error;
   1271 
   1272 	if (index >= 256 || count > 256 || index + count > 256)
   1273 		return EINVAL;
   1274 
   1275 	error = copyout(&sc->sc_cmap_red[index], cm->red, count);
   1276 	if (error)
   1277 		return error;
   1278 	error = copyout(&sc->sc_cmap_green[index], cm->green, count);
   1279 	if (error)
   1280 		return error;
   1281 	error = copyout(&sc->sc_cmap_blue[index], cm->blue, count);
   1282 	if (error)
   1283 		return error;
   1284 
   1285 	return 0;
   1286 }
   1287 
   1288 static int
   1289 veritefb_putcmap(struct veritefb_softc *sc, struct wsdisplay_cmap *cm)
   1290 {
   1291 	u_char rbuf[256], gbuf[256], bbuf[256];
   1292 	u_int index = cm->index;
   1293 	u_int count = cm->count;
   1294 	int i, error;
   1295 
   1296 	if (index >= 256 || count > 256 || index + count > 256)
   1297 		return EINVAL;
   1298 
   1299 	error = copyin(cm->red, &rbuf[index], count);
   1300 	if (error)
   1301 		return error;
   1302 	error = copyin(cm->green, &gbuf[index], count);
   1303 	if (error)
   1304 		return error;
   1305 	error = copyin(cm->blue, &bbuf[index], count);
   1306 	if (error)
   1307 		return error;
   1308 
   1309 	memcpy(&sc->sc_cmap_red[index], &rbuf[index], count);
   1310 	memcpy(&sc->sc_cmap_green[index], &gbuf[index], count);
   1311 	memcpy(&sc->sc_cmap_blue[index], &bbuf[index], count);
   1312 
   1313 	veritefb_wait_vsync(sc);
   1314 	for (i = index; i < index + count; i++)
   1315 		veritefb_set_dac_entry(sc, i, sc->sc_cmap_red[i],
   1316 		    sc->sc_cmap_green[i], sc->sc_cmap_blue[i]);
   1317 
   1318 	return 0;
   1319 }
   1320 
   1321 static void
   1322 veritefb_init_screen(void *cookie, struct vcons_screen *scr, int existing,
   1323     long *defattr)
   1324 {
   1325 	struct veritefb_softc *sc = cookie;
   1326 	struct rasops_info *ri = &scr->scr_ri;
   1327 
   1328 	wsfont_init();
   1329 
   1330 	ri->ri_depth = sc->sc_depth;
   1331 	ri->ri_width = sc->sc_width;
   1332 	ri->ri_height = sc->sc_height;
   1333 	ri->ri_stride = sc->sc_linebytes;
   1334 	ri->ri_flg = RI_CENTER;
   1335 
   1336 	ri->ri_bits = (char *)bus_space_vaddr(sc->sc_memt, sc->sc_memh) +
   1337 	    sc->sc_fb_offset;
   1338 
   1339 	scr->scr_flags |= VCONS_NO_CURSOR;
   1340 
   1341 	rasops_init(ri, 0, 0);
   1342 	ri->ri_caps = WSSCREEN_WSCOLORS;
   1343 	rasops_reconfig(ri, sc->sc_height / ri->ri_font->fontheight,
   1344 	    sc->sc_width / ri->ri_font->fontwidth);
   1345 
   1346 	ri->ri_hw = scr;
   1347 
   1348 	sc->sc_orig_eraserows = ri->ri_ops.eraserows;
   1349 	sc->sc_orig_erasecols = ri->ri_ops.erasecols;
   1350 	sc->sc_orig_copyrows = ri->ri_ops.copyrows;
   1351 	sc->sc_orig_copycols = ri->ri_ops.copycols;
   1352 	sc->sc_orig_putchar = ri->ri_ops.putchar;
   1353 	ri->ri_ops.eraserows = veritefb_eraserows;
   1354 	ri->ri_ops.erasecols = veritefb_erasecols;
   1355 	ri->ri_ops.copyrows = veritefb_copyrows;
   1356 	ri->ri_ops.copycols = veritefb_copycols;
   1357 	ri->ri_ops.putchar = veritefb_putchar;
   1358 }
   1359 
   1360 static int
   1361 veritefb_ioctl(void *v, void *vs, u_long cmd, void *data, int flag,
   1362     struct lwp *l)
   1363 {
   1364 	struct vcons_data *vd;
   1365 	struct veritefb_softc *sc;
   1366 	struct wsdisplay_fbinfo *wsfbi;
   1367 	struct vcons_screen *ms;
   1368 
   1369 	vd = v;
   1370 	sc = vd->cookie;
   1371 	ms = vd->active;
   1372 
   1373 	switch (cmd) {
   1374 	case WSDISPLAYIO_GTYPE:
   1375 		*(u_int *)data = WSDISPLAY_TYPE_PCIMISC;
   1376 		return 0;
   1377 
   1378 	case PCI_IOC_CFGREAD:
   1379 	case PCI_IOC_CFGWRITE:
   1380 		return pci_devioctl(sc->sc_pc, sc->sc_pcitag,
   1381 		    cmd, data, flag, l);
   1382 
   1383 	case WSDISPLAYIO_GET_BUSID:
   1384 		return wsdisplayio_busid_pci(sc->sc_dev, sc->sc_pc,
   1385 		    sc->sc_pcitag, data);
   1386 
   1387 	case WSDISPLAYIO_GINFO:
   1388 		if (ms == NULL)
   1389 			return ENODEV;
   1390 
   1391 		wsfbi = (void *)data;
   1392 		wsfbi->height = ms->scr_ri.ri_height;
   1393 		wsfbi->width = ms->scr_ri.ri_width;
   1394 		wsfbi->depth = ms->scr_ri.ri_depth;
   1395 		wsfbi->cmsize = 256;
   1396 		return 0;
   1397 
   1398 	case WSDISPLAYIO_LINEBYTES:
   1399 		*(u_int *)data = sc->sc_linebytes;
   1400 		return 0;
   1401 
   1402 	case WSDISPLAYIO_GETCMAP:
   1403 		return veritefb_getcmap(sc, (struct wsdisplay_cmap *)data);
   1404 
   1405 	case WSDISPLAYIO_PUTCMAP:
   1406 		return veritefb_putcmap(sc, (struct wsdisplay_cmap *)data);
   1407 
   1408 	case WSDISPLAYIO_SMODE:
   1409 		{
   1410 			int new_mode = *(int *)data;
   1411 
   1412 			/* sync/hold/reload flows below PIO the FIFO */
   1413 			(void)veritefb_dma_drain(sc);
   1414 			if (new_mode != sc->sc_mode) {
   1415 				sc->sc_mode = new_mode;
   1416 				if (new_mode == WSDISPLAYIO_MODE_EMUL) {
   1417 					/*
   1418 					 * reload and restart the microcode
   1419 					 */
   1420 					if (sc->sc_accel == VFB_ACCEL_ON ||
   1421 					    (sc->sc_accel == VFB_ACCEL_OFF &&
   1422 					     sc->sc_ucode != NULL))
   1423 						(void)veritefb_risc_init(sc);
   1424 					if (sc->sc_gc_initted)
   1425 						glyphcache_wipe(&sc->sc_gc);
   1426 					veritefb_init_palette(sc);
   1427 					vcons_redraw_screen(ms);
   1428 				} else {
   1429 					if (sc->sc_accel == VFB_ACCEL_ON) {
   1430 						veritefb_sync(sc);
   1431 						(void)veritefb_drain_outfifo(
   1432 						    sc);
   1433 						veritefb_risc_hold(sc);
   1434 						sc->sc_accel = VFB_ACCEL_OFF;
   1435 					} else if (sc->sc_risc_owner !=
   1436 					    VFB_OWNER_CONSOLE) {
   1437 						veritefb_risc_hold(sc);
   1438 						sc->sc_risc_owner =
   1439 						    VFB_OWNER_CONSOLE;
   1440 					}
   1441 				}
   1442 			}
   1443 			return 0;
   1444 		}
   1445 
   1446 	case WSDISPLAYIO_GET_FBINFO:
   1447 		{
   1448 			struct wsdisplayio_fbinfo *fbi = data;
   1449 			struct rasops_info *ri;
   1450 
   1451 			ri = &sc->vd.active->scr_ri;
   1452 			return wsdisplayio_get_fbinfo(ri, fbi);
   1453 		}
   1454 
   1455 #ifdef VERITEFB_DEBUG
   1456 	/* RISC debug surface, VERITEFB_DEBUG kernels only. */
   1457 	case VERITEFB_DBG_DIAG:
   1458 		{
   1459 			struct veritefb_dbg_diag *dd = data;
   1460 			unsigned i, n;
   1461 
   1462 			dd->vd_accel = sc->sc_accel;
   1463 			dd->vd_owner = sc->sc_risc_owner;
   1464 			dd->vd_pc = veritefb_risc_samplepc(sc);
   1465 			dd->vd_fifoinfree = vfb_read1(sc, VFB_FIFOINFREE) &
   1466 			    VFB_FIFOINFREE_MASK;
   1467 			dd->vd_fifooutvalid = vfb_read1(sc,
   1468 			    VFB_FIFOOUTVALID) & VFB_FIFOOUTVALID_MASK;
   1469 			dd->vd_debugreg = vfb_read1(sc, VFB_DEBUG);
   1470 			dd->vd_ringcount = sc->sc_ring_count;
   1471 			n = MIN(sc->sc_ring_count, VERITEFB_DIAG_RING);
   1472 			memset(dd->vd_ring, 0, sizeof(dd->vd_ring));
   1473 			for (i = 0; i < n; i++)
   1474 				dd->vd_ring[VERITEFB_DIAG_RING - n + i] =
   1475 				    sc->sc_ring[(sc->sc_ring_count - n + i) &
   1476 				    (VFB_RING_SIZE - 1)];
   1477 
   1478 			dd->vd_heartbeat = 1;
   1479 			if (sc->sc_accel == VFB_ACCEL_ON) {
   1480 				uint32_t word = 0;
   1481 
   1482 				veritefb_sync(sc);
   1483 				dd->vd_heartbeat = 2;
   1484 				for (i = 0; i < VFB_DRAINPOLL; i++) {
   1485 					if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   1486 					    VFB_FIFOOUTVALID_MASK) == 0)
   1487 						break;
   1488 					(void)vfb_fifo_read(sc);
   1489 				}
   1490 				if ((vfb_read1(sc, VFB_FIFOINFREE) &
   1491 				    VFB_FIFOINFREE_MASK) >= 1) {
   1492 					vfb_fifo_write(sc,
   1493 					    VFB_CMDW(0, VCMD_PIXENGSYNC));
   1494 					for (i = 0; i < VFB_FIFOPOLL; i++) {
   1495 						if ((vfb_read1(sc,
   1496 						    VFB_FIFOOUTVALID) &
   1497 						    VFB_FIFOOUTVALID_MASK)
   1498 						    != 0) {
   1499 							word =
   1500 							    vfb_fifo_read(sc);
   1501 							break;
   1502 						}
   1503 						delay(1);
   1504 					}
   1505 					if (word == VFB_SYNC_TOKEN)
   1506 						dd->vd_heartbeat = 0;
   1507 				}
   1508 			} else if (sc->sc_risc_owner == VFB_OWNER_PARKED) {
   1509 				uint32_t word;
   1510 
   1511 				/*
   1512 				 * XXX: foreign microcode would eat the ping
   1513 				 * as a command!
   1514 				 */
   1515 				(void)veritefb_dma_drain(sc);
   1516 				dd->vd_heartbeat = 2;
   1517 				if (veritefb_drain_outfifo(sc) == 0 &&
   1518 				    veritefb_waitfifo_raw(sc, 1,
   1519 				      VFB_FIFOPOLL) == 0) {
   1520 					vfb_fifo_write(sc, VFB_CSUCODE_PING);
   1521 					if (veritefb_read_outfifo_raw(sc,
   1522 					      &word, VFB_FIFOPOLL) == 0 &&
   1523 					    word == VFB_CSUCODE_PING)
   1524 						dd->vd_heartbeat = 0;
   1525 				}
   1526 			}
   1527 			return 0;
   1528 		}
   1529 
   1530 	case VERITEFB_DBG_HOLD:
   1531 		veritefb_risc_hold(sc);
   1532 		return 0;
   1533 
   1534 	case VERITEFB_DBG_CONT:
   1535 		veritefb_risc_continue(sc);
   1536 		return 0;
   1537 
   1538 	case VERITEFB_DBG_RDREG:
   1539 		{
   1540 			struct veritefb_dbg_rw *vr = data;
   1541 
   1542 			if ((vfb_read1(sc, VFB_DEBUG) &
   1543 			    VFB_DEBUG_HOLDRISC) == 0)
   1544 				return EBUSY;	/* hold first */
   1545 			if (vr->vr_addr > 255)
   1546 				return EINVAL;
   1547 			vr->vr_val = veritefb_risc_readrf(sc, vr->vr_addr);
   1548 			return 0;
   1549 		}
   1550 
   1551 	case VERITEFB_DBG_RDMEM:
   1552 		{
   1553 			struct veritefb_dbg_rw *vr = data;
   1554 
   1555 			if ((vfb_read1(sc, VFB_DEBUG) &
   1556 			    VFB_DEBUG_HOLDRISC) == 0)
   1557 				return EBUSY;	/* hold first */
   1558 			vr->vr_val = veritefb_risc_readmem(sc, vr->vr_addr);
   1559 			return 0;
   1560 		}
   1561 
   1562 	case VERITEFB_DBG_FAULT:
   1563 		/*
   1564 		 * Only against the 2D loop
   1565 		 */
   1566 		if (sc->sc_risc_owner != VFB_OWNER_CONSOLE)
   1567 			return EBUSY;
   1568 		aprint_normal_dev(sc->sc_dev,
   1569 		    "debug: deliberately sending an invalid command\n");
   1570 		vfb_fifo_write(sc, VFB_CMDW(0, VFB_CMD_BOGUS));
   1571 		return 0;
   1572 
   1573 	case VERITEFB_DBG_RESET:
   1574 		/* Full recovery includes the console scanout mode. */
   1575 		if (sc->sc_depth != 8)
   1576 			(void)veritefb_set_scan_depth(sc, 8);
   1577 		*(int *)data = veritefb_risc_init(sc) ? 1 : 0;
   1578 		return 0;
   1579 
   1580 	case VERITEFB_DBG_STATS:
   1581 		memcpy(data, &sc->sc_stats, sizeof(sc->sc_stats));
   1582 		return 0;
   1583 
   1584 	case VERITEFB_DBG_STATCLR:
   1585 		memset(&sc->sc_stats, 0, sizeof(sc->sc_stats));
   1586 		return 0;
   1587 
   1588 	case VERITEFB_DBG_PCSAMPLE:
   1589 		{
   1590 			struct veritefb_dbg_pcsample *ps = data;
   1591 
   1592 			if (ps->vp_shift >= 32)
   1593 				return EINVAL;
   1594 			sc->sc_pcsample_on = false;
   1595 			callout_stop(&sc->sc_pcsample_ch);
   1596 			/* reset the histogram on every (re)arm */
   1597 			memset(sc->sc_pchist, 0, sizeof(sc->sc_pchist));
   1598 			sc->sc_pchist_samples = 0;
   1599 			sc->sc_pchist_missed = 0;
   1600 			sc->sc_pchist_min = ~0u;
   1601 			sc->sc_pchist_max = 0;
   1602 			if (ps->vp_hz == 0)
   1603 				return 0;	/* stop only */
   1604 			sc->sc_pchist_base = ps->vp_base;
   1605 			sc->sc_pchist_shift = ps->vp_shift;
   1606 			sc->sc_pcsample_hz = ps->vp_hz > (uint32_t)hz ?
   1607 			    (uint32_t)hz : ps->vp_hz;
   1608 			sc->sc_pcsample_on = true;
   1609 			callout_schedule(&sc->sc_pcsample_ch, 1);
   1610 			return 0;
   1611 		}
   1612 
   1613 	case VERITEFB_DBG_PCHIST:
   1614 		{
   1615 			struct veritefb_dbg_pchist *ph = data;
   1616 
   1617 			ph->vp_samples = sc->sc_pchist_samples;
   1618 			ph->vp_missed = sc->sc_pchist_missed;
   1619 			ph->vp_base = sc->sc_pchist_base;
   1620 			ph->vp_shift = sc->sc_pchist_shift;
   1621 			ph->vp_min = sc->sc_pchist_min;
   1622 			ph->vp_max = sc->sc_pchist_max;
   1623 			memcpy(ph->vp_hist, sc->sc_pchist,
   1624 			    sizeof(ph->vp_hist));
   1625 			return 0;
   1626 		}
   1627 
   1628 	case VERITEFB_DBG_RDIO:
   1629 		{
   1630 			struct veritefb_dbg_rw *vr = data;
   1631 
   1632 			if ((vr->vr_addr &
   1633 			    ~(uint32_t)VERITEFB_DBG_IO_IOSPACE) > 0xff)
   1634 				return EINVAL;
   1635 			if (vr->vr_addr & VERITEFB_DBG_IO_IOSPACE)
   1636 				vr->vr_val = bus_space_read_1(sc->sc_iot,
   1637 				    sc->sc_ioh, vr->vr_addr & 0xff);
   1638 			else
   1639 				vr->vr_val = vfb_read1(sc, vr->vr_addr);
   1640 			return 0;
   1641 		}
   1642 
   1643 	case VERITEFB_DBG_WRIO:
   1644 		{
   1645 			struct veritefb_dbg_rw *vr = data;
   1646 
   1647 			if ((vr->vr_addr &
   1648 			    ~(uint32_t)VERITEFB_DBG_IO_IOSPACE) > 0xff)
   1649 				return EINVAL;
   1650 			if (vr->vr_addr & VERITEFB_DBG_IO_IOSPACE)
   1651 				bus_space_write_1(sc->sc_iot, sc->sc_ioh,
   1652 				    vr->vr_addr & 0xff, vr->vr_val);
   1653 			else
   1654 				vfb_write1(sc, vr->vr_addr, vr->vr_val);
   1655 			return 0;
   1656 		}
   1657 
   1658 	/* RISC multiplexing experiment. */
   1659 	case VERITEFB_DBG_SUSPEND2D:
   1660 		if (sc->sc_v3d_open)
   1661 			return EBUSY;	/* /dev/verite3d owns the mux */
   1662 		return veritefb_suspend2d(sc);
   1663 
   1664 	case VERITEFB_DBG_RESUME2D:
   1665 		if (sc->sc_v3d_open)
   1666 			return EBUSY;
   1667 		return veritefb_resume2d(sc);
   1668 
   1669 	case VERITEFB_DBG_UCLOAD:
   1670 		{
   1671 			struct veritefb_dbg_ucload *vu = data;
   1672 			uint8_t *img;
   1673 			uint32_t entry;
   1674 			int error;
   1675 			bool loaded;
   1676 
   1677 			if (sc->sc_mode != WSDISPLAYIO_MODE_EMUL ||
   1678 			    sc->sc_ucode == NULL)
   1679 				return EBUSY;
   1680 			if (vu->vu_size < sizeof(Elf32_Ehdr) ||
   1681 			    vu->vu_size > VFB_MAXUCODE)
   1682 				return EINVAL;
   1683 
   1684 			/* All user-memory access before any hw touch. */
   1685 			img = kmem_alloc(vu->vu_size, KM_SLEEP);
   1686 			error = copyin(vu->vu_data, img, vu->vu_size);
   1687 			if (error != 0) {
   1688 				kmem_free(img, vu->vu_size);
   1689 				return error;
   1690 			}
   1691 
   1692 			/*
   1693 			 * Write the image while the 2D blob still runs
   1694 			 */
   1695 			loaded = veritefb_ucode_load(sc, img, vu->vu_size,
   1696 			    VFB_UCF_BASE, VFB_UCF_END, false, &entry);
   1697 			kmem_free(img, vu->vu_size);
   1698 			if (!loaded)
   1699 				return EINVAL;
   1700 			if (!veritefb_risc_init(sc))
   1701 				return EIO;
   1702 			vu->vu_entry = entry;
   1703 			return 0;
   1704 		}
   1705 
   1706 	case VERITEFB_DBG_FIFOWR:
   1707 		{
   1708 			struct veritefb_dbg_fifowr *vf = data;
   1709 			uint32_t i;
   1710 			int error;
   1711 
   1712 			if (sc->sc_risc_owner == VFB_OWNER_CONSOLE ||
   1713 			    sc->sc_accel == VFB_ACCEL_SW)
   1714 				return EBUSY;
   1715 			if (vf->vf_count < 1 ||
   1716 			    vf->vf_count > VFB_DBG_FIFO_MAX)
   1717 				return EINVAL;
   1718 			if (vf->vf_setowner != VERITEFB_SETOWNER_KEEP &&
   1719 			    vf->vf_setowner != VFB_OWNER_PARKED &&
   1720 			    vf->vf_setowner != VFB_OWNER_FOREIGN)
   1721 				return EINVAL;
   1722 
   1723 			/* PIO into the FIFO: settle any DBG DMA first */
   1724 			(void)veritefb_dma_drain(sc);
   1725 			error = veritefb_waitfifo_raw(sc, vf->vf_count,
   1726 			    VFB_FIFOPOLL);
   1727 			if (error != 0)
   1728 				return error;
   1729 			for (i = 0; i < vf->vf_count; i++)
   1730 				vfb_fifo_write(sc, vf->vf_words[i]);
   1731 			if (vf->vf_setowner != VERITEFB_SETOWNER_KEEP)
   1732 				sc->sc_risc_owner = vf->vf_setowner;
   1733 			return 0;
   1734 		}
   1735 
   1736 	case VERITEFB_DBG_FIFORD:
   1737 		{
   1738 			struct veritefb_dbg_fiford *vf = data;
   1739 
   1740 			if (sc->sc_risc_owner == VFB_OWNER_CONSOLE)
   1741 				return EBUSY;
   1742 			return veritefb_read_outfifo_raw(sc, &vf->vf_word,
   1743 			    MIN(vf->vf_timo_us, VFB_FIFOPOLL));
   1744 		}
   1745 
   1746 	case VERITEFB_DBG_SETDEPTH:
   1747 		/* Never yank the scanout under the live console. */
   1748 		if (sc->sc_risc_owner == VFB_OWNER_CONSOLE ||
   1749 		    sc->sc_v3d_open)
   1750 			return EBUSY;
   1751 		return veritefb_set_scan_depth(sc,
   1752 		    (int)*(const uint32_t *)data);
   1753 
   1754 	case VERITEFB_DBG_DMASUBMIT:
   1755 		{
   1756 			struct veritefb_dbg_dma *vdd = data;
   1757 			int error;
   1758 
   1759 			/* exclusion rule: no console PIO while DMABusy */
   1760 			if (sc->sc_risc_owner == VFB_OWNER_CONSOLE ||
   1761 			    sc->sc_v3d_open)
   1762 				return EBUSY;
   1763 			if (vdd->vd_len == 0 ||
   1764 			    vdd->vd_len > VFB_DMA_BOUNCE ||
   1765 			    (vdd->vd_len & 3) != 0 || vdd->vd_swap > 3)
   1766 				return EINVAL;
   1767 			error = veritefb_dma_alloc(sc);
   1768 			if (error)
   1769 				return error;
   1770 			error = copyin((const void *)(uintptr_t)vdd->vd_buf,
   1771 			    sc->sc_dma_buf, vdd->vd_len);
   1772 			if (error)
   1773 				return error;
   1774 			return veritefb_dma_submit(sc, sc->sc_dma_buf_map,
   1775 			    vdd->vd_len, vdd->vd_swap);
   1776 		}
   1777 
   1778 	case VERITEFB_DBG_RDVRAM:
   1779 		{
   1780 			struct veritefb_dbg_rw *vr = data;
   1781 			uint8_t memendian;
   1782 
   1783 			if (vr->vr_addr >= VFB_MC_SIZE ||
   1784 			    (vr->vr_addr & 3) != 0)
   1785 				return EINVAL;
   1786 			memendian = vfb_read1(sc, VFB_MEMENDIAN);
   1787 			vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
   1788 			vr->vr_val = vfb_fb_read4(sc, vr->vr_addr);
   1789 			vfb_write1(sc, VFB_MEMENDIAN, memendian);
   1790 			return 0;
   1791 		}
   1792 
   1793 #endif /* VERITEFB_DEBUG */
   1794 	}
   1795 	return EPASSTHROUGH;
   1796 }
   1797 
   1798 static paddr_t
   1799 veritefb_mmap(void *v, void *vs, off_t offset, int prot)
   1800 {
   1801 	struct vcons_data *vd;
   1802 	struct veritefb_softc *sc;
   1803 
   1804 	vd = v;
   1805 	sc = vd->cookie;
   1806 
   1807 	if (offset >= 0 && offset < sc->sc_memsize - sc->sc_fb_offset)
   1808 		return bus_space_mmap(sc->sc_memt,
   1809 		    sc->sc_fb_paddr + sc->sc_fb_offset + offset,
   1810 		    0, prot, BUS_SPACE_MAP_LINEAR);
   1811 
   1812 	return -1;
   1813 }
   1814 
   1815 static void
   1816 veritefb_risc_continue(struct veritefb_softc *sc)
   1817 {
   1818 	uint8_t debugreg;
   1819 
   1820 	debugreg = vfb_read1(sc, VFB_DEBUG);
   1821 	vfb_write1(sc, VFB_DEBUG, debugreg & ~VFB_DEBUG_HOLDRISC);
   1822 	vfb_pacepoll4(sc, VFB_STATEDATA, 0, 0);
   1823 }
   1824 
   1825 /*
   1826  * Force one instruction into the RISC decoder and single-step it
   1827  */
   1828 static void
   1829 veritefb_risc_forcestep(struct veritefb_softc *sc, uint32_t insn)
   1830 {
   1831 	uint8_t debugreg, stateindex;
   1832 	int i;
   1833 
   1834 	debugreg = vfb_read1(sc, VFB_DEBUG);
   1835 	stateindex = vfb_read1(sc, VFB_STATEINDEX);
   1836 
   1837 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_IR);
   1838 	vfb_pacepoll1(sc, VFB_STATEINDEX, VFB_STATEINDEX_IR, 0xff);
   1839 	vfb_write4(sc, VFB_STATEDATA, insn);
   1840 	vfb_pacepoll4(sc, VFB_STATEDATA, insn, 0xffffffff);
   1841 	vfb_write1(sc, VFB_DEBUG,
   1842 	    debugreg | VFB_DEBUG_HOLDRISC | VFB_DEBUG_STEPRISC);
   1843 	vfb_pacepoll4(sc, VFB_STATEDATA, 0, 0);
   1844 
   1845 	for (i = 0; i < VFB_SHORTPOLL; i++)
   1846 		if ((vfb_read1(sc, VFB_DEBUG) &
   1847 		    (VFB_DEBUG_HOLDRISC | VFB_DEBUG_STEPRISC)) ==
   1848 		    VFB_DEBUG_HOLDRISC)
   1849 			break;
   1850 
   1851 	vfb_write1(sc, VFB_STATEINDEX, stateindex);
   1852 }
   1853 
   1854 /*
   1855  * Set a register-file entry by force-feeding load-immediate sequences
   1856  */
   1857 static void
   1858 veritefb_risc_writerf(struct veritefb_softc *sc, uint8_t idx, uint32_t data)
   1859 {
   1860 	uint8_t special = 0;
   1861 
   1862 	if (idx < 64) {
   1863 		special = idx;
   1864 		idx = VRISC_SP;
   1865 	}
   1866 
   1867 	if ((data & 0xff000000) == 0) {
   1868 		veritefb_risc_forcestep(sc,
   1869 		    VRISC_LI(VRISC_LI_OP, idx, data & 0xffff));
   1870 		if (data & 0x00ff0000)
   1871 			veritefb_risc_forcestep(sc,
   1872 			    VRISC_INT(VRISC_ADDIFI_OP, idx, idx, data >> 16));
   1873 	} else {
   1874 		veritefb_risc_forcestep(sc,
   1875 		    VRISC_LI(VRISC_LUI_OP, idx, data >> 16));
   1876 		veritefb_risc_forcestep(sc,
   1877 		    VRISC_INT(VRISC_ADDSL8_OP, idx, idx, (data >> 8) & 0xff));
   1878 		veritefb_risc_forcestep(sc,
   1879 		    VRISC_INT(VRISC_ADDI_OP, idx, idx, data & 0xff));
   1880 	}
   1881 
   1882 	if (special) {
   1883 		veritefb_risc_forcestep(sc,
   1884 		    VRISC_INT(VRISC_ADD_OP, special, 0, VRISC_SP));
   1885 		veritefb_risc_forcestep(sc, VRISC_NOP);
   1886 		veritefb_risc_forcestep(sc, VRISC_NOP);
   1887 		veritefb_risc_forcestep(sc, VRISC_NOP);
   1888 	}
   1889 }
   1890 
   1891 /* Read a register-file entry through the S1 operand bus */
   1892 static uint32_t
   1893 veritefb_risc_readrf(struct veritefb_softc *sc, uint8_t idx)
   1894 {
   1895 	uint32_t data, insn;
   1896 	uint8_t debugreg, stateindex;
   1897 
   1898 	debugreg = vfb_read1(sc, VFB_DEBUG);
   1899 	stateindex = vfb_read1(sc, VFB_STATEINDEX);
   1900 
   1901 	vfb_write1(sc, VFB_DEBUG, debugreg | VFB_DEBUG_HOLDRISC);
   1902 
   1903 	/* add zero, zero, idx: puts RF[idx] on the S1 bus, no step needed */
   1904 	insn = VRISC_INT(VRISC_ADD_OP, 0, 0, idx);
   1905 	vfb_write4(sc, VFB_STATEDATA, insn);
   1906 
   1907 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_IR);
   1908 	vfb_pacepoll4(sc, VFB_STATEDATA, insn, 0xffffffff);
   1909 
   1910 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_S1);
   1911 	vfb_pacepoll4(sc, VFB_STATEINDEX, 0, 0);
   1912 	data = vfb_read4(sc, VFB_STATEDATA);
   1913 
   1914 	vfb_write1(sc, VFB_STATEINDEX, stateindex);
   1915 	vfb_write1(sc, VFB_DEBUG, debugreg);
   1916 
   1917 	return data;
   1918 }
   1919 
   1920 /* Word read/write through the RISC's own address space, RISC held. */
   1921 static uint32_t
   1922 veritefb_risc_readmem(struct veritefb_softc *sc, uint32_t addr)
   1923 {
   1924 	veritefb_risc_writerf(sc, VRISC_RA, addr);
   1925 	veritefb_risc_forcestep(sc, VRISC_LD(VRISC_LW_OP, VRISC_SP, 0,
   1926 	    VRISC_RA));
   1927 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1928 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1929 	return veritefb_risc_readrf(sc, VRISC_SP);
   1930 }
   1931 
   1932 static void
   1933 veritefb_risc_writemem(struct veritefb_softc *sc, uint32_t addr,
   1934     uint32_t data)
   1935 {
   1936 	veritefb_risc_writerf(sc, VRISC_RA, addr);
   1937 	veritefb_risc_writerf(sc, VRISC_FP, data);
   1938 	veritefb_risc_forcestep(sc, VRISC_ST(VRISC_SW_OP, 0, VRISC_FP,
   1939 	    VRISC_RA));
   1940 }
   1941 
   1942 /*
   1943  * Flush the icache (and the pixel-engine line buffers in the
   1944  * dcache), returns with the icache enabled.
   1945  */
   1946 static void
   1947 veritefb_risc_flushicache(struct veritefb_softc *sc)
   1948 {
   1949 	uint32_t c, p1, p2;
   1950 
   1951 	/* flush store accumulation buffers */
   1952 	p1 = veritefb_risc_readmem(sc, 0);
   1953 	p2 = veritefb_risc_readmem(sc, 8);
   1954 	veritefb_risc_writemem(sc, 0, p1);
   1955 	veritefb_risc_writemem(sc, 8, p2);
   1956 	(void)veritefb_risc_readmem(sc, 0);
   1957 	(void)veritefb_risc_readmem(sc, 8);
   1958 
   1959 	/* spri Sync, zero: flush pixel-engine line buffers */
   1960 	veritefb_risc_forcestep(sc, VRISC_INT(VRISC_SPRI_OP, 0, 0, 31));
   1961 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1962 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1963 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1964 
   1965 	/* set icache-off bits in the flag register */
   1966 	veritefb_risc_writerf(sc, VRISC_RA, VRISC_ICACHE_ONOFF_MASK);
   1967 	veritefb_risc_forcestep(sc,
   1968 	    VRISC_INT(VRISC_OR_OP, VRISC_FLAG, VRISC_FLAG, VRISC_RA));
   1969 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1970 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1971 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1972 
   1973 	/* jump through two icache's worth of lines to flush it */
   1974 	for (c = 0; c < VRISC_ICACHESIZE * 2; c += VRISC_ICACHELINESIZE)
   1975 		veritefb_risc_forcestep(sc, VRISC_JMP(c >> 2));
   1976 
   1977 	/* clear the icache-off bits again */
   1978 	veritefb_risc_writerf(sc, VRISC_RA, VRISC_ICACHE_ONOFF_MASK);
   1979 	veritefb_risc_forcestep(sc,
   1980 	    VRISC_INT(VRISC_ANDN_OP, VRISC_FLAG, VRISC_FLAG, VRISC_RA));
   1981 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1982 	veritefb_risc_forcestep(sc, VRISC_JMP(0));
   1983 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1984 }
   1985 
   1986 /*
   1987  * Start the RISC at pc: hold it, force-feed a jump (with NOPs for the
   1988  * pipeline and the delay slot), release.
   1989  */
   1990 static void
   1991 veritefb_risc_start(struct veritefb_softc *sc, uint32_t pc)
   1992 {
   1993 	veritefb_risc_hold(sc);
   1994 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1995 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1996 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1997 	veritefb_risc_forcestep(sc, VRISC_JMP(pc >> 2));
   1998 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1999 	veritefb_risc_continue(sc);
   2000 }
   2001 
   2002 /*
   2003  * Sample the RISC program counter.
   2004  */
   2005 static uint32_t
   2006 veritefb_risc_samplepc(struct veritefb_softc *sc)
   2007 {
   2008 	uint32_t pc;
   2009 	uint8_t debugreg, stateindex;
   2010 	bool washeld;
   2011 
   2012 	debugreg = vfb_read1(sc, VFB_DEBUG);
   2013 	washeld = (debugreg & VFB_DEBUG_HOLDRISC) != 0;
   2014 	if (!washeld)
   2015 		veritefb_risc_hold(sc);
   2016 
   2017 	stateindex = vfb_read1(sc, VFB_STATEINDEX);
   2018 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC);
   2019 	vfb_pacepoll1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC, 0xff);
   2020 	pc = vfb_read4(sc, VFB_STATEDATA);
   2021 	vfb_write1(sc, VFB_STATEINDEX, stateindex);
   2022 
   2023 	if (!washeld)
   2024 		veritefb_risc_continue(sc);
   2025 	return pc;
   2026 }
   2027 
   2028 #ifdef VERITEFB_DEBUG
   2029 #define VFB_PCSAMPLE_POLL	200	/* us budget to confirm a sampling hold */
   2030 /*
   2031  * Lightweight PC sampler for the profiler callout.
   2032  */
   2033 static bool
   2034 veritefb_risc_samplepc_fast(struct veritefb_softc *sc, uint32_t *pcp)
   2035 {
   2036 	uint8_t debugreg, stateindex;
   2037 	bool washeld;
   2038 	int i;
   2039 
   2040 	debugreg = vfb_read1(sc, VFB_DEBUG);
   2041 	washeld = (debugreg & VFB_DEBUG_HOLDRISC) != 0;
   2042 	if (!washeld) {
   2043 		vfb_write1(sc, VFB_DEBUG, debugreg | VFB_DEBUG_HOLDRISC);
   2044 		for (i = 0; i < VFB_PCSAMPLE_POLL; i++) {
   2045 			if (vfb_read1(sc, VFB_STATUS) & VFB_STATUS_HELD)
   2046 				break;
   2047 			delay(1);
   2048 		}
   2049 		if (i == VFB_PCSAMPLE_POLL) {
   2050 			veritefb_risc_continue(sc);	/* did not halt - skip */
   2051 			return false;
   2052 		}
   2053 	}
   2054 
   2055 	stateindex = vfb_read1(sc, VFB_STATEINDEX);
   2056 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC);
   2057 	vfb_pacepoll1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC, 0xff);
   2058 	*pcp = vfb_read4(sc, VFB_STATEDATA);
   2059 	vfb_write1(sc, VFB_STATEINDEX, stateindex);
   2060 
   2061 	if (!washeld)
   2062 		veritefb_risc_continue(sc);
   2063 	return true;
   2064 }
   2065 
   2066 /*
   2067  * RISC PC sampling profiler callout.
   2068  */
   2069 static void
   2070 veritefb_pcsample_tick(void *arg)
   2071 {
   2072 	struct veritefb_softc *sc = arg;
   2073 	uint32_t pc;
   2074 	int ticks;
   2075 
   2076 	if (!sc->sc_pcsample_on)
   2077 		return;
   2078 	if (sc->sc_risc_owner == VFB_OWNER_FOREIGN && sc->sc_v3d_open &&
   2079 	    veritefb_risc_samplepc_fast(sc, &pc)) {
   2080 		sc->sc_pchist_samples++;
   2081 		if (pc < sc->sc_pchist_min)
   2082 			sc->sc_pchist_min = pc;
   2083 		if (pc > sc->sc_pchist_max)
   2084 			sc->sc_pchist_max = pc;
   2085 		if (pc >= sc->sc_pchist_base) {
   2086 			uint32_t b = (pc - sc->sc_pchist_base) >>
   2087 			    sc->sc_pchist_shift;
   2088 
   2089 			if (b < VFB_PCHIST_BUCKETS)
   2090 				sc->sc_pchist[b]++;
   2091 			else
   2092 				sc->sc_pchist_missed++;
   2093 		} else
   2094 			sc->sc_pchist_missed++;
   2095 	}
   2096 
   2097 	ticks = hz / sc->sc_pcsample_hz;
   2098 	if (ticks < 1)
   2099 		ticks = 1;
   2100 	callout_schedule(&sc->sc_pcsample_ch, ticks);
   2101 }
   2102 #endif /* VERITEFB_DEBUG */
   2103 
   2104 /*
   2105  * The hang-signature catalog: classify a sampled PC against the known
   2106  * layout of the V2x00 2D blob (loaded at its link address).
   2107  */
   2108 static const char *
   2109 veritefb_pc_signature(uint32_t pc)
   2110 {
   2111 	if (pc >= VFB_UC_TRAP && pc < VFB_UC_TRAP_END)
   2112 		return "invalid-command trap (host sent a bad command or "
   2113 		    "the stream desynced)";
   2114 	if (pc >= VFB_UC_BASE && pc <= VFB_UC_DISPATCH_END)
   2115 		return "dispatch loop (idle, waiting for commands)";
   2116 	if (pc >= VFB_CSUCODE_BASE && pc < VFB_UC_BASE)
   2117 		return "csucode monitor (parked/suspended)";
   2118 	if (pc >= VFB_UC_BASE && pc < VFB_UC_END)
   2119 		return "inside a command handler";
   2120 	if (pc >= VFB_UCF_BASE && pc < VFB_UCF_END)
   2121 		return "foreign ucode region";
   2122 	if (pc >= VFB_RISC_ROM_BASE)
   2123 		return "boot ROM region";
   2124 	return "unknown region";
   2125 }
   2126 
   2127 /*
   2128  * Permanently degrade to software rendering, duh.
   2129  */
   2130 static void
   2131 veritefb_accel_fail(struct veritefb_softc *sc, const char *what)
   2132 {
   2133 	uint32_t pc;
   2134 #ifdef VERITEFB_DEBUG
   2135 	unsigned i, n;
   2136 #endif
   2137 
   2138 	if (sc->sc_accel == VFB_ACCEL_SW)
   2139 		return;
   2140 
   2141 	/* never hold the RISC mid-DMA */
   2142 	(void)veritefb_dma_drain(sc);
   2143 
   2144 	sc->sc_accel = VFB_ACCEL_SW;
   2145 	sc->sc_unsynced = 0;
   2146 	sc->sc_unsynced_area = 0;
   2147 	pc = veritefb_risc_samplepc(sc);
   2148 	aprint_error_dev(sc->sc_dev,
   2149 	    "%s; disabling acceleration until reboot\n", what);
   2150 	aprint_error_dev(sc->sc_dev, "RISC PC 0x%08x: %s\n", pc,
   2151 	    veritefb_pc_signature(pc));
   2152 
   2153 #ifdef VERITEFB_DEBUG
   2154 	n = MIN(sc->sc_ring_count, 8);
   2155 	for (i = 0; i < n; i++)
   2156 		aprint_error_dev(sc->sc_dev, "  fifo[-%u] = 0x%08x\n",
   2157 		    n - i, sc->sc_ring[(sc->sc_ring_count - n + i) &
   2158 		    (VFB_RING_SIZE - 1)]);
   2159 #endif
   2160 
   2161 	veritefb_risc_hold(sc);
   2162 }
   2163 
   2164 /* wait for n free input FIFO entries */
   2165 static int
   2166 veritefb_waitfifo(struct veritefb_softc *sc, int n)
   2167 {
   2168 	int i;
   2169 
   2170 	for (i = 0; i < VFB_FIFOPOLL; i++) {
   2171 		if ((vfb_read1(sc, VFB_FIFOINFREE) & VFB_FIFOINFREE_MASK) >=
   2172 		    n)
   2173 			return 0;
   2174 		delay(1);
   2175 	}
   2176 	veritefb_accel_fail(sc, "input FIFO timeout");
   2177 	return EBUSY;
   2178 }
   2179 
   2180 /* Discard stale output FIFO words. */
   2181 static int
   2182 veritefb_drain_outfifo(struct veritefb_softc *sc)
   2183 {
   2184 	int i;
   2185 
   2186 	for (i = 0; i < VFB_FIFOPOLL; i++) {
   2187 		if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   2188 		    VFB_FIFOOUTVALID_MASK) == 0)
   2189 			return 0;
   2190 		(void)vfb_fifo_read(sc);
   2191 	}
   2192 	veritefb_accel_fail(sc, "output FIFO never drained");
   2193 	return EBUSY;
   2194 }
   2195 
   2196 /* Wait for one word from the output FIFO. */
   2197 static int
   2198 veritefb_read_outfifo(struct veritefb_softc *sc, uint32_t *wordp)
   2199 {
   2200 	int i;
   2201 
   2202 	for (i = 0; i < VFB_FIFOPOLL; i++) {
   2203 		if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   2204 		    VFB_FIFOOUTVALID_MASK) != 0) {
   2205 			*wordp = vfb_fifo_read(sc);
   2206 			return 0;
   2207 		}
   2208 		delay(1);
   2209 	}
   2210 	veritefb_accel_fail(sc, "output FIFO timeout");
   2211 	return EBUSY;
   2212 }
   2213 
   2214 /*
   2215  * Copy an ELF microcode image into its VRAM slot
   2216  */
   2217 static bool
   2218 veritefb_ucode_load(struct veritefb_softc *sc, const uint8_t *u,
   2219     size_t size, uint32_t lo, uint32_t hi, bool install_csucode,
   2220     uint32_t *entryp)
   2221 {
   2222 	uint32_t entry, phoff, filesz, memsz, off, paddr, word;
   2223 	uint16_t phentsize, phnum, ph;
   2224 	uint8_t memendian;
   2225 	size_t i;
   2226 
   2227 	if (size < sizeof(Elf32_Ehdr) ||
   2228 	    memcmp(u, ELFMAG, SELFMAG) != 0 ||
   2229 	    u[EI_CLASS] != ELFCLASS32 || u[EI_DATA] != ELFDATA2MSB) {
   2230 		aprint_error_dev(sc->sc_dev, "microcode is not a "
   2231 		    "big-endian ELF32 image\n");
   2232 		return false;
   2233 	}
   2234 
   2235 	entry = be32dec(u + offsetof(Elf32_Ehdr, e_entry));
   2236 	phoff = be32dec(u + offsetof(Elf32_Ehdr, e_phoff));
   2237 	phentsize = be16dec(u + offsetof(Elf32_Ehdr, e_phentsize));
   2238 	phnum = be16dec(u + offsetof(Elf32_Ehdr, e_phnum));
   2239 
   2240 	if (phnum == 0 || phentsize < sizeof(Elf32_Phdr) ||
   2241 	    (uint64_t)phoff + (uint64_t)phnum * phentsize > size) {
   2242 		aprint_error_dev(sc->sc_dev,
   2243 		    "microcode program headers out of bounds\n");
   2244 		return false;
   2245 	}
   2246 
   2247 	if (entry < lo || entry >= hi) {
   2248 		aprint_error_dev(sc->sc_dev,
   2249 		    "microcode entry 0x%x outside slot [0x%x, 0x%x)\n",
   2250 		    entry, lo, hi);
   2251 		return false;
   2252 	}
   2253 
   2254 	memendian = vfb_read1(sc, VFB_MEMENDIAN);
   2255 	vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
   2256 
   2257 	if (install_csucode) {
   2258 		/* Context-switch monitor and its semaphores. */
   2259 		for (i = 0; i < __arraycount(veritefb_csucode); i++)
   2260 			vfb_fb_write4(sc, VFB_CSUCODE_BASE + i * 4,
   2261 			    veritefb_csucode[i]);
   2262 		vfb_fb_write4(sc, VFB_CSUCODE_SEM0, 0);
   2263 		vfb_fb_write4(sc, VFB_CSUCODE_SEM1, 0);
   2264 	}
   2265 
   2266 	for (ph = 0; ph < phnum; ph++) {
   2267 		const uint8_t *p = u + phoff + (uint32_t)ph * phentsize;
   2268 
   2269 		if (be32dec(p + offsetof(Elf32_Phdr, p_type)) != PT_LOAD)
   2270 			continue;
   2271 		off = be32dec(p + offsetof(Elf32_Phdr, p_offset));
   2272 		filesz = be32dec(p + offsetof(Elf32_Phdr, p_filesz));
   2273 		memsz = be32dec(p + offsetof(Elf32_Phdr, p_memsz));
   2274 		paddr = be32dec(p + offsetof(Elf32_Phdr, p_paddr));
   2275 
   2276 		if (memsz < filesz ||
   2277 		    (uint64_t)off + filesz > size ||
   2278 		    paddr < lo || (paddr & 3) != 0 ||
   2279 		    (uint64_t)paddr + roundup(memsz, 4) > hi) {
   2280 			aprint_error_dev(sc->sc_dev,
   2281 			    "microcode segment out of bounds "
   2282 			    "(paddr 0x%x filesz 0x%x memsz 0x%x)\n",
   2283 			    paddr, filesz, memsz);
   2284 			vfb_write1(sc, VFB_MEMENDIAN, memendian);
   2285 			return false;
   2286 		}
   2287 
   2288 		for (i = 0; i + 4 <= filesz; i += 4)
   2289 			vfb_fb_write4(sc, paddr + i, be32dec(u + off + i));
   2290 		if (i < filesz) {
   2291 			word = 0;
   2292 			for (; i < filesz; i++)
   2293 				word = (word << 8) | u[off + i];
   2294 			word <<= 8 * (4 - (filesz & 3));
   2295 			vfb_fb_write4(sc, paddr + (filesz & ~3U), word);
   2296 			i = (filesz & ~3U) + 4;
   2297 		}
   2298 		/* Zero the bss tail. */
   2299 		for (; i < memsz; i += 4)
   2300 			vfb_fb_write4(sc, paddr + i, 0);
   2301 	}
   2302 
   2303 	vfb_write1(sc, VFB_MEMENDIAN, memendian);
   2304 	*entryp = entry;
   2305 	return true;
   2306 }
   2307 
   2308 /*
   2309  * Full RISC bring-up:
   2310  * - load microcode
   2311  * - start the csucode monitor
   2312  * - feed it the init sequence
   2313  * - validate the command protocol
   2314  */
   2315 static bool
   2316 veritefb_risc_init(struct veritefb_softc *sc)
   2317 {
   2318 
   2319 	/*
   2320 	 * Settle any in-flight DMA first!
   2321 	 */
   2322 	(void)veritefb_dma_drain(sc);
   2323 
   2324 	if (sc->sc_ucode == NULL)
   2325 		return false;
   2326 
   2327 	sc->sc_accel = VFB_ACCEL_OFF;
   2328 	sc->sc_risc_owner = VFB_OWNER_CONSOLE;
   2329 
   2330 	veritefb_risc_hold(sc);
   2331 	if (!veritefb_ucode_load(sc, sc->sc_ucode, sc->sc_ucode_size,
   2332 	    VFB_UC2D_LO, VFB_UC2D_HI, true, &sc->sc_ucode_entry))
   2333 		return false;
   2334 
   2335 	/*
   2336 	 * same VRAM words read through the host aperture and through
   2337 	 * injected RISC loads must agree
   2338 	 */
   2339 	{
   2340 		static const uint32_t testaddr[] =
   2341 		    { VFB_UC_BASE, VFB_CSUCODE_BASE };
   2342 		uint32_t hostv, riscv;
   2343 		uint8_t memendian;
   2344 		size_t t;
   2345 
   2346 		memendian = vfb_read1(sc, VFB_MEMENDIAN);
   2347 		vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
   2348 		for (t = 0; t < __arraycount(testaddr); t++) {
   2349 			hostv = vfb_fb_read4(sc, testaddr[t]);
   2350 			riscv = veritefb_risc_readmem(sc, testaddr[t]);
   2351 			if (hostv != riscv) {
   2352 				vfb_write1(sc, VFB_MEMENDIAN, memendian);
   2353 				aprint_error_dev(sc->sc_dev,
   2354 				    "dual-view self-test failed @0x%x: "
   2355 				    "host 0x%08x vs RISC 0x%08x\n",
   2356 				    testaddr[t], hostv, riscv);
   2357 				return false;
   2358 			}
   2359 		}
   2360 		vfb_write1(sc, VFB_MEMENDIAN, memendian);
   2361 		aprint_debug_dev(sc->sc_dev, "dual-view self-test passed\n");
   2362 	}
   2363 
   2364 	veritefb_risc_flushicache(sc);
   2365 	veritefb_risc_start(sc, VFB_CSUCODE_BASE);
   2366 
   2367 	if (veritefb_waitfifo(sc, 4) != 0)
   2368 		return false;
   2369 	vfb_fifo_write(sc, VFB_CSUCODE_INIT);
   2370 	vfb_fifo_write(sc, 0);		/* context store area */
   2371 	vfb_fifo_write(sc, 0);
   2372 	vfb_fifo_write(sc, sc->sc_ucode_entry);
   2373 
   2374 	if (!veritefb_2d_handshake(sc))
   2375 		return false;
   2376 
   2377 	aprint_normal_dev(sc->sc_dev,
   2378 	    "RISC running 2D microcode (entry 0x%x), handshake passed\n",
   2379 	    sc->sc_ucode_entry);
   2380 	return true;
   2381 }
   2382 
   2383 /*
   2384  * Post-start validation and pixel-engine setup
   2385  */
   2386 static bool
   2387 veritefb_2d_handshake(struct veritefb_softc *sc)
   2388 {
   2389 	uint32_t word, saved;
   2390 
   2391 	if (veritefb_drain_outfifo(sc) != 0)
   2392 		return false;
   2393 	if (veritefb_waitfifo(sc, 1) != 0)
   2394 		return false;
   2395 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   2396 	if (veritefb_read_outfifo(sc, &word) != 0)
   2397 		return false;
   2398 	if (word != VFB_SYNC_TOKEN) {
   2399 		veritefb_accel_fail(sc, "bad sync token from microcode");
   2400 		return false;
   2401 	}
   2402 
   2403 	if (veritefb_waitfifo(sc, 6) != 0)
   2404 		return false;
   2405 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_SETUP));
   2406 	/*
   2407 	 * Word 1 programs the pixel-engine scissor.
   2408 	 * It MUST span the whole VRAM working area.
   2409 	 */
   2410 	vfb_fifo_write(sc, VFB_P2(sc->sc_width,
   2411 	    (sc->sc_memsize - sc->sc_fb_offset) / sc->sc_linebytes));
   2412 	vfb_fifo_write(sc, VFB_P2(sc->sc_depth, VFB_PIXFMT_8I));
   2413 	vfb_fifo_write(sc, (uint32_t)sc->sc_fb_offset);
   2414 	vfb_fifo_write(sc, sc->sc_linebytes);
   2415 	vfb_fifo_write(sc, ((uint32_t)sc->sc_stride1 << 12) |
   2416 	    ((uint32_t)sc->sc_stride0 << 8));
   2417 
   2418 	/* Second sync proves Setup consumed exactly six words. */
   2419 	if (veritefb_waitfifo(sc, 1) != 0)
   2420 		return false;
   2421 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   2422 	if (veritefb_read_outfifo(sc, &word) != 0)
   2423 		return false;
   2424 	if (word != VFB_SYNC_TOKEN) {
   2425 		veritefb_accel_fail(sc, "FIFO desync after Setup");
   2426 		return false;
   2427 	}
   2428 
   2429 	/*
   2430 	 * GetPixel round-trip: place the same magic byte in the first
   2431 	 * four framebuffer pixels through the aperture (immune to the
   2432 	 * MEMENDIAN byte-lane setting) and ask the RISC for pixel (0,0).
   2433 	 */
   2434 	saved = vfb_fb_read4(sc, sc->sc_fb_offset);
   2435 	vfb_fb_write4(sc, sc->sc_fb_offset, VFB_GETPIXEL_PATTERN);
   2436 	if (veritefb_waitfifo(sc, 2) != 0)
   2437 		return false;
   2438 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_GETPIXEL));
   2439 	vfb_fifo_write(sc, VFB_P2(0, 0));
   2440 	if (veritefb_read_outfifo(sc, &word) != 0)
   2441 		return false;
   2442 	vfb_fb_write4(sc, sc->sc_fb_offset, saved);
   2443 	if ((word & 0xff) != (VFB_GETPIXEL_PATTERN & 0xff)) {
   2444 		veritefb_accel_fail(sc, "GetPixel round-trip mismatch");
   2445 		return false;
   2446 	}
   2447 
   2448 	sc->sc_accel = VFB_ACCEL_ON;
   2449 	sc->sc_unsynced = 0;
   2450 	sc->sc_unsynced_area = 0;
   2451 	return true;
   2452 }
   2453 
   2454 static int
   2455 veritefb_waitfifo_raw(struct veritefb_softc *sc, int n, uint32_t timo_us)
   2456 {
   2457 	uint32_t i;
   2458 
   2459 	for (i = 0; i < timo_us; i++) {
   2460 		if ((vfb_read1(sc, VFB_FIFOINFREE) & VFB_FIFOINFREE_MASK) >=
   2461 		    n)
   2462 			return 0;
   2463 		delay(1);
   2464 	}
   2465 	return ETIMEDOUT;
   2466 }
   2467 
   2468 static int
   2469 veritefb_read_outfifo_raw(struct veritefb_softc *sc, uint32_t *wordp,
   2470     uint32_t timo_us)
   2471 {
   2472 	uint32_t i;
   2473 
   2474 	for (i = 0; i < timo_us; i++) {
   2475 		if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   2476 		    VFB_FIFOOUTVALID_MASK) != 0) {
   2477 			*wordp = vfb_fifo_read(sc);
   2478 			return 0;
   2479 		}
   2480 		delay(1);
   2481 	}
   2482 	return ETIMEDOUT;
   2483 }
   2484 
   2485 /* Park the 2D microcode in the csucode monitor. */
   2486 static int
   2487 veritefb_suspend2d(struct veritefb_softc *sc)
   2488 {
   2489 	uint32_t word;
   2490 
   2491 	if (sc->sc_accel != VFB_ACCEL_ON ||
   2492 	    sc->sc_mode != WSDISPLAYIO_MODE_EMUL ||
   2493 	    sc->sc_risc_owner != VFB_OWNER_CONSOLE)
   2494 		return EBUSY;
   2495 
   2496 	/* PIO FIFO words follow */
   2497 	(void)veritefb_dma_drain(sc);
   2498 
   2499 	/*
   2500 	 * Console text ops fall back to software from here on
   2501 	 */
   2502 	sc->sc_accel = VFB_ACCEL_OFF;
   2503 	sc->sc_risc_owner = VFB_OWNER_PARKED;
   2504 	sc->sc_unsynced = 0;
   2505 	sc->sc_unsynced_area = 0;
   2506 
   2507 	/*
   2508 	 * Pixel engine MUST be idle before another microcode
   2509 	 * takes over...
   2510 	 */
   2511 	if (veritefb_drain_outfifo(sc) != 0 ||
   2512 	    veritefb_waitfifo(sc, 2) != 0)
   2513 		goto fail;
   2514 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   2515 	if (veritefb_read_outfifo(sc, &word) != 0 ||
   2516 	    word != VFB_SYNC_TOKEN)
   2517 		goto fail;
   2518 
   2519 	/* Blob saves its state and parks. */
   2520 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_SUSPEND));
   2521 
   2522 	/* Only the monitor echoes pings */
   2523 	if (veritefb_waitfifo(sc, 1) != 0)
   2524 		goto fail;
   2525 	vfb_fifo_write(sc, VFB_CSUCODE_PING);
   2526 	if (veritefb_read_outfifo(sc, &word) != 0 ||
   2527 	    word != VFB_CSUCODE_PING)
   2528 		goto fail;
   2529 
   2530 	aprint_debug_dev(sc->sc_dev, "2D microcode parked\n");
   2531 	return 0;
   2532 fail:
   2533 	aprint_error_dev(sc->sc_dev, "2D suspend failed, reloading\n");
   2534 	(void)veritefb_risc_init(sc);
   2535 	return EIO;
   2536 }
   2537 
   2538 /*
   2539  * DMA engine pulls a word stream into the same input FIFO PIO writes
   2540  * feed.
   2541  */
   2542 static int
   2543 veritefb_dma_alloc(struct veritefb_softc *sc)
   2544 {
   2545 	int nsegs, error;
   2546 
   2547 	if (sc->sc_dma_buf != NULL)
   2548 		return 0;
   2549 
   2550 	/* descriptor block: one page satisfies the 16KB-block rule */
   2551 	error = bus_dmamem_alloc(sc->sc_dmat, PAGE_SIZE, PAGE_SIZE, 0,
   2552 	    &sc->sc_dma_list_seg, 1, &nsegs, BUS_DMA_WAITOK);
   2553 	if (error)
   2554 		return error;
   2555 	error = bus_dmamem_map(sc->sc_dmat, &sc->sc_dma_list_seg, 1,
   2556 	    PAGE_SIZE, (void **)&sc->sc_dma_list, BUS_DMA_WAITOK);
   2557 	if (error)
   2558 		goto fail;
   2559 	error = bus_dmamap_create(sc->sc_dmat, PAGE_SIZE, 1, PAGE_SIZE, 0,
   2560 	    BUS_DMA_WAITOK, &sc->sc_dma_list_map);
   2561 	if (error)
   2562 		goto fail;
   2563 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_dma_list_map,
   2564 	    sc->sc_dma_list, PAGE_SIZE, NULL, BUS_DMA_WAITOK);
   2565 	if (error)
   2566 		goto fail;
   2567 
   2568 	error = bus_dmamem_alloc(sc->sc_dmat, VFB_DMA_BOUNCE, PAGE_SIZE, 0,
   2569 	    &sc->sc_dma_buf_seg, 1, &nsegs, BUS_DMA_WAITOK);
   2570 	if (error)
   2571 		goto fail;
   2572 	error = bus_dmamem_map(sc->sc_dmat, &sc->sc_dma_buf_seg, 1,
   2573 	    VFB_DMA_BOUNCE, (void **)&sc->sc_dma_buf, BUS_DMA_WAITOK);
   2574 	if (error)
   2575 		goto fail;
   2576 	error = bus_dmamap_create(sc->sc_dmat, VFB_DMA_BOUNCE, 1,
   2577 	    VFB_DMA_BOUNCE, 0, BUS_DMA_WAITOK, &sc->sc_dma_buf_map);
   2578 	if (error)
   2579 		goto fail;
   2580 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_dma_buf_map,
   2581 	    sc->sc_dma_buf, VFB_DMA_BOUNCE, NULL, BUS_DMA_WAITOK);
   2582 	if (error)
   2583 		goto fail;
   2584 
   2585 	aprint_debug_dev(sc->sc_dev, "DMA bounce %u bytes at pa 0x%lx, "
   2586 	    "list at pa 0x%lx\n", VFB_DMA_BOUNCE,
   2587 	    (u_long)sc->sc_dma_buf_map->dm_segs[0].ds_addr,
   2588 	    (u_long)sc->sc_dma_list_map->dm_segs[0].ds_addr);
   2589 	return 0;
   2590 fail:
   2591 	/* one-shot lazy init */
   2592 	aprint_error_dev(sc->sc_dev, "DMA setup failed: %d\n", error);
   2593 	sc->sc_dma_buf = NULL;
   2594 	return error;
   2595 }
   2596 
   2597 #ifdef VERITEFB_DEBUG
   2598 static void
   2599 vfb_stat(struct veritefb_softc *sc, int idx, const struct timeval *t0)
   2600 {
   2601 	struct timeval t1;
   2602 
   2603 	microuptime(&t1);
   2604 	sc->sc_stats.vs_count[idx]++;
   2605 	sc->sc_stats.vs_us[idx] +=
   2606 	    (uint64_t)(t1.tv_sec - t0->tv_sec) * 1000000 +
   2607 	    (t1.tv_usec - t0->tv_usec);
   2608 }
   2609 #define VFB_T0()	struct timeval t0_; microuptime(&t0_)
   2610 #define VFB_STAT(sc, idx)	vfb_stat(sc, idx, &t0_)
   2611 #else
   2612 #define VFB_T0()	do { } while (0)
   2613 #define VFB_STAT(sc, idx)	do { } while (0)
   2614 #endif
   2615 
   2616 /*
   2617  * Settle the in-flight descriptor DMA
   2618  */
   2619 static int
   2620 veritefb_dma_drain(struct veritefb_softc *sc)
   2621 {
   2622 	uint32_t i;
   2623 	VFB_T0();
   2624 
   2625 	if (!sc->sc_dma_pending)
   2626 		return 0;
   2627 
   2628 #ifdef VERITEFB_DEBUG
   2629 	/* overlap metric: did the engine finish during CPU build? */
   2630 	sc->sc_stats.vs_count[
   2631 	    (vfb_read4(sc, VFB_DMACMDPTR) & VFB_DMACMDPTR_BUSY) != 0 ?
   2632 	    VFB_STAT_V3D_DRAIN_BUSY : VFB_STAT_V3D_DRAIN_IDLE]++;
   2633 #endif
   2634 	for (i = 0; i < VFB_DMA_TIMEOUT_US; i++) {
   2635 		if ((vfb_read4(sc, VFB_DMACMDPTR) & VFB_DMACMDPTR_BUSY) == 0)
   2636 			break;
   2637 		delay(1);
   2638 	}
   2639 	VFB_STAT(sc, VFB_STAT_V3D_SPIN);
   2640 
   2641 	bus_dmamap_sync(sc->sc_dmat, sc->sc_dma_pending_map, 0,
   2642 	    sc->sc_dma_pending_len, BUS_DMASYNC_POSTWRITE);
   2643 	bus_dmamap_sync(sc->sc_dmat, sc->sc_dma_list_map, 0, 16,
   2644 	    BUS_DMASYNC_POSTWRITE);
   2645 	sc->sc_dma_pending = false;
   2646 
   2647 	if (i == VFB_DMA_TIMEOUT_US) {
   2648 		/* stop a wedged master before it holds the bus forever */
   2649 		vfb_write1(sc, VFB_MODE, VFB_MODE_NATIVE);
   2650 		aprint_error_dev(sc->sc_dev,
   2651 		    "DMA drain timeout, engine off\n");
   2652 		return EIO;
   2653 	}
   2654 	return 0;
   2655 }
   2656 
   2657 static int
   2658 veritefb_intr(void *arg)
   2659 {
   2660 	struct veritefb_softc *sc = arg;
   2661 	uint8_t st;
   2662 
   2663 	st = vfb_read1(sc, VFB_INTR);
   2664 	if (st == 0)
   2665 		return 0;
   2666 	vfb_write1(sc, VFB_INTR, st);		/* W1C ack */
   2667 	if ((st & VFB_INTR_VERT) != 0 && sc->sc_flip_pending) {
   2668 		vfb_write4(sc, VFB_FRAMEBASEA, sc->sc_flip_base);
   2669 		sc->sc_flip_pending = false;
   2670 		vfb_write1(sc, VFB_INTREN, 0);
   2671 	}
   2672 	return 1;
   2673 }
   2674 
   2675 /* Abandon a queued flip (teardown/modeset take scanout over). */
   2676 static void
   2677 veritefb_flip_cancel(struct veritefb_softc *sc)
   2678 {
   2679 
   2680 	if (!sc->sc_flip_intr_ok)
   2681 		return;
   2682 	sc->sc_flip_pending = false;
   2683 	vfb_write1(sc, VFB_INTREN, 0);
   2684 }
   2685 
   2686 static void
   2687 veritefb_flip_wait(struct veritefb_softc *sc)
   2688 {
   2689 	uint32_t i;
   2690 
   2691 	if (!sc->sc_flip_pending)
   2692 		return;
   2693 	for (i = 0; i < 2 * VFB_VSYNCPOLL; i++) {
   2694 		if (!sc->sc_flip_pending)
   2695 			return;
   2696 		delay(1);
   2697 	}
   2698 	vfb_write4(sc, VFB_FRAMEBASEA, sc->sc_flip_base);
   2699 	sc->sc_flip_pending = false;
   2700 	vfb_write1(sc, VFB_INTREN, 0);
   2701 	aprint_error_dev(sc->sc_dev, "queued flip lost, forced\n");
   2702 }
   2703 
   2704 static int
   2705 veritefb_dma_submit(struct veritefb_softc *sc, bus_dmamap_t map,
   2706     uint32_t len, uint32_t swap)
   2707 {
   2708 	uint32_t *dl = sc->sc_dma_list;
   2709 	int error;
   2710 	VFB_T0();
   2711 
   2712 	/* queued flip MUST retire before commands can exec */
   2713 	veritefb_flip_wait(sc);
   2714 
   2715 	/* never kick (or rewrite Mode) while the master runs */
   2716 	error = veritefb_dma_drain(sc);
   2717 	if (error)
   2718 		return error;
   2719 
   2720 	/* data entry: len is a byte count = (words << 2) at b23:2 */
   2721 	dl[0] = htole32((uint32_t)map->dm_segs[0].ds_addr);
   2722 	dl[1] = htole32(len | swap);
   2723 	/* stop-DMA entry: link flag with a null address */
   2724 	dl[2] = htole32(0);
   2725 	dl[3] = htole32(VFB_DMALEN_LINK);
   2726 
   2727 	bus_dmamap_sync(sc->sc_dmat, map, 0, len,
   2728 	    BUS_DMASYNC_PREWRITE);
   2729 	bus_dmamap_sync(sc->sc_dmat, sc->sc_dma_list_map, 0, 16,
   2730 	    BUS_DMASYNC_PREWRITE);
   2731 
   2732 	vfb_write1(sc, VFB_LOWWATERMARK, VFB_DMA_LOWWATER);
   2733 	vfb_write1(sc, VFB_MODE, VFB_MODE_NATIVE | VFB_MODE_DMAEN);
   2734 	vfb_write4(sc, VFB_DMACMDPTR,
   2735 	    (uint32_t)sc->sc_dma_list_map->dm_segs[0].ds_addr);
   2736 
   2737 	/* async: the drain (here or at any drain point) settles it */
   2738 	sc->sc_dma_pending = true;
   2739 	sc->sc_dma_pending_map = map;
   2740 	sc->sc_dma_pending_len = len;
   2741 
   2742 	VFB_STAT(sc, VFB_STAT_V3D_SUBMIT);
   2743 #ifdef VERITEFB_DEBUG
   2744 	sc->sc_stats.vs_count[VFB_STAT_V3D_BYTES] += len;
   2745 #endif
   2746 	return 0;
   2747 }
   2748 
   2749 /*
   2750  * TODO: Consider WSDISPLAYIO_SET_MODE in the future
   2751  */
   2752 static int
   2753 veritefb_set_scan_depth(struct veritefb_softc *sc, int depth)
   2754 {
   2755 	const struct veritefb_stride *st;
   2756 
   2757 	if (depth != 8 && depth != 16)
   2758 		return EINVAL;
   2759 	if (depth == sc->sc_depth)
   2760 		return 0;
   2761 	st = veritefb_stride_for(sc->sc_width * (depth / 8));
   2762 	if (st == NULL)
   2763 		return EINVAL;
   2764 	/* the modeset rewrites Mode, which would abort a live master */
   2765 	(void)veritefb_dma_drain(sc);
   2766 	veritefb_flip_cancel(sc);
   2767 	sc->sc_depth = depth;
   2768 	sc->sc_linebytes = st->linebytes;
   2769 	return veritefb_set_mode(sc, sc->sc_videomode) ? 0 : EIO;
   2770 }
   2771 
   2772 /* Resume the parked 2D microcode from the csucode monitor. */
   2773 static int
   2774 veritefb_resume2d(struct veritefb_softc *sc)
   2775 {
   2776 	uint32_t word;
   2777 
   2778 	if (sc->sc_risc_owner == VFB_OWNER_CONSOLE ||
   2779 	    sc->sc_mode != WSDISPLAYIO_MODE_EMUL ||
   2780 	    sc->sc_ucode == NULL)
   2781 		return EBUSY;
   2782 
   2783 	/* modeset + PIO FIFO words follow */
   2784 	(void)veritefb_dma_drain(sc);
   2785 
   2786 	if (sc->sc_depth != 8)
   2787 		(void)veritefb_set_scan_depth(sc, 8);
   2788 	vfb_write4(sc, VFB_FRAMEBASEA, (uint32_t)sc->sc_fb_offset);
   2789 
   2790 	if (veritefb_drain_outfifo(sc) != 0 ||
   2791 	    veritefb_waitfifo(sc, 1) != 0)
   2792 		goto fail;
   2793 	vfb_fifo_write(sc, VFB_CSUCODE_PING);
   2794 	if (veritefb_read_outfifo(sc, &word) != 0 ||
   2795 	    word != VFB_CSUCODE_PING)
   2796 		goto fail;
   2797 
   2798 	if (veritefb_waitfifo(sc, 4) != 0)
   2799 		goto fail;
   2800 	vfb_fifo_write(sc, VFB_CSUCODE_RESUME);
   2801 	vfb_fifo_write(sc, 0);		/* context store area */
   2802 	vfb_fifo_write(sc, 0);
   2803 	vfb_fifo_write(sc, sc->sc_ucode_entry);
   2804 
   2805 	/* PE state did not survive; the handshake replays Setup. */
   2806 	if (!veritefb_2d_handshake(sc))
   2807 		goto fail;
   2808 	sc->sc_risc_owner = VFB_OWNER_CONSOLE;
   2809 
   2810 	if (sc->sc_gc_initted)
   2811 		glyphcache_wipe(&sc->sc_gc);
   2812 	veritefb_mux_redraw(sc);
   2813 
   2814 	aprint_debug_dev(sc->sc_dev, "2D microcode resumed\n");
   2815 	return 0;
   2816 fail:
   2817 	aprint_error_dev(sc->sc_dev, "2D resume failed, reloading\n");
   2818 	if (veritefb_risc_init(sc)) {
   2819 		if (sc->sc_gc_initted)
   2820 			glyphcache_wipe(&sc->sc_gc);
   2821 		veritefb_mux_redraw(sc);
   2822 	}
   2823 	return EIO;
   2824 }
   2825 
   2826 /*
   2827  * Full-screen redraw after a resume
   2828  */
   2829 static void
   2830 veritefb_mux_redraw(struct veritefb_softc *sc)
   2831 {
   2832 
   2833 	if (db_active)
   2834 		return;
   2835 	if (sc->vd.active != NULL)
   2836 		vcons_redraw_screen(sc->vd.active);
   2837 }
   2838 
   2839 /*
   2840  * /dev/verite3d  exclusive 3D client interface
   2841  */
   2842 
   2843 const struct cdevsw verite3d_cdevsw = {
   2844 	.d_open = verite3d_open,
   2845 	.d_close = verite3d_close,
   2846 	.d_read = noread,
   2847 	.d_write = nowrite,
   2848 	.d_ioctl = verite3d_ioctl,
   2849 	.d_stop = nostop,
   2850 	.d_tty = notty,
   2851 	.d_poll = nopoll,
   2852 	.d_mmap = verite3d_mmap,
   2853 	.d_kqfilter = nokqfilter,
   2854 	.d_discard = nodiscard,
   2855 	.d_flag = D_OTHER
   2856 };
   2857 
   2858 static int
   2859 verite3d_ring_alloc(struct veritefb_softc *sc)
   2860 {
   2861 	int s, nsegs, error;
   2862 
   2863 	if (sc->sc_v3d_slot[0] != NULL)
   2864 		return 0;
   2865 	for (s = 0; s < V3D_RING_SLOTS; s++) {
   2866 		error = bus_dmamem_alloc(sc->sc_dmat, V3D_SLOT_SIZE,
   2867 		    PAGE_SIZE, 0, &sc->sc_v3d_slot_seg[s], 1, &nsegs,
   2868 		    BUS_DMA_WAITOK);
   2869 		if (error)
   2870 			return error;
   2871 		error = bus_dmamem_map(sc->sc_dmat, &sc->sc_v3d_slot_seg[s],
   2872 		    1, V3D_SLOT_SIZE, (void **)&sc->sc_v3d_slot[s],
   2873 		    BUS_DMA_WAITOK);
   2874 		if (error)
   2875 			return error;
   2876 		error = bus_dmamap_create(sc->sc_dmat, V3D_SLOT_SIZE, 1,
   2877 		    V3D_SLOT_SIZE, 0, BUS_DMA_WAITOK,
   2878 		    &sc->sc_v3d_slot_map[s]);
   2879 		if (error)
   2880 			return error;
   2881 		error = bus_dmamap_load(sc->sc_dmat, sc->sc_v3d_slot_map[s],
   2882 		    sc->sc_v3d_slot[s], V3D_SLOT_SIZE, NULL, BUS_DMA_WAITOK);
   2883 		if (error)
   2884 			return error;
   2885 	}
   2886 	return 0;
   2887 }
   2888 
   2889 int
   2890 verite3d_open(dev_t dev, int flags, int mode, struct lwp *l)
   2891 {
   2892 	struct veritefb_softc *sc;
   2893 	int error;
   2894 
   2895 	sc = device_lookup_private(&veritefb_cd, minor(dev));
   2896 	if (sc == NULL)
   2897 		return ENXIO;
   2898 	if (sc->sc_v3d_open)
   2899 		return EBUSY;
   2900 
   2901 	/* console must be healthy and in EMUL; parking happens at INIT */
   2902 	if (sc->sc_mode != WSDISPLAYIO_MODE_EMUL || sc->sc_ucode == NULL ||
   2903 	    sc->sc_risc_owner != VFB_OWNER_CONSOLE)
   2904 		return EBUSY;
   2905 
   2906 	error = veritefb_dma_alloc(sc);	/* descriptor list page */
   2907 	if (error)
   2908 		return error;
   2909 	error = verite3d_ring_alloc(sc);
   2910 	if (error)
   2911 		return error;
   2912 
   2913 	if (sc->sc_v3d_ext == NULL) {
   2914 		sc->sc_v3d_pool_base = (uint32_t)(sc->sc_fb_offset +
   2915 		    (bus_size_t)sc->sc_linebytes * sc->sc_height);
   2916 		sc->sc_v3d_ext = extent_create("verite3d",
   2917 		    sc->sc_v3d_pool_base, sc->sc_memsize - 1, NULL, 0,
   2918 		    EX_WAITOK);
   2919 	}
   2920 	if (sc->sc_v3d_reg == NULL)
   2921 		sc->sc_v3d_reg = kmem_zalloc(V3D_MAX_REGIONS *
   2922 		    sizeof(sc->sc_v3d_reg[0]), KM_SLEEP);
   2923 	sc->sc_v3d_nreg = 0;
   2924 
   2925 	sc->sc_v3d_open = true;
   2926 	sc->sc_v3d_dead = false;
   2927 	sc->sc_v3d_inited = false;
   2928 	return 0;
   2929 }
   2930 
   2931 /* Everything back to the console, whatever the client left behind. */
   2932 static void
   2933 verite3d_teardown(struct veritefb_softc *sc)
   2934 {
   2935 
   2936 	(void)veritefb_dma_drain(sc);
   2937 	veritefb_flip_cancel(sc);
   2938 
   2939 	if (sc->sc_v3d_dead || sc->sc_v3d_inited) {
   2940 		/*
   2941 		 * full reload is the only safe route back
   2942 		 */
   2943 		if (sc->sc_depth != 8)
   2944 			(void)veritefb_set_scan_depth(sc, 8);
   2945 		vfb_write4(sc, VFB_FRAMEBASEA, (uint32_t)sc->sc_fb_offset);
   2946 		if (veritefb_risc_init(sc)) {
   2947 			if (sc->sc_gc_initted)
   2948 				glyphcache_wipe(&sc->sc_gc);
   2949 			veritefb_mux_redraw(sc);
   2950 		}
   2951 	}
   2952 	/* else: INIT never ran, the console was never parked */
   2953 	if (sc->sc_v3d_ext != NULL) {
   2954 		extent_destroy(sc->sc_v3d_ext);
   2955 		sc->sc_v3d_ext = NULL;
   2956 	}
   2957 	sc->sc_v3d_open = false;
   2958 	sc->sc_v3d_dead = false;
   2959 	sc->sc_v3d_inited = false;
   2960 }
   2961 
   2962 int
   2963 verite3d_close(dev_t dev, int flags, int mode, struct lwp *l)
   2964 {
   2965 	struct veritefb_softc *sc;
   2966 
   2967 	sc = device_lookup_private(&veritefb_cd, minor(dev));
   2968 	if (sc == NULL)
   2969 		return ENXIO;
   2970 #ifdef VERITEFB_DEBUG
   2971 	/* the GL client is going away: stop sampling its PC */
   2972 	sc->sc_pcsample_on = false;
   2973 	callout_stop(&sc->sc_pcsample_ch);
   2974 #endif
   2975 	if (sc->sc_v3d_open)
   2976 		verite3d_teardown(sc);
   2977 	return 0;
   2978 }
   2979 
   2980 paddr_t
   2981 verite3d_mmap(dev_t dev, off_t off, int prot)
   2982 {
   2983 	struct veritefb_softc *sc;
   2984 	int s;
   2985 
   2986 	sc = device_lookup_private(&veritefb_cd, minor(dev));
   2987 	if (sc == NULL || !sc->sc_v3d_open)
   2988 		return (paddr_t)-1;
   2989 	if (off < 0)
   2990 		return (paddr_t)-1;
   2991 	if (off >= V3D_VRAM_MMAP_OFF) {
   2992 		off_t voff = off - V3D_VRAM_MMAP_OFF;
   2993 
   2994 		if (voff >= (off_t)sc->sc_memsize)
   2995 			return (paddr_t)-1;
   2996 		return bus_space_mmap(sc->sc_memt, sc->sc_fb_paddr + voff,
   2997 		    0, prot, BUS_SPACE_MAP_LINEAR);
   2998 	}
   2999 	s = (int)(off / V3D_SLOT_SIZE);
   3000 	if (sc->sc_v3d_slot[s] == NULL)
   3001 		return (paddr_t)-1;
   3002 	return bus_dmamem_mmap(sc->sc_dmat, &sc->sc_v3d_slot_seg[s], 1,
   3003 	    off % V3D_SLOT_SIZE, prot, 0);
   3004 }
   3005 
   3006 int
   3007 verite3d_ioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
   3008 {
   3009 	struct veritefb_softc *sc;
   3010 	int error;
   3011 
   3012 	sc = device_lookup_private(&veritefb_cd, minor(dev));
   3013 	if (sc == NULL)
   3014 		return ENXIO;
   3015 	if (!sc->sc_v3d_open)
   3016 		return EBADF;
   3017 	if (sc->sc_v3d_dead && cmd != V3D_MODE)
   3018 		return EIO;
   3019 
   3020 	switch (cmd) {
   3021 	case V3D_INIT:
   3022 		{
   3023 			struct v3d_init *vi = data;
   3024 			uint8_t *img;
   3025 			uint32_t entry;
   3026 			bool ok;
   3027 
   3028 			if (sc->sc_v3d_inited)
   3029 				return EBUSY;
   3030 			if (vi->vi_size < sizeof(Elf32_Ehdr) ||
   3031 			    vi->vi_size > VFB_MAXUCODE)
   3032 				return EINVAL;
   3033 			img = kmem_alloc(vi->vi_size, KM_SLEEP);
   3034 			error = copyin((const void *)(uintptr_t)vi->vi_ucode,
   3035 			    img, vi->vi_size);
   3036 			if (error) {
   3037 				kmem_free(img, vi->vi_size);
   3038 				return error;
   3039 			}
   3040 
   3041 			ok = veritefb_ucode_load(sc, img, vi->vi_size,
   3042 			    VFB_UCF_BASE, VFB_UCF_END, false, &entry);
   3043 			kmem_free(img, vi->vi_size);
   3044 			if (!ok)
   3045 				return EINVAL;
   3046 			if (!veritefb_risc_init(sc))
   3047 				goto dead;
   3048 			error = veritefb_suspend2d(sc);
   3049 			if (error)
   3050 				return error;
   3051 			if (veritefb_waitfifo_raw(sc, 4, 100000) != 0)
   3052 				goto dead;
   3053 			sc->sc_risc_owner = VFB_OWNER_FOREIGN;
   3054 			vfb_fifo_write(sc, VFB_CSUCODE_INIT);
   3055 			vfb_fifo_write(sc, VFB_CTX_BASE);
   3056 			vfb_fifo_write(sc, 0);
   3057 			vfb_fifo_write(sc, entry);
   3058 
   3059 			sc->sc_v3d_inited = true;
   3060 			vi->vi_ctx_base = VFB_CTX_BASE;
   3061 			vi->vi_memsize = (uint32_t)sc->sc_memsize;
   3062 			vi->vi_pool_base = sc->sc_v3d_pool_base;
   3063 			return 0;
   3064 		}
   3065 
   3066 	case V3D_SUBMIT:
   3067 		{
   3068 			struct v3d_submit *vs = data;
   3069 
   3070 			if (!sc->sc_v3d_inited)
   3071 				return EINVAL;
   3072 			if (vs->vs_slot >= V3D_RING_SLOTS ||
   3073 			    vs->vs_len == 0 || vs->vs_len > V3D_SLOT_SIZE ||
   3074 			    (vs->vs_len & 3) != 0 || vs->vs_swap > 3)
   3075 				return EINVAL;
   3076 			error = veritefb_dma_submit(sc,
   3077 			    sc->sc_v3d_slot_map[vs->vs_slot], vs->vs_len,
   3078 			    vs->vs_swap);
   3079 			if (error)
   3080 				goto dead;
   3081 			return 0;
   3082 		}
   3083 
   3084 	case V3D_SYNC:
   3085 		{
   3086 			uint32_t word = *(uint32_t *)data;
   3087 			VFB_T0();
   3088 
   3089 			if (!sc->sc_v3d_inited)
   3090 				return EINVAL;
   3091 
   3092 			if (veritefb_dma_drain(sc) != 0)
   3093 				goto dead;
   3094 #ifdef VERITEFB_DEBUG
   3095 			microuptime(&t0_);	/* round-trip time only */
   3096 #endif
   3097 			if (veritefb_waitfifo_raw(sc, 1, 100000) != 0)
   3098 				goto dead;
   3099 			vfb_fifo_write(sc, word);
   3100 			if (veritefb_read_outfifo_raw(sc, &word,
   3101 			    500000) != 0)
   3102 				goto dead;
   3103 			*(uint32_t *)data = word;
   3104 			VFB_STAT(sc, VFB_STAT_V3D_SYNC);
   3105 			return 0;
   3106 		}
   3107 
   3108 	case V3D_ALLOC:
   3109 		{
   3110 			struct v3d_alloc *va = data;
   3111 			u_long result;
   3112 
   3113 			if (va->va_size == 0 || sc->sc_v3d_ext == NULL ||
   3114 			    sc->sc_v3d_nreg >= V3D_MAX_REGIONS)
   3115 				return EINVAL;
   3116 			error = extent_alloc(sc->sc_v3d_ext, va->va_size,
   3117 			    va->va_align ? va->va_align : 4, 0, EX_NOWAIT,
   3118 			    &result);
   3119 			if (error)
   3120 				return error;
   3121 			sc->sc_v3d_reg[sc->sc_v3d_nreg].addr =
   3122 			    (uint32_t)result;
   3123 			sc->sc_v3d_reg[sc->sc_v3d_nreg].size = va->va_size;
   3124 			sc->sc_v3d_nreg++;
   3125 			va->va_addr = (uint32_t)result;
   3126 			return 0;
   3127 		}
   3128 
   3129 	case V3D_FREE:
   3130 		{
   3131 			uint32_t addr = *(const uint32_t *)data;
   3132 			int i;
   3133 
   3134 			for (i = 0; i < sc->sc_v3d_nreg; i++)
   3135 				if (sc->sc_v3d_reg[i].addr == addr)
   3136 					break;
   3137 			if (i == sc->sc_v3d_nreg)
   3138 				return EINVAL;
   3139 			(void)extent_free(sc->sc_v3d_ext, addr,
   3140 			    sc->sc_v3d_reg[i].size, EX_NOWAIT);
   3141 			sc->sc_v3d_reg[i] =
   3142 			    sc->sc_v3d_reg[--sc->sc_v3d_nreg];
   3143 			return 0;
   3144 		}
   3145 
   3146 	case V3D_MODE:
   3147 		{
   3148 			struct v3d_mode *vm = data;
   3149 			const struct veritefb_stride *st;
   3150 
   3151 			if (vm->vm_depth != 0) {
   3152 				error = veritefb_set_scan_depth(sc,
   3153 				    (int)vm->vm_depth);
   3154 				if (error)
   3155 					return error;
   3156 			}
   3157 			if (vm->vm_frame_base != 0) {
   3158 				veritefb_flip_cancel(sc);
   3159 				veritefb_wait_vsync(sc);
   3160 				vfb_write4(sc, VFB_FRAMEBASEA,
   3161 				    vm->vm_frame_base);
   3162 			}
   3163 			vm->vm_width = (uint32_t)sc->sc_width;
   3164 			vm->vm_height = (uint32_t)sc->sc_height;
   3165 			vm->vm_stride = (uint32_t)sc->sc_linebytes;
   3166 			st = veritefb_stride_for(sc->sc_width *
   3167 			    (sc->sc_depth / 8));
   3168 			vm->vm_pe_stride = st == NULL ? 0 :
   3169 			    ((uint32_t)st->stride1 << 12) |
   3170 			    ((uint32_t)st->stride0 << 8);
   3171 			return 0;
   3172 		}
   3173 
   3174 	case V3D_FLIP:
   3175 		{
   3176 			uint32_t base = *(uint32_t *)data;
   3177 			VFB_T0();
   3178 
   3179 			if ((base & V3D_FLIP_NOWAIT) != 0) {
   3180 				VFB_STAT(sc, VFB_STAT_V3D_FLIP);
   3181 				vfb_write4(sc, VFB_FRAMEBASEA,
   3182 				    base & ~V3D_FLIP_NOWAIT);
   3183 				return 0;
   3184 			}
   3185 			if (sc->sc_flip_intr_ok) {
   3186 				veritefb_flip_wait(sc);
   3187 				sc->sc_flip_base = base;
   3188 				sc->sc_flip_pending = true;
   3189 				/* arm on the NEXT vblank edge only */
   3190 				vfb_write1(sc, VFB_INTR, VFB_INTR_VERT);
   3191 				vfb_write1(sc, VFB_INTREN, VFB_INTR_VERT);
   3192 				VFB_STAT(sc, VFB_STAT_V3D_FLIP);
   3193 				return 0;
   3194 			}
   3195 			veritefb_wait_vsync(sc);
   3196 			VFB_STAT(sc, VFB_STAT_V3D_FLIP);
   3197 			vfb_write4(sc, VFB_FRAMEBASEA, base);
   3198 			return 0;
   3199 		}
   3200 
   3201 	default:
   3202 		return EPASSTHROUGH;
   3203 	}
   3204 
   3205 dead:
   3206 	/*
   3207 	 * The stream or the engine is borked.
   3208 	 */
   3209 	sc->sc_v3d_dead = true;
   3210 	if (sc->sc_depth != 8)
   3211 		(void)veritefb_set_scan_depth(sc, 8);
   3212 	(void)veritefb_risc_init(sc);
   3213 	sc->sc_risc_owner = VFB_OWNER_CONSOLE;
   3214 	return EIO;
   3215 }
   3216 
   3217 /*
   3218  * The microcode ships as a firmware file, so it can only be pulled in
   3219  * once the root filesystem exists.
   3220  */
   3221 static void
   3222 veritefb_load_firmware(device_t self)
   3223 {
   3224 	struct veritefb_softc *sc = device_private(self);
   3225 	firmware_handle_t fh;
   3226 	size_t size;
   3227 	int error;
   3228 
   3229 	error = firmware_open("veritefb", VFB_FIRMWARE_NAME, &fh);
   3230 	if (error != 0) {
   3231 		aprint_normal_dev(sc->sc_dev,
   3232 		    "no microcode (firmware veritefb/%s), "
   3233 		    "running unaccelerated\n", VFB_FIRMWARE_NAME);
   3234 		return;
   3235 	}
   3236 
   3237 	size = firmware_get_size(fh);
   3238 	if (size == 0 || size > VFB_MAXUCODE) {
   3239 		aprint_error_dev(sc->sc_dev,
   3240 		    "implausible microcode size %zu\n", size);
   3241 		firmware_close(fh);
   3242 		return;
   3243 	}
   3244 
   3245 	sc->sc_ucode = firmware_malloc(size);
   3246 	sc->sc_ucode_size = size;
   3247 	error = firmware_read(fh, 0, sc->sc_ucode, size);
   3248 	firmware_close(fh);
   3249 	if (error != 0) {
   3250 		aprint_error_dev(sc->sc_dev, "microcode read failed: %d\n",
   3251 		    error);
   3252 		firmware_free(sc->sc_ucode, size);
   3253 		sc->sc_ucode = NULL;
   3254 		return;
   3255 	}
   3256 
   3257 	(void)veritefb_risc_init(sc);
   3258 }
   3259 
   3260 /*
   3261  * no-op until operations have been queued, then a PixengSync round-trip
   3262  */
   3263 static void
   3264 veritefb_sync(struct veritefb_softc *sc)
   3265 {
   3266 	uint32_t word;
   3267 	VFB_T0();
   3268 
   3269 	if (sc->sc_unsynced == 0)
   3270 		return;
   3271 	sc->sc_unsynced = 0;
   3272 	sc->sc_unsynced_area = 0;
   3273 	if (veritefb_drain_outfifo(sc) != 0)
   3274 		return;
   3275 	if (veritefb_waitfifo(sc, 1) != 0)
   3276 		return;
   3277 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   3278 	if (veritefb_read_outfifo(sc, &word) != 0)
   3279 		return;
   3280 	if (word != VFB_SYNC_TOKEN) {
   3281 		veritefb_accel_fail(sc, "bad sync token after operation");
   3282 		return;
   3283 	}
   3284 	VFB_STAT(sc, VFB_STAT_SYNC);
   3285 }
   3286 
   3287 /* FillRectSolidRop */
   3288 static bool
   3289 veritefb_rectfill(struct veritefb_softc *sc, int x, int y, int w, int h,
   3290     uint32_t color)
   3291 {
   3292 	if (veritefb_waitfifo(sc, 4) != 0)
   3293 		return false;
   3294 	vfb_fifo_write(sc, VFB_CMDW(VFB_ROP_COPY, VCMD_FILLRECTSOLIDROP));
   3295 	vfb_fifo_write(sc, color);
   3296 	vfb_fifo_write(sc, VFB_P2(x, y));
   3297 	vfb_fifo_write(sc, VFB_P2(w, h));
   3298 	sc->sc_unsynced_area += (uint32_t)w * h;
   3299 	if (++sc->sc_unsynced >= VFB_LAZY_LIMIT ||
   3300 	    sc->sc_unsynced_area >= VFB_LAZY_AREA)
   3301 		veritefb_sync(sc);
   3302 	return sc->sc_accel == VFB_ACCEL_ON;
   3303 }
   3304 
   3305 /* ScreenBlt */
   3306 static bool
   3307 veritefb_bitblt(struct veritefb_softc *sc, int sx, int sy, int dx, int dy,
   3308     int w, int h)
   3309 {
   3310 	if (veritefb_waitfifo(sc, 5) != 0)
   3311 		return false;
   3312 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_SCREENBLT));
   3313 	vfb_fifo_write(sc, VFB_ROP_COPY);
   3314 	vfb_fifo_write(sc, VFB_P2(sx, sy));
   3315 	vfb_fifo_write(sc, VFB_P2(w, h));
   3316 	vfb_fifo_write(sc, VFB_P2(dx, dy));
   3317 	sc->sc_unsynced_area += (uint32_t)w * h;
   3318 	if (++sc->sc_unsynced >= VFB_LAZY_LIMIT ||
   3319 	    sc->sc_unsynced_area >= VFB_LAZY_AREA)
   3320 		veritefb_sync(sc);
   3321 	return sc->sc_accel == VFB_ACCEL_ON;
   3322 }
   3323 
   3324 static inline bool
   3325 veritefb_accel_op_ok(struct veritefb_softc *sc)
   3326 {
   3327 	return sc->sc_accel == VFB_ACCEL_ON &&
   3328 	    sc->sc_mode == WSDISPLAYIO_MODE_EMUL;
   3329 }
   3330 
   3331 static void
   3332 veritefb_eraserows(void *cookie, int row, int nrows, long fillattr)
   3333 {
   3334 	struct rasops_info *ri = cookie;
   3335 	struct vcons_screen *scr = ri->ri_hw;
   3336 	struct veritefb_softc *sc = scr->scr_cookie;
   3337 	int x, y, w, h;
   3338 	VFB_T0();
   3339 
   3340 	if (!veritefb_accel_op_ok(sc)) {
   3341 		sc->sc_orig_eraserows(cookie, row, nrows, fillattr);
   3342 		VFB_STAT(sc, VFB_STAT_FILL);
   3343 		return;
   3344 	}
   3345 
   3346 	if (row == 0 && nrows == ri->ri_rows) {
   3347 		x = y = 0;
   3348 		w = ri->ri_width;
   3349 		h = ri->ri_height;
   3350 	} else {
   3351 		x = ri->ri_xorigin;
   3352 		y = ri->ri_yorigin + row * ri->ri_font->fontheight;
   3353 		w = ri->ri_emuwidth;
   3354 		h = nrows * ri->ri_font->fontheight;
   3355 	}
   3356 	if (!veritefb_rectfill(sc, x, y, w, h,
   3357 	    ri->ri_devcmap[(fillattr >> 16) & 0xf]))
   3358 		sc->sc_orig_eraserows(cookie, row, nrows, fillattr);
   3359 	VFB_STAT(sc, VFB_STAT_FILL);
   3360 }
   3361 
   3362 static void
   3363 veritefb_erasecols(void *cookie, int row, int startcol, int ncols,
   3364     long fillattr)
   3365 {
   3366 	struct rasops_info *ri = cookie;
   3367 	struct vcons_screen *scr = ri->ri_hw;
   3368 	struct veritefb_softc *sc = scr->scr_cookie;
   3369 	int x, y, w, h;
   3370 
   3371 	if (!veritefb_accel_op_ok(sc)) {
   3372 		sc->sc_orig_erasecols(cookie, row, startcol, ncols,
   3373 		    fillattr);
   3374 		return;
   3375 	}
   3376 
   3377 	x = ri->ri_xorigin + startcol * ri->ri_font->fontwidth;
   3378 	y = ri->ri_yorigin + row * ri->ri_font->fontheight;
   3379 	w = ncols * ri->ri_font->fontwidth;
   3380 	h = ri->ri_font->fontheight;
   3381 	if (!veritefb_rectfill(sc, x, y, w, h,
   3382 	    ri->ri_devcmap[(fillattr >> 16) & 0xf]))
   3383 		sc->sc_orig_erasecols(cookie, row, startcol, ncols,
   3384 		    fillattr);
   3385 }
   3386 
   3387 static void
   3388 veritefb_copyrows(void *cookie, int srcrow, int dstrow, int nrows)
   3389 {
   3390 	struct rasops_info *ri = cookie;
   3391 	struct vcons_screen *scr = ri->ri_hw;
   3392 	struct veritefb_softc *sc = scr->scr_cookie;
   3393 	int x, sy, dy, w, h;
   3394 	VFB_T0();
   3395 
   3396 	if (!veritefb_accel_op_ok(sc)) {
   3397 		sc->sc_orig_copyrows(cookie, srcrow, dstrow, nrows);
   3398 		VFB_STAT(sc, VFB_STAT_BLT);
   3399 		return;
   3400 	}
   3401 
   3402 	x = ri->ri_xorigin;
   3403 	sy = ri->ri_yorigin + srcrow * ri->ri_font->fontheight;
   3404 	dy = ri->ri_yorigin + dstrow * ri->ri_font->fontheight;
   3405 	w = ri->ri_emuwidth;
   3406 	h = nrows * ri->ri_font->fontheight;
   3407 	if (!veritefb_bitblt(sc, x, sy, x, dy, w, h))
   3408 		sc->sc_orig_copyrows(cookie, srcrow, dstrow, nrows);
   3409 	VFB_STAT(sc, VFB_STAT_BLT);
   3410 }
   3411 
   3412 static void
   3413 veritefb_copycols(void *cookie, int row, int srccol, int dstcol, int ncols)
   3414 {
   3415 	struct rasops_info *ri = cookie;
   3416 	struct vcons_screen *scr = ri->ri_hw;
   3417 	struct veritefb_softc *sc = scr->scr_cookie;
   3418 	int sx, dx, y, w, h;
   3419 
   3420 	if (!veritefb_accel_op_ok(sc)) {
   3421 		sc->sc_orig_copycols(cookie, row, srccol, dstcol, ncols);
   3422 		return;
   3423 	}
   3424 
   3425 	sx = ri->ri_xorigin + srccol * ri->ri_font->fontwidth;
   3426 	dx = ri->ri_xorigin + dstcol * ri->ri_font->fontwidth;
   3427 	y = ri->ri_yorigin + row * ri->ri_font->fontheight;
   3428 	w = ncols * ri->ri_font->fontwidth;
   3429 	h = ri->ri_font->fontheight;
   3430 	if (!veritefb_bitblt(sc, sx, y, dx, y, w, h))
   3431 		sc->sc_orig_copycols(cookie, row, srccol, dstcol, ncols);
   3432 }
   3433 
   3434 /* Blit-within-VRAM for the glyph cache. */
   3435 static void
   3436 veritefb_gc_bitblt(void *cookie, int xs, int ys, int xd, int yd, int wi,
   3437     int he, int rop)
   3438 {
   3439 	struct veritefb_softc *sc = cookie;
   3440 
   3441 	(void)veritefb_bitblt(sc, xs, ys, xd, yd, wi, he);
   3442 }
   3443 
   3444 /*
   3445  * Glyph-cached putchar
   3446  */
   3447 static void
   3448 veritefb_putchar(void *cookie, int row, int col, u_int c, long attr)
   3449 {
   3450 	struct rasops_info *ri = cookie;
   3451 	struct vcons_screen *scr = ri->ri_hw;
   3452 	struct veritefb_softc *sc = scr->scr_cookie;
   3453 	struct wsdisplay_font *font = PICK_FONT(ri, c);
   3454 	uint32_t fg, bg;
   3455 	int x, y, wi, he, rv;
   3456 	VFB_T0();
   3457 
   3458 	/* Anything drawn before firmload lands here. */
   3459 	if (!veritefb_accel_op_ok(sc) || !sc->sc_gc_initted) {
   3460 		veritefb_sync(sc);
   3461 		sc->sc_orig_putchar(cookie, row, col, c, attr);
   3462 		VFB_STAT(sc, VFB_STAT_CHAR_SW);
   3463 		return;
   3464 	}
   3465 
   3466 	if (!CHAR_IN_FONT(c, font))
   3467 		return;
   3468 
   3469 	wi = font->fontwidth;
   3470 	he = font->fontheight;
   3471 	x = ri->ri_xorigin + col * wi;
   3472 	y = ri->ri_yorigin + row * he;
   3473 	fg = ri->ri_devcmap[(attr >> 24) & 0xf];
   3474 	bg = ri->ri_devcmap[(attr >> 16) & 0xf];
   3475 
   3476 	if (c == ' ') {
   3477 		if (!veritefb_rectfill(sc, x, y, wi, he, bg)) {
   3478 			sc->sc_orig_putchar(cookie, row, col, c, attr);
   3479 			return;
   3480 		}
   3481 		if (attr & WSATTR_UNDERLINE)
   3482 			(void)veritefb_rectfill(sc,
   3483 			    x, y + he - VFB_UNDERLINE_OFF, wi, 1, fg);
   3484 		VFB_STAT(sc, VFB_STAT_CHAR_SPACE);
   3485 		return;
   3486 	}
   3487 
   3488 	rv = glyphcache_try(&sc->sc_gc, c, x, y, attr);
   3489 	if (rv == GC_OK) {
   3490 		VFB_STAT(sc, VFB_STAT_CHAR_HIT);
   3491 		return;
   3492 	}
   3493 
   3494 	/*
   3495 	 * The engine may still be executing queued operations...
   3496 	 */
   3497 	veritefb_sync(sc);
   3498 	sc->sc_orig_putchar(cookie, row, col, c, attr &
   3499 	    ~(long)(WSATTR_REVERSE | WSATTR_HILIT | WSATTR_BLINK |
   3500 	    WSATTR_UNDERLINE));
   3501 
   3502 	if (rv == GC_ADD) {
   3503 		glyphcache_add(&sc->sc_gc, c, x, y);
   3504 	} else if (attr & WSATTR_UNDERLINE)
   3505 		(void)veritefb_rectfill(sc,
   3506 		    x, y + he - VFB_UNDERLINE_OFF, wi, 1, fg);
   3507 	VFB_STAT(sc, VFB_STAT_CHAR_ADD);
   3508 }
   3509 
   3510 #if defined(DDB) && defined(VERITEFB_DEBUG)
   3511 /*
   3512  * ddb 'verite*' commands, wrappers over the RISC debug port.
   3513  * 'veriteregs' leaves the RISC held and clobbers the decoder IR,
   3514  * resume with 'veritereset', not 'veritecont'.
   3515  */
   3516 
   3517 static struct veritefb_softc *veritefb_ddb_sc;
   3518 
   3519 static const char *
   3520 veritefb_db_regname(int idx)
   3521 {
   3522 	switch (idx) {
   3523 	case VRISC_FLAG:	return "flag";
   3524 	case 176:		return "cmd-param";
   3525 	case 177:		return "cmd-index";
   3526 	case 224:		return "DispatchTable";
   3527 	case 225:		return "code-base";
   3528 	case 227:		return "shadow/fb-base";
   3529 	case 235:		return "load-bias";
   3530 	case VRISC_SP:		return "SP(dbg-scratch)";
   3531 	case VRISC_RA:		return "RA(dbg-scratch)";
   3532 	case VRISC_FP:		return "FP(dbg-scratch)";
   3533 	default:		return NULL;
   3534 	}
   3535 }
   3536 
   3537 static void
   3538 veritefb_db_diag(db_expr_t addr, bool have_addr, db_expr_t count,
   3539     const char *modif)
   3540 {
   3541 	struct veritefb_softc *sc = veritefb_ddb_sc;
   3542 	uint32_t pc, word;
   3543 	unsigned i, n;
   3544 
   3545 	if (sc == NULL) {
   3546 		db_printf("veritefb not attached\n");
   3547 		return;
   3548 	}
   3549 
   3550 	db_printf("accel state: %s, RISC owner: %s\n",
   3551 	    sc->sc_accel == VFB_ACCEL_ON ? "ON" :
   3552 	    sc->sc_accel == VFB_ACCEL_SW ? "SW (degraded)" : "OFF",
   3553 	    sc->sc_risc_owner == VFB_OWNER_CONSOLE ? "console" :
   3554 	    sc->sc_risc_owner == VFB_OWNER_PARKED ? "parked" : "foreign");
   3555 	db_printf("FIFOINFREE %u/31, FIFOOUTVALID %u, DEBUG 0x%02x\n",
   3556 	    vfb_read1(sc, VFB_FIFOINFREE) & VFB_FIFOINFREE_MASK,
   3557 	    vfb_read1(sc, VFB_FIFOOUTVALID) & VFB_FIFOOUTVALID_MASK,
   3558 	    vfb_read1(sc, VFB_DEBUG));
   3559 
   3560 	pc = veritefb_risc_samplepc(sc);
   3561 	db_printf("RISC PC 0x%08x: %s\n", pc, veritefb_pc_signature(pc));
   3562 
   3563 	n = MIN(sc->sc_ring_count, 16);
   3564 	db_printf("last %u FIFO words (oldest first):\n", n);
   3565 	for (i = 0; i < n; i++)
   3566 		db_printf("  [-%2u] 0x%08x\n", n - i,
   3567 		    sc->sc_ring[(sc->sc_ring_count - n + i) &
   3568 		    (VFB_RING_SIZE - 1)]);
   3569 
   3570 	/* Heartbeat, only if we believe the engine is alive. */
   3571 	if (sc->sc_accel == VFB_ACCEL_ON) {
   3572 		for (i = 0; i < VFB_DRAINPOLL; i++) {
   3573 			if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   3574 			    VFB_FIFOOUTVALID_MASK) == 0)
   3575 				break;
   3576 			(void)vfb_fifo_read(sc);
   3577 			delay(1);
   3578 		}
   3579 		if ((vfb_read1(sc, VFB_FIFOINFREE) &
   3580 		    VFB_FIFOINFREE_MASK) < 1) {
   3581 			db_printf("heartbeat: input FIFO full - RISC "
   3582 			    "not consuming (wedged)\n");
   3583 			return;
   3584 		}
   3585 		vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   3586 		for (i = 0; i < VFB_FIFOPOLL; i++) {
   3587 			if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   3588 			    VFB_FIFOOUTVALID_MASK) != 0)
   3589 				break;
   3590 			delay(1);
   3591 		}
   3592 		if (i == VFB_FIFOPOLL) {
   3593 			db_printf("heartbeat: no sync token (RISC or "
   3594 			    "pixel engine wedged)\n");
   3595 		} else {
   3596 			word = vfb_fifo_read(sc);
   3597 			db_printf("heartbeat: token 0x%08x (%s)\n", word,
   3598 			    word == VFB_SYNC_TOKEN ? "healthy" : "BAD");
   3599 		}
   3600 	} else if (sc->sc_risc_owner == VFB_OWNER_PARKED) {
   3601 		/* PARKED = the DBG-DMA configuration; the ping is PIO */
   3602 		(void)veritefb_dma_drain(sc);
   3603 		if (veritefb_drain_outfifo(sc) != 0 ||
   3604 		    veritefb_waitfifo_raw(sc, 1, VFB_FIFOPOLL) != 0) {
   3605 			db_printf("heartbeat: monitor FIFO stuck\n");
   3606 			return;
   3607 		}
   3608 		vfb_fifo_write(sc, VFB_CSUCODE_PING);
   3609 		if (veritefb_read_outfifo_raw(sc, &word, VFB_FIFOPOLL) == 0)
   3610 			db_printf("heartbeat: monitor ping 0x%08x (%s)\n",
   3611 			    word, word == VFB_CSUCODE_PING ?
   3612 			    "parked, healthy" : "BAD");
   3613 		else
   3614 			db_printf("heartbeat: monitor ping timed out\n");
   3615 	}
   3616 }
   3617 
   3618 static void
   3619 veritefb_db_suspend(db_expr_t addr, bool have_addr, db_expr_t count,
   3620     const char *modif)
   3621 {
   3622 	struct veritefb_softc *sc = veritefb_ddb_sc;
   3623 
   3624 	if (sc == NULL) {
   3625 		db_printf("veritefb not attached\n");
   3626 		return;
   3627 	}
   3628 	db_printf("suspend2d: %d\n", veritefb_suspend2d(sc));
   3629 }
   3630 
   3631 static void
   3632 veritefb_db_resume(db_expr_t addr, bool have_addr, db_expr_t count,
   3633     const char *modif)
   3634 {
   3635 	struct veritefb_softc *sc = veritefb_ddb_sc;
   3636 
   3637 	if (sc == NULL) {
   3638 		db_printf("veritefb not attached\n");
   3639 		return;
   3640 	}
   3641 	db_printf("resume2d: %d\n", veritefb_resume2d(sc));
   3642 }
   3643 
   3644 static void
   3645 veritefb_db_regs(db_expr_t addr, bool have_addr, db_expr_t count,
   3646     const char *modif)
   3647 {
   3648 	struct veritefb_softc *sc = veritefb_ddb_sc;
   3649 	const char *name;
   3650 	uint32_t val;
   3651 	int i;
   3652 
   3653 	if (sc == NULL) {
   3654 		db_printf("veritefb not attached\n");
   3655 		return;
   3656 	}
   3657 
   3658 	veritefb_risc_hold(sc);
   3659 	db_printf("register file snapshot (RISC left held; IR clobbered - "
   3660 	    "use veritereset to resume):\n");
   3661 	for (i = 0; i < 256; i++) {
   3662 		val = veritefb_risc_readrf(sc, i);
   3663 		name = veritefb_db_regname(i);
   3664 		db_printf("%%%-3d 0x%08x%s%s%s", i, val,
   3665 		    name ? " (" : "", name ? name : "", name ? ")" : "");
   3666 		db_printf((i & 3) == 3 ? "\n" : "  ");
   3667 	}
   3668 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC);
   3669 	db_printf("PC 0x%08x\n", vfb_read4(sc, VFB_STATEDATA));
   3670 }
   3671 
   3672 static void
   3673 veritefb_db_reset(db_expr_t addr, bool have_addr, db_expr_t count,
   3674     const char *modif)
   3675 {
   3676 	struct veritefb_softc *sc = veritefb_ddb_sc;
   3677 
   3678 	if (sc == NULL || sc->sc_ucode == NULL) {
   3679 		db_printf("veritefb not attached or no microcode\n");
   3680 		return;
   3681 	}
   3682 
   3683 	db_printf("reloading microcode and restarting RISC...\n");
   3684 	db_printf("%s\n", veritefb_risc_init(sc) ?
   3685 	    "handshake passed, acceleration restored" :
   3686 	    "bring-up FAILED, staying in software rendering");
   3687 }
   3688 
   3689 static void
   3690 veritefb_db_fault(db_expr_t addr, bool have_addr, db_expr_t count,
   3691     const char *modif)
   3692 {
   3693 	struct veritefb_softc *sc = veritefb_ddb_sc;
   3694 
   3695 	if (sc == NULL) {
   3696 		db_printf("veritefb not attached\n");
   3697 		return;
   3698 	}
   3699 
   3700 	db_printf("deliberately sending an invalid command (trap slot), "
   3701 	    "run veritediag to observe, veritereset to recover\n");
   3702 	(void)veritefb_dma_drain(sc);
   3703 	vfb_fifo_write(sc, VFB_CMDW(0, VFB_CMD_BOGUS));
   3704 }
   3705 
   3706 static void
   3707 veritefb_db_cont(db_expr_t addr, bool have_addr, db_expr_t count,
   3708     const char *modif)
   3709 {
   3710 	struct veritefb_softc *sc = veritefb_ddb_sc;
   3711 
   3712 	if (sc == NULL) {
   3713 		db_printf("veritefb not attached\n");
   3714 		return;
   3715 	}
   3716 	veritefb_risc_continue(sc);
   3717 	db_printf("RISC released\n");
   3718 }
   3719 
   3720 static const struct db_command veritefb_db_commands[] = {
   3721 	{ DDB_ADD_CMD("veritediag", veritefb_db_diag, 0,
   3722 	    "veritefb: PC signature, FIFO gauges, ring, heartbeat",
   3723 	    NULL, NULL) },
   3724 	{ DDB_ADD_CMD("veriteregs", veritefb_db_regs, 0,
   3725 	    "veritefb: RISC register file snapshot (leaves RISC held)",
   3726 	    NULL, NULL) },
   3727 	{ DDB_ADD_CMD("veritereset", veritefb_db_reset, 0,
   3728 	    "veritefb: reload microcode, restart RISC, re-handshake",
   3729 	    NULL, NULL) },
   3730 	{ DDB_ADD_CMD("veritefault", veritefb_db_fault, 0,
   3731 	    "veritefb: deliberately wedge the RISC (recovery test)",
   3732 	    NULL, NULL) },
   3733 	{ DDB_ADD_CMD("veritesuspend", veritefb_db_suspend, 0,
   3734 	    "veritefb: park the 2D microcode in the csucode monitor",
   3735 	    NULL, NULL) },
   3736 	{ DDB_ADD_CMD("veriteresume", veritefb_db_resume, 0,
   3737 	    "veritefb: resume the parked 2D microcode",
   3738 	    NULL, NULL) },
   3739 	{ DDB_ADD_CMD("veritecont", veritefb_db_cont, 0,
   3740 	    "veritefb: release the RISC hold bit",
   3741 	    NULL, NULL) },
   3742 	{ DDB_END_CMD },
   3743 };
   3744 
   3745 static void
   3746 veritefb_ddb_attach(struct veritefb_softc *sc)
   3747 {
   3748 	if (veritefb_ddb_sc != NULL)
   3749 		return;
   3750 	veritefb_ddb_sc = sc;
   3751 	(void)db_register_tbl(DDB_BASE_CMD, veritefb_db_commands);
   3752 }
   3753 #endif /* DDB && VERITEFB_DEBUG */
   3754 
   3755