#define INTEL_GRAPHICS_MEMORY_FENCE_GEN6(i) (0x100000 + (i * 8))
+// i965 to IronLake: 16 fences, each 64 bit (low: start, pitch, tiling, valid;
+// high: end)
+#define INTEL_GRAPHICS_MEMORY_FENCE_965(i)	(0x3000 + (i * 8))
+#define INTEL_GRAPHICS_MEMORY_FENCE_VALID	(1UL << 0)

 		for (int i = 0; i < numFences; i++)
 			write32(INTEL_GRAPHICS_MEMORY_FENCE_GEN6(i), 0);
+	} else if (gInfo->shared_info->device_type.Generation() >= 4) {
+		// The firmware may leave fences around its own tiled frame buffer
+		// (Apple EFI on i965GM does). CPU writes through the aperture to a
+		// fenced range get tiled, which garbles our linear frame buffer.
+		for (int i = 0; i < 16; i++) {
+			uint32 fence = INTEL_GRAPHICS_MEMORY_FENCE_965(i);
+			uint32 low = read32(fence);
+			if ((low & INTEL_GRAPHICS_MEMORY_FENCE_VALID) != 0) {
+				TRACE("%s: clearing fence %d: start 0x%" B_PRIx32 " end 0x%"
+					B_PRIx32 " pitch %" B_PRIu32 " %s-tiled\n", __func__, i,
+					low & ~(uint32)0xfff, read32(fence + 4) | 0xfff,
+					(((low >> 2) & 0x3ff) + 1) * 128,
+					(low & (1UL << 1)) != 0 ? "Y" : "X");
+			}
+			write32(fence, 0);
+			write32(fence + 4, 0);
+		}
+		read32(INTEL_GRAPHICS_MEMORY_FENCE_965(15));
 	}

 #define DISPLAY_CONTROL_TILE_MODE_MASK	(7UL << 10)
+// Gen2-4 only: primary plane to pipe assignment (overlaps Skylake color bits)
+#define DISPLAY_CONTROL_PIPE_SELECT_MASK	(3UL << 24)
+#define DISPLAY_CONTROL_PIPE_B			(1UL << 24)
+
+// i965 and G4x: used instead of INTEL_DISPLAY_A_BASE when the plane is tiled
+#define INTEL_DISPLAY_A_TILE_OFFSET		INTEL_DISPLAY_A_OFFSET_HAS
+#define INTEL_DISPLAY_B_TILE_OFFSET		INTEL_DISPLAY_B_OFFSET_HAS

-		write32(planeReg, (read32(planeReg) | DISPLAY_CONTROL_ENABLED)
-			& ~DISPLAY_CONTROL_TILE_MODE_MASK);
+		uint32 planeControl = (read32(planeReg) | DISPLAY_CONTROL_ENABLED)
+			& ~DISPLAY_CONTROL_TILE_MODE_MASK;
+		if (gInfo->shared_info->device_type.Generation() <= 4
+			&& fPipeIndex <= INTEL_PIPE_B) {
+			// Planes can feed either pipe here, and the firmware may have
+			// crossed them (MacBook EFI); tie our plane to our pipe.
+			planeControl &= ~DISPLAY_CONTROL_PIPE_SELECT_MASK;
+			if (fPipeIndex == INTEL_PIPE_B)
+				planeControl |= DISPLAY_CONTROL_PIPE_B;
+			if (gInfo->shared_info->device_type.Generation() == 4)
+				write32(INTEL_DISPLAY_A_TILE_OFFSET + fPlaneOffset, 0);
+		}
+		write32(planeReg, planeControl);

 	write32(INTEL_VGA_DISPLAY_CONTROL, VGA_DISPLAY_DISABLED);
 	read32(INTEL_VGA_DISPLAY_CONTROL);
 
+	if (sharedInfo.device_type.Generation() <= 4) {
+		// The firmware may have left a plane enabled on a pipe we are about
+		// to drive (possibly tiled, and with its own stride). Turn all
+		// primary planes off; Pipe::Enable() turns on the ones we use.
+		write32(INTEL_DISPLAY_A_CONTROL,
+			read32(INTEL_DISPLAY_A_CONTROL) & ~DISPLAY_CONTROL_ENABLED);
+		write32(INTEL_DISPLAY_B_CONTROL,
+			read32(INTEL_DISPLAY_B_CONTROL) & ~DISPLAY_CONTROL_ENABLED);
+		// plane updates are only latched by a write to the surface register
+		// (i965+), or to the base register on older chips
+		uint32 latchA = sharedInfo.device_type.Generation() == 4
+			? INTEL_DISPLAY_A_SURFACE : INTEL_DISPLAY_A_BASE;
+		uint32 latchB = sharedInfo.device_type.Generation() == 4
+			? INTEL_DISPLAY_B_SURFACE : INTEL_DISPLAY_B_BASE;
+		write32(latchA, read32(latchA));
+		write32(latchB, read32(latchB));
+		wait_for_vblank();
+	}
+

 	program_pipe_color_modes(colorMode);
 
+	if (sharedInfo.device_type.Generation() <= 4) {
+		// Program the stride before the planes come back on, so that the
+		// surface write in set_display_power_mode() already latches it,
+		// instead of scanning out with the old (firmware) stride.
+		write32(INTEL_DISPLAY_A_BYTES_PER_ROW, bytesPerRow);
+		write32(INTEL_DISPLAY_B_BYTES_PER_ROW, bytesPerRow);
+		sharedInfo.current_mode = target;
+		sharedInfo.bytes_per_row = bytesPerRow;
+		sharedInfo.bits_per_pixel = bitsPerPixel;
+	}
+
 	// TODO: This may not be neccesary (see DPMS OFF at top)
 	set_display_power_mode(sharedInfo.dpms_mode);

-	} else if (info.type->InGroup(INTEL_GROUP_91x)) {
-		info.gtt_physical_base = get_pci_config(info.display, i915_GTT_BASE, 4);
+	} else if (info.type->Generation() == 3) {
+		// 915, 945, G33 and Pineview have a separate GTT BAR
+		info.gtt_physical_base = get_pci_config(info.display, i915_GTT_BASE, 4)
+			& ~(phys_addr_t)0xf;
+	} else if (info.type->Generation() == 4
+		&& !info.type->InGroup(INTEL_GROUP_G4x)) {
+		// i965: the GTT follows the 512 KB of registers in the MMIO BAR
+		info.gtt_physical_base = addr + (512UL << 10);
 	} else {
-		// 945+?
+		// G4x and later
 		info.gtt_physical_base = addr + (2UL << 20);
 	}
 
 	size_t gttSize = determine_gtt_size(info);
 	size_t stolenSize = determine_gtt_stolen(info);
 
-	info.gtt_entries = gttSize / 4096;
+	if (info.type->Generation() == 4 && !info.type->InGroup(INTEL_GROUP_G4x)
+		&& info.gtt_physical_base + gttSize > addr + barSize) {
+		// we would write the GTT entries into whatever device follows
+		ERROR("GTT (%" B_PRIuSIZE " bytes at 0x%" B_PRIxPHYSADDR ") is outside"
+			" of the MMIO BAR!\n", gttSize, info.gtt_physical_base);
+		return B_ERROR;
+	}
+
+	if (info.type->Generation() < 8) {
+		// one 32 bit entry per page
+		info.gtt_entries = gttSize / sizeof(uint32);
+	} else {
+		// TODO: Gen8+ uses 64 bit entries, which set_gtt_entry() does not
+		// handle yet; keep the old (too small) count so we don't scribble
+		// over live entries with the scratch page loop.
+		info.gtt_entries = gttSize / 4096;
+	}

 	if (intel_allocate_memory(info, B_PAGE_SIZE, 0, B_APERTURE_NEED_PHYSICAL,
-			(addr_t*)info.shared_info->status_page,
+			(addr_t*)&info.shared_info->status_page,
 			&info.shared_info->physical_status_page) == B_OK) {

/*!	Returns whether the GTT maps the aperture range 1:1 to stolen memory.
	Only that is safe to draw to: the firmware may have put its frame buffer
	into boot services memory, which the kernel reuses.
*/
static bool
intel_maps_stolen_memory(efi_pci_root_bridge_io_protocol* pci, uint64 gtt,
	uint64 stolenBase, uint32 offset, uint32 size)
{
	for (uint32 page = offset; page < offset + size; page += B_PAGE_SIZE) {
		uint32 entry = intel_read32(pci, gtt + page / B_PAGE_SIZE * 4);
		uint64 address = (entry & ~0xfffULL) | ((uint64)(entry & 0xf0) << 28);
		if ((entry & GTT_ENTRY_VALID) == 0 || address != stolenBase + page)
			return false;
	}
	return true;
}

		bool relocate = !intel_maps_stolen_memory(pci, gtt, stolenBase,
			surface, size);
		if (relocate) {
			// Apple EFI scans out of boot services memory; use the start of
			// the aperture instead
			surface = 0;
			if (!intel_maps_stolen_memory(pci, gtt, stolenBase, surface, size)
				|| (tiled && !intel_is_fenced(pci, mmio, surface, size,
					stride))) {
				dprintf("Intel firmware frame buffer is not in stolen memory,"
					" ignoring it\n");
				continue;
			}
		}
		...
		// only enabled in platform_switch_to_logo()
		gKernelArgs.frame_buffer.enabled = false;

static void
switch_to_intel_frame_buffer()
{
	if (sIntelFrameBuffer.relocate) {
		...
		// the offsets are latched by the surface write
		intel_write32(pci, mmio + INTEL_PLANE_LINEAR_OFFSET(plane), 0);
		intel_write32(pci, mmio + INTEL_PLANE_TILE_OFFSET(plane), 0);
		intel_write32(pci, mmio + INTEL_PLANE_SURFACE(plane),
			sIntelFrameBuffer.surface);
		sIntelFrameBuffer.relocate = false;
	}

	gKernelArgs.frame_buffer.enabled = true;
}

 		dprintf("GOP protocol not found\n");
 		gKernelArgs.frame_buffer.enabled = false;
 		sGraphicsOutput = NULL;
-		return B_ERROR;
+		sFirmwareFrameBuffer = find_intel_firmware_frame_buffer();
+		return sFirmwareFrameBuffer ? B_OK : B_ERROR;

 platform_switch_to_logo(void)
 {
+	if (sFirmwareFrameBuffer) {
+		// no mode setting possible, keep what the firmware set up
+		switch_to_intel_frame_buffer();
+		video_display_splash(gKernelArgs.frame_buffer.physical_buffer.start);
+		return;
+	}

-	addr_t size = min_c(gKernelArgs.frame_buffer.width
-			* gKernelArgs.frame_buffer.height * 4u,
+	addr_t size = min_c((addr_t)gKernelArgs.frame_buffer.bytes_per_row
+			* gKernelArgs.frame_buffer.height,
 		gKernelArgs.frame_buffer.physical_buffer.size);