Wanting to work on something a little different for a while,
I decided to figure out why mmap() of /dev/grf0 fails on an
SE/30. We have to build dt with USE_OLD_GRF to work around this
problem, and the X server is also built with an SE/30 workaround.

  It turns out that the sc_grfmode->fboff is incorrect on an SE/30.
This field is loaded from the Nubus Indirect Mode data (which I
assume is a Nubus ROM) in grfmv_attach(). It is loaded with
0x8040, while the correct value is 0x0040.

  The old GRFIOCMAP ioctl works because grfmap() truncates fboff:
*addrp += (unsigned long) gp->sc_grfmode->fboff & 0xfff;
while grfmv_phys() (which grfmmap calls) does not.

  I have a few questions:
1) Is that upper bit (0x8000) some kind of flag bit rather than
   part of the offset?
2) Why does grfmap() already truncate fboff, and why doesn't
   grfmv_attach() truncate image.offset similarly?
3) Any suggestions on how to fix it? I could check if the machine
   is an SE/30 in grfmv_phys() and mask off the lower 12 bits,
   but that is pretty hackish. Can anyone suggest a more generic
   fix?
4) Do any other machines have this problem? Does anyone else have
   to build dt with USE_OLD_GRF to get it to work on their
   (non-SE/30) machine?

-Denny