/*
 * df5636_rig.c -- DF-5636/5637/5638 rig: instantiate the REAL in-tree
 * smbus stack (iicbus.ko + iicbb.ko + iicsmb.ko + smbus.ko, all unmodified
 * production modules) under a fake GPIO parent and drive the smbconf.c
 * request/release primitives from userland.
 *
 * Targets (sys/bus/smbus/smbconf.c):
 *   DF-5636  smbus_request_bus()'s ownership loop never re-checks
 *            sc->owner after a wakeup (smbconf.c:126-141): a woken waiter
 *            exits via `if (error == 0) break` and returns SUCCESS without
 *            ever setting sc->owner = dev.  The same break converts the
 *            SMB_DONTWAIT fast-fail into a phantom grant because
 *            `if (error == EWOULDBLOCK) error = 0` (smbconf.c:131-132)
 *            erases poll's EWOULDBLOCK (default case, smbconf.c:96-98).
 *            The iiconf.c twin loop (iiconf.c:99-114) loops back and
 *            re-checks; smbconf.c does not.
 *   DF-5637  smbus_release_bus() tears down the parent-bridge exclusion
 *            BEFORE validating ownership (SMBUS_CALLBACK at smbconf.c:160
 *            precedes the sc->owner==dev check at :166) and broadcasts
 *            wakeup(sc) even on the EACCES path (:177): a non-owner
 *            release frees the underlying iicbus out from under the real
 *            owner, then wakes parked requesters into the DF-5636 phantom
 *            grant while the real owner still holds the bus.
 *   DF-5638  SMB_WAIT-only requesters park in tsleep(sc, 0, "smbreq", 0)
 *            (smbconf.c:92-94) -- no PCATCH, no timeout: an unkillable
 *            park of the calling process (in-tree SMB_WAIT callers:
 *            ipmi_ssif.c:81,181, cyapa.c:1176,1624).
 *
 * Rig structure (family standard, mirrors the DF-5559/5563 fakebb rigs):
 *
 *    nexus -> fakebb0  (this module: GPIO emulator + /dev/df5636)
 *               -> iicbb0    (real iicbb.ko, registered by iicbb_reg.ko)
 *                  -> iicbus0 (real iicbus.ko)
 *                     -> iicsmb0 (real iicsmb.ko, kldload'ed after this rig)
 *                        -> smbus0 (real smbus.ko)  <-- code under test
 *
 * The smbus ownership API only compares device_t pointers, so three
 * distinct in-tree devices play three contending "smbus children":
 *   devA = fakebb0   devB = iicbb0   devC = iicbus0
 * (iicsmb uses the iicsmb child, ipmi_ssif the ipmi device; same rule.)
 *
 * /dev/df5636 ioctls:
 *   F1   phantom grant via the wake path (kernel threads, deterministic)
 *   F2   phantom grant via SMB_DONTWAIT (synchronous)
 *   F3   non-owner release tears down the iicbus exclusion (probe diff)
 *   F3B  EACCES (non-owner) release wakes a parked waiter into a grant
 *        while the real owner still owns the bus -- no release happened
 *   PARK park the calling user process on request(devB, SMB_WAIT)
 *   UNPARK release devA
 *
 * Every step kprintf's its state; the decisive lines are the ones
 * reporting `smbus_request_bus returned 0` next to `sc->owner != caller`.
 */

#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/module.h>
#include <sys/systm.h>
#include <sys/bus.h>
#include <sys/malloc.h>
#include <sys/types.h>
#include <sys/conf.h>
#include <sys/device.h>
#include <sys/sysctl.h>
#include <sys/kthread.h>

#include <bus/iicbus/iiconf.h>
#include <bus/iicbus/iicbus.h>
#include <bus/smbus/smbconf.h>

#include "smbus.h"			/* struct smbus_softc (copied) */

#include "iicbb_if.h"

#define FAKEBB_NACK_ADDR	0x6e	/* slave refuses this address */
#define FAKEBB_TX_BASE		0xc0	/* slave TX pattern base */

/* df5636ctl.c <-> rig ioctl protocol */
#define DF5636_F1	_IOWR('d', 1, int)	/* wake-path phantom grant */
#define DF5636_F2	_IOWR('d', 2, int)	/* DONTWAIT phantom grant */
#define DF5636_F3	_IOWR('d', 3, int)	/* non-owner release teardown */
#define DF5636_F3B	_IOWR('d', 4, int)	/* EACCES release wakes waiter */
#define DF5636_PARK	_IOWR('d', 5, int)	/* park caller: SMB_WAIT */
#define DF5636_UNPARK	_IOWR('d', 6, int)	/* release devA */

static struct dev_ops df5636_ops;

struct fakebb_softc {
	device_t	self;		/* fakebb0: owner token "devA" */
	device_t	iicbb;		/* iicbb0: owner token "devB" */
	device_t	iicbus;		/* iicbus0: owner token "devC" */
	device_t	smbus;		/* smbus0: the bus under test */
	cdev_t		cdev;		/* /dev/df5636 */

	/* emulated GPIO pin state (what the master drove) */
	int		sda, scl, last_scl;

	/* emulated I2C slave */
	int		started;	/* START seen and no STOP yet */
	int		clk;		/* SCL rising edges this byte slot (1..9) */
	u_char		shift;		/* shift-in register */
	int		first_byte;	/* next byte slot is the address */
	int		reading;	/* current transfer direction */
	u_char		addr;		/* addressed slave byte */
	int		nack_this;	/* NACK the current address */
	u_char		rx[32];		/* bytes captured from master */
	int		rxlen;
	u_char		txnext;		/* next TX pattern byte */
	u_char		txcur;		/* current TX byte being clocked out */

	int		starts, stops;
};

static int df5636_busy = 0;	/* fake "bridge busy" (compat knob) */

SYSCTL_NODE(_hw, OID_AUTO, df5636, CTLFLAG_RW, 0, "DF-5636 rig");
SYSCTL_INT(_hw_df5636, OID_AUTO, busy, CTLFLAG_RW, &df5636_busy, 0,
    "bridge reports the bus busy");

/* ------------------------------------------------------------------ */
/* emulated wire: what a master reading SDA would see                  */
/* ------------------------------------------------------------------ */

static int
fakebb_wire_sda(struct fakebb_softc *sc)
{

	if (!sc->started)
		return (sc->sda);
	if (sc->clk == 9) {
		/* ACK slot: the slave owns the wire */
		return (sc->nack_this ? 1 : 0);
	}
	if (sc->reading && !sc->first_byte && sc->clk >= 1 && sc->clk <= 8)
		return ((sc->txcur >> (8 - sc->clk)) & 1);
	return (sc->sda);		/* slave idle: master's own level */
}

/* ------------------------------------------------------------------ */
/* iicbb_if methods (the "fake GPIO" vtable)                           */
/* ------------------------------------------------------------------ */

static void
fakebb_setsda(device_t dev, int val)
{
	struct fakebb_softc *sc = device_get_softc(dev);

	val = val ? 1 : 0;
	if (sc->scl && sc->sda && !val) {
		/* SDA falling while SCL high: START / repeated START */
		sc->started = 1;
		sc->clk = 0;
		sc->shift = 0;
		sc->first_byte = 1;
		sc->reading = 0;
		sc->nack_this = 0;
		sc->rxlen = 0;
		sc->starts++;
	} else if (sc->scl && !sc->sda && val && sc->started) {
		/* SDA rising while SCL high: STOP */
		sc->started = 0;
		sc->stops++;
	}
	sc->sda = val;
}

static void
fakebb_setscl(device_t dev, int val)
{
	struct fakebb_softc *sc = device_get_softc(dev);

	val = val ? 1 : 0;
	if (sc->started) {
		if (val && !sc->last_scl) {
			/* rising edge: data bits are sampled here */
			sc->clk++;
			if (sc->clk >= 1 && sc->clk <= 8)
				sc->shift = (u_char)((sc->shift << 1) |
				    (fakebb_wire_sda(sc) & 1));
		} else if (!val && sc->last_scl && sc->clk == 9) {
			/* falling edge of the ACK clock: byte slot done */
			if (sc->first_byte) {
				sc->addr = sc->shift;
				sc->first_byte = 0;
				sc->reading = sc->shift & 1;
				sc->nack_this =
				    (sc->addr == FAKEBB_NACK_ADDR);
				sc->txnext = FAKEBB_TX_BASE;
				if (sc->reading)
					sc->txcur = sc->txnext++;
			} else if (sc->reading) {
				sc->txcur = sc->txnext++;
			} else {
				if (sc->rxlen < (int)sizeof(sc->rx))
					sc->rx[sc->rxlen] = sc->shift;
				sc->rxlen++;
			}
			sc->clk = 0;
			sc->shift = 0;
		}
	}
	sc->last_scl = val;
	sc->scl = val;
}

static int
fakebb_getsda(device_t dev)
{
	struct fakebb_softc *sc = device_get_softc(dev);

	return (fakebb_wire_sda(sc));
}

static int
fakebb_getscl(device_t dev)
{
	struct fakebb_softc *sc = device_get_softc(dev);

	return (sc->scl);
}

static int
fakebb_reset(device_t dev, u_char speed, u_char addr, u_char *oldaddr)
{

	(void)dev;
	(void)speed;
	(void)addr;
	if (oldaddr != NULL)
		*oldaddr = 0;
	return (0);
}

static int
fakebb_callback(device_t dev, int index, caddr_t data)
{

	(void)dev;
	(void)data;
	if (index == IIC_REQUEST_BUS && df5636_busy)
		return (EWOULDBLOCK);
	return (0);
}

/* ------------------------------------------------------------------ */
/* request/release probe threads                                       */
/* ------------------------------------------------------------------ */

struct req_thread_ctx {
	device_t	bus;
	device_t	dev;
	int		how;
	const char	*tag;
	volatile int	started;	/* set just before the request */
	volatile int	done;
	int		error;
	device_t	owner_seen;	/* sc->owner sampled after return */
};

static void
req_thread(void *arg)
{
	struct req_thread_ctx *c = arg;
	struct smbus_softc *ssc = device_get_softc(c->bus);

	kprintf("[df5636] T(%s): calling smbus_request_bus(%s, how=0x%x) "
	    "softc=%p\n", c->tag, device_get_nameunit(c->dev), c->how,
	    (void *)ssc);
	c->started = 1;
	wakeup(c);
	c->error = smbus_request_bus(c->bus, c->dev, c->how);
	kprintf("[df5636] T(%s): request RETURNED %d\n", c->tag, c->error);
	c->owner_seen = ssc->owner;
	kprintf("[df5636] T(%s): sc->owner=%p (caller=%p)%s\n",
	    c->tag, (void *)c->owner_seen, (void *)c->dev,
	    (c->error == 0 && c->owner_seen != c->dev) ?
	    "  <<< PHANTOM GRANT: success returned, owner is NOT the caller" : "");
	c->done = 1;
	wakeup(c);
	kthread_exit();
}

static void
wait_started(struct req_thread_ctx *c, int secs)
{
	int i;

	for (i = 0; i < secs * 10 && !c->started; i++)
		tsleep(c, 0, "df36s", hz / 10);
}

static void
wait_done(struct req_thread_ctx *c, int secs)
{
	int i;

	for (i = 0; i < secs * 10 && !c->done; i++)
		tsleep(c, 0, "df36w", hz / 10);
}

static int
spawn_req(struct req_thread_ctx *c, device_t bus, device_t dev, int how,
    const char *tag)
{

	bzero(c, sizeof(*c));
	c->bus = bus;
	c->dev = dev;
	c->how = how;
	c->tag = tag;
	return (kthread_create(req_thread, c, NULL, "df5636_%s", tag));
}

/*
 * Restore the iicbus ownership on behalf of iicsmb0 after a test has
 * torn it down non-owner-style (F3/F3B on the unfixed code), so the
 * following smbus_release_bus(devA) finds the bridge held by iicsmb
 * and unwinds cleanly instead of EACCES-ing and leaving smbus owner
 * dangling for the next test.
 */
static void
restore_iicbus(struct fakebb_softc *sc)
{
	device_t iicsmb;
	devclass_t dc;

	if (sc->iicbus == NULL)
		return;
	dc = devclass_find("iicsmb");
	if (dc == NULL)
		return;
	iicsmb = devclass_get_device(dc, 0);
	if (iicsmb == NULL)
		return;
	iicbus_request_bus(sc->iicbus, iicsmb, IIC_WAIT | IIC_INTR);
}

/* ------------------------------------------------------------------ */
/* /dev/df5636: userland entry into the smbconf.c primitives           */
/* ------------------------------------------------------------------ */

static int
df5636_open(struct dev_open_args *ap)
{

	return (0);
}

static int
df5636_close(struct dev_close_args *ap)
{

	return (0);
}

static int
df5636_ioctl(struct dev_ioctl_args *ap)
{
	cdev_t cdev = ap->a_head.a_dev;
	struct fakebb_softc *sc = cdev->si_drv1;
	struct smbus_softc *ssc;
	u_long cmd = ap->a_cmd;
	int *resp = (int *)ap->a_data;
	device_t devA, devB, devC;
	int error, err2;
	struct req_thread_ctx t1, t2;

	if (sc->iicbus == NULL) {
		sc->iicbus = devclass_get_device(devclass_find("iicbus"), 0);
		if (sc->iicbus == NULL)
			return (ENXIO);
	}
	if (sc->smbus == NULL) {
		sc->smbus = devclass_get_device(devclass_find("smbus"), 0);
		if (sc->smbus == NULL) {
			kprintf("[df5636] no smbus0 yet (kldload iicsmb)\n");
			return (ENXIO);
		}
	}

	ssc = device_get_softc(sc->smbus);
	devA = sc->self;	/* fakebb0 */
	devB = sc->iicbb;	/* iicbb0 */
	devC = sc->iicbus;	/* iicbus0 */
	*resp = 0;

	switch (cmd) {
	case DF5636_F1:
		/* --- wake-path phantom grant (DF-5636) --- */
		error = smbus_request_bus(sc->smbus, devA, SMB_WAIT | SMB_INTR);
		kprintf("[df5636] F1.1 request(devA=%s)=%d owner=%p\n",
		    device_get_nameunit(devA), error, (void *)ssc->owner);

		error = spawn_req(&t1, sc->smbus, devB, SMB_WAIT | SMB_INTR,
		    "devB");
		if (error)
			return (error);
		wait_started(&t1, 2);
		tsleep(&t1, 0, "df36p", hz / 2);	/* release mid-tsleep */
		kprintf("[df5636] F1.2 owner while devB parked=%p "
		    "(devA=%p devB=%p)\n", (void *)ssc->owner,
		    (void *)devA, (void *)devB);

		error = smbus_release_bus(sc->smbus, devA);
		kprintf("[df5636] F1.3 release(devA)=%d owner=%p\n",
		    error, (void *)ssc->owner);

		/* poll: watch whether the woken devB claims the bus */
		{
			int k;
			for (k = 0; k < 10; k++) {
				tsleep(&t1, 0, "df36w", hz / 10);
				if (t1.done)
					break;
			}
			kprintf("[df5636] F1.3w %d00ms after release: "
			    "owner=%p t1.done=%d\n", k, (void *)ssc->owner,
			    t1.done);
		}
		wait_done(&t1, 5);
		if (t1.error == 0 && t1.owner_seen != devB)
			*resp |= 0x01;		/* phantom grant observed */
		if (t1.done == 0)
			kprintf("[df5636] F1: devB thread did not finish\n");

		/*
		 * devC now requests.  Unfixed: smbus owner is NULL (or still
		 * someone else's) and devB "holds" a phantom grant -- devC is
		 * granted too => two concurrent granted holders.  Fixed: devB
		 * really owns, devC parks.
		 */
		error = spawn_req(&t2, sc->smbus, devC, SMB_WAIT | SMB_INTR,
		    "devC");
		if (error)
			return (error);
		wait_started(&t2, 2);
		tsleep(&t2, 0, "df36q", hz);
		kprintf("[df5636] F1.4 after 1s of devC request: owner=%p "
		    "devC.done=%d (1 = granted immediately)\n",
		    (void *)ssc->owner, t2.done);
		if (t1.error == 0 && t1.owner_seen != devB && t2.done &&
		    t2.error == 0)
			*resp |= 0x02;		/* double grant observed */

		/* unwedge the fixed-mode parked devC */
		error = smbus_release_bus(sc->smbus, devB);
		kprintf("[df5636] F1.5 release(devB)=%d\n", error);
		wait_done(&t2, 5);
		/*
		 * Robust cleanup: the release-before-validate semantics can
		 * leave the bridge torn down under a stale smbus owner (that
		 * itself is DF-5637 evidence).  Restore the bridge, then
		 * release whichever device currently owns the smbus.
		 */
		restore_iicbus(sc);
		if (ssc->owner == devC) {
			error = smbus_release_bus(sc->smbus, devC);
			kprintf("[df5636] F1.5b cleanup release(devC)=%d "
			    "owner=%p\n", error, (void *)ssc->owner);
		}
		if (ssc->owner == devB) {
			error = smbus_release_bus(sc->smbus, devB);
			kprintf("[df5636] F1.5c cleanup release(devB)=%d "
			    "owner=%p\n", error, (void *)ssc->owner);
		}
		wait_done(&t2, 3);
		tsleep(&t2, 0, "df36r", hz / 4);
		kprintf("[df5636] F1.6 final owner=%p (clean=NULL) "
		    "t1.done=%d t2.done=%d\n", (void *)ssc->owner,
		    t1.done, t2.done);
		return (0);

	case DF5636_F2:
		/* --- SMB_DONTWAIT phantom grant (DF-5636) --- */
		error = smbus_request_bus(sc->smbus, devA, SMB_WAIT | SMB_INTR);
		kprintf("[df5636] F2.1 request(devA)=%d owner=%p\n",
		    error, (void *)ssc->owner);

		err2 = smbus_request_bus(sc->smbus, devB, SMB_DONTWAIT);
		kprintf("[df5636] F2.2 request(devB, SMB_DONTWAIT)=%d "
		    "owner=%p caller=%p %s\n", err2, (void *)ssc->owner,
		    (void *)devB,
		    (err2 == 0) ? "<<< PHANTOM GRANT (must be EWOULDBLOCK)"
				: "(EWOULDBLOCK: correctly refused)");
		if (err2 == 0)
			*resp |= 0x01;		/* phantom grant observed */

		smbus_release_bus(sc->smbus, devB);	/* best effort */
		restore_iicbus(sc);
		error = smbus_release_bus(sc->smbus, devA);
		kprintf("[df5636] F2.3 cleanup release(devA)=%d owner=%p\n",
		    error, (void *)ssc->owner);
		return (0);

	case DF5636_F3:
		/* --- non-owner release tears down the bridge (DF-5637) --- */
		error = smbus_request_bus(sc->smbus, devA, SMB_WAIT | SMB_INTR);
		kprintf("[df5636] F3.1 request(devA)=%d owner=%p "
		    "(iicbus now held via iicsmb)\n", error,
		    (void *)ssc->owner);

		error = smbus_release_bus(sc->smbus, devB);	/* NON-owner */
		kprintf("[df5636] F3.2 NON-owner release(devB)=%d "
		    "smbus owner still=%p\n", error, (void *)ssc->owner);

		/*
		 * Probe the iicbus exclusion devA depends on: devC asks the
		 * iicbus itself, DONTWAIT.  If the non-owner smbus release
		 * tore it down, this succeeds (0) -- while devA still owns
		 * the smbus and believes it is exclusive.  Intact exclusion
		 * answers EWOULDBLOCK.
		 */
		err2 = iicbus_request_bus(sc->iicbus, devC, IIC_DONTWAIT);
		kprintf("[df5636] F3.3 iicbus probe request(devC, DONTWAIT)=%d"
		    " %s\n", err2,
		    (err2 == 0) ? "<<< iicbus TORN DOWN by the non-owner "
		    "release while devA owns smbus"
		    : "(EWOULDBLOCK: bridge exclusion intact)");
		if (err2 == 0) {
			*resp |= 0x01;
			iicbus_release_bus(sc->iicbus, devC);
			restore_iicbus(sc);
		}
		error = smbus_release_bus(sc->smbus, devA);
		kprintf("[df5636] F3.4 cleanup release(devA)=%d owner=%p\n",
		    error, (void *)ssc->owner);
		return (0);

	case DF5636_F3B:
		/* --- EACCES release wakes a waiter into a grant (DF-5637) --- */
		error = smbus_request_bus(sc->smbus, devA, SMB_WAIT | SMB_INTR);
		kprintf("[df5636] F3B.1 request(devA)=%d owner=%p\n",
		    error, (void *)ssc->owner);

		error = spawn_req(&t1, sc->smbus, devB, SMB_WAIT | SMB_INTR,
		    "devB");
		if (error)
			return (error);
		wait_started(&t1, 2);
		tsleep(&t1, 0, "df36p", hz / 2);
		kprintf("[df5636] F3B.2 owner while devB parked=%p "
		    "(devA=%p)\n", (void *)ssc->owner, (void *)devA);

		/* devC releases a bus it does not own: NOTHING is freed at
		 * the smbus level, yet smbconf.c:177 broadcasts wakeup(sc) */
		error = smbus_release_bus(sc->smbus, devC);
		kprintf("[df5636] F3B.3 NON-owner release(devC)=%d "
		    "owner STILL=%p\n", error, (void *)ssc->owner);

		wait_done(&t1, 5);
		kprintf("[df5636] F3B.3w t1 verdict: error=%d owner_seen=%p "
		    "(devA=%p)%s\n", t1.error, (void *)t1.owner_seen,
		    (void *)devA,
		    (t1.error == 0 && t1.owner_seen == devA) ?
		    "  <<< GRANTED while another device verifiably OWNS "
		    "the bus (no release ever happened)" : "");
		if (t1.error == 0 && t1.owner_seen == devA)
			*resp |= 0x01;	/* granted while another device owns */
		if (t1.done == 0)
			kprintf("[df5636] F3B: devB still parked "
			    "(no bogus wakeup: GOOD on fixed code)\n");

		restore_iicbus(sc);
		error = smbus_release_bus(sc->smbus, devA);
		kprintf("[df5636] F3B.4 cleanup release(devA)=%d owner=%p\n",
		    error, (void *)ssc->owner);
		return (0);

	case DF5636_PARK:
		/* park the CALLING PROCESS: DF-5638 unkillable smbreq sleep */
		error = smbus_request_bus(sc->smbus, devA, SMB_WAIT | SMB_INTR);
		kprintf("[df5636] PARK: holding bus with devA=%p, "
		    "parking caller on request(devB, SMB_WAIT=0x%x)\n",
		    (void *)devA, SMB_WAIT);
		error = smbus_request_bus(sc->smbus, devB, SMB_WAIT);
		kprintf("[df5636] PARK: woke: request(devB) returned %d "
		    "owner=%p caller=%p%s\n", error, (void *)ssc->owner,
		    (void *)devB,
		    (error == 0 && ssc->owner != devB) ?
		    "  <<< phantom grant on wake" : "");
		*resp = error;
		return (0);

	case DF5636_UNPARK:
		error = smbus_release_bus(sc->smbus, devA);
		kprintf("[df5636] UNPARK: release(devA)=%d\n", error);
		*resp = error;
		return (0);

	default:
		return (ENOTTY);
	}
}

/* ------------------------------------------------------------------ */
/* fakebb bus device plumbing                                          */
/* ------------------------------------------------------------------ */

static void
fakebb_identify(driver_t *driver, device_t parent)
{
	device_t child;

	child = device_find_child(parent, "fakebb", 0);
	if (child == NULL)
		BUS_ADD_CHILD(parent, parent, 0, "fakebb", 0);
}

static int
fakebb_probe(device_t dev)
{

	device_set_desc(dev, "DF-5636 fake GPIO bit-bang i2c master+slave");
	return (0);
}

static int
fakebb_attach(device_t dev)
{
	struct fakebb_softc *sc = (struct fakebb_softc *)device_get_softc(dev);
	device_t bus = NULL;
	devclass_t dc;
	char wbuf[8], rbuf[8];
	int i, error, sent, rlen;
	int ok_w = 1, ok_r = 1;
	int tries;

	sc->self = dev;
	sc->iicbb = device_add_child(dev, "iicbb", -1);
	if (sc->iicbb == NULL)
		return (ENXIO);

	/* cascades: iicbb0 -> iicbus0 (+ iic0/iicsmb0/smbus0 when loaded) */
	bus_generic_attach(dev);

	for (tries = 0; tries < 50 && bus == NULL; tries++) {
		dc = devclass_find("iicbus");
		if (dc != NULL)
			bus = devclass_get_device(dc, 0);
		if (bus == NULL)
			tsleep(sc, 0, "fkbw", hz / 20);
	}
	sc->iicbus = bus;

	sc->cdev = make_dev(&df5636_ops, 0, UID_ROOT, GID_WHEEL, 0600,
	    "df5636");
	if (sc->cdev == NULL)
		kprintf("[df5636] make_dev failed\n");
	else
		sc->cdev->si_drv1 = sc;

	kprintf("[df5636] attach done: iicbus=%p cdev=%p busy=%d "
	    "(now: kldload iicsmb)\n", bus, sc->cdev, df5636_busy);

	if (bus == NULL)
		return (0);

	/* ---------------- sanity round trip (real iicbus stack) -------- */
	error = iicbus_request_bus(bus, dev, IIC_WAIT | IIC_INTR);
	kprintf("[df5636] sanity iicbus_request_bus error=%d\n", error);

	wbuf[0] = 0xde; wbuf[1] = 0xad; wbuf[2] = 0xbe; wbuf[3] = 0xef;
	wbuf[4] = 0x55; wbuf[5] = 0xaa; wbuf[6] = 0x12; wbuf[7] = 0x34;
	error = iicbus_block_write(bus, 0x50, wbuf, 8, &sent);
	if (error != 0 || sent != 8)
		ok_w = 0;
	for (i = 0; i < 8; i++)
		if (sc->rx[i] != (u_char)wbuf[i])
			ok_w = 0;

	error = iicbus_block_read(bus, 0x50, rbuf, 8, &rlen);
	if (error != 0 || rlen != 8)
		ok_r = 0;
	for (i = 0; i < 8; i++)
		if ((u_char)rbuf[i] != (u_char)(FAKEBB_TX_BASE + i))
			ok_r = 0;

	iicbus_release_bus(bus, dev);

	kprintf("[df5636] SANITY: write_ok=%d read_ok=%d starts=%d stops=%d\n",
	    ok_w, ok_r, sc->starts, sc->stops);

	return (0);
}

static int
fakebb_detach(device_t dev)
{
	struct fakebb_softc *sc = (struct fakebb_softc *)device_get_softc(dev);
	device_t child;

	if (sc->cdev) {
		dev_ops_remove_minor(&df5636_ops, 0);
		sc->cdev = NULL;
	}

	child = sc->iicbb;
	bus_generic_detach(dev);
	if (child)
		device_delete_child(dev, child);

	return (0);
}

static void
fakebb_child_detached(device_t dev, device_t child)
{
	struct fakebb_softc *sc = (struct fakebb_softc *)device_get_softc(dev);

	if (child == sc->iicbb)
		sc->iicbb = NULL;
}

static struct dev_ops df5636_ops = {
	{ "df5636", 0, 0 },
	.d_open =	df5636_open,
	.d_close =	df5636_close,
	.d_ioctl =	df5636_ioctl,
};

static device_method_t fakebb_methods[] = {
	/* device interface */
	DEVMETHOD(device_identify,	fakebb_identify),
	DEVMETHOD(device_probe,		fakebb_probe),
	DEVMETHOD(device_attach,	fakebb_attach),
	DEVMETHOD(device_detach,	fakebb_detach),

	/* bus interface */
	DEVMETHOD(bus_child_detached,	fakebb_child_detached),

	/* iicbb interface (the fake GPIO vtable) */
	DEVMETHOD(iicbb_callback,	fakebb_callback),
	DEVMETHOD(iicbb_setsda,	fakebb_setsda),
	DEVMETHOD(iicbb_setscl,	fakebb_setscl),
	DEVMETHOD(iicbb_getsda,	fakebb_getsda),
	DEVMETHOD(iicbb_getscl,	fakebb_getscl),
	DEVMETHOD(iicbb_reset,		fakebb_reset),

	DEVMETHOD_END
};

static driver_t fakebb_driver = {
	"fakebb",
	fakebb_methods,
	sizeof(struct fakebb_softc),
};

static devclass_t fakebb_devclass;

DRIVER_MODULE(fakebb, nexus, fakebb_driver, fakebb_devclass, NULL, NULL);
MODULE_DEPEND(fakebb, iicbb, 1, 1, 1);
MODULE_DEPEND(fakebb, iicbus, 1, 1, 1);
MODULE_DEPEND(fakebb, smbus, 1, 1, 1);
MODULE_VERSION(fakebb, 1);