Home | History | Annotate | Line # | Download | only in pci
      1 /*	$NetBSD: veritefb.c,v 1.1 2026/07/11 15:18:21 rkujawa Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2026 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Radoslaw Kujawa.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     29  */
     30 
     31 /*
     32  * Rendition Verite V2100/V2200 driver.
     33  *
     34  * Influenced by xf86-video-rendition.
     35  *
     36  * The on-board RISC boots from the card ROM at PCI reset and parks in
     37  * a loop. We reset it and hold before any other access to the card.
     38  * The console runs unaccelerated from autoconf on until 2D microcode is
     39  * loaded.
     40  */
     41 
     42 #include <sys/cdefs.h>
     43 __KERNEL_RCSID(0, "$NetBSD: veritefb.c,v 1.1 2026/07/11 15:18:21 rkujawa Exp $");
     44 
     45 #include <sys/param.h>
     46 #include <sys/systm.h>
     47 #include <sys/kernel.h>
     48 #include <sys/device.h>
     49 #include <sys/endian.h>
     50 
     51 #include <sys/exec_elf.h>
     52 
     53 #include <dev/firmload.h>
     54 
     55 #include <dev/pci/pcivar.h>
     56 #include <dev/pci/pcireg.h>
     57 #include <dev/pci/pcidevs.h>
     58 #include <dev/pci/pciio.h>
     59 
     60 #include <dev/pci/veritefbreg.h>
     61 #include <dev/pci/veritefb_ucode.h>
     62 #include <dev/pci/veritefbio.h>
     63 
     64 #include <dev/wscons/wsdisplayvar.h>
     65 #include <dev/wscons/wsconsio.h>
     66 #include <dev/wsfont/wsfont.h>
     67 #include <dev/rasops/rasops.h>
     68 #include <dev/wscons/wsdisplay_vconsvar.h>
     69 #include <dev/wscons/wsdisplay_glyphcachevar.h>
     70 #include <dev/pci/wsdisplay_pci.h>
     71 
     72 #include "opt_wsemul.h"
     73 #include "opt_veritefb.h"
     74 #include "opt_ddb.h"
     75 
     76 #include <dev/videomode/videomode.h>
     77 #include <dev/videomode/edidvar.h>
     78 
     79 #include <dev/i2c/i2cvar.h>
     80 #include <dev/i2c/i2c_bitbang.h>
     81 #include <dev/i2c/ddcvar.h>
     82 
     83 #ifdef DDB
     84 #include <machine/db_machdep.h>
     85 #include <ddb/db_command.h>
     86 #include <ddb/db_output.h>
     87 #endif
     88 
     89 #define VFB_MAXPOLL	100000	/* status/hold polls */
     90 #define VFB_VSYNCPOLL	40000	/* vsync wait, ~2 frames in us */
     91 #define VFB_SHORTPOLL	100	/* polls in the RISC debug port */
     92 #define VFB_FIFOPOLL	100000	/* FIFO waits, us */
     93 #define VFB_DRAINPOLL	10000	/* output FIFO drains */
     94 
     95 #define VFB_PROBE_PATTERN	0xf5faaf5fU
     96 #define VFB_PROBE_START		0x12345678U
     97 #define VFB_MAXVRAM		(16 * 1024 * 1024)
     98 #define VFB_MAXUCODE		(1024 * 1024)	/* sanity cap for firmware */
     99 
    100 #define VFB_PLL_REF		1431818	/* 14.31818 MHz in units of 10 Hz */
    101 
    102 #define VFB_FIRMWARE_NAME	"v20002d.uc"
    103 
    104 #define VFB_GC_GAP		5	/* scanlines between fb and glyph cache */
    105 #define VFB_UNDERLINE_OFF	2	/* underline offset from cell bottom */
    106 #define VFB_GETPIXEL_PATTERN	0x5a5a5a5aU /* handshake test pixels */
    107 #define VFB_CMD_BOGUS		50	/* unassigned cmd for fault injection */
    108 
    109 #define VFB_ACCEL_OFF	0	/* no microcode loaded */
    110 #define VFB_ACCEL_SW	1	/* degraded after a fault; never retried */
    111 #define VFB_ACCEL_ON	2	/* RISC running, handshake passed */
    112 
    113 struct veritefb_softc {
    114 	device_t		sc_dev;
    115 	pci_chipset_tag_t	sc_pc;
    116 	pcitag_t		sc_pcitag;
    117 
    118 	bus_space_tag_t		sc_iot;		/* I/O registers (BAR1) */
    119 	bus_space_handle_t	sc_ioh;
    120 	bus_addr_t		sc_io_paddr;
    121 	bus_size_t		sc_ios;
    122 	bus_space_tag_t		sc_mmiot;	/* MMIO registers (BAR2) */
    123 	bus_space_handle_t	sc_mmioh;
    124 	bus_addr_t		sc_mmio_paddr;
    125 	bus_size_t		sc_mmios;
    126 
    127 	bus_space_tag_t		sc_regt;
    128 	bus_space_handle_t	sc_regh;
    129 	bus_size_t		sc_regoff;
    130 	bus_space_tag_t		sc_memt;	/* fb aperture (BAR0) */
    131 	bus_space_handle_t	sc_memh;
    132 	bus_addr_t		sc_fb_paddr;
    133 	bus_size_t		sc_apsize;	/* mapped aperture size */
    134 	bus_size_t		sc_memsize;	/* probed VRAM size */
    135 	bus_size_t		sc_fb_offset;	/* fb start (microcode area) */
    136 
    137 	/* RISC / acceleration state */
    138 	int			sc_accel;	/* VFB_ACCEL_* */
    139 	uint32_t		sc_ucode_entry;
    140 	uint8_t			*sc_ucode;	/* firmware image copy */
    141 	size_t			sc_ucode_size;
    142 
    143 	glyphcache		sc_gc;		/* VRAM glyph cache */
    144 	bool			sc_gc_initted;
    145 #ifdef VERITEFB_DEBUG
    146 	/* last words written to the input FIFO */
    147 #define VFB_RING_SIZE	128		/* power of two */
    148 	uint32_t		sc_ring[VFB_RING_SIZE];
    149 	unsigned		sc_ring_count;
    150 	struct veritefb_dbg_stats sc_stats;
    151 #endif
    152 
    153 	/* software rendering ops, the permanent fallback */
    154 	void (*sc_orig_eraserows)(void *, int, int, long);
    155 	void (*sc_orig_erasecols)(void *, int, int, int, long);
    156 	void (*sc_orig_copyrows)(void *, int, int, int);
    157 	void (*sc_orig_copycols)(void *, int, int, int, int);
    158 	void (*sc_orig_putchar)(void *, int, int, u_int, long);
    159 
    160 	int			sc_width;
    161 	int			sc_height;
    162 	int			sc_depth;
    163 	int			sc_linebytes;
    164 	uint8_t			sc_stride0;	/* pixel engine stride */
    165 	uint8_t			sc_stride1;
    166 	const struct videomode	*sc_videomode;	/* the mode in use */
    167 
    168 	/* DDC/EDID */
    169 	struct i2c_controller	sc_i2c;
    170 	uint32_t		sc_ddc_base;	/* CRTCCTL sans DDC bits */
    171 	uint8_t			sc_edid[128];
    172 	struct edid_info	sc_ei;
    173 	bool			sc_edid_valid;
    174 
    175 	int			sc_mode;	/* WSDISPLAYIO_MODE_* */
    176 	struct vcons_data	vd;
    177 	struct vcons_screen	sc_console_screen;
    178 	struct wsscreen_descr	sc_defaultscreen_descr;
    179 	const struct wsscreen_descr *sc_screens[1];
    180 	struct wsscreen_list	sc_screenlist;
    181 	u_char			sc_cmap_red[256];
    182 	u_char			sc_cmap_green[256];
    183 	u_char			sc_cmap_blue[256];
    184 };
    185 
    186 static const struct veritefb_stride {
    187 	uint16_t linebytes;
    188 	uint8_t stride0, stride1;
    189 } veritefb_stride_table[] = {
    190 	{  640, 2, 4 },
    191 	{  704, 6, 4 },
    192 	{  768, 5, 0 },
    193 	{  784, 5, 1 },
    194 	{  800, 5, 2 },
    195 	{  832, 5, 3 },
    196 	{  896, 5, 4 },
    197 	{ 1024, 3, 0 },
    198 	{ 1040, 3, 1 },
    199 	{ 1056, 3, 2 },
    200 	{ 1088, 3, 3 },
    201 	{ 1152, 3, 4 },
    202 	{ 1168, 7, 1 },
    203 	{ 1184, 7, 2 },
    204 	{ 1216, 7, 3 },
    205 	{ 1280, 1, 5 },
    206 	{ 1536, 2, 5 },
    207 	{ 1600, 6, 5 },
    208 	{ 1792, 5, 5 },
    209 	{ 2048, 0, 6 },
    210 	{ 0, 0, 0 }
    211 };
    212 
    213 static int	veritefb_match(device_t, cfdata_t, void *);
    214 static void	veritefb_attach(device_t, device_t, void *);
    215 
    216 static void	veritefb_risc_softreset(struct veritefb_softc *);
    217 static void	veritefb_risc_hold(struct veritefb_softc *);
    218 static void	veritefb_risc_continue(struct veritefb_softc *);
    219 static void	veritefb_risc_forcestep(struct veritefb_softc *, uint32_t);
    220 static void	veritefb_risc_writerf(struct veritefb_softc *, uint8_t,
    221 		    uint32_t);
    222 static uint32_t	veritefb_risc_readrf(struct veritefb_softc *, uint8_t);
    223 static uint32_t	veritefb_risc_readmem(struct veritefb_softc *, uint32_t);
    224 static void	veritefb_risc_writemem(struct veritefb_softc *, uint32_t,
    225 		    uint32_t);
    226 static void	veritefb_risc_flushicache(struct veritefb_softc *);
    227 static void	veritefb_risc_start(struct veritefb_softc *, uint32_t);
    228 
    229 static uint32_t	veritefb_risc_samplepc(struct veritefb_softc *);
    230 static void	veritefb_accel_fail(struct veritefb_softc *, const char *);
    231 static int	veritefb_waitfifo(struct veritefb_softc *, int);
    232 static int	veritefb_drain_outfifo(struct veritefb_softc *);
    233 static int	veritefb_read_outfifo(struct veritefb_softc *, uint32_t *);
    234 static void	veritefb_load_firmware(device_t);
    235 static bool	veritefb_ucode_to_vram(struct veritefb_softc *);
    236 static bool	veritefb_risc_init(struct veritefb_softc *);
    237 static size_t	veritefb_mem_size(struct veritefb_softc *);
    238 
    239 static bool	veritefb_calc_pclk(int, int *, int *, int *);
    240 static const struct veritefb_stride *veritefb_stride_for(int);
    241 static bool	veritefb_set_mode(struct veritefb_softc *,
    242 		    const struct videomode *);
    243 
    244 static void	veritefb_i2cbb_set_bits(void *, uint32_t);
    245 static void	veritefb_i2cbb_set_dir(void *, uint32_t);
    246 static uint32_t	veritefb_i2cbb_read_bits(void *);
    247 static int	veritefb_i2c_send_start(void *, int);
    248 static int	veritefb_i2c_send_stop(void *, int);
    249 static int	veritefb_i2c_initiate_xfer(void *, i2c_addr_t, int);
    250 static int	veritefb_i2c_read_byte(void *, uint8_t *, int);
    251 static int	veritefb_i2c_write_byte(void *, uint8_t, int);
    252 static void	veritefb_ddc_read(struct veritefb_softc *);
    253 static void	veritefb_pick_mode(struct veritefb_softc *);
    254 static void	veritefb_init_dac(struct veritefb_softc *);
    255 static void	veritefb_wait_vsync(struct veritefb_softc *);
    256 static void	veritefb_set_dac_entry(struct veritefb_softc *, int, uint8_t,
    257 		    uint8_t, uint8_t);
    258 static void	veritefb_init_palette(struct veritefb_softc *);
    259 static int	veritefb_getcmap(struct veritefb_softc *,
    260 		    struct wsdisplay_cmap *);
    261 static int	veritefb_putcmap(struct veritefb_softc *,
    262 		    struct wsdisplay_cmap *);
    263 
    264 static void	veritefb_init_screen(void *, struct vcons_screen *, int,
    265 		    long *);
    266 static paddr_t	veritefb_mmap(void *, void *, off_t, int);
    267 static int	veritefb_ioctl(void *, void *, u_long, void *, int,
    268 		    struct lwp *);
    269 
    270 static void	veritefb_sync(struct veritefb_softc *);
    271 static bool	veritefb_rectfill(struct veritefb_softc *, int, int, int,
    272 		    int, uint32_t);
    273 static bool	veritefb_bitblt(struct veritefb_softc *, int, int, int, int,
    274 		    int, int);
    275 static void	veritefb_eraserows(void *, int, int, long);
    276 static void	veritefb_erasecols(void *, int, int, int, long);
    277 static void	veritefb_copyrows(void *, int, int, int);
    278 static void	veritefb_copycols(void *, int, int, int, int);
    279 static void	veritefb_putchar(void *, int, int, u_int, long);
    280 static void	veritefb_gc_bitblt(void *, int, int, int, int, int, int,
    281 		    int);
    282 
    283 #if defined(DDB) && defined(VERITEFB_DEBUG)
    284 static void	veritefb_ddb_attach(struct veritefb_softc *);
    285 #endif
    286 
    287 CFATTACH_DECL_NEW(veritefb, sizeof(struct veritefb_softc),
    288     veritefb_match, veritefb_attach, NULL, NULL);
    289 
    290 static struct wsdisplay_accessops veritefb_accessops = {
    291 	.ioctl = veritefb_ioctl,
    292 	.mmap = veritefb_mmap,
    293 };
    294 
    295 static inline uint8_t
    296 vfb_read1(struct veritefb_softc *sc, bus_size_t reg)
    297 {
    298 	if (reg >= VFB_IOONLY_BASE)
    299 		return bus_space_read_1(sc->sc_iot, sc->sc_ioh, reg);
    300 	return bus_space_read_1(sc->sc_regt, sc->sc_regh,
    301 	    sc->sc_regoff + reg);
    302 }
    303 
    304 static inline void
    305 vfb_write1(struct veritefb_softc *sc, bus_size_t reg, uint8_t val)
    306 {
    307 	if (reg >= VFB_IOONLY_BASE) {
    308 		bus_space_write_1(sc->sc_iot, sc->sc_ioh, reg, val);
    309 		return;
    310 	}
    311 	bus_space_write_1(sc->sc_regt, sc->sc_regh, sc->sc_regoff + reg,
    312 	    val);
    313 }
    314 
    315 static inline uint32_t
    316 vfb_read4(struct veritefb_softc *sc, bus_size_t reg)
    317 {
    318 	if (reg >= VFB_IOONLY_BASE)
    319 		return bus_space_read_4(sc->sc_iot, sc->sc_ioh, reg);
    320 	return bus_space_read_4(sc->sc_regt, sc->sc_regh,
    321 	    sc->sc_regoff + reg);
    322 }
    323 
    324 static inline void
    325 vfb_write4(struct veritefb_softc *sc, bus_size_t reg, uint32_t val)
    326 {
    327 	if (reg >= VFB_IOONLY_BASE) {
    328 		bus_space_write_4(sc->sc_iot, sc->sc_ioh, reg, val);
    329 		return;
    330 	}
    331 	bus_space_write_4(sc->sc_regt, sc->sc_regh, sc->sc_regoff + reg,
    332 	    val);
    333 }
    334 
    335 static inline uint32_t
    336 vfb_fb_read4(struct veritefb_softc *sc, bus_size_t off)
    337 {
    338 	return bus_space_read_4(sc->sc_memt, sc->sc_memh, off);
    339 }
    340 
    341 static inline void
    342 vfb_fb_write4(struct veritefb_softc *sc, bus_size_t off, uint32_t val)
    343 {
    344 	bus_space_write_4(sc->sc_memt, sc->sc_memh, off, val);
    345 }
    346 
    347 /*
    348  * The FIFO window: input FIFO on write, output FIFO on read.
    349  */
    350 static void
    351 vfb_fifo_write(struct veritefb_softc *sc, uint32_t word)
    352 {
    353 #ifdef VERITEFB_DEBUG
    354 	sc->sc_ring[sc->sc_ring_count++ & (VFB_RING_SIZE - 1)] = word;
    355 #endif
    356 	bus_space_write_4(sc->sc_regt, sc->sc_regh, VFB_FIFO_SWAP_NO, word);
    357 }
    358 
    359 static inline uint32_t
    360 vfb_fifo_read(struct veritefb_softc *sc)
    361 {
    362 	return bus_space_read_4(sc->sc_regt, sc->sc_regh, VFB_FIFO_SWAP_NO);
    363 }
    364 
    365 static void
    366 vfb_pacepoll4(struct veritefb_softc *sc, bus_size_t reg, uint32_t data,
    367     uint32_t mask)
    368 {
    369 	int i;
    370 
    371 	for (i = 0; i < VFB_SHORTPOLL; i++)
    372 		if ((vfb_read4(sc, reg) & mask) == (data & mask))
    373 			break;
    374 }
    375 
    376 static void
    377 vfb_pacepoll1(struct veritefb_softc *sc, bus_size_t reg, uint8_t data,
    378     uint8_t mask)
    379 {
    380 	int i;
    381 
    382 	for (i = 0; i < VFB_SHORTPOLL; i++)
    383 		if ((vfb_read1(sc, reg) & mask) == (data & mask))
    384 			break;
    385 }
    386 
    387 static int
    388 veritefb_match(device_t parent, cfdata_t match, void *aux)
    389 {
    390 	const struct pci_attach_args *pa = aux;
    391 
    392 	if (PCI_VENDOR(pa->pa_id) == PCI_VENDOR_RENDITION &&
    393 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_RENDITION_V2X00)
    394 		return 100;	/* ahead of genfb(4) */
    395 
    396 	return 0;
    397 }
    398 
    399 static void
    400 veritefb_attach(device_t parent, device_t self, void *aux)
    401 {
    402 	struct veritefb_softc *sc = device_private(self);
    403 	struct wsemuldisplaydev_attach_args ws_aa;
    404 	struct rasops_info *ri;
    405 	const struct pci_attach_args *pa = aux;
    406 	pcireg_t screg;
    407 	bool console;
    408 	long defattr;
    409 
    410 #ifdef VERITEFB_CONSOLE
    411 	console = true;
    412 #else
    413 	console = false;
    414 	prop_dictionary_get_bool(device_properties(self), "is_console",
    415 	    &console);
    416 #endif
    417 
    418 	sc->sc_dev = self;
    419 	sc->sc_pc = pa->pa_pc;
    420 	sc->sc_pcitag = pa->pa_tag;
    421 
    422 	screg = pci_conf_read(sc->sc_pc, sc->sc_pcitag,
    423 	    PCI_COMMAND_STATUS_REG);
    424 	screg |= PCI_COMMAND_IO_ENABLE | PCI_COMMAND_MEM_ENABLE;
    425 	pci_conf_write(sc->sc_pc, sc->sc_pcitag, PCI_COMMAND_STATUS_REG,
    426 	    screg);
    427 
    428 	pci_aprint_devinfo(pa, NULL);
    429 
    430 	if (pci_mapreg_map(pa, VFB_IO_BAR, PCI_MAPREG_TYPE_IO, 0,
    431 	    &sc->sc_iot, &sc->sc_ioh, &sc->sc_io_paddr, &sc->sc_ios) != 0) {
    432 		aprint_error_dev(sc->sc_dev, "unable to map I/O registers\n");
    433 		return;
    434 	}
    435 	sc->sc_regt = sc->sc_iot;
    436 	sc->sc_regh = sc->sc_ioh;
    437 	sc->sc_regoff = 0;
    438 
    439 	/*
    440 	 * Reset and hold it the RISC before touching the rest of the card.
    441 	 */
    442 	veritefb_risc_softreset(sc);
    443 	veritefb_risc_hold(sc);
    444 
    445 	if (pci_mapreg_map(pa, VFB_MMIO_BAR, PCI_MAPREG_TYPE_MEM, 0,
    446 	    &sc->sc_mmiot, &sc->sc_mmioh, &sc->sc_mmio_paddr,
    447 	    &sc->sc_mmios) == 0) {
    448 		sc->sc_regt = sc->sc_mmiot;
    449 		sc->sc_regh = sc->sc_mmioh;
    450 		sc->sc_regoff = VFB_MMIO_REG_BASE;
    451 	} else {
    452 		aprint_normal_dev(sc->sc_dev,
    453 		    "MMIO BAR unmappable, all registers via I/O\n");
    454 	}
    455 
    456 	if (pci_mapreg_map(pa, VFB_FB_BAR, PCI_MAPREG_TYPE_MEM,
    457 	    BUS_SPACE_MAP_LINEAR, &sc->sc_memt, &sc->sc_memh,
    458 	    &sc->sc_fb_paddr, &sc->sc_apsize) != 0) {
    459 		aprint_error_dev(sc->sc_dev,
    460 		    "unable to map framebuffer aperture\n");
    461 		return;
    462 	}
    463 
    464 	if (sc->sc_regoff != 0)
    465 		aprint_normal_dev(sc->sc_dev,
    466 		    "fb at 0x%08x, MMIO registers at 0x%08x, "
    467 		    "I/O registers at 0x%04x\n",
    468 		    (uint32_t)sc->sc_fb_paddr, (uint32_t)sc->sc_mmio_paddr,
    469 		    (uint32_t)sc->sc_io_paddr);
    470 	else
    471 		aprint_normal_dev(sc->sc_dev,
    472 		    "fb at 0x%08x, I/O registers at 0x%04x\n",
    473 		    (uint32_t)sc->sc_fb_paddr, (uint32_t)sc->sc_io_paddr);
    474 
    475 	sc->sc_memsize = veritefb_mem_size(sc);
    476 	if (sc->sc_memsize == 0) {
    477 		aprint_error_dev(sc->sc_dev, "VRAM probe failed\n");
    478 		return;
    479 	}
    480 
    481 	aprint_normal_dev(sc->sc_dev, "%zu MB video memory present\n",
    482 	    sc->sc_memsize / 1024 / 1024);
    483 
    484 	/*
    485 	 * The first VFB_MC_SIZE bytes of VRAM are reserved for the 2D
    486 	 * microcode, the framebuffer lives above it.
    487 	 */
    488 	sc->sc_fb_offset = VFB_MC_SIZE;
    489 	sc->sc_accel = VFB_ACCEL_OFF;
    490 
    491 	veritefb_ddc_read(sc);
    492 	veritefb_pick_mode(sc);
    493 
    494 	sc->sc_width = sc->sc_videomode->hdisplay;
    495 	sc->sc_height = sc->sc_videomode->vdisplay;
    496 	sc->sc_depth = 8;
    497 
    498 	{
    499 		const struct veritefb_stride *st;
    500 
    501 		st = veritefb_stride_for(sc->sc_width * (sc->sc_depth / 8));
    502 		if (st == NULL) {
    503 			aprint_error_dev(sc->sc_dev,
    504 			    "no stride encoding for %d bytes/line\n",
    505 			    sc->sc_width * (sc->sc_depth / 8));
    506 			return;
    507 		}
    508 		sc->sc_linebytes = st->linebytes;
    509 		sc->sc_stride0 = st->stride0;
    510 		sc->sc_stride1 = st->stride1;
    511 	}
    512 
    513 	aprint_normal_dev(sc->sc_dev, "setting %dx%d %d bpp resolution\n",
    514 	    sc->sc_width, sc->sc_height, sc->sc_depth);
    515 
    516 	if (!veritefb_set_mode(sc, sc->sc_videomode)) {
    517 		aprint_error_dev(sc->sc_dev, "mode set failed\n");
    518 		return;
    519 	}
    520 
    521 	bus_space_set_region_4(sc->sc_memt, sc->sc_memh, sc->sc_fb_offset, 0,
    522 	    (sc->sc_linebytes * sc->sc_height) / 4);
    523 
    524 	veritefb_init_palette(sc);
    525 
    526 	sc->sc_defaultscreen_descr = (struct wsscreen_descr){
    527 		"default",
    528 		0, 0,
    529 		NULL,
    530 		8, 16,
    531 		WSSCREEN_WSCOLORS | WSSCREEN_HILIT,
    532 		NULL
    533 	};
    534 	sc->sc_screens[0] = &sc->sc_defaultscreen_descr;
    535 	sc->sc_screenlist = (struct wsscreen_list){1, sc->sc_screens};
    536 	sc->sc_mode = WSDISPLAYIO_MODE_EMUL;
    537 
    538 	vcons_init(&sc->vd, sc, &sc->sc_defaultscreen_descr,
    539 	    &veritefb_accessops);
    540 	sc->vd.init_screen = veritefb_init_screen;
    541 
    542 	/* Glyph cache in the VRAM above the visible framebuffer. */
    543 	sc->sc_gc.gc_bitblt = veritefb_gc_bitblt;
    544 	sc->sc_gc.gc_rectfill = NULL;
    545 	sc->sc_gc.gc_blitcookie = sc;
    546 	sc->sc_gc.gc_rop = VFB_ROP_COPY;
    547 	sc->vd.show_screen_cookie = &sc->sc_gc;
    548 	sc->vd.show_screen_cb = glyphcache_adapt;
    549 
    550 	ri = &sc->sc_console_screen.scr_ri;
    551 
    552 	vcons_init_screen(&sc->vd, &sc->sc_console_screen, 1, &defattr);
    553 	sc->sc_console_screen.scr_flags |= VCONS_SCREEN_IS_STATIC;
    554 
    555 	sc->sc_gc_initted = glyphcache_init(&sc->sc_gc,
    556 	    sc->sc_height + VFB_GC_GAP,
    557 	    (int)((sc->sc_memsize - sc->sc_fb_offset) / sc->sc_linebytes) -
    558 		sc->sc_height - VFB_GC_GAP,
    559 	    sc->sc_width,
    560 	    ri->ri_font->fontwidth,
    561 	    ri->ri_font->fontheight,
    562 	    defattr) == 0;
    563 	if (!sc->sc_gc_initted)
    564 		aprint_error_dev(sc->sc_dev, "glyph cache init failed\n");
    565 
    566 	sc->sc_defaultscreen_descr.textops = &ri->ri_ops;
    567 	sc->sc_defaultscreen_descr.capabilities = ri->ri_caps;
    568 	sc->sc_defaultscreen_descr.nrows = ri->ri_rows;
    569 	sc->sc_defaultscreen_descr.ncols = ri->ri_cols;
    570 
    571 	vcons_redraw_screen(&sc->sc_console_screen);
    572 
    573 	if (console) {
    574 		wsdisplay_cnattach(&sc->sc_defaultscreen_descr, ri, 0, 0,
    575 		    defattr);
    576 		vcons_replay_msgbuf(&sc->sc_console_screen);
    577 	}
    578 
    579 	ws_aa.console = console;
    580 	ws_aa.scrdata = &sc->sc_screenlist;
    581 	ws_aa.accessops = &veritefb_accessops;
    582 	ws_aa.accesscookie = &sc->vd;
    583 
    584 	config_found(sc->sc_dev, &ws_aa, wsemuldisplaydevprint, CFARGS_NONE);
    585 
    586 #if defined(DDB) && defined(VERITEFB_DEBUG)
    587 	veritefb_ddb_attach(sc);
    588 #endif
    589 
    590 	/* Firmware needs a mounted root filesystem. */
    591 	config_mountroot(self, veritefb_load_firmware);
    592 }
    593 
    594 /*
    595  * Reset the chip, leaving the RISC held.
    596  */
    597 static void
    598 veritefb_risc_softreset(struct veritefb_softc *sc)
    599 {
    600 	int i;
    601 
    602 	vfb_write1(sc, VFB_DEBUG, VFB_DEBUG_SOFTRESET | VFB_DEBUG_HOLDRISC);
    603 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC);
    604 	for (i = 0; i < 3; i++)
    605 		(void)vfb_read4(sc, VFB_STATEDATA);
    606 
    607 	vfb_write1(sc, VFB_DEBUG, VFB_DEBUG_HOLDRISC);
    608 	for (i = 0; i < 3; i++)
    609 		(void)vfb_read4(sc, VFB_STATEDATA);
    610 
    611 	/* Clear any pending interrupts, no byte swapping. */
    612 	vfb_write1(sc, VFB_INTR, 0xff);
    613 	vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
    614 }
    615 
    616 /*
    617  * Make sure the RISC is held.
    618  */
    619 static void
    620 veritefb_risc_hold(struct veritefb_softc *sc)
    621 {
    622 	uint8_t debugreg;
    623 	int i;
    624 
    625 	for (i = 0; i < VFB_MAXPOLL; i++) {
    626 		if ((vfb_read1(sc, VFB_STATUS) & VFB_STATUS_HOLD_MASK) ==
    627 		    VFB_STATUS_HOLD_MASK)
    628 			break;
    629 		delay(1);
    630 	}
    631 	if (i == VFB_MAXPOLL)
    632 		aprint_debug_dev(sc->sc_dev,
    633 		    "timeout waiting for idle status before hold\n");
    634 
    635 	debugreg = vfb_read1(sc, VFB_DEBUG);
    636 	vfb_write1(sc, VFB_DEBUG, debugreg | VFB_DEBUG_HOLDRISC);
    637 
    638 	for (i = 0; i < VFB_MAXPOLL; i++) {
    639 		if (vfb_read1(sc, VFB_STATUS) & VFB_STATUS_HELD)
    640 			break;
    641 		delay(1);
    642 	}
    643 	if (i == VFB_MAXPOLL)
    644 		aprint_debug_dev(sc->sc_dev,
    645 		    "timeout waiting for hold confirmation\n");
    646 }
    647 
    648 /*
    649  * Probe the amount of VRAM by write/readback at 1 MB steps...
    650  */
    651 static size_t
    652 veritefb_mem_size(struct veritefb_softc *sc)
    653 {
    654 	const bus_size_t onemeg = 1024 * 1024;
    655 	bus_size_t offset, maxvram;
    656 	uint32_t pattern, start;
    657 	uint8_t modereg, memendian;
    658 	size_t memsize;
    659 
    660 	maxvram = MIN(VFB_MAXVRAM, sc->sc_apsize);
    661 
    662 	modereg = vfb_read1(sc, VFB_MODE);
    663 	vfb_write1(sc, VFB_MODE, VFB_MODE_NATIVE);
    664 	memendian = vfb_read1(sc, VFB_MEMENDIAN);
    665 	vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
    666 
    667 	start = vfb_fb_read4(sc, 0);
    668 	vfb_fb_write4(sc, 0, VFB_PROBE_START);
    669 	for (offset = onemeg; offset < maxvram; offset += onemeg) {
    670 		pattern = vfb_fb_read4(sc, offset);
    671 		if (pattern == VFB_PROBE_START)
    672 			break;	/* wrapped around, back at offset 0 */
    673 
    674 		pattern ^= VFB_PROBE_PATTERN;
    675 		vfb_fb_write4(sc, offset, pattern);
    676 		if (vfb_fb_read4(sc, offset) != pattern) {
    677 			offset -= onemeg;
    678 			break;
    679 		}
    680 		vfb_fb_write4(sc, offset, pattern ^ VFB_PROBE_PATTERN);
    681 	}
    682 	vfb_fb_write4(sc, 0, start);
    683 
    684 	if (offset >= maxvram)
    685 		memsize = 4 * onemeg;
    686 	else
    687 		memsize = offset;
    688 
    689 	vfb_write1(sc, VFB_MEMENDIAN, memendian);
    690 	vfb_write1(sc, VFB_MODE, modereg);
    691 
    692 	return memsize;
    693 }
    694 
    695 /*
    696  * Find PLL parameters for the requested pixel clock
    697  */
    698 static bool
    699 veritefb_calc_pclk(int kHz, int *m, int *n, int *p)
    700 {
    701 	int64_t target, vco, pcf, freq, diff, mindiff;
    702 	int mm, nn, pp;
    703 
    704 	target = (int64_t)kHz * 100;
    705 	mindiff = INT64_MAX;
    706 	*m = *n = *p = 0;
    707 
    708 	for (pp = 1; pp <= VFB_PLL_P_MAX; pp++) {
    709 		for (nn = 1; nn <= VFB_PLL_N_MAX; nn++) {
    710 			pcf = VFB_PLL_REF / nn;
    711 			if (pcf < VFB_PLL_PCF_MIN || pcf > VFB_PLL_PCF_MAX)
    712 				continue;
    713 			for (mm = 1; mm <= VFB_PLL_M_MAX; mm++) {
    714 				vco = (int64_t)VFB_PLL_REF * mm / nn;
    715 				if (vco < VFB_PLL_VCO_MIN ||
    716 				    vco > VFB_PLL_VCO_MAX)
    717 					continue;
    718 				freq = vco / pp;
    719 				diff = freq > target ?
    720 				    freq - target : target - freq;
    721 				if (diff < mindiff) {
    722 					*m = mm;
    723 					*n = nn;
    724 					*p = pp;
    725 					mindiff = diff;
    726 				}
    727 			}
    728 		}
    729 	}
    730 
    731 	return *m != 0;
    732 }
    733 
    734 /*
    735  * Smallest pixel-engine stride encoding that fits a line of the given
    736  * width... widths with no dense encoding get a padded framebuffer.
    737  */
    738 static const struct veritefb_stride *
    739 veritefb_stride_for(int linebytes)
    740 {
    741 	const struct veritefb_stride *st;
    742 
    743 	for (st = veritefb_stride_table; st->linebytes != 0; st++)
    744 		if (st->linebytes >= linebytes)
    745 			return st;
    746 	return NULL;
    747 }
    748 
    749 /*
    750  * Program a native (non-VGA) mode: memory/system clocks, pixel clock
    751  * PLL, RAMDAC, CRTC timing, frame base and stride, then enable video.
    752  */
    753 static bool
    754 veritefb_set_mode(struct veritefb_softc *sc, const struct videomode *vm)
    755 {
    756 	uint32_t memctl, crtcctl, offset, screenwidth;
    757 	int m, n, p;
    758 
    759 	if (!veritefb_calc_pclk(vm->dot_clock, &m, &n, &p)) {
    760 		aprint_error_dev(sc->sc_dev, "no PLL solution for %d kHz\n",
    761 		    vm->dot_clock);
    762 		return false;
    763 	}
    764 	aprint_debug_dev(sc->sc_dev, "PLL M=%d N=%d P=%d for %d kHz\n",
    765 	    m, n, p, vm->dot_clock);
    766 
    767 	/* Leave VGA emulation; no legacy 0xA0000 window. */
    768 	vfb_write1(sc, VFB_MODE, VFB_MODE_NATIVE);
    769 
    770 	/*
    771 	 * 8bpp this does not matter...
    772 	 * TODO: Revisit for 16/32bpp.
    773 	 */
    774 	switch (sc->sc_depth) {
    775 	case 8:
    776 		vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_END);
    777 		break;
    778 	case 16:
    779 		vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_HW);
    780 		break;
    781 	case 32:
    782 		vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
    783 		break;
    784 	}
    785 
    786 	/* System/memory clock: MClk 110 MHz, SClk 55 MHz. */
    787 	vfb_write4(sc, VFB_SCLKPLL, VFB_SCLKPLL_DEFAULT);
    788 	delay(VFB_PLL_STABILIZE_US);
    789 
    790 	/* Resume memory refresh, default write refresh period. */
    791 	memctl = vfb_read4(sc, VFB_MEMCTL) & ~VFB_MEMCTL_HOLDREFRESH;
    792 	vfb_write4(sc, VFB_MEMCTL, memctl | VFB_MEMCTL_WREFRESH_DEFAULT);
    793 
    794 	/* Native mode wants swizzled memory addressing. */
    795 	memctl = vfb_read4(sc, VFB_MEMCTL) & ~VFB_MEMCTL_ADRSWIZZLE_MASK;
    796 	vfb_write4(sc, VFB_MEMCTL, memctl);
    797 
    798 	vfb_write4(sc, VFB_PCLKPLL,
    799 	    __SHIFTIN((uint32_t)n, VFB_PCLKPLL_N_MASK) |
    800 	    __SHIFTIN((uint32_t)p, VFB_PCLKPLL_P_MASK) |
    801 	    __SHIFTIN((uint32_t)m, VFB_PCLKPLL_M_MASK));
    802 	delay(VFB_PLL_STABILIZE_US);
    803 
    804 	veritefb_init_dac(sc);
    805 
    806 	vfb_write4(sc, VFB_CRTCHORZ,
    807 	    __SHIFTIN((uint32_t)(vm->hsync_start - vm->hdisplay) / 8 - 1,
    808 		VFB_CRTCHORZ_FRONTPORCH_MASK) |
    809 	    __SHIFTIN((uint32_t)(vm->hsync_end - vm->hsync_start) / 8 - 1,
    810 		VFB_CRTCHORZ_SYNC_MASK) |
    811 	    __SHIFTIN((uint32_t)(vm->htotal - vm->hsync_end) / 8 - 1,
    812 		VFB_CRTCHORZ_BACKPORCH_MASK) |
    813 	    __SHIFTIN((uint32_t)vm->hdisplay / 8 - 1,
    814 		VFB_CRTCHORZ_ACTIVE_MASK));
    815 	vfb_write4(sc, VFB_CRTCVERT,
    816 	    __SHIFTIN((uint32_t)(vm->vsync_start - vm->vdisplay) - 1,
    817 		VFB_CRTCVERT_FRONTPORCH_MASK) |
    818 	    __SHIFTIN((uint32_t)(vm->vsync_end - vm->vsync_start) - 1,
    819 		VFB_CRTCVERT_SYNC_MASK) |
    820 	    __SHIFTIN((uint32_t)(vm->vtotal - vm->vsync_end) - 1,
    821 		VFB_CRTCVERT_BACKPORCH_MASK) |
    822 	    __SHIFTIN((uint32_t)vm->vdisplay - 1,
    823 		VFB_CRTCVERT_ACTIVE_MASK));
    824 
    825 	screenwidth = (uint32_t)sc->sc_width * (sc->sc_depth / 8);
    826 	offset = sc->sc_linebytes - screenwidth +
    827 	    screenwidth % VFB_VIDEOFIFO_BYTES;
    828 	if (screenwidth % VFB_VIDEOFIFO_BYTES == 0)
    829 		offset += VFB_VIDEOFIFO_BYTES;
    830 	vfb_write4(sc, VFB_FRAMEBASEA, (uint32_t)sc->sc_fb_offset);
    831 	vfb_write4(sc, VFB_CRTCOFFSET, offset & VFB_CRTCOFFSET_MASK);
    832 
    833 	crtcctl = VFB_PIXFMT_8I |
    834 	    VFB_CRTCCTL_VIDEOFIFOSIZE128 |
    835 	    ((vm->flags & VID_PHSYNC) ? VFB_CRTCCTL_HSYNCHI : 0) |
    836 	    ((vm->flags & VID_PVSYNC) ? VFB_CRTCCTL_VSYNCHI : 0) |
    837 	    VFB_CRTCCTL_HSYNCENABLE |
    838 	    VFB_CRTCCTL_VSYNCENABLE |
    839 	    VFB_CRTCCTL_VIDEOENABLE;
    840 	vfb_write4(sc, VFB_CRTCCTL, crtcctl);
    841 
    842 	return true;
    843 }
    844 
    845 #define VFB_DDC_PACE_US		5	/* between line transitions */
    846 #define VFB_DDC_STRETCH_US	1000	/* max tolerated clock stretch */
    847 
    848 static const struct i2c_bitbang_ops veritefb_i2cbb_ops = {
    849 	veritefb_i2cbb_set_bits,
    850 	veritefb_i2cbb_set_dir,
    851 	veritefb_i2cbb_read_bits,
    852 	{
    853 		VFB_CRTCCTL_DDCDATA,	/* SDA */
    854 		VFB_CRTCCTL_DDCOUTPUT,	/* SCL */
    855 		0,			/* open-drain: no direction flip */
    856 		0
    857 	}
    858 };
    859 
    860 /*
    861  * SDA in output mode is push-pull, so open-drain is emulated
    862  */
    863 static void
    864 veritefb_i2cbb_set_bits(void *cookie, uint32_t bits)
    865 {
    866 	struct veritefb_softc *sc = cookie;
    867 	uint32_t v;
    868 
    869 	v = sc->sc_ddc_base & ~(VFB_CRTCCTL_DDCDATA |
    870 	    VFB_CRTCCTL_DDCOUTPUT | VFB_CRTCCTL_ENABLEDDC);
    871 	if (bits & VFB_CRTCCTL_DDCOUTPUT)
    872 		v |= VFB_CRTCCTL_DDCOUTPUT;	/* SCL: release */
    873 	if (bits & VFB_CRTCCTL_DDCDATA)
    874 		v |= VFB_CRTCCTL_DDCDATA;	/* SDA high: mirror to latch */
    875 	else
    876 		v |= VFB_CRTCCTL_ENABLEDDC;	/* SDA: drive low (b7=0) */
    877 
    878 	sc->sc_ddc_base = v;
    879 	vfb_write4(sc, VFB_CRTCCTL, v);
    880 	delay(VFB_DDC_PACE_US);
    881 }
    882 
    883 static void
    884 veritefb_i2cbb_set_dir(void *cookie, uint32_t dir)
    885 {
    886 	/* open-drain emulation: direction is part of set_bits */
    887 }
    888 
    889 static uint32_t
    890 veritefb_i2cbb_read_bits(void *cookie)
    891 {
    892 	struct veritefb_softc *sc = cookie;
    893 
    894 	return vfb_read4(sc, VFB_CRTCCTL);
    895 }
    896 
    897 /*
    898  * I2C START, including a properly shaped repeated START.
    899  */
    900 static int
    901 veritefb_i2c_send_start(void *cookie, int flags)
    902 {
    903 	struct veritefb_softc *sc = cookie;
    904 	int bail;
    905 
    906 	if ((veritefb_i2cbb_read_bits(sc) & VFB_CRTCCTL_DDCOUTPUT) == 0) {
    907 		veritefb_i2cbb_set_bits(sc, VFB_CRTCCTL_DDCDATA);
    908 		delay(VFB_DDC_PACE_US);	/* SDA settle while SCL still low */
    909 		veritefb_i2cbb_set_bits(sc,
    910 		    VFB_CRTCCTL_DDCDATA | VFB_CRTCCTL_DDCOUTPUT);
    911 		for (bail = 0; bail < VFB_DDC_STRETCH_US; bail++) {
    912 			if (veritefb_i2cbb_read_bits(sc) &
    913 			    VFB_CRTCCTL_DDCOUTPUT)
    914 				break;
    915 			delay(1);
    916 		}
    917 		delay(VFB_DDC_PACE_US);	/* START setup time (4.7 us) */
    918 	}
    919 	return i2c_bitbang_send_start(cookie, flags, &veritefb_i2cbb_ops);
    920 }
    921 
    922 static int
    923 veritefb_i2c_send_stop(void *cookie, int flags)
    924 {
    925 	return i2c_bitbang_send_stop(cookie, flags, &veritefb_i2cbb_ops);
    926 }
    927 
    928 static int
    929 veritefb_i2c_initiate_xfer(void *cookie, i2c_addr_t addr, int flags)
    930 {
    931 	return i2c_bitbang_initiate_xfer(cookie, addr, flags,
    932 	    &veritefb_i2cbb_ops);
    933 }
    934 
    935 static int
    936 veritefb_i2c_read_byte(void *cookie, uint8_t *valp, int flags)
    937 {
    938 	return i2c_bitbang_read_byte(cookie, valp, flags,
    939 	    &veritefb_i2cbb_ops);
    940 }
    941 
    942 static int
    943 veritefb_i2c_write_byte(void *cookie, uint8_t val, int flags)
    944 {
    945 	return i2c_bitbang_write_byte(cookie, val, flags,
    946 	    &veritefb_i2cbb_ops);
    947 }
    948 
    949 static void
    950 veritefb_ddc_read(struct veritefb_softc *sc)
    951 {
    952 	int i;
    953 
    954 	/*
    955 	 * Release both lines (SDA as input, SCL high-Z) before
    956 	 * starting the controller.
    957 	 */
    958 	sc->sc_ddc_base = vfb_read4(sc, VFB_CRTCCTL) &
    959 	    ~(VFB_CRTCCTL_DDCDATA | VFB_CRTCCTL_DDCOUTPUT |
    960 	      VFB_CRTCCTL_ENABLEDDC);
    961 	vfb_write4(sc, VFB_CRTCCTL,
    962 	    sc->sc_ddc_base | VFB_CRTCCTL_DDCOUTPUT);
    963 	sc->sc_ddc_base |= VFB_CRTCCTL_DDCOUTPUT;
    964 
    965 	iic_tag_init(&sc->sc_i2c);
    966 	sc->sc_i2c.ic_cookie = sc;
    967 	sc->sc_i2c.ic_send_start = veritefb_i2c_send_start;
    968 	sc->sc_i2c.ic_send_stop = veritefb_i2c_send_stop;
    969 	sc->sc_i2c.ic_initiate_xfer = veritefb_i2c_initiate_xfer;
    970 	sc->sc_i2c.ic_read_byte = veritefb_i2c_read_byte;
    971 	sc->sc_i2c.ic_write_byte = veritefb_i2c_write_byte;
    972 
    973 	/* Some monitors do not respond on the first attempt. */
    974 	sc->sc_edid_valid = false;
    975 	memset(sc->sc_edid, 0, sizeof(sc->sc_edid));
    976 	for (i = 0; i < 3; i++) {
    977 		if (ddc_read_edid(&sc->sc_i2c, sc->sc_edid,
    978 		    sizeof(sc->sc_edid)) == 0 && sc->sc_edid[1] != 0)
    979 			break;
    980 		memset(sc->sc_edid, 0, sizeof(sc->sc_edid));
    981 	}
    982 
    983 	if (sc->sc_edid[1] == 0) {
    984 		aprint_normal_dev(sc->sc_dev, "DDC: no EDID response\n");
    985 		return;
    986 	}
    987 
    988 	if (edid_parse(sc->sc_edid, &sc->sc_ei) != 0) {
    989 		aprint_error_dev(sc->sc_dev, "DDC: EDID parse failed\n");
    990 		return;
    991 	}
    992 	sc->sc_edid_valid = true;
    993 #ifdef VERITEFB_DEBUG
    994 	edid_print(&sc->sc_ei);
    995 #endif
    996 }
    997 
    998 /*
    999  * Can the hardware and this driver do the given mode?
   1000  */
   1001 static bool
   1002 veritefb_mode_usable(struct veritefb_softc *sc, const struct videomode *m)
   1003 {
   1004 	const struct veritefb_stride *st;
   1005 
   1006 	if (m->dot_clock > 170000)
   1007 		return false;
   1008 	if (m->flags & (VID_INTERLACE | VID_DBLSCAN))
   1009 		return false;
   1010 	if (m->hdisplay > 2048 || (m->hdisplay & 7) != 0 ||
   1011 	    m->vdisplay > 2047)
   1012 		return false;
   1013 	if ((m->hsync_start - m->hdisplay) / 8 - 1 > 0x7 ||
   1014 	    (m->hsync_end - m->hsync_start) / 8 - 1 > 0x1f ||
   1015 	    (m->htotal - m->hsync_end) / 8 - 1 > 0x3f ||
   1016 	    ((m->hsync_start - m->hdisplay) & 7) != 0 ||
   1017 	    ((m->hsync_end - m->hsync_start) & 7) != 0 ||
   1018 	    ((m->htotal - m->hsync_end) & 7) != 0)
   1019 		return false;
   1020 	if (m->vsync_start - m->vdisplay < 1 ||
   1021 	    m->vsync_start - m->vdisplay - 1 > 0x3f ||
   1022 	    m->vsync_end - m->vsync_start - 1 > 0x7 ||
   1023 	    m->vtotal - m->vsync_end - 1 > 0x3f)
   1024 		return false;
   1025 	/* one byte per pixel at 8bpp, the stride may be padded */
   1026 	st = veritefb_stride_for(m->hdisplay);
   1027 	if (st == NULL)
   1028 		return false;
   1029 	if ((bus_size_t)st->linebytes * m->vdisplay >
   1030 	    sc->sc_memsize - sc->sc_fb_offset)
   1031 		return false;
   1032 	return true;
   1033 }
   1034 
   1035 /*
   1036  * Choose the mode: the monitor's EDID preferred mode when usable,
   1037  * 640x480@60 from the modes database otherwise.
   1038  */
   1039 static void
   1040 veritefb_pick_mode(struct veritefb_softc *sc)
   1041 {
   1042 	const struct videomode *m;
   1043 
   1044 	sc->sc_videomode = pick_mode_by_ref(640, 480, 60);
   1045 	KASSERT(sc->sc_videomode != NULL);
   1046 
   1047 	if (!sc->sc_edid_valid || sc->sc_ei.edid_preferred_mode == NULL)
   1048 		return;
   1049 
   1050 	m = sc->sc_ei.edid_preferred_mode;
   1051 	if (!veritefb_mode_usable(sc, m)) {
   1052 		aprint_normal_dev(sc->sc_dev,
   1053 		    "EDID preferred mode %dx%d (%d kHz) not usable, "
   1054 		    "using default\n",
   1055 		    m->hdisplay, m->vdisplay, m->dot_clock);
   1056 		return;
   1057 	}
   1058 
   1059 	aprint_normal_dev(sc->sc_dev, "using EDID mode %dx%d (%d kHz)\n",
   1060 	    m->hdisplay, m->vdisplay, m->dot_clock);
   1061 	sc->sc_videomode = m;
   1062 }
   1063 
   1064 /*
   1065  * Initialize the Bt485-compatible RAMDAC core for 8bpp indexed
   1066  */
   1067 static void
   1068 veritefb_init_dac(struct veritefb_softc *sc)
   1069 {
   1070 	vfb_write1(sc, VFB_DACCOMMAND0,
   1071 	    VFB_DACCMD0_EXTENDED | VFB_DACCMD0_8BITDAC);
   1072 	vfb_write1(sc, VFB_DACCOMMAND1,
   1073 	    VFB_DACCMD1_8BPP | VFB_DACCMD1_PORT_AB);
   1074 	vfb_write1(sc, VFB_DACCOMMAND2,
   1075 	    VFB_DACCMD2_PIXEL_INPUT_GATE | VFB_DACCMD2_DISABLE_CURSOR);
   1076 
   1077 	/* Command register 3 is indexed through the write address. */
   1078 	vfb_write1(sc, VFB_DACRAMWRITEADR, VFB_DACCMD3_INDEX);
   1079 	vfb_write1(sc, VFB_DACCOMMAND3, 0);
   1080 
   1081 	vfb_write1(sc, VFB_DACPIXELMSK, 0xff);
   1082 }
   1083 
   1084 /*
   1085  * Wait for vertical sync so palette updates do not tear.
   1086  */
   1087 static void
   1088 veritefb_wait_vsync(struct veritefb_softc *sc)
   1089 {
   1090 	int i;
   1091 
   1092 	for (i = 0; i < VFB_VSYNCPOLL; i++) {
   1093 		if ((vfb_read4(sc, VFB_CRTCSTATUS) &
   1094 		    VFB_CRTCSTATUS_VERT_MASK) == VFB_CRTCSTATUS_VERT_SYNC)
   1095 			break;
   1096 		delay(1);
   1097 	}
   1098 }
   1099 
   1100 static void
   1101 veritefb_set_dac_entry(struct veritefb_softc *sc, int index,
   1102     uint8_t r, uint8_t g, uint8_t b)
   1103 {
   1104 	vfb_write1(sc, VFB_DACRAMWRITEADR, index);
   1105 	vfb_write1(sc, VFB_DACRAMDATA, r);
   1106 	vfb_write1(sc, VFB_DACRAMDATA, g);
   1107 	vfb_write1(sc, VFB_DACRAMDATA, b);
   1108 }
   1109 
   1110 static void
   1111 veritefb_init_palette(struct veritefb_softc *sc)
   1112 {
   1113 	int i, j;
   1114 
   1115 	j = 0;
   1116 	veritefb_wait_vsync(sc);
   1117 	for (i = 0; i < 256; i++) {
   1118 		sc->sc_cmap_red[i] = rasops_cmap[j];
   1119 		sc->sc_cmap_green[i] = rasops_cmap[j + 1];
   1120 		sc->sc_cmap_blue[i] = rasops_cmap[j + 2];
   1121 		veritefb_set_dac_entry(sc, i, rasops_cmap[j],
   1122 		    rasops_cmap[j + 1], rasops_cmap[j + 2]);
   1123 		j += 3;
   1124 	}
   1125 }
   1126 
   1127 static int
   1128 veritefb_getcmap(struct veritefb_softc *sc, struct wsdisplay_cmap *cm)
   1129 {
   1130 	u_int index = cm->index;
   1131 	u_int count = cm->count;
   1132 	int error;
   1133 
   1134 	if (index >= 256 || count > 256 || index + count > 256)
   1135 		return EINVAL;
   1136 
   1137 	error = copyout(&sc->sc_cmap_red[index], cm->red, count);
   1138 	if (error)
   1139 		return error;
   1140 	error = copyout(&sc->sc_cmap_green[index], cm->green, count);
   1141 	if (error)
   1142 		return error;
   1143 	error = copyout(&sc->sc_cmap_blue[index], cm->blue, count);
   1144 	if (error)
   1145 		return error;
   1146 
   1147 	return 0;
   1148 }
   1149 
   1150 static int
   1151 veritefb_putcmap(struct veritefb_softc *sc, struct wsdisplay_cmap *cm)
   1152 {
   1153 	u_char rbuf[256], gbuf[256], bbuf[256];
   1154 	u_int index = cm->index;
   1155 	u_int count = cm->count;
   1156 	int i, error;
   1157 
   1158 	if (index >= 256 || count > 256 || index + count > 256)
   1159 		return EINVAL;
   1160 
   1161 	error = copyin(cm->red, &rbuf[index], count);
   1162 	if (error)
   1163 		return error;
   1164 	error = copyin(cm->green, &gbuf[index], count);
   1165 	if (error)
   1166 		return error;
   1167 	error = copyin(cm->blue, &bbuf[index], count);
   1168 	if (error)
   1169 		return error;
   1170 
   1171 	memcpy(&sc->sc_cmap_red[index], &rbuf[index], count);
   1172 	memcpy(&sc->sc_cmap_green[index], &gbuf[index], count);
   1173 	memcpy(&sc->sc_cmap_blue[index], &bbuf[index], count);
   1174 
   1175 	veritefb_wait_vsync(sc);
   1176 	for (i = index; i < index + count; i++)
   1177 		veritefb_set_dac_entry(sc, i, sc->sc_cmap_red[i],
   1178 		    sc->sc_cmap_green[i], sc->sc_cmap_blue[i]);
   1179 
   1180 	return 0;
   1181 }
   1182 
   1183 static void
   1184 veritefb_init_screen(void *cookie, struct vcons_screen *scr, int existing,
   1185     long *defattr)
   1186 {
   1187 	struct veritefb_softc *sc = cookie;
   1188 	struct rasops_info *ri = &scr->scr_ri;
   1189 
   1190 	wsfont_init();
   1191 
   1192 	ri->ri_depth = sc->sc_depth;
   1193 	ri->ri_width = sc->sc_width;
   1194 	ri->ri_height = sc->sc_height;
   1195 	ri->ri_stride = sc->sc_linebytes;
   1196 	ri->ri_flg = RI_CENTER;
   1197 
   1198 	ri->ri_bits = (char *)bus_space_vaddr(sc->sc_memt, sc->sc_memh) +
   1199 	    sc->sc_fb_offset;
   1200 
   1201 	scr->scr_flags |= VCONS_NO_CURSOR;
   1202 
   1203 	rasops_init(ri, 0, 0);
   1204 	ri->ri_caps = WSSCREEN_WSCOLORS;
   1205 	rasops_reconfig(ri, sc->sc_height / ri->ri_font->fontheight,
   1206 	    sc->sc_width / ri->ri_font->fontwidth);
   1207 
   1208 	ri->ri_hw = scr;
   1209 
   1210 	sc->sc_orig_eraserows = ri->ri_ops.eraserows;
   1211 	sc->sc_orig_erasecols = ri->ri_ops.erasecols;
   1212 	sc->sc_orig_copyrows = ri->ri_ops.copyrows;
   1213 	sc->sc_orig_copycols = ri->ri_ops.copycols;
   1214 	sc->sc_orig_putchar = ri->ri_ops.putchar;
   1215 	ri->ri_ops.eraserows = veritefb_eraserows;
   1216 	ri->ri_ops.erasecols = veritefb_erasecols;
   1217 	ri->ri_ops.copyrows = veritefb_copyrows;
   1218 	ri->ri_ops.copycols = veritefb_copycols;
   1219 	ri->ri_ops.putchar = veritefb_putchar;
   1220 }
   1221 
   1222 static int
   1223 veritefb_ioctl(void *v, void *vs, u_long cmd, void *data, int flag,
   1224     struct lwp *l)
   1225 {
   1226 	struct vcons_data *vd;
   1227 	struct veritefb_softc *sc;
   1228 	struct wsdisplay_fbinfo *wsfbi;
   1229 	struct vcons_screen *ms;
   1230 
   1231 	vd = v;
   1232 	sc = vd->cookie;
   1233 	ms = vd->active;
   1234 
   1235 	switch (cmd) {
   1236 	case WSDISPLAYIO_GTYPE:
   1237 		*(u_int *)data = WSDISPLAY_TYPE_PCIMISC;
   1238 		return 0;
   1239 
   1240 	case PCI_IOC_CFGREAD:
   1241 	case PCI_IOC_CFGWRITE:
   1242 		return pci_devioctl(sc->sc_pc, sc->sc_pcitag,
   1243 		    cmd, data, flag, l);
   1244 
   1245 	case WSDISPLAYIO_GET_BUSID:
   1246 		return wsdisplayio_busid_pci(sc->sc_dev, sc->sc_pc,
   1247 		    sc->sc_pcitag, data);
   1248 
   1249 	case WSDISPLAYIO_GINFO:
   1250 		if (ms == NULL)
   1251 			return ENODEV;
   1252 
   1253 		wsfbi = (void *)data;
   1254 		wsfbi->height = ms->scr_ri.ri_height;
   1255 		wsfbi->width = ms->scr_ri.ri_width;
   1256 		wsfbi->depth = ms->scr_ri.ri_depth;
   1257 		wsfbi->cmsize = 256;
   1258 		return 0;
   1259 
   1260 	case WSDISPLAYIO_LINEBYTES:
   1261 		*(u_int *)data = sc->sc_linebytes;
   1262 		return 0;
   1263 
   1264 	case WSDISPLAYIO_GETCMAP:
   1265 		return veritefb_getcmap(sc, (struct wsdisplay_cmap *)data);
   1266 
   1267 	case WSDISPLAYIO_PUTCMAP:
   1268 		return veritefb_putcmap(sc, (struct wsdisplay_cmap *)data);
   1269 
   1270 	case WSDISPLAYIO_SMODE:
   1271 		{
   1272 			int new_mode = *(int *)data;
   1273 			if (new_mode != sc->sc_mode) {
   1274 				sc->sc_mode = new_mode;
   1275 				if (new_mode == WSDISPLAYIO_MODE_EMUL) {
   1276 					/*
   1277 					 * reload and restart the microcode
   1278 					 */
   1279 					if (sc->sc_accel == VFB_ACCEL_ON ||
   1280 					    (sc->sc_accel == VFB_ACCEL_OFF &&
   1281 					     sc->sc_ucode != NULL))
   1282 						(void)veritefb_risc_init(sc);
   1283 					if (sc->sc_gc_initted)
   1284 						glyphcache_wipe(&sc->sc_gc);
   1285 					veritefb_init_palette(sc);
   1286 					vcons_redraw_screen(ms);
   1287 				} else {
   1288 					if (sc->sc_accel == VFB_ACCEL_ON) {
   1289 						(void)veritefb_drain_outfifo(
   1290 						    sc);
   1291 						veritefb_risc_hold(sc);
   1292 						sc->sc_accel = VFB_ACCEL_OFF;
   1293 					}
   1294 				}
   1295 			}
   1296 			return 0;
   1297 		}
   1298 
   1299 	case WSDISPLAYIO_GET_FBINFO:
   1300 		{
   1301 			struct wsdisplayio_fbinfo *fbi = data;
   1302 			struct rasops_info *ri;
   1303 
   1304 			ri = &sc->vd.active->scr_ri;
   1305 			return wsdisplayio_get_fbinfo(ri, fbi);
   1306 		}
   1307 
   1308 #ifdef VERITEFB_DEBUG
   1309 	/* RISC debug surface, VERITEFB_DEBUG kernels only. */
   1310 	case VERITEFB_DBG_DIAG:
   1311 		{
   1312 			struct veritefb_dbg_diag *dd = data;
   1313 			unsigned i, n;
   1314 
   1315 			dd->vd_accel = sc->sc_accel;
   1316 			dd->vd_pc = veritefb_risc_samplepc(sc);
   1317 			dd->vd_fifoinfree = vfb_read1(sc, VFB_FIFOINFREE) &
   1318 			    VFB_FIFOINFREE_MASK;
   1319 			dd->vd_fifooutvalid = vfb_read1(sc,
   1320 			    VFB_FIFOOUTVALID) & VFB_FIFOOUTVALID_MASK;
   1321 			dd->vd_debugreg = vfb_read1(sc, VFB_DEBUG);
   1322 			dd->vd_ringcount = sc->sc_ring_count;
   1323 			n = MIN(sc->sc_ring_count, VERITEFB_DIAG_RING);
   1324 			memset(dd->vd_ring, 0, sizeof(dd->vd_ring));
   1325 			for (i = 0; i < n; i++)
   1326 				dd->vd_ring[VERITEFB_DIAG_RING - n + i] =
   1327 				    sc->sc_ring[(sc->sc_ring_count - n + i) &
   1328 				    (VFB_RING_SIZE - 1)];
   1329 
   1330 			dd->vd_heartbeat = 1;
   1331 			if (sc->sc_accel == VFB_ACCEL_ON) {
   1332 				uint32_t word = 0;
   1333 
   1334 				dd->vd_heartbeat = 2;
   1335 				for (i = 0; i < VFB_DRAINPOLL; i++) {
   1336 					if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   1337 					    VFB_FIFOOUTVALID_MASK) == 0)
   1338 						break;
   1339 					(void)vfb_fifo_read(sc);
   1340 				}
   1341 				if ((vfb_read1(sc, VFB_FIFOINFREE) &
   1342 				    VFB_FIFOINFREE_MASK) >= 1) {
   1343 					vfb_fifo_write(sc,
   1344 					    VFB_CMDW(0, VCMD_PIXENGSYNC));
   1345 					for (i = 0; i < VFB_FIFOPOLL; i++) {
   1346 						if ((vfb_read1(sc,
   1347 						    VFB_FIFOOUTVALID) &
   1348 						    VFB_FIFOOUTVALID_MASK)
   1349 						    != 0) {
   1350 							word =
   1351 							    vfb_fifo_read(sc);
   1352 							break;
   1353 						}
   1354 						delay(1);
   1355 					}
   1356 					if (word == VFB_SYNC_TOKEN)
   1357 						dd->vd_heartbeat = 0;
   1358 				}
   1359 			}
   1360 			return 0;
   1361 		}
   1362 
   1363 	case VERITEFB_DBG_HOLD:
   1364 		veritefb_risc_hold(sc);
   1365 		return 0;
   1366 
   1367 	case VERITEFB_DBG_CONT:
   1368 		veritefb_risc_continue(sc);
   1369 		return 0;
   1370 
   1371 	case VERITEFB_DBG_RDREG:
   1372 		{
   1373 			struct veritefb_dbg_rw *vr = data;
   1374 
   1375 			if ((vfb_read1(sc, VFB_DEBUG) &
   1376 			    VFB_DEBUG_HOLDRISC) == 0)
   1377 				return EBUSY;	/* hold first */
   1378 			if (vr->vr_addr > 255)
   1379 				return EINVAL;
   1380 			vr->vr_val = veritefb_risc_readrf(sc, vr->vr_addr);
   1381 			return 0;
   1382 		}
   1383 
   1384 	case VERITEFB_DBG_RDMEM:
   1385 		{
   1386 			struct veritefb_dbg_rw *vr = data;
   1387 
   1388 			if ((vfb_read1(sc, VFB_DEBUG) &
   1389 			    VFB_DEBUG_HOLDRISC) == 0)
   1390 				return EBUSY;	/* hold first */
   1391 			vr->vr_val = veritefb_risc_readmem(sc, vr->vr_addr);
   1392 			return 0;
   1393 		}
   1394 
   1395 	case VERITEFB_DBG_FAULT:
   1396 		aprint_normal_dev(sc->sc_dev,
   1397 		    "debug: deliberately sending an invalid command\n");
   1398 		vfb_fifo_write(sc, VFB_CMDW(0, VFB_CMD_BOGUS));
   1399 		return 0;
   1400 
   1401 	case VERITEFB_DBG_RESET:
   1402 		*(int *)data = veritefb_risc_init(sc) ? 1 : 0;
   1403 		return 0;
   1404 
   1405 	case VERITEFB_DBG_STATS:
   1406 		memcpy(data, &sc->sc_stats, sizeof(sc->sc_stats));
   1407 		return 0;
   1408 
   1409 	case VERITEFB_DBG_STATCLR:
   1410 		memset(&sc->sc_stats, 0, sizeof(sc->sc_stats));
   1411 		return 0;
   1412 
   1413 	case VERITEFB_DBG_RDIO:
   1414 		{
   1415 			struct veritefb_dbg_rw *vr = data;
   1416 
   1417 			if ((vr->vr_addr &
   1418 			    ~(uint32_t)VERITEFB_DBG_IO_IOSPACE) > 0xff)
   1419 				return EINVAL;
   1420 			if (vr->vr_addr & VERITEFB_DBG_IO_IOSPACE)
   1421 				vr->vr_val = bus_space_read_1(sc->sc_iot,
   1422 				    sc->sc_ioh, vr->vr_addr & 0xff);
   1423 			else
   1424 				vr->vr_val = vfb_read1(sc, vr->vr_addr);
   1425 			return 0;
   1426 		}
   1427 
   1428 	case VERITEFB_DBG_WRIO:
   1429 		{
   1430 			struct veritefb_dbg_rw *vr = data;
   1431 
   1432 			if ((vr->vr_addr &
   1433 			    ~(uint32_t)VERITEFB_DBG_IO_IOSPACE) > 0xff)
   1434 				return EINVAL;
   1435 			if (vr->vr_addr & VERITEFB_DBG_IO_IOSPACE)
   1436 				bus_space_write_1(sc->sc_iot, sc->sc_ioh,
   1437 				    vr->vr_addr & 0xff, vr->vr_val);
   1438 			else
   1439 				vfb_write1(sc, vr->vr_addr, vr->vr_val);
   1440 			return 0;
   1441 		}
   1442 
   1443 #endif /* VERITEFB_DEBUG */
   1444 	}
   1445 	return EPASSTHROUGH;
   1446 }
   1447 
   1448 static paddr_t
   1449 veritefb_mmap(void *v, void *vs, off_t offset, int prot)
   1450 {
   1451 	struct vcons_data *vd;
   1452 	struct veritefb_softc *sc;
   1453 
   1454 	vd = v;
   1455 	sc = vd->cookie;
   1456 
   1457 	if (offset >= 0 && offset < sc->sc_memsize - sc->sc_fb_offset)
   1458 		return bus_space_mmap(sc->sc_memt,
   1459 		    sc->sc_fb_paddr + sc->sc_fb_offset + offset,
   1460 		    0, prot, BUS_SPACE_MAP_LINEAR);
   1461 
   1462 	return -1;
   1463 }
   1464 
   1465 static void
   1466 veritefb_risc_continue(struct veritefb_softc *sc)
   1467 {
   1468 	uint8_t debugreg;
   1469 
   1470 	debugreg = vfb_read1(sc, VFB_DEBUG);
   1471 	vfb_write1(sc, VFB_DEBUG, debugreg & ~VFB_DEBUG_HOLDRISC);
   1472 	vfb_pacepoll4(sc, VFB_STATEDATA, 0, 0);
   1473 }
   1474 
   1475 /*
   1476  * Force one instruction into the RISC decoder and single-step it
   1477  */
   1478 static void
   1479 veritefb_risc_forcestep(struct veritefb_softc *sc, uint32_t insn)
   1480 {
   1481 	uint8_t debugreg, stateindex;
   1482 	int i;
   1483 
   1484 	debugreg = vfb_read1(sc, VFB_DEBUG);
   1485 	stateindex = vfb_read1(sc, VFB_STATEINDEX);
   1486 
   1487 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_IR);
   1488 	vfb_pacepoll1(sc, VFB_STATEINDEX, VFB_STATEINDEX_IR, 0xff);
   1489 	vfb_write4(sc, VFB_STATEDATA, insn);
   1490 	vfb_pacepoll4(sc, VFB_STATEDATA, insn, 0xffffffff);
   1491 	vfb_write1(sc, VFB_DEBUG,
   1492 	    debugreg | VFB_DEBUG_HOLDRISC | VFB_DEBUG_STEPRISC);
   1493 	vfb_pacepoll4(sc, VFB_STATEDATA, 0, 0);
   1494 
   1495 	for (i = 0; i < VFB_SHORTPOLL; i++)
   1496 		if ((vfb_read1(sc, VFB_DEBUG) &
   1497 		    (VFB_DEBUG_HOLDRISC | VFB_DEBUG_STEPRISC)) ==
   1498 		    VFB_DEBUG_HOLDRISC)
   1499 			break;
   1500 
   1501 	vfb_write1(sc, VFB_STATEINDEX, stateindex);
   1502 }
   1503 
   1504 /*
   1505  * Set a register-file entry by force-feeding load-immediate sequences
   1506  */
   1507 static void
   1508 veritefb_risc_writerf(struct veritefb_softc *sc, uint8_t idx, uint32_t data)
   1509 {
   1510 	uint8_t special = 0;
   1511 
   1512 	if (idx < 64) {
   1513 		special = idx;
   1514 		idx = VRISC_SP;
   1515 	}
   1516 
   1517 	if ((data & 0xff000000) == 0) {
   1518 		veritefb_risc_forcestep(sc,
   1519 		    VRISC_LI(VRISC_LI_OP, idx, data & 0xffff));
   1520 		if (data & 0x00ff0000)
   1521 			veritefb_risc_forcestep(sc,
   1522 			    VRISC_INT(VRISC_ADDIFI_OP, idx, idx, data >> 16));
   1523 	} else {
   1524 		veritefb_risc_forcestep(sc,
   1525 		    VRISC_LI(VRISC_LUI_OP, idx, data >> 16));
   1526 		veritefb_risc_forcestep(sc,
   1527 		    VRISC_INT(VRISC_ADDSL8_OP, idx, idx, (data >> 8) & 0xff));
   1528 		veritefb_risc_forcestep(sc,
   1529 		    VRISC_INT(VRISC_ADDI_OP, idx, idx, data & 0xff));
   1530 	}
   1531 
   1532 	if (special) {
   1533 		veritefb_risc_forcestep(sc,
   1534 		    VRISC_INT(VRISC_ADD_OP, special, 0, VRISC_SP));
   1535 		veritefb_risc_forcestep(sc, VRISC_NOP);
   1536 		veritefb_risc_forcestep(sc, VRISC_NOP);
   1537 		veritefb_risc_forcestep(sc, VRISC_NOP);
   1538 	}
   1539 }
   1540 
   1541 /* Read a register-file entry through the S1 operand bus */
   1542 static uint32_t
   1543 veritefb_risc_readrf(struct veritefb_softc *sc, uint8_t idx)
   1544 {
   1545 	uint32_t data, insn;
   1546 	uint8_t debugreg, stateindex;
   1547 
   1548 	debugreg = vfb_read1(sc, VFB_DEBUG);
   1549 	stateindex = vfb_read1(sc, VFB_STATEINDEX);
   1550 
   1551 	vfb_write1(sc, VFB_DEBUG, debugreg | VFB_DEBUG_HOLDRISC);
   1552 
   1553 	/* add zero, zero, idx: puts RF[idx] on the S1 bus, no step needed */
   1554 	insn = VRISC_INT(VRISC_ADD_OP, 0, 0, idx);
   1555 	vfb_write4(sc, VFB_STATEDATA, insn);
   1556 
   1557 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_IR);
   1558 	vfb_pacepoll4(sc, VFB_STATEDATA, insn, 0xffffffff);
   1559 
   1560 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_S1);
   1561 	vfb_pacepoll4(sc, VFB_STATEINDEX, 0, 0);
   1562 	data = vfb_read4(sc, VFB_STATEDATA);
   1563 
   1564 	vfb_write1(sc, VFB_STATEINDEX, stateindex);
   1565 	vfb_write1(sc, VFB_DEBUG, debugreg);
   1566 
   1567 	return data;
   1568 }
   1569 
   1570 /* Word read/write through the RISC's own address space, RISC held. */
   1571 static uint32_t
   1572 veritefb_risc_readmem(struct veritefb_softc *sc, uint32_t addr)
   1573 {
   1574 	veritefb_risc_writerf(sc, VRISC_RA, addr);
   1575 	veritefb_risc_forcestep(sc, VRISC_LD(VRISC_LW_OP, VRISC_SP, 0,
   1576 	    VRISC_RA));
   1577 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1578 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1579 	return veritefb_risc_readrf(sc, VRISC_SP);
   1580 }
   1581 
   1582 static void
   1583 veritefb_risc_writemem(struct veritefb_softc *sc, uint32_t addr,
   1584     uint32_t data)
   1585 {
   1586 	veritefb_risc_writerf(sc, VRISC_RA, addr);
   1587 	veritefb_risc_writerf(sc, VRISC_FP, data);
   1588 	veritefb_risc_forcestep(sc, VRISC_ST(VRISC_SW_OP, 0, VRISC_FP,
   1589 	    VRISC_RA));
   1590 }
   1591 
   1592 /*
   1593  * Flush the icache (and the pixel-engine line buffers in the
   1594  * dcache), returns with the icache enabled.
   1595  */
   1596 static void
   1597 veritefb_risc_flushicache(struct veritefb_softc *sc)
   1598 {
   1599 	uint32_t c, p1, p2;
   1600 
   1601 	/* flush store accumulation buffers */
   1602 	p1 = veritefb_risc_readmem(sc, 0);
   1603 	p2 = veritefb_risc_readmem(sc, 8);
   1604 	veritefb_risc_writemem(sc, 0, p1);
   1605 	veritefb_risc_writemem(sc, 8, p2);
   1606 	(void)veritefb_risc_readmem(sc, 0);
   1607 	(void)veritefb_risc_readmem(sc, 8);
   1608 
   1609 	/* spri Sync, zero: flush pixel-engine line buffers */
   1610 	veritefb_risc_forcestep(sc, VRISC_INT(VRISC_SPRI_OP, 0, 0, 31));
   1611 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1612 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1613 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1614 
   1615 	/* set icache-off bits in the flag register */
   1616 	veritefb_risc_writerf(sc, VRISC_RA, VRISC_ICACHE_ONOFF_MASK);
   1617 	veritefb_risc_forcestep(sc,
   1618 	    VRISC_INT(VRISC_OR_OP, VRISC_FLAG, VRISC_FLAG, VRISC_RA));
   1619 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1620 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1621 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1622 
   1623 	/* jump through two icache's worth of lines to flush it */
   1624 	for (c = 0; c < VRISC_ICACHESIZE * 2; c += VRISC_ICACHELINESIZE)
   1625 		veritefb_risc_forcestep(sc, VRISC_JMP(c >> 2));
   1626 
   1627 	/* clear the icache-off bits again */
   1628 	veritefb_risc_writerf(sc, VRISC_RA, VRISC_ICACHE_ONOFF_MASK);
   1629 	veritefb_risc_forcestep(sc,
   1630 	    VRISC_INT(VRISC_ANDN_OP, VRISC_FLAG, VRISC_FLAG, VRISC_RA));
   1631 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1632 	veritefb_risc_forcestep(sc, VRISC_JMP(0));
   1633 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1634 }
   1635 
   1636 /*
   1637  * Start the RISC at pc: hold it, force-feed a jump (with NOPs for the
   1638  * pipeline and the delay slot), release.
   1639  */
   1640 static void
   1641 veritefb_risc_start(struct veritefb_softc *sc, uint32_t pc)
   1642 {
   1643 	veritefb_risc_hold(sc);
   1644 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1645 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1646 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1647 	veritefb_risc_forcestep(sc, VRISC_JMP(pc >> 2));
   1648 	veritefb_risc_forcestep(sc, VRISC_NOP);
   1649 	veritefb_risc_continue(sc);
   1650 }
   1651 
   1652 /*
   1653  * Sample the RISC program counter.
   1654  */
   1655 static uint32_t
   1656 veritefb_risc_samplepc(struct veritefb_softc *sc)
   1657 {
   1658 	uint32_t pc;
   1659 	uint8_t debugreg, stateindex;
   1660 	bool washeld;
   1661 
   1662 	debugreg = vfb_read1(sc, VFB_DEBUG);
   1663 	washeld = (debugreg & VFB_DEBUG_HOLDRISC) != 0;
   1664 	if (!washeld)
   1665 		veritefb_risc_hold(sc);
   1666 
   1667 	stateindex = vfb_read1(sc, VFB_STATEINDEX);
   1668 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC);
   1669 	vfb_pacepoll1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC, 0xff);
   1670 	pc = vfb_read4(sc, VFB_STATEDATA);
   1671 	vfb_write1(sc, VFB_STATEINDEX, stateindex);
   1672 
   1673 	if (!washeld)
   1674 		veritefb_risc_continue(sc);
   1675 	return pc;
   1676 }
   1677 
   1678 /*
   1679  * The hang-signature catalog: classify a sampled PC against the known
   1680  * layout of the V2x00 2D blob (loaded at its link address).
   1681  */
   1682 static const char *
   1683 veritefb_pc_signature(uint32_t pc)
   1684 {
   1685 	if (pc >= VFB_UC_TRAP && pc < VFB_UC_TRAP_END)
   1686 		return "invalid-command trap (host sent a bad command or "
   1687 		    "the stream desynced)";
   1688 	if (pc >= VFB_UC_BASE && pc <= VFB_UC_DISPATCH_END)
   1689 		return "dispatch loop (idle, waiting for commands)";
   1690 	if (pc >= VFB_CSUCODE_BASE && pc < VFB_UC_BASE)
   1691 		return "csucode monitor (parked/suspended)";
   1692 	if (pc >= VFB_UC_BASE && pc < VFB_UC_END)
   1693 		return "inside a command handler";
   1694 	if (pc >= VFB_RISC_ROM_BASE)
   1695 		return "boot ROM region";
   1696 	return "unknown region";
   1697 }
   1698 
   1699 /*
   1700  * Permanently degrade to software rendering, duh.
   1701  */
   1702 static void
   1703 veritefb_accel_fail(struct veritefb_softc *sc, const char *what)
   1704 {
   1705 	uint32_t pc;
   1706 #ifdef VERITEFB_DEBUG
   1707 	unsigned i, n;
   1708 #endif
   1709 
   1710 	if (sc->sc_accel == VFB_ACCEL_SW)
   1711 		return;
   1712 
   1713 	sc->sc_accel = VFB_ACCEL_SW;
   1714 	pc = veritefb_risc_samplepc(sc);
   1715 	aprint_error_dev(sc->sc_dev,
   1716 	    "%s; disabling acceleration until reboot\n", what);
   1717 	aprint_error_dev(sc->sc_dev, "RISC PC 0x%08x: %s\n", pc,
   1718 	    veritefb_pc_signature(pc));
   1719 
   1720 #ifdef VERITEFB_DEBUG
   1721 	n = MIN(sc->sc_ring_count, 8);
   1722 	for (i = 0; i < n; i++)
   1723 		aprint_error_dev(sc->sc_dev, "  fifo[-%u] = 0x%08x\n",
   1724 		    n - i, sc->sc_ring[(sc->sc_ring_count - n + i) &
   1725 		    (VFB_RING_SIZE - 1)]);
   1726 #endif
   1727 
   1728 	veritefb_risc_hold(sc);
   1729 }
   1730 
   1731 /* wait for n free input FIFO entries */
   1732 static int
   1733 veritefb_waitfifo(struct veritefb_softc *sc, int n)
   1734 {
   1735 	int i;
   1736 
   1737 	for (i = 0; i < VFB_FIFOPOLL; i++) {
   1738 		if ((vfb_read1(sc, VFB_FIFOINFREE) & VFB_FIFOINFREE_MASK) >=
   1739 		    n)
   1740 			return 0;
   1741 		delay(1);
   1742 	}
   1743 	veritefb_accel_fail(sc, "input FIFO timeout");
   1744 	return EBUSY;
   1745 }
   1746 
   1747 /* Discard stale output FIFO words. */
   1748 static int
   1749 veritefb_drain_outfifo(struct veritefb_softc *sc)
   1750 {
   1751 	int i;
   1752 
   1753 	for (i = 0; i < VFB_FIFOPOLL; i++) {
   1754 		if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   1755 		    VFB_FIFOOUTVALID_MASK) == 0)
   1756 			return 0;
   1757 		(void)vfb_fifo_read(sc);
   1758 	}
   1759 	veritefb_accel_fail(sc, "output FIFO never drained");
   1760 	return EBUSY;
   1761 }
   1762 
   1763 /* Wait for one word from the output FIFO. */
   1764 static int
   1765 veritefb_read_outfifo(struct veritefb_softc *sc, uint32_t *wordp)
   1766 {
   1767 	int i;
   1768 
   1769 	for (i = 0; i < VFB_FIFOPOLL; i++) {
   1770 		if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   1771 		    VFB_FIFOOUTVALID_MASK) != 0) {
   1772 			*wordp = vfb_fifo_read(sc);
   1773 			return 0;
   1774 		}
   1775 		delay(1);
   1776 	}
   1777 	veritefb_accel_fail(sc, "output FIFO timeout");
   1778 	return EBUSY;
   1779 }
   1780 
   1781 /*
   1782  * Copy the csucode monitor and the ELF microcode image into the
   1783  * reserved VRAM area.
   1784  */
   1785 static bool
   1786 veritefb_ucode_to_vram(struct veritefb_softc *sc)
   1787 {
   1788 	const uint8_t *u = sc->sc_ucode;
   1789 	uint32_t entry, phoff, filesz, off, paddr, word;
   1790 	uint16_t phentsize, phnum, ph;
   1791 	uint8_t memendian;
   1792 	size_t i;
   1793 
   1794 	if (sc->sc_ucode_size < sizeof(Elf32_Ehdr) ||
   1795 	    memcmp(u, ELFMAG, SELFMAG) != 0 ||
   1796 	    u[EI_CLASS] != ELFCLASS32 || u[EI_DATA] != ELFDATA2MSB) {
   1797 		aprint_error_dev(sc->sc_dev, "microcode is not a "
   1798 		    "big-endian ELF32 image\n");
   1799 		return false;
   1800 	}
   1801 
   1802 	entry = be32dec(u + offsetof(Elf32_Ehdr, e_entry));
   1803 	phoff = be32dec(u + offsetof(Elf32_Ehdr, e_phoff));
   1804 	phentsize = be16dec(u + offsetof(Elf32_Ehdr, e_phentsize));
   1805 	phnum = be16dec(u + offsetof(Elf32_Ehdr, e_phnum));
   1806 
   1807 	if (phnum == 0 || phentsize < sizeof(Elf32_Phdr) ||
   1808 	    phoff + (uint32_t)phnum * phentsize > sc->sc_ucode_size) {
   1809 		aprint_error_dev(sc->sc_dev,
   1810 		    "microcode program headers out of bounds\n");
   1811 		return false;
   1812 	}
   1813 
   1814 	memendian = vfb_read1(sc, VFB_MEMENDIAN);
   1815 	vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
   1816 
   1817 	/* Context-switch monitor and its semaphores. */
   1818 	for (i = 0; i < __arraycount(veritefb_csucode); i++)
   1819 		vfb_fb_write4(sc, VFB_CSUCODE_BASE + i * 4,
   1820 		    veritefb_csucode[i]);
   1821 	vfb_fb_write4(sc, VFB_CSUCODE_SEM0, 0);
   1822 	vfb_fb_write4(sc, VFB_CSUCODE_SEM1, 0);
   1823 
   1824 	for (ph = 0; ph < phnum; ph++) {
   1825 		const uint8_t *p = u + phoff + (uint32_t)ph * phentsize;
   1826 
   1827 		if (be32dec(p + offsetof(Elf32_Phdr, p_type)) != PT_LOAD)
   1828 			continue;
   1829 		off = be32dec(p + offsetof(Elf32_Phdr, p_offset));
   1830 		filesz = be32dec(p + offsetof(Elf32_Phdr, p_filesz));
   1831 		paddr = be32dec(p + offsetof(Elf32_Phdr, p_paddr));
   1832 
   1833 		if (off + filesz > sc->sc_ucode_size ||
   1834 		    paddr + filesz > VFB_MC_SIZE) {
   1835 			aprint_error_dev(sc->sc_dev,
   1836 			    "microcode segment out of bounds "
   1837 			    "(paddr 0x%x size 0x%x)\n", paddr, filesz);
   1838 			vfb_write1(sc, VFB_MEMENDIAN, memendian);
   1839 			return false;
   1840 		}
   1841 
   1842 		for (i = 0; i + 4 <= filesz; i += 4)
   1843 			vfb_fb_write4(sc, paddr + i, be32dec(u + off + i));
   1844 		if (i < filesz) {
   1845 			word = 0;
   1846 			for (; i < filesz; i++)
   1847 				word = (word << 8) | u[off + i];
   1848 			word <<= 8 * (4 - (filesz & 3));
   1849 			vfb_fb_write4(sc, paddr + (filesz & ~3U), word);
   1850 		}
   1851 	}
   1852 
   1853 	vfb_write1(sc, VFB_MEMENDIAN, memendian);
   1854 	sc->sc_ucode_entry = entry;
   1855 	return true;
   1856 }
   1857 
   1858 /*
   1859  * Full RISC bring-up:
   1860  * - load microcode
   1861  * - start the csucode monitor
   1862  * - feed it the init sequence
   1863  * - validate the command protocol
   1864  */
   1865 static bool
   1866 veritefb_risc_init(struct veritefb_softc *sc)
   1867 {
   1868 	uint32_t word, saved;
   1869 
   1870 	if (sc->sc_ucode == NULL)
   1871 		return false;
   1872 
   1873 	sc->sc_accel = VFB_ACCEL_OFF;
   1874 
   1875 	veritefb_risc_hold(sc);
   1876 	if (!veritefb_ucode_to_vram(sc))
   1877 		return false;
   1878 
   1879 	/*
   1880 	 * same VRAM words read through the host aperture and through
   1881 	 * injected RISC loads must agree
   1882 	 */
   1883 	{
   1884 		static const uint32_t testaddr[] =
   1885 		    { VFB_UC_BASE, VFB_CSUCODE_BASE };
   1886 		uint32_t hostv, riscv;
   1887 		uint8_t memendian;
   1888 		size_t t;
   1889 
   1890 		memendian = vfb_read1(sc, VFB_MEMENDIAN);
   1891 		vfb_write1(sc, VFB_MEMENDIAN, VFB_MEMENDIAN_NO);
   1892 		for (t = 0; t < __arraycount(testaddr); t++) {
   1893 			hostv = vfb_fb_read4(sc, testaddr[t]);
   1894 			riscv = veritefb_risc_readmem(sc, testaddr[t]);
   1895 			if (hostv != riscv) {
   1896 				vfb_write1(sc, VFB_MEMENDIAN, memendian);
   1897 				aprint_error_dev(sc->sc_dev,
   1898 				    "dual-view self-test failed @0x%x: "
   1899 				    "host 0x%08x vs RISC 0x%08x\n",
   1900 				    testaddr[t], hostv, riscv);
   1901 				return false;
   1902 			}
   1903 		}
   1904 		vfb_write1(sc, VFB_MEMENDIAN, memendian);
   1905 		aprint_debug_dev(sc->sc_dev, "dual-view self-test passed\n");
   1906 	}
   1907 
   1908 	veritefb_risc_flushicache(sc);
   1909 	veritefb_risc_start(sc, VFB_CSUCODE_BASE);
   1910 
   1911 	if (veritefb_waitfifo(sc, 4) != 0)
   1912 		return false;
   1913 	vfb_fifo_write(sc, VFB_CSUCODE_INIT);
   1914 	vfb_fifo_write(sc, 0);		/* context store area */
   1915 	vfb_fifo_write(sc, 0);
   1916 	vfb_fifo_write(sc, sc->sc_ucode_entry);
   1917 
   1918 	if (veritefb_drain_outfifo(sc) != 0)
   1919 		return false;
   1920 	if (veritefb_waitfifo(sc, 1) != 0)
   1921 		return false;
   1922 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   1923 	if (veritefb_read_outfifo(sc, &word) != 0)
   1924 		return false;
   1925 	if (word != VFB_SYNC_TOKEN) {
   1926 		veritefb_accel_fail(sc, "bad sync token from microcode");
   1927 		return false;
   1928 	}
   1929 
   1930 	if (veritefb_waitfifo(sc, 6) != 0)
   1931 		return false;
   1932 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_SETUP));
   1933 	/*
   1934 	 * Word 1 programs the pixel-engine scissor.
   1935 	 * It MUST span the whole VRAM working area.
   1936 	 */
   1937 	vfb_fifo_write(sc, VFB_P2(sc->sc_width,
   1938 	    (sc->sc_memsize - sc->sc_fb_offset) / sc->sc_linebytes));
   1939 	vfb_fifo_write(sc, VFB_P2(sc->sc_depth, VFB_PIXFMT_8I));
   1940 	vfb_fifo_write(sc, (uint32_t)sc->sc_fb_offset);
   1941 	vfb_fifo_write(sc, sc->sc_linebytes);
   1942 	vfb_fifo_write(sc, ((uint32_t)sc->sc_stride1 << 12) |
   1943 	    ((uint32_t)sc->sc_stride0 << 8));
   1944 
   1945 	/* Second sync proves Setup consumed exactly six words. */
   1946 	if (veritefb_waitfifo(sc, 1) != 0)
   1947 		return false;
   1948 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   1949 	if (veritefb_read_outfifo(sc, &word) != 0)
   1950 		return false;
   1951 	if (word != VFB_SYNC_TOKEN) {
   1952 		veritefb_accel_fail(sc, "FIFO desync after Setup");
   1953 		return false;
   1954 	}
   1955 
   1956 	/*
   1957 	 * GetPixel round-trip: place the same magic byte in the first
   1958 	 * four framebuffer pixels through the aperture (immune to the
   1959 	 * MEMENDIAN byte-lane setting) and ask the RISC for pixel (0,0).
   1960 	 */
   1961 	saved = vfb_fb_read4(sc, sc->sc_fb_offset);
   1962 	vfb_fb_write4(sc, sc->sc_fb_offset, VFB_GETPIXEL_PATTERN);
   1963 	if (veritefb_waitfifo(sc, 2) != 0)
   1964 		return false;
   1965 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_GETPIXEL));
   1966 	vfb_fifo_write(sc, VFB_P2(0, 0));
   1967 	if (veritefb_read_outfifo(sc, &word) != 0)
   1968 		return false;
   1969 	vfb_fb_write4(sc, sc->sc_fb_offset, saved);
   1970 	if ((word & 0xff) != (VFB_GETPIXEL_PATTERN & 0xff)) {
   1971 		veritefb_accel_fail(sc, "GetPixel round-trip mismatch");
   1972 		return false;
   1973 	}
   1974 
   1975 	sc->sc_accel = VFB_ACCEL_ON;
   1976 	aprint_normal_dev(sc->sc_dev,
   1977 	    "RISC running 2D microcode (entry 0x%x), handshake passed\n",
   1978 	    sc->sc_ucode_entry);
   1979 	return true;
   1980 }
   1981 
   1982 /*
   1983  * The microcode ships as a firmware file, so it can only be pulled in
   1984  * once the root filesystem exists.
   1985  */
   1986 static void
   1987 veritefb_load_firmware(device_t self)
   1988 {
   1989 	struct veritefb_softc *sc = device_private(self);
   1990 	firmware_handle_t fh;
   1991 	size_t size;
   1992 	int error;
   1993 
   1994 	error = firmware_open("veritefb", VFB_FIRMWARE_NAME, &fh);
   1995 	if (error != 0) {
   1996 		aprint_normal_dev(sc->sc_dev,
   1997 		    "no microcode (firmware veritefb/%s), "
   1998 		    "running unaccelerated\n", VFB_FIRMWARE_NAME);
   1999 		return;
   2000 	}
   2001 
   2002 	size = firmware_get_size(fh);
   2003 	if (size == 0 || size > VFB_MAXUCODE) {
   2004 		aprint_error_dev(sc->sc_dev,
   2005 		    "implausible microcode size %zu\n", size);
   2006 		firmware_close(fh);
   2007 		return;
   2008 	}
   2009 
   2010 	sc->sc_ucode = firmware_malloc(size);
   2011 	sc->sc_ucode_size = size;
   2012 	error = firmware_read(fh, 0, sc->sc_ucode, size);
   2013 	firmware_close(fh);
   2014 	if (error != 0) {
   2015 		aprint_error_dev(sc->sc_dev, "microcode read failed: %d\n",
   2016 		    error);
   2017 		firmware_free(sc->sc_ucode, size);
   2018 		sc->sc_ucode = NULL;
   2019 		return;
   2020 	}
   2021 
   2022 	(void)veritefb_risc_init(sc);
   2023 }
   2024 
   2025 /*
   2026  * Barrier after every accelerated operation
   2027  */
   2028 static void
   2029 veritefb_sync(struct veritefb_softc *sc)
   2030 {
   2031 	uint32_t word;
   2032 
   2033 	if (veritefb_drain_outfifo(sc) != 0)
   2034 		return;
   2035 	if (veritefb_waitfifo(sc, 1) != 0)
   2036 		return;
   2037 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   2038 	if (veritefb_read_outfifo(sc, &word) != 0)
   2039 		return;
   2040 	if (word != VFB_SYNC_TOKEN)
   2041 		veritefb_accel_fail(sc, "bad sync token after operation");
   2042 }
   2043 
   2044 /* FillRectSolidRop */
   2045 static bool
   2046 veritefb_rectfill(struct veritefb_softc *sc, int x, int y, int w, int h,
   2047     uint32_t color)
   2048 {
   2049 	if (veritefb_waitfifo(sc, 4) != 0)
   2050 		return false;
   2051 	vfb_fifo_write(sc, VFB_CMDW(VFB_ROP_COPY, VCMD_FILLRECTSOLIDROP));
   2052 	vfb_fifo_write(sc, color);
   2053 	vfb_fifo_write(sc, VFB_P2(x, y));
   2054 	vfb_fifo_write(sc, VFB_P2(w, h));
   2055 	veritefb_sync(sc);
   2056 	return sc->sc_accel == VFB_ACCEL_ON;
   2057 }
   2058 
   2059 /* ScreenBlt */
   2060 static bool
   2061 veritefb_bitblt(struct veritefb_softc *sc, int sx, int sy, int dx, int dy,
   2062     int w, int h)
   2063 {
   2064 	if (veritefb_waitfifo(sc, 5) != 0)
   2065 		return false;
   2066 	vfb_fifo_write(sc, VFB_CMDW(0, VCMD_SCREENBLT));
   2067 	vfb_fifo_write(sc, VFB_ROP_COPY);
   2068 	vfb_fifo_write(sc, VFB_P2(sx, sy));
   2069 	vfb_fifo_write(sc, VFB_P2(w, h));
   2070 	vfb_fifo_write(sc, VFB_P2(dx, dy));
   2071 	veritefb_sync(sc);
   2072 	return sc->sc_accel == VFB_ACCEL_ON;
   2073 }
   2074 
   2075 static inline bool
   2076 veritefb_accel_op_ok(struct veritefb_softc *sc)
   2077 {
   2078 	return sc->sc_accel == VFB_ACCEL_ON &&
   2079 	    sc->sc_mode == WSDISPLAYIO_MODE_EMUL;
   2080 }
   2081 
   2082 #ifdef VERITEFB_DEBUG
   2083 static void
   2084 vfb_stat(struct veritefb_softc *sc, int idx, const struct timeval *t0)
   2085 {
   2086 	struct timeval t1;
   2087 
   2088 	microuptime(&t1);
   2089 	sc->sc_stats.vs_count[idx]++;
   2090 	sc->sc_stats.vs_us[idx] +=
   2091 	    (uint64_t)(t1.tv_sec - t0->tv_sec) * 1000000 +
   2092 	    (t1.tv_usec - t0->tv_usec);
   2093 }
   2094 #define VFB_T0()	struct timeval t0_; microuptime(&t0_)
   2095 #define VFB_STAT(sc, idx)	vfb_stat(sc, idx, &t0_)
   2096 #else
   2097 #define VFB_T0()	do { } while (0)
   2098 #define VFB_STAT(sc, idx)	do { } while (0)
   2099 #endif
   2100 
   2101 static void
   2102 veritefb_eraserows(void *cookie, int row, int nrows, long fillattr)
   2103 {
   2104 	struct rasops_info *ri = cookie;
   2105 	struct vcons_screen *scr = ri->ri_hw;
   2106 	struct veritefb_softc *sc = scr->scr_cookie;
   2107 	int x, y, w, h;
   2108 	VFB_T0();
   2109 
   2110 	if (!veritefb_accel_op_ok(sc)) {
   2111 		sc->sc_orig_eraserows(cookie, row, nrows, fillattr);
   2112 		VFB_STAT(sc, VFB_STAT_FILL);
   2113 		return;
   2114 	}
   2115 
   2116 	if (row == 0 && nrows == ri->ri_rows) {
   2117 		x = y = 0;
   2118 		w = ri->ri_width;
   2119 		h = ri->ri_height;
   2120 	} else {
   2121 		x = ri->ri_xorigin;
   2122 		y = ri->ri_yorigin + row * ri->ri_font->fontheight;
   2123 		w = ri->ri_emuwidth;
   2124 		h = nrows * ri->ri_font->fontheight;
   2125 	}
   2126 	if (!veritefb_rectfill(sc, x, y, w, h,
   2127 	    ri->ri_devcmap[(fillattr >> 16) & 0xf]))
   2128 		sc->sc_orig_eraserows(cookie, row, nrows, fillattr);
   2129 	VFB_STAT(sc, VFB_STAT_FILL);
   2130 }
   2131 
   2132 static void
   2133 veritefb_erasecols(void *cookie, int row, int startcol, int ncols,
   2134     long fillattr)
   2135 {
   2136 	struct rasops_info *ri = cookie;
   2137 	struct vcons_screen *scr = ri->ri_hw;
   2138 	struct veritefb_softc *sc = scr->scr_cookie;
   2139 	int x, y, w, h;
   2140 
   2141 	if (!veritefb_accel_op_ok(sc)) {
   2142 		sc->sc_orig_erasecols(cookie, row, startcol, ncols,
   2143 		    fillattr);
   2144 		return;
   2145 	}
   2146 
   2147 	x = ri->ri_xorigin + startcol * ri->ri_font->fontwidth;
   2148 	y = ri->ri_yorigin + row * ri->ri_font->fontheight;
   2149 	w = ncols * ri->ri_font->fontwidth;
   2150 	h = ri->ri_font->fontheight;
   2151 	if (!veritefb_rectfill(sc, x, y, w, h,
   2152 	    ri->ri_devcmap[(fillattr >> 16) & 0xf]))
   2153 		sc->sc_orig_erasecols(cookie, row, startcol, ncols,
   2154 		    fillattr);
   2155 }
   2156 
   2157 static void
   2158 veritefb_copyrows(void *cookie, int srcrow, int dstrow, int nrows)
   2159 {
   2160 	struct rasops_info *ri = cookie;
   2161 	struct vcons_screen *scr = ri->ri_hw;
   2162 	struct veritefb_softc *sc = scr->scr_cookie;
   2163 	int x, sy, dy, w, h;
   2164 	VFB_T0();
   2165 
   2166 	if (!veritefb_accel_op_ok(sc)) {
   2167 		sc->sc_orig_copyrows(cookie, srcrow, dstrow, nrows);
   2168 		VFB_STAT(sc, VFB_STAT_BLT);
   2169 		return;
   2170 	}
   2171 
   2172 	x = ri->ri_xorigin;
   2173 	sy = ri->ri_yorigin + srcrow * ri->ri_font->fontheight;
   2174 	dy = ri->ri_yorigin + dstrow * ri->ri_font->fontheight;
   2175 	w = ri->ri_emuwidth;
   2176 	h = nrows * ri->ri_font->fontheight;
   2177 	if (!veritefb_bitblt(sc, x, sy, x, dy, w, h))
   2178 		sc->sc_orig_copyrows(cookie, srcrow, dstrow, nrows);
   2179 	VFB_STAT(sc, VFB_STAT_BLT);
   2180 }
   2181 
   2182 static void
   2183 veritefb_copycols(void *cookie, int row, int srccol, int dstcol, int ncols)
   2184 {
   2185 	struct rasops_info *ri = cookie;
   2186 	struct vcons_screen *scr = ri->ri_hw;
   2187 	struct veritefb_softc *sc = scr->scr_cookie;
   2188 	int sx, dx, y, w, h;
   2189 
   2190 	if (!veritefb_accel_op_ok(sc)) {
   2191 		sc->sc_orig_copycols(cookie, row, srccol, dstcol, ncols);
   2192 		return;
   2193 	}
   2194 
   2195 	sx = ri->ri_xorigin + srccol * ri->ri_font->fontwidth;
   2196 	dx = ri->ri_xorigin + dstcol * ri->ri_font->fontwidth;
   2197 	y = ri->ri_yorigin + row * ri->ri_font->fontheight;
   2198 	w = ncols * ri->ri_font->fontwidth;
   2199 	h = ri->ri_font->fontheight;
   2200 	if (!veritefb_bitblt(sc, sx, y, dx, y, w, h))
   2201 		sc->sc_orig_copycols(cookie, row, srccol, dstcol, ncols);
   2202 }
   2203 
   2204 /* Blit-within-VRAM for the glyph cache. */
   2205 static void
   2206 veritefb_gc_bitblt(void *cookie, int xs, int ys, int xd, int yd, int wi,
   2207     int he, int rop)
   2208 {
   2209 	struct veritefb_softc *sc = cookie;
   2210 
   2211 	(void)veritefb_bitblt(sc, xs, ys, xd, yd, wi, he);
   2212 }
   2213 
   2214 /*
   2215  * Glyph-cached putchar
   2216  */
   2217 static void
   2218 veritefb_putchar(void *cookie, int row, int col, u_int c, long attr)
   2219 {
   2220 	struct rasops_info *ri = cookie;
   2221 	struct vcons_screen *scr = ri->ri_hw;
   2222 	struct veritefb_softc *sc = scr->scr_cookie;
   2223 	struct wsdisplay_font *font = PICK_FONT(ri, c);
   2224 	uint32_t fg, bg;
   2225 	int x, y, wi, he, rv;
   2226 	VFB_T0();
   2227 
   2228 	/* Anything drawn before firmload lands here. */
   2229 	if (!veritefb_accel_op_ok(sc) || !sc->sc_gc_initted) {
   2230 		sc->sc_orig_putchar(cookie, row, col, c, attr);
   2231 		VFB_STAT(sc, VFB_STAT_CHAR_SW);
   2232 		return;
   2233 	}
   2234 
   2235 	if (!CHAR_IN_FONT(c, font))
   2236 		return;
   2237 
   2238 	wi = font->fontwidth;
   2239 	he = font->fontheight;
   2240 	x = ri->ri_xorigin + col * wi;
   2241 	y = ri->ri_yorigin + row * he;
   2242 	fg = ri->ri_devcmap[(attr >> 24) & 0xf];
   2243 	bg = ri->ri_devcmap[(attr >> 16) & 0xf];
   2244 
   2245 	if (c == ' ') {
   2246 		if (!veritefb_rectfill(sc, x, y, wi, he, bg)) {
   2247 			sc->sc_orig_putchar(cookie, row, col, c, attr);
   2248 			return;
   2249 		}
   2250 		if (attr & WSATTR_UNDERLINE)
   2251 			(void)veritefb_rectfill(sc,
   2252 			    x, y + he - VFB_UNDERLINE_OFF, wi, 1, fg);
   2253 		VFB_STAT(sc, VFB_STAT_CHAR_SPACE);
   2254 		return;
   2255 	}
   2256 
   2257 	rv = glyphcache_try(&sc->sc_gc, c, x, y, attr);
   2258 	if (rv == GC_OK) {
   2259 		VFB_STAT(sc, VFB_STAT_CHAR_HIT);
   2260 		return;
   2261 	}
   2262 
   2263 	/*
   2264 	 * Every accelerated op above ends in a sync, so the engine is
   2265 	 * idle by the time the software renderer scribbles into VRAM.
   2266 	 */
   2267 	sc->sc_orig_putchar(cookie, row, col, c, attr &
   2268 	    ~(long)(WSATTR_REVERSE | WSATTR_HILIT | WSATTR_BLINK |
   2269 	    WSATTR_UNDERLINE));
   2270 
   2271 	if (rv == GC_ADD) {
   2272 		glyphcache_add(&sc->sc_gc, c, x, y);
   2273 	} else if (attr & WSATTR_UNDERLINE)
   2274 		(void)veritefb_rectfill(sc,
   2275 		    x, y + he - VFB_UNDERLINE_OFF, wi, 1, fg);
   2276 	VFB_STAT(sc, VFB_STAT_CHAR_ADD);
   2277 }
   2278 
   2279 #if defined(DDB) && defined(VERITEFB_DEBUG)
   2280 /*
   2281  * ddb 'verite*' commands, wrappers over the RISC debug port.
   2282  * 'veriteregs' leaves the RISC held and clobbers the decoder IR,
   2283  * resume with 'veritereset', not 'veritecont'.
   2284  */
   2285 
   2286 static struct veritefb_softc *veritefb_ddb_sc;
   2287 
   2288 static const char *
   2289 veritefb_db_regname(int idx)
   2290 {
   2291 	switch (idx) {
   2292 	case VRISC_FLAG:	return "flag";
   2293 	case 176:		return "cmd-param";
   2294 	case 177:		return "cmd-index";
   2295 	case 224:		return "DispatchTable";
   2296 	case 225:		return "code-base";
   2297 	case 227:		return "shadow/fb-base";
   2298 	case 235:		return "load-bias";
   2299 	case VRISC_SP:		return "SP(dbg-scratch)";
   2300 	case VRISC_RA:		return "RA(dbg-scratch)";
   2301 	case VRISC_FP:		return "FP(dbg-scratch)";
   2302 	default:		return NULL;
   2303 	}
   2304 }
   2305 
   2306 static void
   2307 veritefb_db_diag(db_expr_t addr, bool have_addr, db_expr_t count,
   2308     const char *modif)
   2309 {
   2310 	struct veritefb_softc *sc = veritefb_ddb_sc;
   2311 	uint32_t pc, word;
   2312 	unsigned i, n;
   2313 
   2314 	if (sc == NULL) {
   2315 		db_printf("veritefb not attached\n");
   2316 		return;
   2317 	}
   2318 
   2319 	db_printf("accel state: %s\n",
   2320 	    sc->sc_accel == VFB_ACCEL_ON ? "ON" :
   2321 	    sc->sc_accel == VFB_ACCEL_SW ? "SW (degraded)" : "OFF");
   2322 	db_printf("FIFOINFREE %u/31, FIFOOUTVALID %u, DEBUG 0x%02x\n",
   2323 	    vfb_read1(sc, VFB_FIFOINFREE) & VFB_FIFOINFREE_MASK,
   2324 	    vfb_read1(sc, VFB_FIFOOUTVALID) & VFB_FIFOOUTVALID_MASK,
   2325 	    vfb_read1(sc, VFB_DEBUG));
   2326 
   2327 	pc = veritefb_risc_samplepc(sc);
   2328 	db_printf("RISC PC 0x%08x: %s\n", pc, veritefb_pc_signature(pc));
   2329 
   2330 	n = MIN(sc->sc_ring_count, 16);
   2331 	db_printf("last %u FIFO words (oldest first):\n", n);
   2332 	for (i = 0; i < n; i++)
   2333 		db_printf("  [-%2u] 0x%08x\n", n - i,
   2334 		    sc->sc_ring[(sc->sc_ring_count - n + i) &
   2335 		    (VFB_RING_SIZE - 1)]);
   2336 
   2337 	/* Heartbeat, only if we believe the engine is alive. */
   2338 	if (sc->sc_accel == VFB_ACCEL_ON) {
   2339 		for (i = 0; i < VFB_DRAINPOLL; i++) {
   2340 			if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   2341 			    VFB_FIFOOUTVALID_MASK) == 0)
   2342 				break;
   2343 			(void)vfb_fifo_read(sc);
   2344 			delay(1);
   2345 		}
   2346 		if ((vfb_read1(sc, VFB_FIFOINFREE) &
   2347 		    VFB_FIFOINFREE_MASK) < 1) {
   2348 			db_printf("heartbeat: input FIFO full - RISC "
   2349 			    "not consuming (wedged)\n");
   2350 			return;
   2351 		}
   2352 		vfb_fifo_write(sc, VFB_CMDW(0, VCMD_PIXENGSYNC));
   2353 		for (i = 0; i < VFB_FIFOPOLL; i++) {
   2354 			if ((vfb_read1(sc, VFB_FIFOOUTVALID) &
   2355 			    VFB_FIFOOUTVALID_MASK) != 0)
   2356 				break;
   2357 			delay(1);
   2358 		}
   2359 		if (i == VFB_FIFOPOLL) {
   2360 			db_printf("heartbeat: no sync token (RISC or "
   2361 			    "pixel engine wedged)\n");
   2362 		} else {
   2363 			word = vfb_fifo_read(sc);
   2364 			db_printf("heartbeat: token 0x%08x (%s)\n", word,
   2365 			    word == VFB_SYNC_TOKEN ? "healthy" : "BAD");
   2366 		}
   2367 	}
   2368 }
   2369 
   2370 static void
   2371 veritefb_db_regs(db_expr_t addr, bool have_addr, db_expr_t count,
   2372     const char *modif)
   2373 {
   2374 	struct veritefb_softc *sc = veritefb_ddb_sc;
   2375 	const char *name;
   2376 	uint32_t val;
   2377 	int i;
   2378 
   2379 	if (sc == NULL) {
   2380 		db_printf("veritefb not attached\n");
   2381 		return;
   2382 	}
   2383 
   2384 	veritefb_risc_hold(sc);
   2385 	db_printf("register file snapshot (RISC left held; IR clobbered - "
   2386 	    "use veritereset to resume):\n");
   2387 	for (i = 0; i < 256; i++) {
   2388 		val = veritefb_risc_readrf(sc, i);
   2389 		name = veritefb_db_regname(i);
   2390 		db_printf("%%%-3d 0x%08x%s%s%s", i, val,
   2391 		    name ? " (" : "", name ? name : "", name ? ")" : "");
   2392 		db_printf((i & 3) == 3 ? "\n" : "  ");
   2393 	}
   2394 	vfb_write1(sc, VFB_STATEINDEX, VFB_STATEINDEX_PC);
   2395 	db_printf("PC 0x%08x\n", vfb_read4(sc, VFB_STATEDATA));
   2396 }
   2397 
   2398 static void
   2399 veritefb_db_reset(db_expr_t addr, bool have_addr, db_expr_t count,
   2400     const char *modif)
   2401 {
   2402 	struct veritefb_softc *sc = veritefb_ddb_sc;
   2403 
   2404 	if (sc == NULL || sc->sc_ucode == NULL) {
   2405 		db_printf("veritefb not attached or no microcode\n");
   2406 		return;
   2407 	}
   2408 
   2409 	db_printf("reloading microcode and restarting RISC...\n");
   2410 	db_printf("%s\n", veritefb_risc_init(sc) ?
   2411 	    "handshake passed, acceleration restored" :
   2412 	    "bring-up FAILED, staying in software rendering");
   2413 }
   2414 
   2415 static void
   2416 veritefb_db_fault(db_expr_t addr, bool have_addr, db_expr_t count,
   2417     const char *modif)
   2418 {
   2419 	struct veritefb_softc *sc = veritefb_ddb_sc;
   2420 
   2421 	if (sc == NULL) {
   2422 		db_printf("veritefb not attached\n");
   2423 		return;
   2424 	}
   2425 
   2426 	db_printf("deliberately sending an invalid command (trap slot), "
   2427 	    "run veritediag to observe, veritereset to recover\n");
   2428 	vfb_fifo_write(sc, VFB_CMDW(0, VFB_CMD_BOGUS));
   2429 }
   2430 
   2431 static void
   2432 veritefb_db_cont(db_expr_t addr, bool have_addr, db_expr_t count,
   2433     const char *modif)
   2434 {
   2435 	struct veritefb_softc *sc = veritefb_ddb_sc;
   2436 
   2437 	if (sc == NULL) {
   2438 		db_printf("veritefb not attached\n");
   2439 		return;
   2440 	}
   2441 	veritefb_risc_continue(sc);
   2442 	db_printf("RISC released\n");
   2443 }
   2444 
   2445 static const struct db_command veritefb_db_commands[] = {
   2446 	{ DDB_ADD_CMD("veritediag", veritefb_db_diag, 0,
   2447 	    "veritefb: PC signature, FIFO gauges, ring, heartbeat",
   2448 	    NULL, NULL) },
   2449 	{ DDB_ADD_CMD("veriteregs", veritefb_db_regs, 0,
   2450 	    "veritefb: RISC register file snapshot (leaves RISC held)",
   2451 	    NULL, NULL) },
   2452 	{ DDB_ADD_CMD("veritereset", veritefb_db_reset, 0,
   2453 	    "veritefb: reload microcode, restart RISC, re-handshake",
   2454 	    NULL, NULL) },
   2455 	{ DDB_ADD_CMD("veritefault", veritefb_db_fault, 0,
   2456 	    "veritefb: deliberately wedge the RISC (recovery test)",
   2457 	    NULL, NULL) },
   2458 	{ DDB_ADD_CMD("veritecont", veritefb_db_cont, 0,
   2459 	    "veritefb: release the RISC hold bit",
   2460 	    NULL, NULL) },
   2461 	{ DDB_END_CMD },
   2462 };
   2463 
   2464 static void
   2465 veritefb_ddb_attach(struct veritefb_softc *sc)
   2466 {
   2467 	if (veritefb_ddb_sc != NULL)
   2468 		return;
   2469 	veritefb_ddb_sc = sc;
   2470 	(void)db_register_tbl(DDB_BASE_CMD, veritefb_db_commands);
   2471 }
   2472 #endif /* DDB && VERITEFB_DEBUG */
   2473 
   2474