Merge branch 'topic/dp-aux-rework' into drm-intel-next-queued

Conflicts:
	drivers/gpu/drm/i915/intel_dp.c

A bit a mess with reverts which differe in details between -fixes and
-next and some other unrelated shuffling.

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

252 files changed, 7837 insertions, 4231 deletions

diff --git a/Documentation/DocBook/drm.tmpl b/Documentation/DocBook/drm.tmpl
index ed1d6d289022..9f5457ac0373 100644
--- a/Documentation/DocBook/drm.tmpl
+++ b/Documentation/DocBook/drm.tmpl
@@ -29,12 +29,26 @@
           </address>
         </affiliation>
       </author>
+      <author>
+        <firstname>Daniel</firstname>
+        <surname>Vetter</surname>
+        <contrib>Contributions all over the place</contrib>
+        <affiliation>
+          <orgname>Intel Corporation</orgname>
+          <address>
+            <email>daniel.vetter@ffwll.ch</email>
+          </address>
+        </affiliation>
+      </author>
     </authorgroup>
 
     <copyright>
       <year>2008-2009</year>
-      <year>2012</year>
+      <year>2013-2014</year>
       <holder>Intel Corporation</holder>
+    </copyright>
+    <copyright>
+      <year>2012</year>
       <holder>Laurent Pinchart</holder>
     </copyright>
 
@@ -60,7 +74,15 @@
 
 <toc></toc>
 
-  <!-- Introduction -->
+<part id="drmCore">
+  <title>DRM Core</title>
+  <partintro>
+    <para>
+      This first part of the DRM Developer's Guide documents core DRM code,
+      helper libraries for writting drivers and generic userspace interfaces
+      exposed by DRM drivers.
+    </para>
+  </partintro>
 
   <chapter id="drmIntroduction">
     <title>Introduction</title>
@@ -264,8 +286,8 @@ char *date;</synopsis>
       <para>
         The <methodname>load</methodname> method is the driver and device
         initialization entry point. The method is responsible for allocating and
-        initializing driver private data, specifying supported performance
-        counters, performing resource allocation and mapping (e.g. acquiring
+        initializing driver private data, performing resource allocation and
+        mapping (e.g. acquiring
         clocks, mapping registers or allocating command buffers), initializing
         the memory manager (<xref linkend="drm-memory-management"/>), installing
         the IRQ handler (<xref linkend="drm-irq-registration"/>), setting up
@@ -295,7 +317,7 @@ char *date;</synopsis>
         their <methodname>load</methodname> method called with flags to 0.
       </para>
       <sect3>
-        <title>Driver Private &amp; Performance Counters</title>
+        <title>Driver Private Data</title>
         <para>
           The driver private hangs off the main
           <structname>drm_device</structname> structure and can be used for
@@ -307,14 +329,6 @@ char *date;</synopsis>
           <structname>drm_device</structname>.<structfield>dev_priv</structfield>
           set to NULL when the driver is unloaded.
         </para>
-        <para>
-          DRM supports several counters which were used for rough performance
-          characterization. This stat counter system is deprecated and should not
-          be used. If performance monitoring is desired, the developer should
-          investigate and potentially enhance the kernel perf and tracing
-          infrastructure to export GPU related performance information for
-          consumption by performance monitoring tools and applications.
-        </para>
       </sect3>
       <sect3 id="drm-irq-registration">
         <title>IRQ Registration</title>
@@ -697,55 +711,16 @@ char *date;</synopsis>
           respectively. The conversion is handled by the DRM core without any
           driver-specific support.
         </para>
-        <para>
-          Similar to global names, GEM file descriptors are also used to share GEM
-          objects across processes. They offer additional security: as file
-          descriptors must be explicitly sent over UNIX domain sockets to be shared
-          between applications, they can't be guessed like the globally unique GEM
-          names.
-        </para>
-        <para>
-          Drivers that support GEM file descriptors, also known as the DRM PRIME
-          API, must set the DRIVER_PRIME bit in the struct
-          <structname>drm_driver</structname>
-          <structfield>driver_features</structfield> field, and implement the
-          <methodname>prime_handle_to_fd</methodname> and
-          <methodname>prime_fd_to_handle</methodname> operations.
-        </para>
-        <para>
-          <synopsis>int (*prime_handle_to_fd)(struct drm_device *dev,
-                            struct drm_file *file_priv, uint32_t handle,
-                            uint32_t flags, int *prime_fd);
-  int (*prime_fd_to_handle)(struct drm_device *dev,
-                            struct drm_file *file_priv, int prime_fd,
-                            uint32_t *handle);</synopsis>
-          Those two operations convert a handle to a PRIME file descriptor and
-          vice versa. Drivers must use the kernel dma-buf buffer sharing framework
-          to manage the PRIME file descriptors.
-        </para>
-        <para>
-          While non-GEM drivers must implement the operations themselves, GEM
-          drivers must use the <function>drm_gem_prime_handle_to_fd</function>
-          and <function>drm_gem_prime_fd_to_handle</function> helper functions.
-          Those helpers rely on the driver
-          <methodname>gem_prime_export</methodname> and
-          <methodname>gem_prime_import</methodname> operations to create a dma-buf
-          instance from a GEM object (dma-buf exporter role) and to create a GEM
-          object from a dma-buf instance (dma-buf importer role).
-        </para>
-        <para>
-          <synopsis>struct dma_buf * (*gem_prime_export)(struct drm_device *dev,
-                                       struct drm_gem_object *obj,
-                                       int flags);
-  struct drm_gem_object * (*gem_prime_import)(struct drm_device *dev,
-                                              struct dma_buf *dma_buf);</synopsis>
-          These two operations are mandatory for GEM drivers that support DRM
-          PRIME.
-        </para>
-        <sect4>
-          <title>DRM PRIME Helper Functions Reference</title>
-!Pdrivers/gpu/drm/drm_prime.c PRIME Helpers
-        </sect4>
+        <para>
+          GEM also supports buffer sharing with dma-buf file descriptors through
+          PRIME. GEM-based drivers must use the provided helpers functions to
+          implement the exporting and importing correctly. See <xref linkend="drm-prime-support" />.
+          Since sharing file descriptors is inherently more secure than the
+          easily guessable and global GEM names it is the preferred buffer
+          sharing mechanism. Sharing buffers through GEM names is only supported
+          for legacy userspace. Furthermore PRIME also allows cross-device
+          buffer sharing since it is based on dma-bufs.
+        </para>
       </sect3>
       <sect3 id="drm-gem-objects-mapping">
         <title>GEM Objects Mapping</title>
@@ -830,62 +805,6 @@ char *date;</synopsis>
         </para>
       </sect3>
       <sect3>
-        <title>Dumb GEM Objects</title>
-        <para>
-          The GEM API doesn't standardize GEM objects creation and leaves it to
-          driver-specific ioctls. While not an issue for full-fledged graphics
-          stacks that include device-specific userspace components (in libdrm for
-          instance), this limit makes DRM-based early boot graphics unnecessarily
-          complex.
-        </para>
-        <para>
-          Dumb GEM objects partly alleviate the problem by providing a standard
-          API to create dumb buffers suitable for scanout, which can then be used
-          to create KMS frame buffers.
-        </para>
-        <para>
-          To support dumb GEM objects drivers must implement the
-          <methodname>dumb_create</methodname>,
-          <methodname>dumb_destroy</methodname> and
-          <methodname>dumb_map_offset</methodname> operations.
-        </para>
-        <itemizedlist>
-          <listitem>
-            <synopsis>int (*dumb_create)(struct drm_file *file_priv, struct drm_device *dev,
-                     struct drm_mode_create_dumb *args);</synopsis>
-            <para>
-              The <methodname>dumb_create</methodname> operation creates a GEM
-              object suitable for scanout based on the width, height and depth
-              from the struct <structname>drm_mode_create_dumb</structname>
-              argument. It fills the argument's <structfield>handle</structfield>,
-              <structfield>pitch</structfield> and <structfield>size</structfield>
-              fields with a handle for the newly created GEM object and its line
-              pitch and size in bytes.
-            </para>
-          </listitem>
-          <listitem>
-            <synopsis>int (*dumb_destroy)(struct drm_file *file_priv, struct drm_device *dev,
-                      uint32_t handle);</synopsis>
-            <para>
-              The <methodname>dumb_destroy</methodname> operation destroys a dumb
-              GEM object created by <methodname>dumb_create</methodname>.
-            </para>
-          </listitem>
-          <listitem>
-            <synopsis>int (*dumb_map_offset)(struct drm_file *file_priv, struct drm_device *dev,
-                         uint32_t handle, uint64_t *offset);</synopsis>
-            <para>
-              The <methodname>dumb_map_offset</methodname> operation associates an
-              mmap fake offset with the GEM object given by the handle and returns
-              it. Drivers must use the
-              <function>drm_gem_create_mmap_offset</function> function to
-              associate the fake offset as described in
-              <xref linkend="drm-gem-objects-mapping"/>.
-            </para>
-          </listitem>
-        </itemizedlist>
-      </sect3>
-      <sect3>
         <title>Memory Coherency</title>
         <para>
           When mapped to the device or used in a command buffer, backing pages
@@ -924,7 +843,99 @@ char *date;</synopsis>
           abstracted from the client in libdrm.
         </para>
       </sect3>
-    </sect2>
+      <sect3>
+        <title>GEM Function Reference</title>
+!Edrivers/gpu/drm/drm_gem.c
+      </sect3>
+      </sect2>
+      <sect2>
+        <title>VMA Offset Manager</title>
+!Pdrivers/gpu/drm/drm_vma_manager.c vma offset manager
+!Edrivers/gpu/drm/drm_vma_manager.c
+!Iinclude/drm/drm_vma_manager.h
+      </sect2>
+      <sect2 id="drm-prime-support">
+        <title>PRIME Buffer Sharing</title>
+        <para>
+          PRIME is the cross device buffer sharing framework in drm, originally
+          created for the OPTIMUS range of multi-gpu platforms. To userspace
+          PRIME buffers are dma-buf based file descriptors.
+        </para>
+        <sect3>
+          <title>Overview and Driver Interface</title>
+          <para>
+            Similar to GEM global names, PRIME file descriptors are
+            also used to share buffer objects across processes. They offer
+            additional security: as file descriptors must be explicitly sent over
+            UNIX domain sockets to be shared between applications, they can't be
+            guessed like the globally unique GEM names.
+          </para>
+          <para>
+            Drivers that support the PRIME
+            API must set the DRIVER_PRIME bit in the struct
+            <structname>drm_driver</structname>
+            <structfield>driver_features</structfield> field, and implement the
+            <methodname>prime_handle_to_fd</methodname> and
+            <methodname>prime_fd_to_handle</methodname> operations.
+          </para>
+          <para>
+            <synopsis>int (*prime_handle_to_fd)(struct drm_device *dev,
+                          struct drm_file *file_priv, uint32_t handle,
+                          uint32_t flags, int *prime_fd);
+int (*prime_fd_to_handle)(struct drm_device *dev,
+                          struct drm_file *file_priv, int prime_fd,
+                          uint32_t *handle);</synopsis>
+            Those two operations convert a handle to a PRIME file descriptor and
+            vice versa. Drivers must use the kernel dma-buf buffer sharing framework
+            to manage the PRIME file descriptors. Similar to the mode setting
+            API PRIME is agnostic to the underlying buffer object manager, as
+            long as handles are 32bit unsinged integers.
+          </para>
+          <para>
+            While non-GEM drivers must implement the operations themselves, GEM
+            drivers must use the <function>drm_gem_prime_handle_to_fd</function>
+            and <function>drm_gem_prime_fd_to_handle</function> helper functions.
+            Those helpers rely on the driver
+            <methodname>gem_prime_export</methodname> and
+            <methodname>gem_prime_import</methodname> operations to create a dma-buf
+            instance from a GEM object (dma-buf exporter role) and to create a GEM
+            object from a dma-buf instance (dma-buf importer role).
+          </para>
+          <para>
+            <synopsis>struct dma_buf * (*gem_prime_export)(struct drm_device *dev,
+                                     struct drm_gem_object *obj,
+                                     int flags);
+struct drm_gem_object * (*gem_prime_import)(struct drm_device *dev,
+                                            struct dma_buf *dma_buf);</synopsis>
+            These two operations are mandatory for GEM drivers that support
+            PRIME.
+          </para>
+        </sect3>
+        <sect3>
+          <title>PRIME Helper Functions</title>
+!Pdrivers/gpu/drm/drm_prime.c PRIME Helpers
+        </sect3>
+      </sect2>
+      <sect2>
+        <title>PRIME Function References</title>
+!Edrivers/gpu/drm/drm_prime.c
+      </sect2>
+      <sect2>
+        <title>DRM MM Range Allocator</title>
+        <sect3>
+          <title>Overview</title>
+!Pdrivers/gpu/drm/drm_mm.c Overview
+        </sect3>
+        <sect3>
+          <title>LRU Scan/Eviction Support</title>
+!Pdrivers/gpu/drm/drm_mm.c lru scan roaster
+        </sect3>
+      </sect2>
+      <sect2>
+        <title>DRM MM Range Allocator Function References</title>
+!Edrivers/gpu/drm/drm_mm.c
+!Iinclude/drm/drm_mm.h
+      </sect2>
   </sect1>
 
   <!-- Internals: mode setting -->
@@ -953,6 +964,11 @@ int max_width, max_height;</synopsis>
       </listitem>
     </itemizedlist>
     <sect2>
+      <title>Display Modes Function Reference</title>
+!Iinclude/drm/drm_modes.h
+!Edrivers/gpu/drm/drm_modes.c
+    </sect2>
+    <sect2>
       <title>Frame Buffer Creation</title>
       <synopsis>struct drm_framebuffer *(*fb_create)(struct drm_device *dev,
                                      struct drm_file *file_priv,
@@ -968,9 +984,11 @@ int max_width, max_height;</synopsis>
         Frame buffers rely on the underneath memory manager for low-level memory
         operations. When creating a frame buffer applications pass a memory
         handle (or a list of memory handles for multi-planar formats) through
-        the <parameter>drm_mode_fb_cmd2</parameter> argument. This document
-        assumes that the driver uses GEM, those handles thus reference GEM
-        objects.
+        the <parameter>drm_mode_fb_cmd2</parameter> argument. For drivers using
+        GEM as their userspace buffer management interface this would be a GEM
+        handle.  Drivers are however free to use their own backing storage object
+        handles, e.g. vmwgfx directly exposes special TTM handles to userspace
+        and so expects TTM handles in the create ioctl and not GEM handles.
       </para>
       <para>
         Drivers must first validate the requested frame buffer parameters passed
@@ -992,7 +1010,7 @@ int max_width, max_height;</synopsis>
       </para>
 
       <para>
-        The initailization of the new framebuffer instance is finalized with a
+        The initialization of the new framebuffer instance is finalized with a
         call to <function>drm_framebuffer_init</function> which takes a pointer
         to DRM frame buffer operations (struct
         <structname>drm_framebuffer_funcs</structname>). Note that this function
@@ -1042,7 +1060,7 @@ int max_width, max_height;</synopsis>
       <para>
         The lifetime of a drm framebuffer is controlled with a reference count,
         drivers can grab additional references with
-        <function>drm_framebuffer_reference</function> </para> and drop them
+        <function>drm_framebuffer_reference</function>and drop them
         again with <function>drm_framebuffer_unreference</function>. For
         driver-private framebuffers for which the last reference is never
         dropped (e.g. for the fbdev framebuffer when the struct
@@ -1050,6 +1068,72 @@ int max_width, max_height;</synopsis>
         helper struct) drivers can manually clean up a framebuffer at module
         unload time with
         <function>drm_framebuffer_unregister_private</function>.
+      </para>
+    </sect2>
+    <sect2>
+      <title>Dumb Buffer Objects</title>
+      <para>
+        The KMS API doesn't standardize backing storage object creation and
+        leaves it to driver-specific ioctls. Furthermore actually creating a
+        buffer object even for GEM-based drivers is done through a
+        driver-specific ioctl - GEM only has a common userspace interface for
+        sharing and destroying objects. While not an issue for full-fledged
+        graphics stacks that include device-specific userspace components (in
+        libdrm for instance), this limit makes DRM-based early boot graphics
+        unnecessarily complex.
+      </para>
+      <para>
+        Dumb objects partly alleviate the problem by providing a standard
+        API to create dumb buffers suitable for scanout, which can then be used
+        to create KMS frame buffers.
+      </para>
+      <para>
+        To support dumb objects drivers must implement the
+        <methodname>dumb_create</methodname>,
+        <methodname>dumb_destroy</methodname> and
+        <methodname>dumb_map_offset</methodname> operations.
+      </para>
+      <itemizedlist>
+        <listitem>
+          <synopsis>int (*dumb_create)(struct drm_file *file_priv, struct drm_device *dev,
+                   struct drm_mode_create_dumb *args);</synopsis>
+          <para>
+            The <methodname>dumb_create</methodname> operation creates a driver
+            object (GEM or TTM handle) suitable for scanout based on the
+            width, height and depth from the struct
+            <structname>drm_mode_create_dumb</structname> argument. It fills the
+            argument's <structfield>handle</structfield>,
+            <structfield>pitch</structfield> and <structfield>size</structfield>
+            fields with a handle for the newly created object and its line
+            pitch and size in bytes.
+          </para>
+        </listitem>
+        <listitem>
+          <synopsis>int (*dumb_destroy)(struct drm_file *file_priv, struct drm_device *dev,
+                    uint32_t handle);</synopsis>
+          <para>
+            The <methodname>dumb_destroy</methodname> operation destroys a dumb
+            object created by <methodname>dumb_create</methodname>.
+          </para>
+        </listitem>
+        <listitem>
+          <synopsis>int (*dumb_map_offset)(struct drm_file *file_priv, struct drm_device *dev,
+                       uint32_t handle, uint64_t *offset);</synopsis>
+          <para>
+            The <methodname>dumb_map_offset</methodname> operation associates an
+            mmap fake offset with the object given by the handle and returns
+            it. Drivers must use the
+            <function>drm_gem_create_mmap_offset</function> function to
+            associate the fake offset as described in
+            <xref linkend="drm-gem-objects-mapping"/>.
+          </para>
+        </listitem>
+      </itemizedlist>
+      <para>
+        Note that dumb objects may not be used for gpu acceleration, as has been
+        attempted on some ARM embedded platforms. Such drivers really must have
+        a hardware-specific ioctl to allocate suitable buffer objects.
+      </para>
     </sect2>
     <sect2>
       <title>Output Polling</title>
@@ -1130,8 +1214,11 @@ int max_width, max_height;</synopsis>
             This operation is called with the mode config lock held.
           </para>
           <note><para>
-            FIXME: How should set_config interact with DPMS? If the CRTC is
-            suspended, should it be resumed?
+            Note that the drm core has no notion of restoring the mode setting
+            state after resume, since all resume handling is in the full
+            responsibility of the driver. The common mode setting helper library
+            though provides a helper which can be used for this:
+            <function>drm_helper_resume_force_mode</function>.
           </para></note>
         </sect4>
         <sect4>
@@ -2134,7 +2221,7 @@ void intel_crt_init(struct drm_device *dev)
             set the <structfield>display_info</structfield>
             <structfield>width_mm</structfield> and
             <structfield>height_mm</structfield> fields if they haven't been set
-            already (for instance at initilization time when a fixed-size panel is
+            already (for instance at initialization time when a fixed-size panel is
             attached to the connector). The mode <structfield>width_mm</structfield>
             and <structfield>height_mm</structfield> fields are only used internally
             during EDID parsing and should not be set when creating modes manually.
@@ -2196,10 +2283,15 @@ void intel_crt_init(struct drm_device *dev)
 !Edrivers/gpu/drm/drm_flip_work.c
     </sect2>
     <sect2>
-      <title>VMA Offset Manager</title>
-!Pdrivers/gpu/drm/drm_vma_manager.c vma offset manager
-!Edrivers/gpu/drm/drm_vma_manager.c
-!Iinclude/drm/drm_vma_manager.h
+      <title>HDMI Infoframes Helper Reference</title>
+      <para>
+        Strictly speaking this is not a DRM helper library but generally useable
+        by any driver interfacing with HDMI outputs like v4l or alsa drivers.
+        But it nicely fits into the overall topic of mode setting helper
+        libraries and hence is also included here.
+      </para>
+!Iinclude/linux/hdmi.h
+!Edrivers/video/hdmi.c
     </sect2>
   </sect1>
 
@@ -2561,42 +2653,44 @@ int num_ioctls;</synopsis>
       </para>
     </sect2>
   </sect1>
-
   <sect1>
-    <title>Command submission &amp; fencing</title>
+    <title>Legacy Support Code</title>
     <para>
-      This should cover a few device-specific command submission
-      implementations.
+      The section very brievely covers some of the old legacy support code which
+      is only used by old DRM drivers which have done a so-called shadow-attach
+      to the underlying device instead of registering as a real driver. This
+      also includes some of the old generic buffer mangement and command
+      submission code. Do not use any of this in new and modern drivers.
     </para>
-  </sect1>
-
-  <!-- Internals: suspend/resume -->
 
-  <sect1>
-    <title>Suspend/Resume</title>
-    <para>
-      The DRM core provides some suspend/resume code, but drivers wanting full
-      suspend/resume support should provide save() and restore() functions.
-      These are called at suspend, hibernate, or resume time, and should perform
-      any state save or restore required by your device across suspend or
-      hibernate states.
-    </para>
-    <synopsis>int (*suspend) (struct drm_device *, pm_message_t state);
-int (*resume) (struct drm_device *);</synopsis>
-    <para>
-      Those are legacy suspend and resume methods. New driver should use the
-      power management interface provided by their bus type (usually through
-      the struct <structname>device_driver</structname> dev_pm_ops) and set
-      these methods to NULL.
-    </para>
-  </sect1>
+    <sect2>
+      <title>Legacy Suspend/Resume</title>
+      <para>
+        The DRM core provides some suspend/resume code, but drivers wanting full
+        suspend/resume support should provide save() and restore() functions.
+        These are called at suspend, hibernate, or resume time, and should perform
+        any state save or restore required by your device across suspend or
+        hibernate states.
+      </para>
+      <synopsis>int (*suspend) (struct drm_device *, pm_message_t state);
+  int (*resume) (struct drm_device *);</synopsis>
+      <para>
+        Those are legacy suspend and resume methods which
+        <emphasis>only</emphasis> work with the legacy shadow-attach driver
+        registration functions. New driver should use the power management
+        interface provided by their bus type (usually through
+        the struct <structname>device_driver</structname> dev_pm_ops) and set
+        these methods to NULL.
+      </para>
+    </sect2>
 
-  <sect1>
-    <title>DMA services</title>
-    <para>
-      This should cover how DMA mapping etc. is supported by the core.
-      These functions are deprecated and should not be used.
-    </para>
+    <sect2>
+      <title>Legacy DMA Services</title>
+      <para>
+        This should cover how DMA mapping etc. is supported by the core.
+        These functions are deprecated and should not be used.
+      </para>
+    </sect2>
   </sect1>
   </chapter>
 
@@ -2658,8 +2752,8 @@ int (*resume) (struct drm_device *);</synopsis>
         DRM core provides multiple character-devices for user-space to use.
         Depending on which device is opened, user-space can perform a different
         set of operations (mainly ioctls). The primary node is always created
-        and called <term>card&lt;num&gt;</term>. Additionally, a currently
-        unused control node, called <term>controlD&lt;num&gt;</term> is also
+        and called card&lt;num&gt;. Additionally, a currently
+        unused control node, called controlD&lt;num&gt; is also
         created. The primary node provides all legacy operations and
         historically was the only interface used by userspace. With KMS, the
         control node was introduced. However, the planned KMS control interface
@@ -2674,21 +2768,21 @@ int (*resume) (struct drm_device *);</synopsis>
         nodes were introduced. Render nodes solely serve render clients, that
         is, no modesetting or privileged ioctls can be issued on render nodes.
         Only non-global rendering commands are allowed. If a driver supports
-        render nodes, it must advertise it via the <term>DRIVER_RENDER</term>
+        render nodes, it must advertise it via the DRIVER_RENDER
         DRM driver capability. If not supported, the primary node must be used
         for render clients together with the legacy drmAuth authentication
         procedure.
       </para>
       <para>
         If a driver advertises render node support, DRM core will create a
-        separate render node called <term>renderD&lt;num&gt;</term>. There will
+        separate render node called renderD&lt;num&gt;. There will
         be one render node per device. No ioctls except  PRIME-related ioctls
-        will be allowed on this node. Especially <term>GEM_OPEN</term> will be
+        will be allowed on this node. Especially GEM_OPEN will be
         explicitly prohibited. Render nodes are designed to avoid the
         buffer-leaks, which occur if clients guess the flink names or mmap
         offsets on the legacy interface. Additionally to this basic interface,
         drivers must mark their driver-dependent render-only ioctls as
-        <term>DRM_RENDER_ALLOW</term> so render clients can use them. Driver
+        DRM_RENDER_ALLOW so render clients can use them. Driver
         authors must be careful not to allow any privileged ioctls on render
         nodes.
       </para>
@@ -2749,15 +2843,73 @@ int (*resume) (struct drm_device *);</synopsis>
     </sect1>
 
   </chapter>
+</part>
+<part id="drmDrivers">
+  <title>DRM Drivers</title>
 
-  <!-- API reference -->
+  <partintro>
+    <para>
+      This second part of the DRM Developer's Guide documents driver code,
+      implementation details and also all the driver-specific userspace
+      interfaces. Especially since all hardware-acceleration interfaces to
+      userspace are driver specific for efficiency and other reasons these
+      interfaces can be rather substantial. Hence every driver has its own
+      chapter.
+    </para>
+  </partintro>
 
-  <appendix id="drmDriverApi">
-    <title>DRM Driver API</title>
+  <chapter id="drmI915">
+    <title>drm/i915 Intel GFX Driver</title>
     <para>
-      Include auto-generated API reference here (need to reference it
-      from paragraphs above too).
+      The drm/i915 driver supports all (with the exception of some very early
+      models) integrated GFX chipsets with both Intel display and rendering
+      blocks. This excludes a set of SoC platforms with an SGX rendering unit,
+      those have basic support through the gma500 drm driver.
     </para>
-  </appendix>
+    <sect1>
+      <title>Display Hardware Handling</title>
+      <para>
+        This section covers everything related to the display hardware including
+        the mode setting infrastructure, plane, sprite and cursor handling and
+        display, output probing and related topics.
+      </para>
+      <sect2>
+        <title>Mode Setting Infrastructure</title>
+        <para>
+          The i915 driver is thus far the only DRM driver which doesn't use the
+          common DRM helper code to implement mode setting sequences. Thus it
+          has its own tailor-made infrastructure for executing a display
+          configuration change.
+        </para>
+      </sect2>
+      <sect2>
+        <title>Plane Configuration</title>
+        <para>
+          This section covers plane configuration and composition with the
+          primary plane, sprites, cursors and overlays. This includes the
+          infrastructure to do atomic vsync'ed updates of all this state and
+          also tightly coupled topics like watermark setup and computation,
+          framebuffer compression and panel self refresh.
+        </para>
+      </sect2>
+      <sect2>
+        <title>Output Probing</title>
+        <para>
+          This section covers output probing and related infrastructure like the
+          hotplug interrupt storm detection and mitigation code. Note that the
+          i915 driver still uses most of the common DRM helper code for output
+          probing, so those sections fully apply.
+        </para>
+      </sect2>
+    </sect1>
 
+    <sect1>
+      <title>Memory Management and Command Submission</title>
+      <para>
+        This sections covers all things related to the GEM implementation in the
+        i915 driver.
+      </para>
+    </sect1>
+  </chapter>
+</part>
 </book>
diff --git a/Documentation/devicetree/bindings/drm/i2c/tda998x.txt b/Documentation/devicetree/bindings/drm/i2c/tda998x.txt
new file mode 100644
index 000000000000..d7df01c5bb3a
--- /dev/null
+++ b/Documentation/devicetree/bindings/drm/i2c/tda998x.txt
@@ -0,0 +1,27 @@
+Device-Tree bindings for the NXP TDA998x HDMI transmitter
+
+Required properties;
+  - compatible: must be "nxp,tda998x"
+
+Optional properties:
+  - interrupts: interrupt number and trigger type
+        default: polling
+
+  - pinctrl-0: pin control group to be used for
+        screen plug/unplug interrupt.
+
+  - pinctrl-names: must contain a "default" entry.
+
+  - video-ports: 24 bits value which defines how the video controller
+        output is wired to the TDA998x input - default: <0x230145>
+
+Example:
+
+        tda998x: hdmi-encoder {
+                compatible = "nxp,tda998x";
+                reg = <0x70>;
+                interrupt-parent = <&gpio0>;
+                interrupts = <27 2>;            /* falling edge */
+                pinctrl-0 = <&pmx_camera>;
+                pinctrl-names = "default";
+        };
diff --git a/Documentation/networking/packet_mmap.txt b/Documentation/networking/packet_mmap.txt
index 1404674c0a02..6fea79efb4cb 100644
--- a/Documentation/networking/packet_mmap.txt
+++ b/Documentation/networking/packet_mmap.txt
@@ -453,7 +453,7 @@ TP_STATUS_COPY        : This flag indicates that the frame (and associated
                         enabled previously with setsockopt() and 
                         the PACKET_COPY_THRESH option. 
 
-                        The number of frames than can be buffered to 
+                        The number of frames that can be buffered to
                         be read with recvfrom is limited like a normal socket.
                         See the SO_RCVBUF option in the socket (7) man page.
 
diff --git a/Documentation/networking/timestamping.txt b/Documentation/networking/timestamping.txt
index 661d3c316a17..048c92b487f6 100644
--- a/Documentation/networking/timestamping.txt
+++ b/Documentation/networking/timestamping.txt
@@ -21,26 +21,38 @@ has such a feature).
 
 SO_TIMESTAMPING:
 
-Instructs the socket layer which kind of information is wanted. The
-parameter is an integer with some of the following bits set. Setting
-other bits is an error and doesn't change the current state.
-
-SOF_TIMESTAMPING_TX_HARDWARE:  try to obtain send time stamp in hardware
-SOF_TIMESTAMPING_TX_SOFTWARE:  if SOF_TIMESTAMPING_TX_HARDWARE is off or
-                               fails, then do it in software
-SOF_TIMESTAMPING_RX_HARDWARE:  return the original, unmodified time stamp
-                               as generated by the hardware
-SOF_TIMESTAMPING_RX_SOFTWARE:  if SOF_TIMESTAMPING_RX_HARDWARE is off or
-                               fails, then do it in software
-SOF_TIMESTAMPING_RAW_HARDWARE: return original raw hardware time stamp
-SOF_TIMESTAMPING_SYS_HARDWARE: return hardware time stamp transformed to
-                               the system time base
-SOF_TIMESTAMPING_SOFTWARE:     return system time stamp generated in
-                               software
-
-SOF_TIMESTAMPING_TX/RX determine how time stamps are generated.
-SOF_TIMESTAMPING_RAW/SYS determine how they are reported in the
-following control message:
+Instructs the socket layer which kind of information should be collected
+and/or reported.  The parameter is an integer with some of the following
+bits set. Setting other bits is an error and doesn't change the current
+state.
+
+Four of the bits are requests to the stack to try to generate
+timestamps.  Any combination of them is valid.
+
+SOF_TIMESTAMPING_TX_HARDWARE:  try to obtain send time stamps in hardware
+SOF_TIMESTAMPING_TX_SOFTWARE:  try to obtain send time stamps in software
+SOF_TIMESTAMPING_RX_HARDWARE:  try to obtain receive time stamps in hardware
+SOF_TIMESTAMPING_RX_SOFTWARE:  try to obtain receive time stamps in software
+
+The other three bits control which timestamps will be reported in a
+generated control message.  If none of these bits are set or if none of
+the set bits correspond to data that is available, then the control
+message will not be generated:
+
+SOF_TIMESTAMPING_SOFTWARE:     report systime if available
+SOF_TIMESTAMPING_SYS_HARDWARE: report hwtimetrans if available
+SOF_TIMESTAMPING_RAW_HARDWARE: report hwtimeraw if available
+
+It is worth noting that timestamps may be collected for reasons other
+than being requested by a particular socket with
+SOF_TIMESTAMPING_[TR]X_(HARD|SOFT)WARE.  For example, most drivers that
+can generate hardware receive timestamps ignore
+SOF_TIMESTAMPING_RX_HARDWARE.  It is still a good idea to set that flag
+in case future drivers pay attention.
+
+If timestamps are reported, they will appear in a control message with
+cmsg_level==SOL_SOCKET, cmsg_type==SO_TIMESTAMPING, and a payload like
+this:
 
 struct scm_timestamping {
         struct timespec systime;
diff --git a/MAINTAINERS b/MAINTAINERS
index b7befe758429..b3fdb0f004ba 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1738,6 +1738,7 @@ F:	include/uapi/linux/bfs_fs.h
 BLACKFIN ARCHITECTURE
 M:      Steven Miao <realmz6@gmail.com>
 L:      adi-buildroot-devel@lists.sourceforge.net
+T:      git git://git.code.sf.net/p/adi-linux/code
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      arch/blackfin/
@@ -6002,6 +6003,8 @@ F:	include/linux/netdevice.h
 F:      include/uapi/linux/in.h
 F:      include/uapi/linux/net.h
 F:      include/uapi/linux/netdevice.h
+F:      tools/net/
+F:      tools/testing/selftests/net/
 
 NETWORKING [IPv4/IPv6]
 M:      "David S. Miller" <davem@davemloft.net>
diff --git a/Makefile b/Makefile
index 1a2628ee5d91..ef779ec26f62 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
diff --git a/arch/cris/include/asm/bitops.h b/arch/cris/include/asm/bitops.h
index 184066ceb1f6..053c17b36559 100644
--- a/arch/cris/include/asm/bitops.h
+++ b/arch/cris/include/asm/bitops.h
@@ -144,7 +144,7 @@ static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
  * definition, which doesn't have the same semantics.  We don't want to
  * use -fno-builtin, so just hide the name ffs.
  */
-#define ffs kernel_ffs
+#define ffs(x) kernel_ffs(x)
 
 #include <asm-generic/bitops/fls.h>
 #include <asm-generic/bitops/__fls.h>
diff --git a/arch/ia64/kernel/uncached.c b/arch/ia64/kernel/uncached.c
index a96bcf83a735..20e8a9b21d75 100644
--- a/arch/ia64/kernel/uncached.c
+++ b/arch/ia64/kernel/uncached.c
@@ -98,7 +98,7 @@ static int uncached_add_chunk(struct uncached_pool *uc_pool, int nid)
         /* attempt to allocate a granule's worth of cached memory pages */
 
         page = alloc_pages_exact_node(nid,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                 IA64_GRANULE_SHIFT-PAGE_SHIFT);
         if (!page) {
                 mutex_unlock(&uc_pool->add_chunk_mutex);
diff --git a/arch/powerpc/platforms/cell/ras.c b/arch/powerpc/platforms/cell/ras.c
index 5ec1e47a0d77..e865d748179b 100644
--- a/arch/powerpc/platforms/cell/ras.c
+++ b/arch/powerpc/platforms/cell/ras.c
@@ -123,7 +123,8 @@ static int __init cbe_ptcal_enable_on_node(int nid, int order)
 
         area->nid = nid;
         area->order = order;
-        area->pages = alloc_pages_exact_node(area->nid, GFP_KERNEL|GFP_THISNODE,
+        area->pages = alloc_pages_exact_node(area->nid,
+                                                GFP_KERNEL|__GFP_THISNODE,
                                                 area->order);
 
         if (!area->pages) {
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index c026cca5602c..f3aaf231b4e5 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -341,10 +341,6 @@ config X86_USE_3DNOW
         def_bool y
         depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
 
-config X86_OOSTORE
-        def_bool y
-        depends on (MWINCHIP3D || MWINCHIPC6) && MTRR
-
 #
 # P6_NOPs are a relatively minor optimization that require a family >=
 # 6 processor, except that it is broken on certain VIA chips.
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 04a48903b2eb..69bbb4845020 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -85,11 +85,7 @@
 #else
 # define smp_rmb()      barrier()
 #endif
-#ifdef CONFIG_X86_OOSTORE
-# define smp_wmb()      wmb()
-#else
-# define smp_wmb()      barrier()
-#endif
+#define smp_wmb()       barrier()
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
 #else /* !SMP */
@@ -100,7 +96,7 @@
 #define set_mb(var, value) do { var = value; barrier(); } while (0)
 #endif /* SMP */
 
-#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+#if defined(CONFIG_X86_PPRO_FENCE)
 
 /*
  * For either of these options x86 doesn't have a strong TSO memory
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 34f69cb9350a..91d9c69a629e 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -237,7 +237,7 @@ memcpy_toio(volatile void __iomem *dst, const void *src, size_t count)
 
 static inline void flush_write_buffers(void)
 {
-#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+#if defined(CONFIG_X86_PPRO_FENCE)
         asm volatile("lock; addl $0,0(%%esp)": : :"memory");
 #endif
 }
diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index bf156ded74b5..0f62f5482d91 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -26,10 +26,9 @@
 # define LOCK_PTR_REG "D"
 #endif
 
-#if defined(CONFIG_X86_32) && \
-        (defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE))
+#if defined(CONFIG_X86_32) && (defined(CONFIG_X86_PPRO_FENCE))
 /*
- * On PPro SMP or if we are using OOSTORE, we use a locked operation to unlock
+ * On PPro SMP, we use a locked operation to unlock
  * (PPro errata 66, 92)
  */
 # define UNLOCK_LOCK_PREFIX LOCK_PREFIX
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index 8779edab684e..d8fba5c15fbd 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -8,236 +8,6 @@
 
 #include "cpu.h"
 
-#ifdef CONFIG_X86_OOSTORE
-
-static u32 power2(u32 x)
-{
-        u32 s = 1;
-
-        while (s <= x)
-                s <<= 1;
-
-        return s >>= 1;
-}
-
-
-/*
- * Set up an actual MCR
- */
-static void centaur_mcr_insert(int reg, u32 base, u32 size, int key)
-{
-        u32 lo, hi;
-
-        hi = base & ~0xFFF;
-        lo = ~(size-1);         /* Size is a power of 2 so this makes a mask */
-        lo &= ~0xFFF;           /* Remove the ctrl value bits */
-        lo |= key;              /* Attribute we wish to set */
-        wrmsr(reg+MSR_IDT_MCR0, lo, hi);
-        mtrr_centaur_report_mcr(reg, lo, hi);   /* Tell the mtrr driver */
-}
-
-/*
- * Figure what we can cover with MCR's
- *
- * Shortcut: We know you can't put 4Gig of RAM on a winchip
- */
-static u32 ramtop(void)
-{
-        u32 clip = 0xFFFFFFFFUL;
-        u32 top = 0;
-        int i;
-
-        for (i = 0; i < e820.nr_map; i++) {
-                unsigned long start, end;
-
-                if (e820.map[i].addr > 0xFFFFFFFFUL)
-                        continue;
-                /*
-                 * Don't MCR over reserved space. Ignore the ISA hole
-                 * we frob around that catastrophe already
-                 */
-                if (e820.map[i].type == E820_RESERVED) {
-                        if (e820.map[i].addr >= 0x100000UL &&
-                            e820.map[i].addr < clip)
-                                clip = e820.map[i].addr;
-                        continue;
-                }
-                start = e820.map[i].addr;
-                end = e820.map[i].addr + e820.map[i].size;
-                if (start >= end)
-                        continue;
-                if (end > top)
-                        top = end;
-        }
-        /*
-         * Everything below 'top' should be RAM except for the ISA hole.
-         * Because of the limited MCR's we want to map NV/ACPI into our
-         * MCR range for gunk in RAM
-         *
-         * Clip might cause us to MCR insufficient RAM but that is an
-         * acceptable failure mode and should only bite obscure boxes with
-         * a VESA hole at 15Mb
-         *
-         * The second case Clip sometimes kicks in is when the EBDA is marked
-         * as reserved. Again we fail safe with reasonable results
-         */
-        if (top > clip)
-                top = clip;
-
-        return top;
-}
-
-/*
- * Compute a set of MCR's to give maximum coverage
- */
-static int centaur_mcr_compute(int nr, int key)
-{
-        u32 mem = ramtop();
-        u32 root = power2(mem);
-        u32 base = root;
-        u32 top = root;
-        u32 floor = 0;
-        int ct = 0;
-
-        while (ct < nr) {
-                u32 fspace = 0;
-                u32 high;
-                u32 low;
-
-                /*
-                 * Find the largest block we will fill going upwards
-                 */
-                high = power2(mem-top);
-
-                /*
-                 * Find the largest block we will fill going downwards
-                 */
-                low = base/2;
-
-                /*
-                 * Don't fill below 1Mb going downwards as there
-                 * is an ISA hole in the way.
-                 */
-                if (base <= 1024*1024)
-                        low = 0;
-
-                /*
-                 * See how much space we could cover by filling below
-                 * the ISA hole
-                 */
-
-                if (floor == 0)
-                        fspace = 512*1024;
-                else if (floor == 512*1024)
-                        fspace = 128*1024;
-
-                /* And forget ROM space */
-
-                /*
-                 * Now install the largest coverage we get
-                 */
-                if (fspace > high && fspace > low) {
-                        centaur_mcr_insert(ct, floor, fspace, key);
-                        floor += fspace;
-                } else if (high > low) {
-                        centaur_mcr_insert(ct, top, high, key);
-                        top += high;
-                } else if (low > 0) {
-                        base -= low;
-                        centaur_mcr_insert(ct, base, low, key);
-                } else
-                        break;
-                ct++;
-        }
-        /*
-         * We loaded ct values. We now need to set the mask. The caller
-         * must do this bit.
-         */
-        return ct;
-}
-
-static void centaur_create_optimal_mcr(void)
-{
-        int used;
-        int i;
-
-        /*
-         * Allocate up to 6 mcrs to mark as much of ram as possible
-         * as write combining and weak write ordered.
-         *
-         * To experiment with: Linux never uses stack operations for
-         * mmio spaces so we could globally enable stack operation wc
-         *
-         * Load the registers with type 31 - full write combining, all
-         * writes weakly ordered.
-         */
-        used = centaur_mcr_compute(6, 31);
-
-        /*
-         * Wipe unused MCRs
-         */
-        for (i = used; i < 8; i++)
-                wrmsr(MSR_IDT_MCR0+i, 0, 0);
-}
-
-static void winchip2_create_optimal_mcr(void)
-{
-        u32 lo, hi;
-        int used;
-        int i;
-
-        /*
-         * Allocate up to 6 mcrs to mark as much of ram as possible
-         * as write combining, weak store ordered.
-         *
-         * Load the registers with type 25
-         *      8       -       weak write ordering
-         *      16      -       weak read ordering
-         *      1       -       write combining
-         */
-        used = centaur_mcr_compute(6, 25);
-
-        /*
-         * Mark the registers we are using.
-         */
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        for (i = 0; i < used; i++)
-                lo |= 1<<(9+i);
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-
-        /*
-         * Wipe unused MCRs
-         */
-
-        for (i = used; i < 8; i++)
-                wrmsr(MSR_IDT_MCR0+i, 0, 0);
-}
-
-/*
- * Handle the MCR key on the Winchip 2.
- */
-static void winchip2_unprotect_mcr(void)
-{
-        u32 lo, hi;
-        u32 key;
-
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        lo &= ~0x1C0;   /* blank bits 8-6 */
-        key = (lo>>17) & 7;
-        lo |= key<<6;   /* replace with unlock key */
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-}
-
-static void winchip2_protect_mcr(void)
-{
-        u32 lo, hi;
-
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        lo &= ~0x1C0;   /* blank bits 8-6 */
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-}
-#endif /* CONFIG_X86_OOSTORE */
-
 #define ACE_PRESENT     (1 << 6)
 #define ACE_ENABLED     (1 << 7)
 #define ACE_FCR         (1 << 28)       /* MSR_VIA_FCR */
@@ -362,20 +132,6 @@ static void init_centaur(struct cpuinfo_x86 *c)
                         fcr_clr = DPDC;
                         printk(KERN_NOTICE "Disabling bugged TSC.\n");
                         clear_cpu_cap(c, X86_FEATURE_TSC);
-#ifdef CONFIG_X86_OOSTORE
-                        centaur_create_optimal_mcr();
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         *
-                         * The C6 original lacks weak read order
-                         *
-                         * Note 0x120 is write only on Winchip 1
-                         */
-                        wrmsr(MSR_IDT_MCR_CTRL, 0x01F0001F, 0);
-#endif
                         break;
                 case 8:
                         switch (c->x86_mask) {
@@ -392,40 +148,12 @@ static void init_centaur(struct cpuinfo_x86 *c)
                         fcr_set = ECX8|DSMC|DTLOCK|EMMX|EBRPRED|ERETSTK|
                                   E2MMX|EAMD3D;
                         fcr_clr = DPDC;
-#ifdef CONFIG_X86_OOSTORE
-                        winchip2_unprotect_mcr();
-                        winchip2_create_optimal_mcr();
-                        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         */
-                        lo |= 31;
-                        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        winchip2_protect_mcr();
-#endif
                         break;
                 case 9:
                         name = "3";
                         fcr_set = ECX8|DSMC|DTLOCK|EMMX|EBRPRED|ERETSTK|
                                   E2MMX|EAMD3D;
                         fcr_clr = DPDC;
-#ifdef CONFIG_X86_OOSTORE
-                        winchip2_unprotect_mcr();
-                        winchip2_create_optimal_mcr();
-                        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         */
-                        lo |= 31;
-                        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        winchip2_protect_mcr();
-#endif
                         break;
                 default:
                         name = "??";
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index c88f7f4b03ee..047f540cf3f7 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -3334,6 +3334,8 @@ static int __init uncore_type_init(struct intel_uncore_type *type)
         if (!pmus)
                 return -ENOMEM;
 
+        type->pmus = pmus;
+
         type->unconstrainted = (struct event_constraint)
                 __EVENT_CONSTRAINT(0, (1ULL << type->num_counters) - 1,
                                 0, type->num_counters, 0, 0);
@@ -3369,7 +3371,6 @@ static int __init uncore_type_init(struct intel_uncore_type *type)
         }
 
         type->pmu_group = &uncore_pmu_attr_group;
-        type->pmus = pmus;
         return 0;
 fail:
         uncore_type_exit(type);
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index e8368c6dd2a2..d5dd80814419 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -86,10 +86,19 @@ EXPORT_SYMBOL(__kernel_fpu_begin);
 
 void __kernel_fpu_end(void)
 {
-        if (use_eager_fpu())
-                math_state_restore();
-        else
+        if (use_eager_fpu()) {
+                /*
+                 * For eager fpu, most the time, tsk_used_math() is true.
+                 * Restore the user math as we are done with the kernel usage.
+                 * At few instances during thread exit, signal handling etc,
+                 * tsk_used_math() is false. Those few places will take proper
+                 * actions, so we don't need to restore the math here.
+                 */
+                if (likely(tsk_used_math(current)))
+                        math_state_restore();
+        } else {
                 stts();
+        }
 }
 EXPORT_SYMBOL(__kernel_fpu_end);
 
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index 7c6acd4b8995..ff898bbf579d 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -529,7 +529,7 @@ static void quirk_amd_nb_node(struct pci_dev *dev)
                 return;
 
         pci_read_config_dword(nb_ht, 0x60, &val);
-        node = val & 7;
+        node = pcibus_to_node(dev->bus) | (val & 7);
         /*
          * Some hardware may return an invalid node ID,
          * so check it first:
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index e81df8fce027..2de1bc09a8d4 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3002,10 +3002,8 @@ static int cr8_write_interception(struct vcpu_svm *svm)
         u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
         /* instruction emulation calls kvm_set_cr8() */
         r = cr_interception(svm);
-        if (irqchip_in_kernel(svm->vcpu.kvm)) {
-                clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
+        if (irqchip_in_kernel(svm->vcpu.kvm))
                 return r;
-        }
         if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
                 return r;
         kvm_run->exit_reason = KVM_EXIT_SET_TPR;
@@ -3567,6 +3565,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
         if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
                 return;
 
+        clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
+
         if (irr == -1)
                 return;
 
diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
index 877b9a1b2152..01495755701b 100644
--- a/arch/x86/net/bpf_jit.S
+++ b/arch/x86/net/bpf_jit.S
@@ -140,7 +140,7 @@ bpf_slow_path_byte_msh:
         push    %r9;                                            \
         push    SKBDATA;                                        \
 /* rsi already has offset */                                    \
-        mov     $SIZE,%ecx;     /* size */                      \
+        mov     $SIZE,%edx;     /* size */                      \
         call    bpf_internal_load_pointer_neg_helper;           \
         test    %rax,%rax;                                      \
         pop     SKBDATA;                                        \
diff --git a/arch/x86/um/asm/barrier.h b/arch/x86/um/asm/barrier.h
index 7d01b8c56c00..cc04e67bfd05 100644
--- a/arch/x86/um/asm/barrier.h
+++ b/arch/x86/um/asm/barrier.h
@@ -40,11 +40,7 @@
 #define smp_rmb()       barrier()
 #endif /* CONFIG_X86_PPRO_FENCE */
 
-#ifdef CONFIG_X86_OOSTORE
-#define smp_wmb()       wmb()
-#else /* CONFIG_X86_OOSTORE */
 #define smp_wmb()       barrier()
-#endif /* CONFIG_X86_OOSTORE */
 
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index b718806657cd..c40fb2e81bbc 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -71,6 +71,17 @@ static int acpi_sleep_prepare(u32 acpi_state)
         return 0;
 }
 
+static bool acpi_sleep_state_supported(u8 sleep_state)
+{
+        acpi_status status;
+        u8 type_a, type_b;
+
+        status = acpi_get_sleep_type_data(sleep_state, &type_a, &type_b);
+        return ACPI_SUCCESS(status) && (!acpi_gbl_reduced_hardware
+                || (acpi_gbl_FADT.sleep_control.address
+                        && acpi_gbl_FADT.sleep_status.address));
+}
+
 #ifdef CONFIG_ACPI_SLEEP
 static u32 acpi_target_sleep_state = ACPI_STATE_S0;
 
@@ -604,15 +615,9 @@ static void acpi_sleep_suspend_setup(void)
 {
         int i;
 
-        for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++) {
-                acpi_status status;
-                u8 type_a, type_b;
-
-                status = acpi_get_sleep_type_data(i, &type_a, &type_b);
-                if (ACPI_SUCCESS(status)) {
+        for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++)
+                if (acpi_sleep_state_supported(i))
                         sleep_states[i] = 1;
-                }
-        }
 
         suspend_set_ops(old_suspend_ordering ?
                 &acpi_suspend_ops_old : &acpi_suspend_ops);
@@ -740,11 +745,7 @@ static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
 
 static void acpi_sleep_hibernate_setup(void)
 {
-        acpi_status status;
-        u8 type_a, type_b;
-
-        status = acpi_get_sleep_type_data(ACPI_STATE_S4, &type_a, &type_b);
-        if (ACPI_FAILURE(status))
+        if (!acpi_sleep_state_supported(ACPI_STATE_S4))
                 return;
 
         hibernation_set_ops(old_suspend_ordering ?
@@ -793,8 +794,6 @@ static void acpi_power_off(void)
 
 int __init acpi_sleep_init(void)
 {
-        acpi_status status;
-        u8 type_a, type_b;
         char supported[ACPI_S_STATE_COUNT * 3 + 1];
         char *pos = supported;
         int i;
@@ -806,8 +805,7 @@ int __init acpi_sleep_init(void)
         acpi_sleep_suspend_setup();
         acpi_sleep_hibernate_setup();
 
-        status = acpi_get_sleep_type_data(ACPI_STATE_S5, &type_a, &type_b);
-        if (ACPI_SUCCESS(status)) {
+        if (acpi_sleep_state_supported(ACPI_STATE_S5)) {
                 sleep_states[ACPI_STATE_S5] = 1;
                 pm_power_off_prepare = acpi_power_off_prepare;
                 pm_power_off = acpi_power_off;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 65d3f1b5966c..8cb2522d592a 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4225,8 +4225,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
 
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD3",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
 
         /*
          * Some WD SATA-I drives spin up and down erratically when the link
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index cf485d928903..199b52b7c3e1 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1129,7 +1129,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 per_cpu(cpufreq_cpu_data, j) = policy;
         write_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
-        if (cpufreq_driver->get) {
+        if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
                 policy->cur = cpufreq_driver->get(policy->cpu);
                 if (!policy->cur) {
                         pr_err("%s: ->get() failed\n", __func__);
@@ -2143,7 +2143,7 @@ int cpufreq_update_policy(unsigned int cpu)
          * BIOS might change freq behind our back
          * -> ask driver for current freq and notify governors about a change
          */
-        if (cpufreq_driver->get) {
+        if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
                 new_policy.cur = cpufreq_driver->get(cpu);
                 if (!policy->cur) {
                         pr_debug("Driver did not initialize current freq");
diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c
index 4ea9b17ac17a..b8246227bab0 100644
--- a/drivers/gpu/drm/ast/ast_ttm.c
+++ b/drivers/gpu/drm/ast/ast_ttm.c
@@ -259,7 +259,9 @@ int ast_mm_init(struct ast_private *ast)
 
         ret = ttm_bo_device_init(&ast->ttm.bdev,
                                  ast->ttm.bo_global_ref.ref.object,
-                                 &ast_bo_driver, DRM_FILE_PAGE_OFFSET,
+                                 &ast_bo_driver,
+                                 dev->anon_inode->i_mapping,
+                                 DRM_FILE_PAGE_OFFSET,
                                  true);
         if (ret) {
                 DRM_ERROR("Error initialising bo driver; %d\n", ret);
@@ -324,7 +326,6 @@ int ast_bo_create(struct drm_device *dev, int size, int align,
         }
 
         astbo->bo.bdev = &ast->ttm.bdev;
-        astbo->bo.bdev->dev_mapping = dev->dev_mapping;
 
         ast_ttm_placement(astbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
 
diff --git a/drivers/gpu/drm/bochs/bochs_mm.c b/drivers/gpu/drm/bochs/bochs_mm.c
index ce6858765b37..f488be55d650 100644
--- a/drivers/gpu/drm/bochs/bochs_mm.c
+++ b/drivers/gpu/drm/bochs/bochs_mm.c
@@ -225,7 +225,9 @@ int bochs_mm_init(struct bochs_device *bochs)
 
         ret = ttm_bo_device_init(&bochs->ttm.bdev,
                                  bochs->ttm.bo_global_ref.ref.object,
-                                 &bochs_bo_driver, DRM_FILE_PAGE_OFFSET,
+                                 &bochs_bo_driver,
+                                 bochs->dev->anon_inode->i_mapping,
+                                 DRM_FILE_PAGE_OFFSET,
                                  true);
         if (ret) {
                 DRM_ERROR("Error initialising bo driver; %d\n", ret);
@@ -359,7 +361,7 @@ static int bochs_bo_create(struct drm_device *dev, int size, int align,
         }
 
         bochsbo->bo.bdev = &bochs->ttm.bdev;
-        bochsbo->bo.bdev->dev_mapping = dev->dev_mapping;
+        bochsbo->bo.bdev->dev_mapping = dev->anon_inode->i_mapping;
 
         bochs_ttm_placement(bochsbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
 
diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c
index 8b37c25ff9bd..92e6b7786097 100644
--- a/drivers/gpu/drm/cirrus/cirrus_ttm.c
+++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c
@@ -259,7 +259,9 @@ int cirrus_mm_init(struct cirrus_device *cirrus)
 
         ret = ttm_bo_device_init(&cirrus->ttm.bdev,
                                  cirrus->ttm.bo_global_ref.ref.object,
-                                 &cirrus_bo_driver, DRM_FILE_PAGE_OFFSET,
+                                 &cirrus_bo_driver,
+                                 dev->anon_inode->i_mapping,
+                                 DRM_FILE_PAGE_OFFSET,
                                  true);
         if (ret) {
                 DRM_ERROR("Error initialising bo driver; %d\n", ret);
@@ -329,7 +331,6 @@ int cirrus_bo_create(struct drm_device *dev, int size, int align,
         }
 
         cirrusbo->bo.bdev = &cirrus->ttm.bdev;
-        cirrusbo->bo.bdev->dev_mapping = dev->dev_mapping;
 
         cirrus_ttm_placement(cirrusbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
 
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 35ea15d5ffff..16ca28ed5ee8 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -38,12 +38,15 @@
 #include <drm/drm_edid.h>
 #include <drm/drm_fourcc.h>
 
+#include "drm_crtc_internal.h"
+
 /**
  * drm_modeset_lock_all - take all modeset locks
  * @dev: drm device
  *
  * This function takes all modeset locks, suitable where a more fine-grained
- * scheme isn't (yet) implemented.
+ * scheme isn't (yet) implemented. Locks must be dropped with
+ * drm_modeset_unlock_all.
  */
 void drm_modeset_lock_all(struct drm_device *dev)
 {
@@ -59,6 +62,8 @@ EXPORT_SYMBOL(drm_modeset_lock_all);
 /**
  * drm_modeset_unlock_all - drop all modeset locks
  * @dev: device
+ *
+ * This function drop all modeset locks taken by drm_modeset_lock_all.
  */
 void drm_modeset_unlock_all(struct drm_device *dev)
 {
@@ -74,6 +79,8 @@ EXPORT_SYMBOL(drm_modeset_unlock_all);
 /**
  * drm_warn_on_modeset_not_all_locked - check that all modeset locks are locked
  * @dev: device
+ *
+ * Useful as a debug assert.
  */
 void drm_warn_on_modeset_not_all_locked(struct drm_device *dev)
 {
@@ -241,6 +248,15 @@ void drm_connector_ida_destroy(void)
                 ida_destroy(&drm_connector_enum_list[i].ida);
 }
 
+/**
+ * drm_get_encoder_name - return a string for encoder
+ * @encoder: encoder to compute name of
+ *
+ * Note that the buffer used by this function is globally shared and owned by
+ * the function itself.
+ *
+ * FIXME: This isn't really multithreading safe.
+ */
 const char *drm_get_encoder_name(const struct drm_encoder *encoder)
 {
         static char buf[32];
@@ -252,6 +268,15 @@ const char *drm_get_encoder_name(const struct drm_encoder *encoder)
 }
 EXPORT_SYMBOL(drm_get_encoder_name);
 
+/**
+ * drm_get_connector_name - return a string for connector
+ * @connector: connector to compute name of
+ *
+ * Note that the buffer used by this function is globally shared and owned by
+ * the function itself.
+ *
+ * FIXME: This isn't really multithreading safe.
+ */
 const char *drm_get_connector_name(const struct drm_connector *connector)
 {
         static char buf[32];
@@ -263,6 +288,13 @@ const char *drm_get_connector_name(const struct drm_connector *connector)
 }
 EXPORT_SYMBOL(drm_get_connector_name);
 
+/**
+ * drm_get_connector_status_name - return a string for connector status
+ * @status: connector status to compute name of
+ *
+ * In contrast to the other drm_get_*_name functions this one here returns a
+ * const pointer and hence is threadsafe.
+ */
 const char *drm_get_connector_status_name(enum drm_connector_status status)
 {
         if (status == connector_status_connected)
@@ -292,6 +324,15 @@ static char printable_char(int c)
         return isascii(c) && isprint(c) ? c : '?';
 }
 
+/**
+ * drm_get_format_name - return a string for drm fourcc format
+ * @format: format to compute name of
+ *
+ * Note that the buffer used by this function is globally shared and owned by
+ * the function itself.
+ *
+ * FIXME: This isn't really multithreading safe.
+ */
 const char *drm_get_format_name(uint32_t format)
 {
         static char buf[32];
@@ -316,14 +357,16 @@ EXPORT_SYMBOL(drm_get_format_name);
  * @obj_type: object type
  *
  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
- * for tracking modes, CRTCs and connectors.
+ * for tracking modes, CRTCs and connectors. Note that despite the _get postfix
+ * modeset identifiers are _not_ reference counted. Hence don't use this for
+ * reference counted modeset objects like framebuffers.
  *
- * RETURNS:
+ * Returns:
  * New unique (relative to other objects in @dev) integer identifier for the
  * object.
  */
-static int drm_mode_object_get(struct drm_device *dev,
-                               struct drm_mode_object *obj, uint32_t obj_type)
+int drm_mode_object_get(struct drm_device *dev,
+                        struct drm_mode_object *obj, uint32_t obj_type)
 {
         int ret;
 
@@ -347,10 +390,12 @@ static int drm_mode_object_get(struct drm_device *dev,
  * @dev: DRM device
  * @object: object to free
  *
- * Free @id from @dev's unique identifier pool.
+ * Free @id from @dev's unique identifier pool. Note that despite the _get
+ * postfix modeset identifiers are _not_ reference counted. Hence don't use this
+ * for reference counted modeset objects like framebuffers.
  */
-static void drm_mode_object_put(struct drm_device *dev,
-                                struct drm_mode_object *object)
+void drm_mode_object_put(struct drm_device *dev,
+                         struct drm_mode_object *object)
 {
         mutex_lock(&dev->mode_config.idr_mutex);
         idr_remove(&dev->mode_config.crtc_idr, object->id);
@@ -400,7 +445,7 @@ EXPORT_SYMBOL(drm_mode_object_find);
  * since all the fb attributes are invariant over its lifetime, no further
  * locking but only correct reference counting is required.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, error code on failure.
  */
 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
@@ -461,7 +506,7 @@ static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
  *
  * If successful, this grabs an additional reference to the framebuffer -
  * callers need to make sure to eventually unreference the returned framebuffer
- * again.
+ * again, using @drm_framebuffer_unreference.
  */
 struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
                                                uint32_t id)
@@ -494,6 +539,8 @@ EXPORT_SYMBOL(drm_framebuffer_unreference);
 /**
  * drm_framebuffer_reference - incr the fb refcnt
  * @fb: framebuffer
+ *
+ * This functions increments the fb's refcount.
  */
 void drm_framebuffer_reference(struct drm_framebuffer *fb)
 {
@@ -550,8 +597,9 @@ EXPORT_SYMBOL(drm_framebuffer_unregister_private);
  * drm_framebuffer_cleanup - remove a framebuffer object
  * @fb: framebuffer to remove
  *
- * Cleanup references to a user-created framebuffer. This function is intended
- * to be used from the drivers ->destroy callback.
+ * Cleanup framebuffer. This function is intended to be used from the drivers
+ * ->destroy callback. It can also be used to clean up driver private
+ *  framebuffers embedded into a larger structure.
  *
  * Note that this function does not remove the fb from active usuage - if it is
  * still used anywhere, hilarity can ensue since userspace could call getfb on
@@ -644,7 +692,7 @@ EXPORT_SYMBOL(drm_framebuffer_remove);
  *
  * Inits a new object created as base part of a driver crtc object.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, error code on failure.
  */
 int drm_crtc_init(struct drm_device *dev, struct drm_crtc *crtc,
@@ -720,20 +768,6 @@ unsigned int drm_crtc_index(struct drm_crtc *crtc)
 }
 EXPORT_SYMBOL(drm_crtc_index);
 
-/**
- * drm_mode_probed_add - add a mode to a connector's probed mode list
- * @connector: connector the new mode
- * @mode: mode data
- *
- * Add @mode to @connector's mode list for later use.
- */
-void drm_mode_probed_add(struct drm_connector *connector,
-                         struct drm_display_mode *mode)
-{
-        list_add_tail(&mode->head, &connector->probed_modes);
-}
-EXPORT_SYMBOL(drm_mode_probed_add);
-
 /*
  * drm_mode_remove - remove and free a mode
  * @connector: connector list to modify
@@ -758,7 +792,7 @@ static void drm_mode_remove(struct drm_connector *connector,
  * Initialises a preallocated connector. Connectors should be
  * subclassed as part of driver connector objects.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, error code on failure.
  */
 int drm_connector_init(struct drm_device *dev,
@@ -836,6 +870,14 @@ void drm_connector_cleanup(struct drm_connector *connector)
 }
 EXPORT_SYMBOL(drm_connector_cleanup);
 
+/**
+ * drm_connector_unplug_all - unregister connector userspace interfaces
+ * @dev: drm device
+ *
+ * This function unregisters all connector userspace interfaces in sysfs. Should
+ * be call when the device is disconnected, e.g. from an usb driver's
+ * ->disconnect callback.
+ */
 void drm_connector_unplug_all(struct drm_device *dev)
 {
         struct drm_connector *connector;
@@ -847,6 +889,18 @@ void drm_connector_unplug_all(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_connector_unplug_all);
 
+/**
+ * drm_bridge_init - initialize a drm transcoder/bridge
+ * @dev: drm device
+ * @bridge: transcoder/bridge to set up
+ * @funcs: bridge function table
+ *
+ * Initialises a preallocated bridge. Bridges should be
+ * subclassed as part of driver connector objects.
+ *
+ * Returns:
+ * Zero on success, error code on failure.
+ */
 int drm_bridge_init(struct drm_device *dev, struct drm_bridge *bridge,
                 const struct drm_bridge_funcs *funcs)
 {
@@ -870,6 +924,12 @@ int drm_bridge_init(struct drm_device *dev, struct drm_bridge *bridge,
 }
 EXPORT_SYMBOL(drm_bridge_init);
 
+/**
+ * drm_bridge_cleanup - cleans up an initialised bridge
+ * @bridge: bridge to cleanup
+ *
+ * Cleans up the bridge but doesn't free the object.
+ */
 void drm_bridge_cleanup(struct drm_bridge *bridge)
 {
         struct drm_device *dev = bridge->dev;
@@ -882,6 +942,19 @@ void drm_bridge_cleanup(struct drm_bridge *bridge)
 }
 EXPORT_SYMBOL(drm_bridge_cleanup);
 
+/**
+ * drm_encoder_init - Init a preallocated encoder
+ * @dev: drm device
+ * @encoder: the encoder to init
+ * @funcs: callbacks for this encoder
+ * @encoder_type: user visible type of the encoder
+ *
+ * Initialises a preallocated encoder. Encoder should be
+ * subclassed as part of driver encoder objects.
+ *
+ * Returns:
+ * Zero on success, error code on failure.
+ */
 int drm_encoder_init(struct drm_device *dev,
                       struct drm_encoder *encoder,
                       const struct drm_encoder_funcs *funcs,
@@ -909,6 +982,12 @@ int drm_encoder_init(struct drm_device *dev,
 }
 EXPORT_SYMBOL(drm_encoder_init);
 
+/**
+ * drm_encoder_cleanup - cleans up an initialised encoder
+ * @encoder: encoder to cleanup
+ *
+ * Cleans up the encoder but doesn't free the object.
+ */
 void drm_encoder_cleanup(struct drm_encoder *encoder)
 {
         struct drm_device *dev = encoder->dev;
@@ -930,9 +1009,10 @@ EXPORT_SYMBOL(drm_encoder_cleanup);
  * @format_count: number of elements in @formats
  * @priv: plane is private (hidden from userspace)?
  *
- * Inits a new object created as base part of a driver plane object.
+ * Inits a preallocate plane object created as base part of a driver plane
+ * object.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, error code on failure.
  */
 int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
@@ -1033,50 +1113,6 @@ void drm_plane_force_disable(struct drm_plane *plane)
 }
 EXPORT_SYMBOL(drm_plane_force_disable);
 
-/**
- * drm_mode_create - create a new display mode
- * @dev: DRM device
- *
- * Create a new drm_display_mode, give it an ID, and return it.
- *
- * RETURNS:
- * Pointer to new mode on success, NULL on error.
- */
-struct drm_display_mode *drm_mode_create(struct drm_device *dev)
-{
-        struct drm_display_mode *nmode;
-
-        nmode = kzalloc(sizeof(struct drm_display_mode), GFP_KERNEL);
-        if (!nmode)
-                return NULL;
-
-        if (drm_mode_object_get(dev, &nmode->base, DRM_MODE_OBJECT_MODE)) {
-                kfree(nmode);
-                return NULL;
-        }
-
-        return nmode;
-}
-EXPORT_SYMBOL(drm_mode_create);
-
-/**
- * drm_mode_destroy - remove a mode
- * @dev: DRM device
- * @mode: mode to remove
- *
- * Free @mode's unique identifier, then free it.
- */
-void drm_mode_destroy(struct drm_device *dev, struct drm_display_mode *mode)
-{
-        if (!mode)
-                return;
-
-        drm_mode_object_put(dev, &mode->base);
-
-        kfree(mode);
-}
-EXPORT_SYMBOL(drm_mode_destroy);
-
 static int drm_mode_create_standard_connector_properties(struct drm_device *dev)
 {
         struct drm_property *edid;
@@ -1280,6 +1316,10 @@ static int drm_mode_group_init(struct drm_device *dev, struct drm_mode_group *gr
         return 0;
 }
 
+/*
+ * NOTE: Driver's shouldn't ever call drm_mode_group_init_legacy_group - it is
+ * the drm core's responsibility to set up mode control groups.
+ */
 int drm_mode_group_init_legacy_group(struct drm_device *dev,
                                      struct drm_mode_group *group)
 {
@@ -1356,7 +1396,7 @@ static void drm_crtc_convert_to_umode(struct drm_mode_modeinfo *out,
  * Convert a drm_mode_modeinfo into a drm_display_mode structure to return to
  * the caller.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 static int drm_crtc_convert_umode(struct drm_display_mode *out,
@@ -1399,7 +1439,7 @@ static int drm_crtc_convert_umode(struct drm_display_mode *out,
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 int drm_mode_getresources(struct drm_device *dev, void *data,
@@ -1584,7 +1624,7 @@ out:
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 int drm_mode_getcrtc(struct drm_device *dev,
@@ -1653,7 +1693,7 @@ static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 int drm_mode_getconnector(struct drm_device *dev, void *data,
@@ -1788,6 +1828,19 @@ out:
         return ret;
 }
 
+/**
+ * drm_mode_getencoder - get encoder configuration
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
+ *
+ * Construct a encoder configuration structure to return to the user.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_getencoder(struct drm_device *dev, void *data,
                         struct drm_file *file_priv)
 {
@@ -1823,15 +1876,20 @@ out:
 }
 
 /**
- * drm_mode_getplane_res - get plane info
+ * drm_mode_getplane_res - enumerate all plane resources
  * @dev: DRM device
  * @data: ioctl data
  * @file_priv: DRM file info
  *
- * Return an plane count and set of IDs.
+ * Construct a list of plane ids to return to the user.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
  */
 int drm_mode_getplane_res(struct drm_device *dev, void *data,
-                            struct drm_file *file_priv)
+                          struct drm_file *file_priv)
 {
         struct drm_mode_get_plane_res *plane_resp = data;
         struct drm_mode_config *config;
@@ -1869,16 +1927,20 @@ out:
 }
 
 /**
- * drm_mode_getplane - get plane info
+ * drm_mode_getplane - get plane configuration
  * @dev: DRM device
  * @data: ioctl data
  * @file_priv: DRM file info
  *
- * Return plane info, including formats supported, gamma size, any
- * current fb, etc.
+ * Construct a plane configuration structure to return to the user.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
  */
 int drm_mode_getplane(struct drm_device *dev, void *data,
-                        struct drm_file *file_priv)
+                      struct drm_file *file_priv)
 {
         struct drm_mode_get_plane *plane_resp = data;
         struct drm_mode_object *obj;
@@ -1934,16 +1996,19 @@ out:
 }
 
 /**
- * drm_mode_setplane - set up or tear down an plane
+ * drm_mode_setplane - configure a plane's configuration
  * @dev: DRM device
  * @data: ioctl data*
  * @file_priv: DRM file info
  *
- * Set plane info, including placement, fb, scaling, and other factors.
+ * Set plane configuration, including placement, fb, scaling, and other factors.
  * Or pass a NULL fb to disable.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
  */
 int drm_mode_setplane(struct drm_device *dev, void *data,
-                        struct drm_file *file_priv)
+                      struct drm_file *file_priv)
 {
         struct drm_mode_set_plane *plane_req = data;
         struct drm_mode_object *obj;
@@ -2073,6 +2138,9 @@ out:
  *
  * This is a little helper to wrap internal calls to the ->set_config driver
  * interface. The only thing it adds is correct refcounting dance.
+ * 
+ * Returns:
+ * Zero on success, errno on failure.
  */
 int drm_mode_set_config_internal(struct drm_mode_set *set)
 {
@@ -2157,7 +2225,7 @@ static int drm_crtc_check_viewport(const struct drm_crtc *crtc,
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 int drm_mode_setcrtc(struct drm_device *dev, void *data,
@@ -2359,8 +2427,23 @@ out:
         return ret;
 
 }
+
+
+/**
+ * drm_mode_cursor_ioctl - set CRTC's cursor configuration
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
+ *
+ * Set the cursor configuration based on user request.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_cursor_ioctl(struct drm_device *dev,
-                        void *data, struct drm_file *file_priv)
+                          void *data, struct drm_file *file_priv)
 {
         struct drm_mode_cursor *req = data;
         struct drm_mode_cursor2 new_req;
@@ -2371,6 +2454,21 @@ int drm_mode_cursor_ioctl(struct drm_device *dev,
         return drm_mode_cursor_common(dev, &new_req, file_priv);
 }
 
+/**
+ * drm_mode_cursor2_ioctl - set CRTC's cursor configuration
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
+ *
+ * Set the cursor configuration based on user request. This implements the 2nd
+ * version of the cursor ioctl, which allows userspace to additionally specify
+ * the hotspot of the pointer.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_cursor2_ioctl(struct drm_device *dev,
                            void *data, struct drm_file *file_priv)
 {
@@ -2378,7 +2476,14 @@ int drm_mode_cursor2_ioctl(struct drm_device *dev,
         return drm_mode_cursor_common(dev, req, file_priv);
 }
 
-/* Original addfb only supported RGB formats, so figure out which one */
+/**
+ * drm_mode_legacy_fb_format - compute drm fourcc code from legacy description
+ * @bpp: bits per pixels
+ * @depth: bit depth per pixel
+ *
+ * Computes a drm fourcc pixel format code for the given @bpp/@depth values.
+ * Useful in fbdev emulation code, since that deals in those values.
+ */
 uint32_t drm_mode_legacy_fb_format(uint32_t bpp, uint32_t depth)
 {
         uint32_t fmt;
@@ -2420,11 +2525,12 @@ EXPORT_SYMBOL(drm_mode_legacy_fb_format);
  * @data: data pointer for the ioctl
  * @file_priv: drm file for the ioctl call
  *
- * Add a new FB to the specified CRTC, given a user request.
+ * Add a new FB to the specified CRTC, given a user request. This is the
+ * original addfb ioclt which only supported RGB formats.
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 int drm_mode_addfb(struct drm_device *dev,
@@ -2597,11 +2703,13 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
  * @data: data pointer for the ioctl
  * @file_priv: drm file for the ioctl call
  *
- * Add a new FB to the specified CRTC, given a user request with format.
+ * Add a new FB to the specified CRTC, given a user request with format. This is
+ * the 2nd version of the addfb ioctl, which supports multi-planar framebuffers
+ * and uses fourcc codes as pixel format specifiers.
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 int drm_mode_addfb2(struct drm_device *dev,
@@ -2661,7 +2769,7 @@ int drm_mode_addfb2(struct drm_device *dev,
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 int drm_mode_rmfb(struct drm_device *dev,
@@ -2715,7 +2823,7 @@ fail_lookup:
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 int drm_mode_getfb(struct drm_device *dev,
@@ -2759,6 +2867,25 @@ int drm_mode_getfb(struct drm_device *dev,
         return ret;
 }
 
+/**
+ * drm_mode_dirtyfb_ioctl - flush frontbuffer rendering on an FB
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
+ *
+ * Lookup the FB and flush out the damaged area supplied by userspace as a clip
+ * rectangle list. Generic userspace which does frontbuffer rendering must call
+ * this ioctl to flush out the changes on manual-update display outputs, e.g.
+ * usb display-link, mipi manual update panels or edp panel self refresh modes.
+ *
+ * Modesetting drivers which always update the frontbuffer do not need to
+ * implement the corresponding ->dirty framebuffer callback.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
                            void *data, struct drm_file *file_priv)
 {
@@ -2836,7 +2963,7 @@ out_err1:
  *
  * Called by the user via ioctl.
  *
- * RETURNS:
+ * Returns:
  * Zero on success, errno on failure.
  */
 void drm_fb_release(struct drm_file *priv)
@@ -2860,6 +2987,20 @@ void drm_fb_release(struct drm_file *priv)
         mutex_unlock(&priv->fbs_lock);
 }
 
+/**
+ * drm_property_create - create a new property type
+ * @dev: drm device
+ * @flags: flags specifying the property type
+ * @name: name of the property
+ * @num_values: number of pre-defined values
+ *
+ * This creates a new generic drm property which can then be attached to a drm
+ * object with drm_object_attach_property. The returned property object must be
+ * freed with drm_property_destroy.
+ *
+ * Returns:
+ * A pointer to the newly created property on success, NULL on failure.
+ */
 struct drm_property *drm_property_create(struct drm_device *dev, int flags,
                                          const char *name, int num_values)
 {
@@ -2898,6 +3039,24 @@ fail:
 }
 EXPORT_SYMBOL(drm_property_create);
 
+/**
+ * drm_property_create - create a new enumeration property type
+ * @dev: drm device
+ * @flags: flags specifying the property type
+ * @name: name of the property
+ * @props: enumeration lists with property values
+ * @num_values: number of pre-defined values
+ *
+ * This creates a new generic drm property which can then be attached to a drm
+ * object with drm_object_attach_property. The returned property object must be
+ * freed with drm_property_destroy.
+ *
+ * Userspace is only allowed to set one of the predefined values for enumeration
+ * properties.
+ *
+ * Returns:
+ * A pointer to the newly created property on success, NULL on failure.
+ */
 struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
                                          const char *name,
                                          const struct drm_prop_enum_list *props,
@@ -2926,6 +3085,24 @@ struct drm_property *drm_property_create_enum(struct drm_device *dev, int flags,
 }
 EXPORT_SYMBOL(drm_property_create_enum);
 
+/**
+ * drm_property_create - create a new bitmask property type
+ * @dev: drm device
+ * @flags: flags specifying the property type
+ * @name: name of the property
+ * @props: enumeration lists with property bitflags
+ * @num_values: number of pre-defined values
+ *
+ * This creates a new generic drm property which can then be attached to a drm
+ * object with drm_object_attach_property. The returned property object must be
+ * freed with drm_property_destroy.
+ *
+ * Compared to plain enumeration properties userspace is allowed to set any
+ * or'ed together combination of the predefined property bitflag values
+ *
+ * Returns:
+ * A pointer to the newly created property on success, NULL on failure.
+ */
 struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
                                          int flags, const char *name,
                                          const struct drm_prop_enum_list *props,
@@ -2954,6 +3131,24 @@ struct drm_property *drm_property_create_bitmask(struct drm_device *dev,
 }
 EXPORT_SYMBOL(drm_property_create_bitmask);
 
+/**
+ * drm_property_create - create a new ranged property type
+ * @dev: drm device
+ * @flags: flags specifying the property type
+ * @name: name of the property
+ * @min: minimum value of the property
+ * @max: maximum value of the property
+ *
+ * This creates a new generic drm property which can then be attached to a drm
+ * object with drm_object_attach_property. The returned property object must be
+ * freed with drm_property_destroy.
+ *
+ * Userspace is allowed to set any interger value in the (min, max) range
+ * inclusive.
+ *
+ * Returns:
+ * A pointer to the newly created property on success, NULL on failure.
+ */
 struct drm_property *drm_property_create_range(struct drm_device *dev, int flags,
                                          const char *name,
                                          uint64_t min, uint64_t max)
@@ -2973,6 +3168,21 @@ struct drm_property *drm_property_create_range(struct drm_device *dev, int flags
 }
 EXPORT_SYMBOL(drm_property_create_range);
 
+/**
+ * drm_property_add_enum - add a possible value to an enumeration property
+ * @property: enumeration property to change
+ * @index: index of the new enumeration
+ * @value: value of the new enumeration
+ * @name: symbolic name of the new enumeration
+ *
+ * This functions adds enumerations to a property.
+ *
+ * It's use is deprecated, drivers should use one of the more specific helpers
+ * to directly create the property with all enumerations already attached.
+ *
+ * Returns:
+ * Zero on success, error code on failure.
+ */
 int drm_property_add_enum(struct drm_property *property, int index,
                           uint64_t value, const char *name)
 {
@@ -3012,6 +3222,14 @@ int drm_property_add_enum(struct drm_property *property, int index,
 }
 EXPORT_SYMBOL(drm_property_add_enum);
 
+/**
+ * drm_property_destroy - destroy a drm property
+ * @dev: drm device
+ * @property: property to destry
+ *
+ * This function frees a property including any attached resources like
+ * enumeration values.
+ */
 void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
 {
         struct drm_property_enum *prop_enum, *pt;
@@ -3029,6 +3247,16 @@ void drm_property_destroy(struct drm_device *dev, struct drm_property *property)
 }
 EXPORT_SYMBOL(drm_property_destroy);
 
+/**
+ * drm_object_attach_property - attach a property to a modeset object
+ * @obj: drm modeset object
+ * @property: property to attach
+ * @init_val: initial value of the property
+ *
+ * This attaches the given property to the modeset object with the given initial
+ * value. Currently this function cannot fail since the properties are stored in
+ * a statically sized array.
+ */
 void drm_object_attach_property(struct drm_mode_object *obj,
                                 struct drm_property *property,
                                 uint64_t init_val)
@@ -3049,6 +3277,19 @@ void drm_object_attach_property(struct drm_mode_object *obj,
 }
 EXPORT_SYMBOL(drm_object_attach_property);
 
+/**
+ * drm_object_property_set_value - set the value of a property
+ * @obj: drm mode object to set property value for
+ * @property: property to set
+ * @val: value the property should be set to
+ *
+ * This functions sets a given property on a given object. This function only
+ * changes the software state of the property, it does not call into the
+ * driver's ->set_property callback.
+ *
+ * Returns:
+ * Zero on success, error code on failure.
+ */
 int drm_object_property_set_value(struct drm_mode_object *obj,
                                   struct drm_property *property, uint64_t val)
 {
@@ -3065,6 +3306,20 @@ int drm_object_property_set_value(struct drm_mode_object *obj,
 }
 EXPORT_SYMBOL(drm_object_property_set_value);
 
+/**
+ * drm_object_property_get_value - retrieve the value of a property
+ * @obj: drm mode object to get property value from
+ * @property: property to retrieve
+ * @val: storage for the property value
+ *
+ * This function retrieves the softare state of the given property for the given
+ * property. Since there is no driver callback to retrieve the current property
+ * value this might be out of sync with the hardware, depending upon the driver
+ * and property.
+ *
+ * Returns:
+ * Zero on success, error code on failure.
+ */
 int drm_object_property_get_value(struct drm_mode_object *obj,
                                   struct drm_property *property, uint64_t *val)
 {
@@ -3081,6 +3336,19 @@ int drm_object_property_get_value(struct drm_mode_object *obj,
 }
 EXPORT_SYMBOL(drm_object_property_get_value);
 
+/**
+ * drm_mode_getproperty_ioctl - get the current value of a connector's property
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * This function retrieves the current value for an connectors's property.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_getproperty_ioctl(struct drm_device *dev,
                                void *data, struct drm_file *file_priv)
 {
@@ -3219,6 +3487,20 @@ static void drm_property_destroy_blob(struct drm_device *dev,
         kfree(blob);
 }
 
+/**
+ * drm_mode_getblob_ioctl - get the contents of a blob property value
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * This function retrieves the contents of a blob property. The value stored in
+ * an object's blob property is just a normal modeset object id.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_getblob_ioctl(struct drm_device *dev,
                            void *data, struct drm_file *file_priv)
 {
@@ -3253,6 +3535,17 @@ done:
         return ret;
 }
 
+/**
+ * drm_mode_connector_update_edid_property - update the edid property of a connector
+ * @connector: drm connector
+ * @edid: new value of the edid property
+ *
+ * This function creates a new blob modeset object and assigns its id to the
+ * connector's edid property.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_connector_update_edid_property(struct drm_connector *connector,
                                             struct edid *edid)
 {
@@ -3310,6 +3603,20 @@ static bool drm_property_change_is_valid(struct drm_property *property,
         }
 }
 
+/**
+ * drm_mode_connector_property_set_ioctl - set the current value of a connector property
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * This function sets the current value for a connectors's property. It also
+ * calls into a driver's ->set_property callback to update the hardware state
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
                                        void *data, struct drm_file *file_priv)
 {
@@ -3376,6 +3683,21 @@ static int drm_mode_plane_set_obj_prop(struct drm_mode_object *obj,
         return ret;
 }
 
+/**
+ * drm_mode_getproperty_ioctl - get the current value of a object's property
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * This function retrieves the current value for an object's property. Compared
+ * to the connector specific ioctl this one is extended to also work on crtc and
+ * plane objects.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
                                       struct drm_file *file_priv)
 {
@@ -3432,6 +3754,22 @@ out:
         return ret;
 }
 
+/**
+ * drm_mode_obj_set_property_ioctl - set the current value of an object's property
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * This function sets the current value for an object's property. It also calls
+ * into a driver's ->set_property callback to update the hardware state.
+ * Compared to the connector specific ioctl this one is extended to also work on
+ * crtc and plane objects.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
                                     struct drm_file *file_priv)
 {
@@ -3491,6 +3829,18 @@ out:
         return ret;
 }
 
+/**
+ * drm_mode_connector_attach_encoder - attach a connector to an encoder
+ * @connector: connector to attach
+ * @encoder: encoder to attach @connector to
+ *
+ * This function links up a connector to an encoder. Note that the routing
+ * restrictions between encoders and crtcs are exposed to userspace through the
+ * possible_clones and possible_crtcs bitmasks.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_connector_attach_encoder(struct drm_connector *connector,
                                       struct drm_encoder *encoder)
 {
@@ -3506,23 +3856,20 @@ int drm_mode_connector_attach_encoder(struct drm_connector *connector,
 }
 EXPORT_SYMBOL(drm_mode_connector_attach_encoder);
 
-void drm_mode_connector_detach_encoder(struct drm_connector *connector,
-                                    struct drm_encoder *encoder)
-{
-        int i;
-        for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
-                if (connector->encoder_ids[i] == encoder->base.id) {
-                        connector->encoder_ids[i] = 0;
-                        if (connector->encoder == encoder)
-                                connector->encoder = NULL;
-                        break;
-                }
-        }
-}
-EXPORT_SYMBOL(drm_mode_connector_detach_encoder);
-
+/**
+ * drm_mode_crtc_set_gamma_size - set the gamma table size
+ * @crtc: CRTC to set the gamma table size for
+ * @gamma_size: size of the gamma table
+ *
+ * Drivers which support gamma tables should set this to the supported gamma
+ * table size when initializing the CRTC. Currently the drm core only supports a
+ * fixed gamma table size.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
-                                  int gamma_size)
+                                 int gamma_size)
 {
         crtc->gamma_size = gamma_size;
 
@@ -3536,6 +3883,20 @@ int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
 }
 EXPORT_SYMBOL(drm_mode_crtc_set_gamma_size);
 
+/**
+ * drm_mode_gamma_set_ioctl - set the gamma table
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * Set the gamma table of a CRTC to the one passed in by the user. Userspace can
+ * inquire the required gamma table size through drm_mode_gamma_get_ioctl.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_gamma_set_ioctl(struct drm_device *dev,
                              void *data, struct drm_file *file_priv)
 {
@@ -3595,6 +3956,21 @@ out:
 
 }
 
+/**
+ * drm_mode_gamma_get_ioctl - get the gamma table
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * Copy the current gamma table into the storage provided. This also provides
+ * the gamma table size the driver expects, which can be used to size the
+ * allocated storage.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_gamma_get_ioctl(struct drm_device *dev,
                              void *data, struct drm_file *file_priv)
 {
@@ -3645,6 +4021,24 @@ out:
         return ret;
 }
 
+/**
+ * drm_mode_page_flip_ioctl - schedule an asynchronous fb update
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * This schedules an asynchronous update on a given CRTC, called page flip.
+ * Optionally a drm event is generated to signal the completion of the event.
+ * Generic drivers cannot assume that a pageflip with changed framebuffer
+ * properties (including driver specific metadata like tiling layout) will work,
+ * but some drivers support e.g. pixel format changes through the pageflip
+ * ioctl.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_page_flip_ioctl(struct drm_device *dev,
                              void *data, struct drm_file *file_priv)
 {
@@ -3757,6 +4151,14 @@ out:
         return ret;
 }
 
+/**
+ * drm_mode_config_reset - call ->reset callbacks
+ * @dev: drm device
+ *
+ * This functions calls all the crtc's, encoder's and connector's ->reset
+ * callback. Drivers can use this in e.g. their driver load or resume code to
+ * reset hardware and software state.
+ */
 void drm_mode_config_reset(struct drm_device *dev)
 {
         struct drm_crtc *crtc;
@@ -3780,16 +4182,66 @@ void drm_mode_config_reset(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_mode_config_reset);
 
+/**
+ * drm_mode_create_dumb_ioctl - create a dumb backing storage buffer
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * This creates a new dumb buffer in the driver's backing storage manager (GEM,
+ * TTM or something else entirely) and returns the resulting buffer handle. This
+ * handle can then be wrapped up into a framebuffer modeset object.
+ *
+ * Note that userspace is not allowed to use such objects for render
+ * acceleration - drivers must create their own private ioctls for such a use
+ * case.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_create_dumb_ioctl(struct drm_device *dev,
                                void *data, struct drm_file *file_priv)
 {
         struct drm_mode_create_dumb *args = data;
+        u32 cpp, stride, size;
 
         if (!dev->driver->dumb_create)
                 return -ENOSYS;
+        if (!args->width || !args->height || !args->bpp)
+                return -EINVAL;
+
+        /* overflow checks for 32bit size calculations */
+        cpp = DIV_ROUND_UP(args->bpp, 8);
+        if (cpp > 0xffffffffU / args->width)
+                return -EINVAL;
+        stride = cpp * args->width;
+        if (args->height > 0xffffffffU / stride)
+                return -EINVAL;
+
+        /* test for wrap-around */
+        size = args->height * stride;
+        if (PAGE_ALIGN(size) == 0)
+                return -EINVAL;
+
         return dev->driver->dumb_create(file_priv, dev, args);
 }
 
+/**
+ * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * Allocate an offset in the drm device node's address space to be able to
+ * memory map a dumb buffer.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
                              void *data, struct drm_file *file_priv)
 {
@@ -3802,6 +4254,21 @@ int drm_mode_mmap_dumb_ioctl(struct drm_device *dev,
         return dev->driver->dumb_map_offset(file_priv, dev, args->handle, &args->offset);
 }
 
+/**
+ * drm_mode_destroy_dumb_ioctl - destroy a dumb backing strage buffer
+ * @dev: DRM device
+ * @data: ioctl data
+ * @file_priv: DRM file info
+ *
+ * This destroys the userspace handle for the given dumb backing storage buffer.
+ * Since buffer objects must be reference counted in the kernel a buffer object
+ * won't be immediately freed if a framebuffer modeset object still uses it.
+ *
+ * Called by the user via ioctl.
+ *
+ * Returns:
+ * Zero on success, errno on failure.
+ */
 int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
                                 void *data, struct drm_file *file_priv)
 {
@@ -3813,9 +4280,14 @@ int drm_mode_destroy_dumb_ioctl(struct drm_device *dev,
         return dev->driver->dumb_destroy(file_priv, dev, args->handle);
 }
 
-/*
- * Just need to support RGB formats here for compat with code that doesn't
- * use pixel formats directly yet.
+/**
+ * drm_fb_get_bpp_depth - get the bpp/depth values for format
+ * @format: pixel format (DRM_FORMAT_*)
+ * @depth: storage for the depth value
+ * @bpp: storage for the bpp value
+ *
+ * This only supports RGB formats here for compat with code that doesn't use
+ * pixel formats directly yet.
  */
 void drm_fb_get_bpp_depth(uint32_t format, unsigned int *depth,
                           int *bpp)
@@ -3887,7 +4359,7 @@ EXPORT_SYMBOL(drm_fb_get_bpp_depth);
  * drm_format_num_planes - get the number of planes for format
  * @format: pixel format (DRM_FORMAT_*)
  *
- * RETURNS:
+ * Returns:
  * The number of planes used by the specified pixel format.
  */
 int drm_format_num_planes(uint32_t format)
@@ -3922,7 +4394,7 @@ EXPORT_SYMBOL(drm_format_num_planes);
  * @format: pixel format (DRM_FORMAT_*)
  * @plane: plane index
  *
- * RETURNS:
+ * Returns:
  * The bytes per pixel value for the specified plane.
  */
 int drm_format_plane_cpp(uint32_t format, int plane)
@@ -3968,7 +4440,7 @@ EXPORT_SYMBOL(drm_format_plane_cpp);
  * drm_format_horz_chroma_subsampling - get the horizontal chroma subsampling factor
  * @format: pixel format (DRM_FORMAT_*)
  *
- * RETURNS:
+ * Returns:
  * The horizontal chroma subsampling factor for the
  * specified pixel format.
  */
@@ -4003,7 +4475,7 @@ EXPORT_SYMBOL(drm_format_horz_chroma_subsampling);
  * drm_format_vert_chroma_subsampling - get the vertical chroma subsampling factor
  * @format: pixel format (DRM_FORMAT_*)
  *
- * RETURNS:
+ * Returns:
  * The vertical chroma subsampling factor for the
  * specified pixel format.
  */
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index ea92b827e787..a85517854073 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -105,9 +105,6 @@ static void drm_mode_validate_flag(struct drm_connector *connector,
  * @maxX: max width for modes
  * @maxY: max height for modes
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Based on the helper callbacks implemented by @connector try to detect all
  * valid modes.  Modes will first be added to the connector's probed_modes list,
  * then culled (based on validity and the @maxX, @maxY parameters) and put into
@@ -117,8 +114,8 @@ static void drm_mode_validate_flag(struct drm_connector *connector,
  * @connector vfunc for drivers that use the crtc helpers for output mode
  * filtering and detection.
  *
- * RETURNS:
- * Number of modes found on @connector.
+ * Returns:
+ * The number of modes found on @connector.
  */
 int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
                                             uint32_t maxX, uint32_t maxY)
@@ -131,6 +128,8 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
         int mode_flags = 0;
         bool verbose_prune = true;
 
+        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+
         DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id,
                         drm_get_connector_name(connector));
         /* set all modes to the unverified state */
@@ -176,8 +175,7 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
         drm_mode_connector_list_update(connector);
 
         if (maxX && maxY)
-                drm_mode_validate_size(dev, &connector->modes, maxX,
-                                       maxY, 0);
+                drm_mode_validate_size(dev, &connector->modes, maxX, maxY);
 
         if (connector->interlace_allowed)
                 mode_flags |= DRM_MODE_FLAG_INTERLACE;
@@ -219,18 +217,19 @@ EXPORT_SYMBOL(drm_helper_probe_single_connector_modes);
  * drm_helper_encoder_in_use - check if a given encoder is in use
  * @encoder: encoder to check
  *
- * LOCKING:
- * Caller must hold mode config lock.
+ * Checks whether @encoder is with the current mode setting output configuration
+ * in use by any connector. This doesn't mean that it is actually enabled since
+ * the DPMS state is tracked separately.
  *
- * Walk @encoders's DRM device's mode_config and see if it's in use.
- *
- * RETURNS:
- * True if @encoder is part of the mode_config, false otherwise.
+ * Returns:
+ * True if @encoder is used, false otherwise.
  */
 bool drm_helper_encoder_in_use(struct drm_encoder *encoder)
 {
         struct drm_connector *connector;
         struct drm_device *dev = encoder->dev;
+
+        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
         list_for_each_entry(connector, &dev->mode_config.connector_list, head)
                 if (connector->encoder == encoder)
                         return true;
@@ -242,19 +241,19 @@ EXPORT_SYMBOL(drm_helper_encoder_in_use);
  * drm_helper_crtc_in_use - check if a given CRTC is in a mode_config
  * @crtc: CRTC to check
  *
- * LOCKING:
- * Caller must hold mode config lock.
+ * Checks whether @crtc is with the current mode setting output configuration
+ * in use by any connector. This doesn't mean that it is actually enabled since
+ * the DPMS state is tracked separately.
  *
- * Walk @crtc's DRM device's mode_config and see if it's in use.
- *
- * RETURNS:
- * True if @crtc is part of the mode_config, false otherwise.
+ * Returns:
+ * True if @crtc is used, false otherwise.
  */
 bool drm_helper_crtc_in_use(struct drm_crtc *crtc)
 {
         struct drm_encoder *encoder;
         struct drm_device *dev = crtc->dev;
-        /* FIXME: Locking around list access? */
+
+        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
         list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
                 if (encoder->crtc == crtc && drm_helper_encoder_in_use(encoder))
                         return true;
@@ -283,11 +282,11 @@ drm_encoder_disable(struct drm_encoder *encoder)
  * drm_helper_disable_unused_functions - disable unused objects
  * @dev: DRM device
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
- * If an connector or CRTC isn't part of @dev's mode_config, it can be disabled
- * by calling its dpms function, which should power it off.
+ * This function walks through the entire mode setting configuration of @dev. It
+ * will remove any crtc links of unused encoders and encoder links of
+ * disconnected connectors. Then it will disable all unused encoders and crtcs
+ * either by calling their disable callback if available or by calling their
+ * dpms callback with DRM_MODE_DPMS_OFF.
  */
 void drm_helper_disable_unused_functions(struct drm_device *dev)
 {
@@ -295,6 +294,8 @@ void drm_helper_disable_unused_functions(struct drm_device *dev)
         struct drm_connector *connector;
         struct drm_crtc *crtc;
 
+        drm_warn_on_modeset_not_all_locked(dev);
+
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 if (!connector->encoder)
                         continue;
@@ -355,9 +356,6 @@ drm_crtc_prepare_encoders(struct drm_device *dev)
  * @y: vertical offset into the surface
  * @old_fb: old framebuffer, for cleanup
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Try to set @mode on @crtc.  Give @crtc and its associated connectors a chance
  * to fixup or reject the mode prior to trying to set it. This is an internal
  * helper that drivers could e.g. use to update properties that require the
@@ -367,8 +365,8 @@ drm_crtc_prepare_encoders(struct drm_device *dev)
  * drm_crtc_helper_set_config() helper function to drive the mode setting
  * sequence.
  *
- * RETURNS:
- * True if the mode was set successfully, or false otherwise.
+ * Returns:
+ * True if the mode was set successfully, false otherwise.
  */
 bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
                               struct drm_display_mode *mode,
@@ -384,6 +382,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         struct drm_encoder *encoder;
         bool ret = true;
 
+        drm_warn_on_modeset_not_all_locked(dev);
+
         saved_enabled = crtc->enabled;
         crtc->enabled = drm_helper_crtc_in_use(crtc);
         if (!crtc->enabled)
@@ -560,17 +560,14 @@ drm_crtc_helper_disable(struct drm_crtc *crtc)
  * drm_crtc_helper_set_config - set a new config from userspace
  * @set: mode set configuration
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Setup a new configuration, provided by the upper layers (either an ioctl call
  * from userspace or internally e.g. from the fbdev suppport code) in @set, and
  * enable it. This is the main helper functions for drivers that implement
  * kernel mode setting with the crtc helper functions and the assorted
  * ->prepare(), ->modeset() and ->commit() helper callbacks.
  *
- * RETURNS:
- * Returns 0 on success, -ERRNO on failure.
+ * Returns:
+ * Returns 0 on success, negative errno numbers on failure.
  */
 int drm_crtc_helper_set_config(struct drm_mode_set *set)
 {
@@ -612,6 +609,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
 
         dev = set->crtc->dev;
 
+        drm_warn_on_modeset_not_all_locked(dev);
+
         /*
          * Allocate space for the backup of all (non-pointer) encoder and
          * connector data.
@@ -924,8 +923,16 @@ void drm_helper_connector_dpms(struct drm_connector *connector, int mode)
 }
 EXPORT_SYMBOL(drm_helper_connector_dpms);
 
-int drm_helper_mode_fill_fb_struct(struct drm_framebuffer *fb,
-                                   struct drm_mode_fb_cmd2 *mode_cmd)
+/**
+ * drm_helper_mode_fill_fb_struct - fill out framebuffer metadata
+ * @fb: drm_framebuffer object to fill out
+ * @mode_cmd: metadata from the userspace fb creation request
+ *
+ * This helper can be used in a drivers fb_create callback to pre-fill the fb's
+ * metadata fields.
+ */
+void drm_helper_mode_fill_fb_struct(struct drm_framebuffer *fb,
+                                    struct drm_mode_fb_cmd2 *mode_cmd)
 {
         int i;
 
@@ -938,17 +945,36 @@ int drm_helper_mode_fill_fb_struct(struct drm_framebuffer *fb,
         drm_fb_get_bpp_depth(mode_cmd->pixel_format, &fb->depth,
                                     &fb->bits_per_pixel);
         fb->pixel_format = mode_cmd->pixel_format;
-
-        return 0;
 }
 EXPORT_SYMBOL(drm_helper_mode_fill_fb_struct);
 
-int drm_helper_resume_force_mode(struct drm_device *dev)
+/**
+ * drm_helper_resume_force_mode - force-restore mode setting configuration
+ * @dev: drm_device which should be restored
+ *
+ * Drivers which use the mode setting helpers can use this function to
+ * force-restore the mode setting configuration e.g. on resume or when something
+ * else might have trampled over the hw state (like some overzealous old BIOSen
+ * tended to do).
+ *
+ * This helper doesn't provide a error return value since restoring the old
+ * config should never fail due to resource allocation issues since the driver
+ * has successfully set the restored configuration already. Hence this should
+ * boil down to the equivalent of a few dpms on calls, which also don't provide
+ * an error code.
+ *
+ * Drivers where simply restoring an old configuration again might fail (e.g.
+ * due to slight differences in allocating shared resources when the
+ * configuration is restored in a different order than when userspace set it up)
+ * need to use their own restore logic.
+ */
+void drm_helper_resume_force_mode(struct drm_device *dev)
 {
         struct drm_crtc *crtc;
         struct drm_encoder *encoder;
         struct drm_crtc_helper_funcs *crtc_funcs;
-        int ret, encoder_dpms;
+        int encoder_dpms;
+        bool ret;
 
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
 
@@ -958,6 +984,7 @@ int drm_helper_resume_force_mode(struct drm_device *dev)
                 ret = drm_crtc_helper_set_mode(crtc, &crtc->mode,
                                                crtc->x, crtc->y, crtc->fb);
 
+                /* Restoring the old config should never fail! */
                 if (ret == false)
                         DRM_ERROR("failed to set mode on crtc %p\n", crtc);
 
@@ -980,12 +1007,28 @@ int drm_helper_resume_force_mode(struct drm_device *dev)
                                                      drm_helper_choose_crtc_dpms(crtc));
                 }
         }
+
         /* disable the unused connectors while restoring the modesetting */
         drm_helper_disable_unused_functions(dev);
-        return 0;
 }
 EXPORT_SYMBOL(drm_helper_resume_force_mode);
 
+/**
+ * drm_kms_helper_hotplug_event - fire off KMS hotplug events
+ * @dev: drm_device whose connector state changed
+ *
+ * This function fires off the uevent for userspace and also calls the
+ * output_poll_changed function, which is most commonly used to inform the fbdev
+ * emulation code and allow it to update the fbcon output configuration.
+ *
+ * Drivers should call this from their hotplug handling code when a change is
+ * detected. Note that this function does not do any output detection of its
+ * own, like drm_helper_hpd_irq_event() does - this is assumed to be done by the
+ * driver already.
+ *
+ * This function must be called from process context with no mode
+ * setting locks held.
+ */
 void drm_kms_helper_hotplug_event(struct drm_device *dev)
 {
         /* send a uevent + call fbdev */
@@ -1054,6 +1097,16 @@ static void output_poll_execute(struct work_struct *work)
                 schedule_delayed_work(delayed_work, DRM_OUTPUT_POLL_PERIOD);
 }
 
+/**
+ * drm_kms_helper_poll_disable - disable output polling
+ * @dev: drm_device
+ *
+ * This function disables the output polling work.
+ *
+ * Drivers can call this helper from their device suspend implementation. It is
+ * not an error to call this even when output polling isn't enabled or arlready
+ * disabled.
+ */
 void drm_kms_helper_poll_disable(struct drm_device *dev)
 {
         if (!dev->mode_config.poll_enabled)
@@ -1062,6 +1115,16 @@ void drm_kms_helper_poll_disable(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_kms_helper_poll_disable);
 
+/**
+ * drm_kms_helper_poll_enable - re-enable output polling.
+ * @dev: drm_device
+ *
+ * This function re-enables the output polling work.
+ *
+ * Drivers can call this helper from their device resume implementation. It is
+ * an error to call this when the output polling support has not yet been set
+ * up.
+ */
 void drm_kms_helper_poll_enable(struct drm_device *dev)
 {
         bool poll = false;
@@ -1081,6 +1144,25 @@ void drm_kms_helper_poll_enable(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_kms_helper_poll_enable);
 
+/**
+ * drm_kms_helper_poll_init - initialize and enable output polling
+ * @dev: drm_device
+ *
+ * This function intializes and then also enables output polling support for
+ * @dev. Drivers which do not have reliable hotplug support in hardware can use
+ * this helper infrastructure to regularly poll such connectors for changes in
+ * their connection state.
+ *
+ * Drivers can control which connectors are polled by setting the
+ * DRM_CONNECTOR_POLL_CONNECT and DRM_CONNECTOR_POLL_DISCONNECT flags. On
+ * connectors where probing live outputs can result in visual distortion drivers
+ * should not set the DRM_CONNECTOR_POLL_DISCONNECT flag to avoid this.
+ * Connectors which have no flag or only DRM_CONNECTOR_POLL_HPD set are
+ * completely ignored by the polling logic.
+ *
+ * Note that a connector can be both polled and probed from the hotplug handler,
+ * in case the hotplug interrupt is known to be unreliable.
+ */
 void drm_kms_helper_poll_init(struct drm_device *dev)
 {
         INIT_DELAYED_WORK(&dev->mode_config.output_poll_work, output_poll_execute);
@@ -1090,12 +1172,39 @@ void drm_kms_helper_poll_init(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_kms_helper_poll_init);
 
+/**
+ * drm_kms_helper_poll_fini - disable output polling and clean it up
+ * @dev: drm_device
+ */
 void drm_kms_helper_poll_fini(struct drm_device *dev)
 {
         drm_kms_helper_poll_disable(dev);
 }
 EXPORT_SYMBOL(drm_kms_helper_poll_fini);
 
+/**
+ * drm_helper_hpd_irq_event - hotplug processing
+ * @dev: drm_device
+ *
+ * Drivers can use this helper function to run a detect cycle on all connectors
+ * which have the DRM_CONNECTOR_POLL_HPD flag set in their &polled member. All
+ * other connectors are ignored, which is useful to avoid reprobing fixed
+ * panels.
+ *
+ * This helper function is useful for drivers which can't or don't track hotplug
+ * interrupts for each connector.
+ *
+ * Drivers which support hotplug interrupts for each connector individually and
+ * which have a more fine-grained detect logic should bypass this code and
+ * directly call drm_kms_helper_hotplug_event() in case the connector state
+ * changed.
+ *
+ * This function must be called from process context with no mode
+ * setting locks held.
+ *
+ * Note that a connector can be both polled and probed from the hotplug handler,
+ * in case the hotplug interrupt is known to be unreliable.
+ */
 bool drm_helper_hpd_irq_event(struct drm_device *dev)
 {
         struct drm_connector *connector;
diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
new file mode 100644
index 000000000000..a2945ee6d675
--- /dev/null
+++ b/drivers/gpu/drm/drm_crtc_internal.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright © 2006 Keith Packard
+ * Copyright © 2007-2008 Dave Airlie
+ * Copyright © 2007-2008 Intel Corporation
+ *   Jesse Barnes <jesse.barnes@intel.com>
+ * Copyright © 2014 Intel Corporation
+ *   Daniel Vetter <daniel.vetter@ffwll.ch>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+/*
+ * This header file contains mode setting related functions and definitions
+ * which are only used within the drm module as internal implementation details
+ * and are not exported to drivers.
+ */
+
+int drm_mode_object_get(struct drm_device *dev,
+                        struct drm_mode_object *obj, uint32_t obj_type);
+void drm_mode_object_put(struct drm_device *dev,
+                         struct drm_mode_object *object);
+
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 9e978aae8972..17832d048147 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -346,3 +346,399 @@ int drm_dp_bw_code_to_link_rate(u8 link_bw)
         }
 }
 EXPORT_SYMBOL(drm_dp_bw_code_to_link_rate);
+
+/**
+ * DOC: dp helpers
+ *
+ * The DisplayPort AUX channel is an abstraction to allow generic, driver-
+ * independent access to AUX functionality. Drivers can take advantage of
+ * this by filling in the fields of the drm_dp_aux structure.
+ *
+ * Transactions are described using a hardware-independent drm_dp_aux_msg
+ * structure, which is passed into a driver's .transfer() implementation.
+ * Both native and I2C-over-AUX transactions are supported.
+ */
+
+static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
+                              unsigned int offset, void *buffer, size_t size)
+{
+        struct drm_dp_aux_msg msg;
+        unsigned int retry;
+        int err;
+
+        memset(&msg, 0, sizeof(msg));
+        msg.address = offset;
+        msg.request = request;
+        msg.buffer = buffer;
+        msg.size = size;
+
+        /*
+         * The specification doesn't give any recommendation on how often to
+         * retry native transactions, so retry 7 times like for I2C-over-AUX
+         * transactions.
+         */
+        for (retry = 0; retry < 7; retry++) {
+                err = aux->transfer(aux, &msg);
+                if (err < 0) {
+                        if (err == -EBUSY)
+                                continue;
+
+                        return err;
+                }
+
+                if (err < size)
+                        return -EPROTO;
+
+                switch (msg.reply & DP_AUX_NATIVE_REPLY_MASK) {
+                case DP_AUX_NATIVE_REPLY_ACK:
+                        return err;
+
+                case DP_AUX_NATIVE_REPLY_NACK:
+                        return -EIO;
+
+                case DP_AUX_NATIVE_REPLY_DEFER:
+                        usleep_range(400, 500);
+                        break;
+                }
+        }
+
+        DRM_ERROR("too many retries, giving up\n");
+        return -EIO;
+}
+
+/**
+ * drm_dp_dpcd_read() - read a series of bytes from the DPCD
+ * @aux: DisplayPort AUX channel
+ * @offset: address of the (first) register to read
+ * @buffer: buffer to store the register values
+ * @size: number of bytes in @buffer
+ *
+ * Returns the number of bytes transferred on success, or a negative error
+ * code on failure. -EIO is returned if the request was NAKed by the sink or
+ * if the retry count was exceeded. If not all bytes were transferred, this
+ * function returns -EPROTO. Errors from the underlying AUX channel transfer
+ * function, with the exception of -EBUSY (which causes the transaction to
+ * be retried), are propagated to the caller.
+ */
+ssize_t drm_dp_dpcd_read(struct drm_dp_aux *aux, unsigned int offset,
+                         void *buffer, size_t size)
+{
+        return drm_dp_dpcd_access(aux, DP_AUX_NATIVE_READ, offset, buffer,
+                                  size);
+}
+EXPORT_SYMBOL(drm_dp_dpcd_read);
+
+/**
+ * drm_dp_dpcd_write() - write a series of bytes to the DPCD
+ * @aux: DisplayPort AUX channel
+ * @offset: address of the (first) register to write
+ * @buffer: buffer containing the values to write
+ * @size: number of bytes in @buffer
+ *
+ * Returns the number of bytes transferred on success, or a negative error
+ * code on failure. -EIO is returned if the request was NAKed by the sink or
+ * if the retry count was exceeded. If not all bytes were transferred, this
+ * function returns -EPROTO. Errors from the underlying AUX channel transfer
+ * function, with the exception of -EBUSY (which causes the transaction to
+ * be retried), are propagated to the caller.
+ */
+ssize_t drm_dp_dpcd_write(struct drm_dp_aux *aux, unsigned int offset,
+                          void *buffer, size_t size)
+{
+        return drm_dp_dpcd_access(aux, DP_AUX_NATIVE_WRITE, offset, buffer,
+                                  size);
+}
+EXPORT_SYMBOL(drm_dp_dpcd_write);
+
+/**
+ * drm_dp_dpcd_read_link_status() - read DPCD link status (bytes 0x202-0x207)
+ * @aux: DisplayPort AUX channel
+ * @status: buffer to store the link status in (must be at least 6 bytes)
+ *
+ * Returns the number of bytes transferred on success or a negative error
+ * code on failure.
+ */
+int drm_dp_dpcd_read_link_status(struct drm_dp_aux *aux,
+                                 u8 status[DP_LINK_STATUS_SIZE])
+{
+        return drm_dp_dpcd_read(aux, DP_LANE0_1_STATUS, status,
+                                DP_LINK_STATUS_SIZE);
+}
+EXPORT_SYMBOL(drm_dp_dpcd_read_link_status);
+
+/**
+ * drm_dp_link_probe() - probe a DisplayPort link for capabilities
+ * @aux: DisplayPort AUX channel
+ * @link: pointer to structure in which to return link capabilities
+ *
+ * The structure filled in by this function can usually be passed directly
+ * into drm_dp_link_power_up() and drm_dp_link_configure() to power up and
+ * configure the link based on the link's capabilities.
+ *
+ * Returns 0 on success or a negative error code on failure.
+ */
+int drm_dp_link_probe(struct drm_dp_aux *aux, struct drm_dp_link *link)
+{
+        u8 values[3];
+        int err;
+
+        memset(link, 0, sizeof(*link));
+
+        err = drm_dp_dpcd_read(aux, DP_DPCD_REV, values, sizeof(values));
+        if (err < 0)
+                return err;
+
+        link->revision = values[0];
+        link->rate = drm_dp_bw_code_to_link_rate(values[1]);
+        link->num_lanes = values[2] & DP_MAX_LANE_COUNT_MASK;
+
+        if (values[2] & DP_ENHANCED_FRAME_CAP)
+                link->capabilities |= DP_LINK_CAP_ENHANCED_FRAMING;
+
+        return 0;
+}
+EXPORT_SYMBOL(drm_dp_link_probe);
+
+/**
+ * drm_dp_link_power_up() - power up a DisplayPort link
+ * @aux: DisplayPort AUX channel
+ * @link: pointer to a structure containing the link configuration
+ *
+ * Returns 0 on success or a negative error code on failure.
+ */
+int drm_dp_link_power_up(struct drm_dp_aux *aux, struct drm_dp_link *link)
+{
+        u8 value;
+        int err;
+
+        /* DP_SET_POWER register is only available on DPCD v1.1 and later */
+        if (link->revision < 0x11)
+                return 0;
+
+        err = drm_dp_dpcd_readb(aux, DP_SET_POWER, &value);
+        if (err < 0)
+                return err;
+
+        value &= ~DP_SET_POWER_MASK;
+        value |= DP_SET_POWER_D0;
+
+        err = drm_dp_dpcd_writeb(aux, DP_SET_POWER, value);
+        if (err < 0)
+                return err;
+
+        /*
+         * According to the DP 1.1 specification, a "Sink Device must exit the
+         * power saving state within 1 ms" (Section 2.5.3.1, Table 5-52, "Sink
+         * Control Field" (register 0x600).
+         */
+        usleep_range(1000, 2000);
+
+        return 0;
+}
+EXPORT_SYMBOL(drm_dp_link_power_up);
+
+/**
+ * drm_dp_link_configure() - configure a DisplayPort link
+ * @aux: DisplayPort AUX channel
+ * @link: pointer to a structure containing the link configuration
+ *
+ * Returns 0 on success or a negative error code on failure.
+ */
+int drm_dp_link_configure(struct drm_dp_aux *aux, struct drm_dp_link *link)
+{
+        u8 values[2];
+        int err;
+
+        values[0] = drm_dp_link_rate_to_bw_code(link->rate);
+        values[1] = link->num_lanes;
+
+        if (link->capabilities & DP_LINK_CAP_ENHANCED_FRAMING)
+                values[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
+
+        err = drm_dp_dpcd_write(aux, DP_LINK_BW_SET, values, sizeof(values));
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+EXPORT_SYMBOL(drm_dp_link_configure);
+
+/*
+ * I2C-over-AUX implementation
+ */
+
+static u32 drm_dp_i2c_functionality(struct i2c_adapter *adapter)
+{
+        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL |
+               I2C_FUNC_SMBUS_READ_BLOCK_DATA |
+               I2C_FUNC_SMBUS_BLOCK_PROC_CALL |
+               I2C_FUNC_10BIT_ADDR;
+}
+
+/*
+ * Transfer a single I2C-over-AUX message and handle various error conditions,
+ * retrying the transaction as appropriate.
+ */
+static int drm_dp_i2c_do_msg(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
+{
+        unsigned int retry;
+        int err;
+
+        /*
+         * DP1.2 sections 2.7.7.1.5.6.1 and 2.7.7.1.6.6.1: A DP Source device
+         * is required to retry at least seven times upon receiving AUX_DEFER
+         * before giving up the AUX transaction.
+         */
+        for (retry = 0; retry < 7; retry++) {
+                err = aux->transfer(aux, msg);
+                if (err < 0) {
+                        if (err == -EBUSY)
+                                continue;
+
+                        DRM_DEBUG_KMS("transaction failed: %d\n", err);
+                        return err;
+                }
+
+                if (err < msg->size)
+                        return -EPROTO;
+
+                switch (msg->reply & DP_AUX_NATIVE_REPLY_MASK) {
+                case DP_AUX_NATIVE_REPLY_ACK:
+                        /*
+                         * For I2C-over-AUX transactions this isn't enough, we
+                         * need to check for the I2C ACK reply.
+                         */
+                        break;
+
+                case DP_AUX_NATIVE_REPLY_NACK:
+                        DRM_DEBUG_KMS("native nack\n");
+                        return -EREMOTEIO;
+
+                case DP_AUX_NATIVE_REPLY_DEFER:
+                        DRM_DEBUG_KMS("native defer");
+                        /*
+                         * We could check for I2C bit rate capabilities and if
+                         * available adjust this interval. We could also be
+                         * more careful with DP-to-legacy adapters where a
+                         * long legacy cable may force very low I2C bit rates.
+                         *
+                         * For now just defer for long enough to hopefully be
+                         * safe for all use-cases.
+                         */
+                        usleep_range(500, 600);
+                        continue;
+
+                default:
+                        DRM_ERROR("invalid native reply %#04x\n", msg->reply);
+                        return -EREMOTEIO;
+                }
+
+                switch (msg->reply & DP_AUX_I2C_REPLY_MASK) {
+                case DP_AUX_I2C_REPLY_ACK:
+                        /*
+                         * Both native ACK and I2C ACK replies received. We
+                         * can assume the transfer was successful.
+                         */
+                        return 0;
+
+                case DP_AUX_I2C_REPLY_NACK:
+                        DRM_DEBUG_KMS("I2C nack\n");
+                        return -EREMOTEIO;
+
+                case DP_AUX_I2C_REPLY_DEFER:
+                        DRM_DEBUG_KMS("I2C defer\n");
+                        usleep_range(400, 500);
+                        continue;
+
+                default:
+                        DRM_ERROR("invalid I2C reply %#04x\n", msg->reply);
+                        return -EREMOTEIO;
+                }
+        }
+
+        DRM_ERROR("too many retries, giving up\n");
+        return -EREMOTEIO;
+}
+
+static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
+                           int num)
+{
+        struct drm_dp_aux *aux = adapter->algo_data;
+        unsigned int i, j;
+
+        for (i = 0; i < num; i++) {
+                struct drm_dp_aux_msg msg;
+                int err;
+
+                /*
+                 * Many hardware implementations support FIFOs larger than a
+                 * single byte, but it has been empirically determined that
+                 * transferring data in larger chunks can actually lead to
+                 * decreased performance. Therefore each message is simply
+                 * transferred byte-by-byte.
+                 */
+                for (j = 0; j < msgs[i].len; j++) {
+                        memset(&msg, 0, sizeof(msg));
+                        msg.address = msgs[i].addr;
+
+                        msg.request = (msgs[i].flags & I2C_M_RD) ?
+                                        DP_AUX_I2C_READ :
+                                        DP_AUX_I2C_WRITE;
+
+                        /*
+                         * All messages except the last one are middle-of-
+                         * transfer messages.
+                         */
+                        if ((i < num - 1) || (j < msgs[i].len - 1))
+                                msg.request |= DP_AUX_I2C_MOT;
+
+                        msg.buffer = msgs[i].buf + j;
+                        msg.size = 1;
+
+                        err = drm_dp_i2c_do_msg(aux, &msg);
+                        if (err < 0)
+                                return err;
+                }
+        }
+
+        return num;
+}
+
+static const struct i2c_algorithm drm_dp_i2c_algo = {
+        .functionality = drm_dp_i2c_functionality,
+        .master_xfer = drm_dp_i2c_xfer,
+};
+
+/**
+ * drm_dp_aux_register_i2c_bus() - register an I2C adapter for I2C-over-AUX
+ * @aux: DisplayPort AUX channel
+ *
+ * Returns 0 on success or a negative error code on failure.
+ */
+int drm_dp_aux_register_i2c_bus(struct drm_dp_aux *aux)
+{
+        aux->ddc.algo = &drm_dp_i2c_algo;
+        aux->ddc.algo_data = aux;
+        aux->ddc.retries = 3;
+
+        aux->ddc.class = I2C_CLASS_DDC;
+        aux->ddc.owner = THIS_MODULE;
+        aux->ddc.dev.parent = aux->dev;
+        aux->ddc.dev.of_node = aux->dev->of_node;
+
+        strlcpy(aux->ddc.name, aux->name ? aux->name : dev_name(aux->dev),
+                sizeof(aux->ddc.name));
+
+        return i2c_add_adapter(&aux->ddc);
+}
+EXPORT_SYMBOL(drm_dp_aux_register_i2c_bus);
+
+/**
+ * drm_dp_aux_unregister_i2c_bus() - unregister an I2C-over-AUX adapter
+ * @aux: DisplayPort AUX channel
+ */
+void drm_dp_aux_unregister_i2c_bus(struct drm_dp_aux *aux)
+{
+        i2c_del_adapter(&aux->ddc);
+}
+EXPORT_SYMBOL(drm_dp_aux_unregister_i2c_bus);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 345be03c23db..ec651be2f3cb 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -344,7 +344,7 @@ long drm_ioctl(struct file *filp,
 
         DRM_DEBUG("pid=%d, dev=0x%lx, auth=%d, %s\n",
                   task_pid_nr(current),
-                  (long)old_encode_dev(file_priv->minor->device),
+                  (long)old_encode_dev(file_priv->minor->kdev->devt),
                   file_priv->authenticated, ioctl->name);
 
         /* Do not trust userspace, use our own definition */
@@ -402,7 +402,7 @@ long drm_ioctl(struct file *filp,
         if (!ioctl)
                 DRM_DEBUG("invalid ioctl: pid=%d, dev=0x%lx, auth=%d, cmd=0x%02x, nr=0x%02x\n",
                           task_pid_nr(current),
-                          (long)old_encode_dev(file_priv->minor->device),
+                          (long)old_encode_dev(file_priv->minor->kdev->devt),
                           file_priv->authenticated, cmd, nr);
 
         if (kdata != stack_kdata)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index b924306b8477..d4e3f9d9370f 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1098,10 +1098,14 @@ EXPORT_SYMBOL(drm_edid_is_valid);
 /**
  * Get EDID information via I2C.
  *
- * \param adapter : i2c device adaptor
- * \param buf     : EDID data buffer to be filled
- * \param len     : EDID data buffer length
- * \return 0 on success or -1 on failure.
+ * @adapter : i2c device adaptor
+ * @buf: EDID data buffer to be filled
+ * @block: 128 byte EDID block to start fetching from
+ * @len: EDID data buffer length to fetch
+ *
+ * Returns:
+ *
+ * 0 on success or -1 on failure.
  *
  * Try to fetch EDID information by calling i2c driver function.
  */
@@ -1243,9 +1247,11 @@ out:
 
 /**
  * Probe DDC presence.
+ * @adapter: i2c adapter to probe
+ *
+ * Returns:
  *
- * \param adapter : i2c device adaptor
- * \return 1 on success
+ * 1 on success
  */
 bool
 drm_probe_ddc(struct i2c_adapter *adapter)
@@ -1586,8 +1592,10 @@ bad_std_timing(u8 a, u8 b)
 
 /**
  * drm_mode_std - convert standard mode info (width, height, refresh) into mode
+ * @connector: connector of for the EDID block
+ * @edid: EDID block to scan
  * @t: standard timing params
- * @timing_level: standard timing level
+ * @revision: standard timing level
  *
  * Take the standard timing params (in this case width, aspect, and refresh)
  * and convert them into a real mode using CVT/GTF/DMT.
@@ -2132,6 +2140,7 @@ do_established_modes(struct detailed_timing *timing, void *c)
 
 /**
  * add_established_modes - get est. modes from EDID and add them
+ * @connector: connector of for the EDID block
  * @edid: EDID block to scan
  *
  * Each EDID block contains a bitmap of the supported "established modes" list
@@ -2194,6 +2203,7 @@ do_standard_modes(struct detailed_timing *timing, void *c)
 
 /**
  * add_standard_modes - get std. modes from EDID and add them
+ * @connector: connector of for the EDID block
  * @edid: EDID block to scan
  *
  * Standard modes can be calculated using the appropriate standard (DMT,
@@ -2580,6 +2590,9 @@ drm_display_mode_from_vic_index(struct drm_connector *connector,
                 return NULL;
 
         newmode = drm_mode_duplicate(dev, &edid_cea_modes[cea_mode]);
+        if (!newmode)
+                return NULL;
+
         newmode->vrefresh = 0;
 
         return newmode;
@@ -3300,6 +3313,7 @@ EXPORT_SYMBOL(drm_detect_hdmi_monitor);
 
 /**
  * drm_detect_monitor_audio - check monitor audio capability
+ * @edid: EDID block to scan
  *
  * Monitor should have CEA extension block.
  * If monitor has 'basic audio', but no CEA audio blocks, it's 'basic
@@ -3345,6 +3359,7 @@ EXPORT_SYMBOL(drm_detect_monitor_audio);
 
 /**
  * drm_rgb_quant_range_selectable - is RGB quantization range selectable?
+ * @edid: EDID block to scan
  *
  * Check whether the monitor reports the RGB quantization range selection
  * as supported. The AVI infoframe can then be used to inform the monitor
@@ -3564,8 +3579,8 @@ void drm_set_preferred_mode(struct drm_connector *connector,
         struct drm_display_mode *mode;
 
         list_for_each_entry(mode, &connector->probed_modes, head) {
-                if (drm_mode_width(mode)  == hpref &&
-                    drm_mode_height(mode) == vpref)
+                if (mode->hdisplay  == hpref &&
+                    mode->vdisplay == vpref)
                         mode->type |= DRM_MODE_TYPE_PREFERRED;
         }
 }
@@ -3599,6 +3614,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame,
 
         frame->picture_aspect = HDMI_PICTURE_ASPECT_NONE;
         frame->active_aspect = HDMI_ACTIVE_ASPECT_PICTURE;
+        frame->scan_mode = HDMI_SCAN_MODE_UNDERSCAN;
 
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index d99df15a78bc..87876198801d 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -516,6 +516,9 @@ int drm_fb_helper_init(struct drm_device *dev,
         struct drm_crtc *crtc;
         int i;
 
+        if (!max_conn_count)
+                return -EINVAL;
+
         fb_helper->dev = dev;
 
         INIT_LIST_HEAD(&fb_helper->kernel_fb_list);
@@ -809,8 +812,6 @@ int drm_fb_helper_set_par(struct fb_info *info)
         struct drm_fb_helper *fb_helper = info->par;
         struct drm_device *dev = fb_helper->dev;
         struct fb_var_screeninfo *var = &info->var;
-        int ret;
-        int i;
 
         if (var->pixclock != 0) {
                 DRM_ERROR("PIXEL CLOCK SET\n");
@@ -818,13 +819,7 @@ int drm_fb_helper_set_par(struct fb_info *info)
         }
 
         drm_modeset_lock_all(dev);
-        for (i = 0; i < fb_helper->crtc_count; i++) {
-                ret = drm_mode_set_config_internal(&fb_helper->crtc_info[i].mode_set);
-                if (ret) {
-                        drm_modeset_unlock_all(dev);
-                        return ret;
-                }
-        }
+        drm_fb_helper_restore_fbdev_mode(fb_helper);
         drm_modeset_unlock_all(dev);
 
         if (fb_helper->delayed_hotplug) {
@@ -1141,8 +1136,8 @@ struct drm_display_mode *drm_has_preferred_mode(struct drm_fb_helper_connector *
         struct drm_display_mode *mode;
 
         list_for_each_entry(mode, &fb_connector->connector->modes, head) {
-                if (drm_mode_width(mode) > width ||
-                    drm_mode_height(mode) > height)
+                if (mode->hdisplay > width ||
+                    mode->vdisplay > height)
                         continue;
                 if (mode->type & DRM_MODE_TYPE_PREFERRED)
                         return mode;
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 7f2af9aca038..9b02f126fb0d 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -39,12 +39,12 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 
-/* from BKL pushdown: note that nothing else serializes idr_find() */
+/* from BKL pushdown */
 DEFINE_MUTEX(drm_global_mutex);
 EXPORT_SYMBOL(drm_global_mutex);
 
 static int drm_open_helper(struct inode *inode, struct file *filp,
-                           struct drm_device * dev);
+                           struct drm_minor *minor);
 
 static int drm_setup(struct drm_device * dev)
 {
@@ -79,38 +79,23 @@ static int drm_setup(struct drm_device * dev)
  */
 int drm_open(struct inode *inode, struct file *filp)
 {
-        struct drm_device *dev = NULL;
-        int minor_id = iminor(inode);
+        struct drm_device *dev;
         struct drm_minor *minor;
-        int retcode = 0;
+        int retcode;
         int need_setup = 0;
-        struct address_space *old_mapping;
-        struct address_space *old_imapping;
-
-        minor = idr_find(&drm_minors_idr, minor_id);
-        if (!minor)
-                return -ENODEV;
-
-        if (!(dev = minor->dev))
-                return -ENODEV;
 
-        if (drm_device_is_unplugged(dev))
-                return -ENODEV;
+        minor = drm_minor_acquire(iminor(inode));
+        if (IS_ERR(minor))
+                return PTR_ERR(minor);
 
+        dev = minor->dev;
         if (!dev->open_count++)
                 need_setup = 1;
-        mutex_lock(&dev->struct_mutex);
-        old_imapping = inode->i_mapping;
-        old_mapping = dev->dev_mapping;
-        if (old_mapping == NULL)
-                dev->dev_mapping = &inode->i_data;
-        /* ihold ensures nobody can remove inode with our i_data */
-        ihold(container_of(dev->dev_mapping, struct inode, i_data));
-        inode->i_mapping = dev->dev_mapping;
-        filp->f_mapping = dev->dev_mapping;
-        mutex_unlock(&dev->struct_mutex);
 
-        retcode = drm_open_helper(inode, filp, dev);
+        /* share address_space across all char-devs of a single device */
+        filp->f_mapping = dev->anon_inode->i_mapping;
+
+        retcode = drm_open_helper(inode, filp, minor);
         if (retcode)
                 goto err_undo;
         if (need_setup) {
@@ -121,13 +106,8 @@ int drm_open(struct inode *inode, struct file *filp)
         return 0;
 
 err_undo:
-        mutex_lock(&dev->struct_mutex);
-        filp->f_mapping = old_imapping;
-        inode->i_mapping = old_imapping;
-        iput(container_of(dev->dev_mapping, struct inode, i_data));
-        dev->dev_mapping = old_mapping;
-        mutex_unlock(&dev->struct_mutex);
         dev->open_count--;
+        drm_minor_release(minor);
         return retcode;
 }
 EXPORT_SYMBOL(drm_open);
@@ -143,33 +123,30 @@ EXPORT_SYMBOL(drm_open);
  */
 int drm_stub_open(struct inode *inode, struct file *filp)
 {
-        struct drm_device *dev = NULL;
+        struct drm_device *dev;
         struct drm_minor *minor;
-        int minor_id = iminor(inode);
         int err = -ENODEV;
         const struct file_operations *new_fops;
 
         DRM_DEBUG("\n");
 
         mutex_lock(&drm_global_mutex);
-        minor = idr_find(&drm_minors_idr, minor_id);
-        if (!minor)
-                goto out;
-
-        if (!(dev = minor->dev))
-                goto out;
-
-        if (drm_device_is_unplugged(dev))
-                goto out;
+        minor = drm_minor_acquire(iminor(inode));
+        if (IS_ERR(minor))
+                goto out_unlock;
 
+        dev = minor->dev;
         new_fops = fops_get(dev->driver->fops);
         if (!new_fops)
-                goto out;
+                goto out_release;
 
         replace_fops(filp, new_fops);
         if (filp->f_op->open)
                 err = filp->f_op->open(inode, filp);
-out:
+
+out_release:
+        drm_minor_release(minor);
+out_unlock:
         mutex_unlock(&drm_global_mutex);
         return err;
 }
@@ -196,16 +173,16 @@ static int drm_cpu_valid(void)
  *
  * \param inode device inode.
  * \param filp file pointer.
- * \param dev device.
+ * \param minor acquired minor-object.
  * \return zero on success or a negative number on failure.
  *
  * Creates and initializes a drm_file structure for the file private data in \p
  * filp and add it into the double linked list in \p dev.
  */
 static int drm_open_helper(struct inode *inode, struct file *filp,
-                           struct drm_device * dev)
+                           struct drm_minor *minor)
 {
-        int minor_id = iminor(inode);
+        struct drm_device *dev = minor->dev;
         struct drm_file *priv;
         int ret;
 
@@ -216,7 +193,7 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
         if (dev->switch_power_state != DRM_SWITCH_POWER_ON && dev->switch_power_state != DRM_SWITCH_POWER_DYNAMIC_OFF)
                 return -EINVAL;
 
-        DRM_DEBUG("pid = %d, minor = %d\n", task_pid_nr(current), minor_id);
+        DRM_DEBUG("pid = %d, minor = %d\n", task_pid_nr(current), minor->index);
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv)
@@ -226,11 +203,7 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
         priv->filp = filp;
         priv->uid = current_euid();
         priv->pid = get_pid(task_pid(current));
-        priv->minor = idr_find(&drm_minors_idr, minor_id);
-        if (!priv->minor) {
-                ret = -ENODEV;
-                goto out_put_pid;
-        }
+        priv->minor = minor;
 
         /* for compatibility root is always authenticated */
         priv->always_authenticated = capable(CAP_SYS_ADMIN);
@@ -336,7 +309,6 @@ out_prime_destroy:
                 drm_prime_destroy_file_private(&priv->prime);
         if (dev->driver->driver_features & DRIVER_GEM)
                 drm_gem_release(dev, priv);
-out_put_pid:
         put_pid(priv->pid);
         kfree(priv);
         filp->private_data = NULL;
@@ -434,7 +406,6 @@ int drm_lastclose(struct drm_device * dev)
 
         drm_legacy_dma_takedown(dev);
 
-        dev->dev_mapping = NULL;
         mutex_unlock(&dev->struct_mutex);
 
         drm_legacy_dev_reinit(dev);
@@ -458,7 +429,8 @@ int drm_lastclose(struct drm_device * dev)
 int drm_release(struct inode *inode, struct file *filp)
 {
         struct drm_file *file_priv = filp->private_data;
-        struct drm_device *dev = file_priv->minor->dev;
+        struct drm_minor *minor = file_priv->minor;
+        struct drm_device *dev = minor->dev;
         int retcode = 0;
 
         mutex_lock(&drm_global_mutex);
@@ -474,7 +446,7 @@ int drm_release(struct inode *inode, struct file *filp)
 
         DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
                   task_pid_nr(current),
-                  (long)old_encode_dev(file_priv->minor->device),
+                  (long)old_encode_dev(file_priv->minor->kdev->devt),
                   dev->open_count);
 
         /* Release any auth tokens that might point to this file_priv,
@@ -549,9 +521,6 @@ int drm_release(struct inode *inode, struct file *filp)
                 }
         }
 
-        BUG_ON(dev->dev_mapping == NULL);
-        iput(container_of(dev->dev_mapping, struct inode, i_data));
-
         /* drop the reference held my the file priv */
         if (file_priv->master)
                 drm_master_put(&file_priv->master);
@@ -580,6 +549,8 @@ int drm_release(struct inode *inode, struct file *filp)
         }
         mutex_unlock(&drm_global_mutex);
 
+        drm_minor_release(minor);
+
         return retcode;
 }
 EXPORT_SYMBOL(drm_release);
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 5bbad873c798..9909bef59800 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -85,9 +85,9 @@
 #endif
 
 /**
- * Initialize the GEM device fields
+ * drm_gem_init - Initialize the GEM device fields
+ * @dev: drm_devic structure to initialize
  */
-
 int
 drm_gem_init(struct drm_device *dev)
 {
@@ -120,6 +120,11 @@ drm_gem_destroy(struct drm_device *dev)
 }
 
 /**
+ * drm_gem_object_init - initialize an allocated shmem-backed GEM object
+ * @dev: drm_device the object should be initialized for
+ * @obj: drm_gem_object to initialize
+ * @size: object size
+ *
  * Initialize an already allocated GEM object of the specified size with
  * shmfs backing store.
  */
@@ -141,6 +146,11 @@ int drm_gem_object_init(struct drm_device *dev,
 EXPORT_SYMBOL(drm_gem_object_init);
 
 /**
+ * drm_gem_object_init - initialize an allocated private GEM object
+ * @dev: drm_device the object should be initialized for
+ * @obj: drm_gem_object to initialize
+ * @size: object size
+ *
  * Initialize an already allocated GEM object of the specified size with
  * no GEM provided backing store. Instead the caller is responsible for
  * backing the object and handling it.
@@ -176,6 +186,9 @@ drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp)
 }
 
 /**
+ * drm_gem_object_free - release resources bound to userspace handles
+ * @obj: GEM object to clean up.
+ *
  * Called after the last handle to the object has been closed
  *
  * Removes any name for the object. Note that this must be
@@ -225,7 +238,12 @@ drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj)
 }
 
 /**
- * Removes the mapping from handle to filp for this object.
+ * drm_gem_handle_delete - deletes the given file-private handle
+ * @filp: drm file-private structure to use for the handle look up
+ * @handle: userspace handle to delete
+ *
+ * Removes the GEM handle from the @filp lookup table and if this is the last
+ * handle also cleans up linked resources like GEM names.
  */
 int
 drm_gem_handle_delete(struct drm_file *filp, u32 handle)
@@ -270,6 +288,9 @@ EXPORT_SYMBOL(drm_gem_handle_delete);
 
 /**
  * drm_gem_dumb_destroy - dumb fb callback helper for gem based drivers
+ * @file: drm file-private structure to remove the dumb handle from
+ * @dev: corresponding drm_device
+ * @handle: the dumb handle to remove
  * 
  * This implements the ->dumb_destroy kms driver callback for drivers which use
  * gem to manage their backing storage.
@@ -284,6 +305,9 @@ EXPORT_SYMBOL(drm_gem_dumb_destroy);
 
 /**
  * drm_gem_handle_create_tail - internal functions to create a handle
+ * @file_priv: drm file-private structure to register the handle for
+ * @obj: object to register
+ * @handlep: pionter to return the created handle to the caller
  * 
  * This expects the dev->object_name_lock to be held already and will drop it
  * before returning. Used to avoid races in establishing new handles when
@@ -336,6 +360,11 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
 }
 
 /**
+ * gem_handle_create - create a gem handle for an object
+ * @file_priv: drm file-private structure to register the handle for
+ * @obj: object to register
+ * @handlep: pionter to return the created handle to the caller
+ *
  * Create a handle for this object. This adds a handle reference
  * to the object, which includes a regular reference count. Callers
  * will likely want to dereference the object afterwards.
@@ -536,6 +565,11 @@ drm_gem_object_lookup(struct drm_device *dev, struct drm_file *filp,
 EXPORT_SYMBOL(drm_gem_object_lookup);
 
 /**
+ * drm_gem_close_ioctl - implementation of the GEM_CLOSE ioctl
+ * @dev: drm_device
+ * @data: ioctl data
+ * @file_priv: drm file-private structure
+ *
  * Releases the handle to an mm object.
  */
 int
@@ -554,6 +588,11 @@ drm_gem_close_ioctl(struct drm_device *dev, void *data,
 }
 
 /**
+ * drm_gem_flink_ioctl - implementation of the GEM_FLINK ioctl
+ * @dev: drm_device
+ * @data: ioctl data
+ * @file_priv: drm file-private structure
+ *
  * Create a global name for an object, returning the name.
  *
  * Note that the name does not hold a reference; when the object
@@ -601,6 +640,11 @@ err:
 }
 
 /**
+ * drm_gem_open - implementation of the GEM_OPEN ioctl
+ * @dev: drm_device
+ * @data: ioctl data
+ * @file_priv: drm file-private structure
+ *
  * Open an object using the global name, returning a handle and the size.
  *
  * This handle (of course) holds a reference to the object, so the object
@@ -640,6 +684,10 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
 }
 
 /**
+ * gem_gem_open - initalizes GEM file-private structures at devnode open time
+ * @dev: drm_device which is being opened by userspace
+ * @file_private: drm file-private structure to set up
+ *
  * Called at device open time, sets up the structure for handling refcounting
  * of mm objects.
  */
@@ -650,7 +698,7 @@ drm_gem_open(struct drm_device *dev, struct drm_file *file_private)
         spin_lock_init(&file_private->table_lock);
 }
 
-/**
+/*
  * Called at device close to release the file's
  * handle references on objects.
  */
@@ -674,6 +722,10 @@ drm_gem_object_release_handle(int id, void *ptr, void *data)
 }
 
 /**
+ * drm_gem_release - release file-private GEM resources
+ * @dev: drm_device which is being closed by userspace
+ * @file_private: drm file-private structure to clean up
+ *
  * Called at close time when the filp is going away.
  *
  * Releases any remaining references on objects by this filp.
@@ -692,11 +744,16 @@ drm_gem_object_release(struct drm_gem_object *obj)
         WARN_ON(obj->dma_buf);
 
         if (obj->filp)
-            fput(obj->filp);
+                fput(obj->filp);
+
+        drm_gem_free_mmap_offset(obj);
 }
 EXPORT_SYMBOL(drm_gem_object_release);
 
 /**
+ * drm_gem_object_free - free a GEM object
+ * @kref: kref of the object to free
+ *
  * Called after the last reference to the object has been lost.
  * Must be called holding struct_ mutex
  *
@@ -782,7 +839,7 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size,
         vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;
         vma->vm_ops = dev->driver->gem_vm_ops;
         vma->vm_private_data = obj;
-        vma->vm_page_prot =  pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
+        vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
 
         /* Take a ref for this mapping of the object, so that the fault
          * handler can dereference the mmap offset's pointer to the object.
@@ -818,7 +875,7 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
         struct drm_device *dev = priv->minor->dev;
         struct drm_gem_object *obj;
         struct drm_vma_offset_node *node;
-        int ret = 0;
+        int ret;
 
         if (drm_device_is_unplugged(dev))
                 return -ENODEV;
diff --git a/drivers/gpu/drm/drm_gem_cma_helper.c b/drivers/gpu/drm/drm_gem_cma_helper.c
index 6b51bf90df0e..2c07cb9550ef 100644
--- a/drivers/gpu/drm/drm_gem_cma_helper.c
+++ b/drivers/gpu/drm/drm_gem_cma_helper.c
@@ -79,7 +79,6 @@ struct drm_gem_cma_object *drm_gem_cma_create(struct drm_device *drm,
                 unsigned int size)
 {
         struct drm_gem_cma_object *cma_obj;
-        struct sg_table *sgt = NULL;
         int ret;
 
         size = round_up(size, PAGE_SIZE);
@@ -97,23 +96,9 @@ struct drm_gem_cma_object *drm_gem_cma_create(struct drm_device *drm,
                 goto error;
         }
 
-        sgt = kzalloc(sizeof(*cma_obj->sgt), GFP_KERNEL);
-        if (sgt == NULL) {
-                ret = -ENOMEM;
-                goto error;
-        }
-
-        ret = dma_get_sgtable(drm->dev, sgt, cma_obj->vaddr,
-                              cma_obj->paddr, size);
-        if (ret < 0)
-                goto error;
-
-        cma_obj->sgt = sgt;
-
         return cma_obj;
 
 error:
-        kfree(sgt);
         drm_gem_cma_free_object(&cma_obj->base);
         return ERR_PTR(ret);
 }
@@ -175,10 +160,6 @@ void drm_gem_cma_free_object(struct drm_gem_object *gem_obj)
         if (cma_obj->vaddr) {
                 dma_free_writecombine(gem_obj->dev->dev, cma_obj->base.size,
                                       cma_obj->vaddr, cma_obj->paddr);
-                if (cma_obj->sgt) {
-                        sg_free_table(cma_obj->sgt);
-                        kfree(cma_obj->sgt);
-                }
         } else if (gem_obj->import_attach) {
                 drm_prime_gem_destroy(gem_obj, cma_obj->sgt);
         }
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index af93cc55259f..a2d45b748f86 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -47,7 +47,44 @@
 #include <linux/seq_file.h>
 #include <linux/export.h>
 
-#define MM_UNUSED_TARGET 4
+/**
+ * DOC: Overview
+ *
+ * drm_mm provides a simple range allocator. The drivers are free to use the
+ * resource allocator from the linux core if it suits them, the upside of drm_mm
+ * is that it's in the DRM core. Which means that it's easier to extend for
+ * some of the crazier special purpose needs of gpus.
+ *
+ * The main data struct is &drm_mm, allocations are tracked in &drm_mm_node.
+ * Drivers are free to embed either of them into their own suitable
+ * datastructures. drm_mm itself will not do any allocations of its own, so if
+ * drivers choose not to embed nodes they need to still allocate them
+ * themselves.
+ *
+ * The range allocator also supports reservation of preallocated blocks. This is
+ * useful for taking over initial mode setting configurations from the firmware,
+ * where an object needs to be created which exactly matches the firmware's
+ * scanout target. As long as the range is still free it can be inserted anytime
+ * after the allocator is initialized, which helps with avoiding looped
+ * depencies in the driver load sequence.
+ *
+ * drm_mm maintains a stack of most recently freed holes, which of all
+ * simplistic datastructures seems to be a fairly decent approach to clustering
+ * allocations and avoiding too much fragmentation. This means free space
+ * searches are O(num_holes). Given that all the fancy features drm_mm supports
+ * something better would be fairly complex and since gfx thrashing is a fairly
+ * steep cliff not a real concern. Removing a node again is O(1).
+ *
+ * drm_mm supports a few features: Alignment and range restrictions can be
+ * supplied. Further more every &drm_mm_node has a color value (which is just an
+ * opaqua unsigned long) which in conjunction with a driver callback can be used
+ * to implement sophisticated placement restrictions. The i915 DRM driver uses
+ * this to implement guard pages between incompatible caching domains in the
+ * graphics TT.
+ *
+ * Finally iteration helpers to walk all nodes and all holes are provided as are
+ * some basic allocator dumpers for debugging.
+ */
 
 static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
                                                 unsigned long size,
@@ -107,6 +144,20 @@ static void drm_mm_insert_helper(struct drm_mm_node *hole_node,
         }
 }
 
+/**
+ * drm_mm_reserve_node - insert an pre-initialized node
+ * @mm: drm_mm allocator to insert @node into
+ * @node: drm_mm_node to insert
+ *
+ * This functions inserts an already set-up drm_mm_node into the allocator,
+ * meaning that start, size and color must be set by the caller. This is useful
+ * to initialize the allocator with preallocated objects which must be set-up
+ * before the range allocator can be set-up, e.g. when taking over a firmware
+ * framebuffer.
+ *
+ * Returns:
+ * 0 on success, -ENOSPC if there's no hole where @node is.
+ */
 int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node)
 {
         struct drm_mm_node *hole;
@@ -148,9 +199,18 @@ int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node)
 EXPORT_SYMBOL(drm_mm_reserve_node);
 
 /**
- * Search for free space and insert a preallocated memory node. Returns
- * -ENOSPC if no suitable free area is available. The preallocated memory node
- * must be cleared.
+ * drm_mm_insert_node_generic - search for space and insert @node
+ * @mm: drm_mm to allocate from
+ * @node: preallocate node to insert
+ * @size: size of the allocation
+ * @alignment: alignment of the allocation
+ * @color: opaque tag value to use for this node
+ * @flags: flags to fine-tune the allocation
+ *
+ * The preallocated node must be cleared to 0.
+ *
+ * Returns:
+ * 0 on success, -ENOSPC if there's no suitable hole.
  */
 int drm_mm_insert_node_generic(struct drm_mm *mm, struct drm_mm_node *node,
                                unsigned long size, unsigned alignment,
@@ -222,9 +282,20 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
 }
 
 /**
- * Search for free space and insert a preallocated memory node. Returns
- * -ENOSPC if no suitable free area is available. This is for range
- * restricted allocations. The preallocated memory node must be cleared.
+ * drm_mm_insert_node_in_range_generic - ranged search for space and insert @node
+ * @mm: drm_mm to allocate from
+ * @node: preallocate node to insert
+ * @size: size of the allocation
+ * @alignment: alignment of the allocation
+ * @color: opaque tag value to use for this node
+ * @start: start of the allowed range for this node
+ * @end: end of the allowed range for this node
+ * @flags: flags to fine-tune the allocation
+ *
+ * The preallocated node must be cleared to 0.
+ *
+ * Returns:
+ * 0 on success, -ENOSPC if there's no suitable hole.
  */
 int drm_mm_insert_node_in_range_generic(struct drm_mm *mm, struct drm_mm_node *node,
                                         unsigned long size, unsigned alignment, unsigned long color,
@@ -247,7 +318,12 @@ int drm_mm_insert_node_in_range_generic(struct drm_mm *mm, struct drm_mm_node *n
 EXPORT_SYMBOL(drm_mm_insert_node_in_range_generic);
 
 /**
- * Remove a memory node from the allocator.
+ * drm_mm_remove_node - Remove a memory node from the allocator.
+ * @node: drm_mm_node to remove
+ *
+ * This just removes a node from its drm_mm allocator. The node does not need to
+ * be cleared again before it can be re-inserted into this or any other drm_mm
+ * allocator. It is a bug to call this function on a un-allocated node.
  */
 void drm_mm_remove_node(struct drm_mm_node *node)
 {
@@ -384,7 +460,13 @@ static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_
 }
 
 /**
- * Moves an allocation. To be used with embedded struct drm_mm_node.
+ * drm_mm_replace_node - move an allocation from @old to @new
+ * @old: drm_mm_node to remove from the allocator
+ * @new: drm_mm_node which should inherit @old's allocation
+ *
+ * This is useful for when drivers embed the drm_mm_node structure and hence
+ * can't move allocations by reassigning pointers. It's a combination of remove
+ * and insert with the guarantee that the allocation start will match.
  */
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new)
 {
@@ -402,12 +484,46 @@ void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new)
 EXPORT_SYMBOL(drm_mm_replace_node);
 
 /**
- * Initializa lru scanning.
+ * DOC: lru scan roaster
+ *
+ * Very often GPUs need to have continuous allocations for a given object. When
+ * evicting objects to make space for a new one it is therefore not most
+ * efficient when we simply start to select all objects from the tail of an LRU
+ * until there's a suitable hole: Especially for big objects or nodes that
+ * otherwise have special allocation constraints there's a good chance we evict
+ * lots of (smaller) objects unecessarily.
+ *
+ * The DRM range allocator supports this use-case through the scanning
+ * interfaces. First a scan operation needs to be initialized with
+ * drm_mm_init_scan() or drm_mm_init_scan_with_range(). The the driver adds
+ * objects to the roaster (probably by walking an LRU list, but this can be
+ * freely implemented) until a suitable hole is found or there's no further
+ * evitable object.
+ *
+ * The the driver must walk through all objects again in exactly the reverse
+ * order to restore the allocator state. Note that while the allocator is used
+ * in the scan mode no other operation is allowed.
+ *
+ * Finally the driver evicts all objects selected in the scan. Adding and
+ * removing an object is O(1), and since freeing a node is also O(1) the overall
+ * complexity is O(scanned_objects). So like the free stack which needs to be
+ * walked before a scan operation even begins this is linear in the number of
+ * objects. It doesn't seem to hurt badly.
+ */
+
+/**
+ * drm_mm_init_scan - initialize lru scanning
+ * @mm: drm_mm to scan
+ * @size: size of the allocation
+ * @alignment: alignment of the allocation
+ * @color: opaque tag value to use for the allocation
  *
  * This simply sets up the scanning routines with the parameters for the desired
- * hole.
+ * hole. Note that there's no need to specify allocation flags, since they only
+ * change the place a node is allocated from within a suitable hole.
  *
- * Warning: As long as the scan list is non-empty, no other operations than
+ * Warning:
+ * As long as the scan list is non-empty, no other operations than
  * adding/removing nodes to/from the scan list are allowed.
  */
 void drm_mm_init_scan(struct drm_mm *mm,
@@ -427,12 +543,20 @@ void drm_mm_init_scan(struct drm_mm *mm,
 EXPORT_SYMBOL(drm_mm_init_scan);
 
 /**
- * Initializa lru scanning.
+ * drm_mm_init_scan - initialize range-restricted lru scanning
+ * @mm: drm_mm to scan
+ * @size: size of the allocation
+ * @alignment: alignment of the allocation
+ * @color: opaque tag value to use for the allocation
+ * @start: start of the allowed range for the allocation
+ * @end: end of the allowed range for the allocation
  *
  * This simply sets up the scanning routines with the parameters for the desired
- * hole. This version is for range-restricted scans.
+ * hole. Note that there's no need to specify allocation flags, since they only
+ * change the place a node is allocated from within a suitable hole.
  *
- * Warning: As long as the scan list is non-empty, no other operations than
+ * Warning:
+ * As long as the scan list is non-empty, no other operations than
  * adding/removing nodes to/from the scan list are allowed.
  */
 void drm_mm_init_scan_with_range(struct drm_mm *mm,
@@ -456,12 +580,16 @@ void drm_mm_init_scan_with_range(struct drm_mm *mm,
 EXPORT_SYMBOL(drm_mm_init_scan_with_range);
 
 /**
+ * drm_mm_scan_add_block - add a node to the scan list
+ * @node: drm_mm_node to add
+ *
  * Add a node to the scan list that might be freed to make space for the desired
  * hole.
  *
- * Returns non-zero, if a hole has been found, zero otherwise.
+ * Returns:
+ * True if a hole has been found, false otherwise.
  */
-int drm_mm_scan_add_block(struct drm_mm_node *node)
+bool drm_mm_scan_add_block(struct drm_mm_node *node)
 {
         struct drm_mm *mm = node->mm;
         struct drm_mm_node *prev_node;
@@ -501,15 +629,16 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
                             mm->scan_size, mm->scan_alignment)) {
                 mm->scan_hit_start = hole_start;
                 mm->scan_hit_end = hole_end;
-                return 1;
+                return true;
         }
 
-        return 0;
+        return false;
 }
 EXPORT_SYMBOL(drm_mm_scan_add_block);
 
 /**
- * Remove a node from the scan list.
+ * drm_mm_scan_remove_block - remove a node from the scan list
+ * @node: drm_mm_node to remove
  *
  * Nodes _must_ be removed in the exact same order from the scan list as they
  * have been added, otherwise the internal state of the memory manager will be
@@ -519,10 +648,11 @@ EXPORT_SYMBOL(drm_mm_scan_add_block);
  * immediately following drm_mm_search_free with !DRM_MM_SEARCH_BEST will then
  * return the just freed block (because its at the top of the free_stack list).
  *
- * Returns one if this block should be evicted, zero otherwise. Will always
- * return zero when no hole has been found.
+ * Returns:
+ * True if this block should be evicted, false otherwise. Will always
+ * return false when no hole has been found.
  */
-int drm_mm_scan_remove_block(struct drm_mm_node *node)
+bool drm_mm_scan_remove_block(struct drm_mm_node *node)
 {
         struct drm_mm *mm = node->mm;
         struct drm_mm_node *prev_node;
@@ -543,7 +673,15 @@ int drm_mm_scan_remove_block(struct drm_mm_node *node)
 }
 EXPORT_SYMBOL(drm_mm_scan_remove_block);
 
-int drm_mm_clean(struct drm_mm * mm)
+/**
+ * drm_mm_clean - checks whether an allocator is clean
+ * @mm: drm_mm allocator to check
+ *
+ * Returns:
+ * True if the allocator is completely free, false if there's still a node
+ * allocated in it.
+ */
+bool drm_mm_clean(struct drm_mm * mm)
 {
         struct list_head *head = &mm->head_node.node_list;
 
@@ -551,6 +689,14 @@ int drm_mm_clean(struct drm_mm * mm)
 }
 EXPORT_SYMBOL(drm_mm_clean);
 
+/**
+ * drm_mm_init - initialize a drm-mm allocator
+ * @mm: the drm_mm structure to initialize
+ * @start: start of the range managed by @mm
+ * @size: end of the range managed by @mm
+ *
+ * Note that @mm must be cleared to 0 before calling this function.
+ */
 void drm_mm_init(struct drm_mm * mm, unsigned long start, unsigned long size)
 {
         INIT_LIST_HEAD(&mm->hole_stack);
@@ -572,6 +718,13 @@ void drm_mm_init(struct drm_mm * mm, unsigned long start, unsigned long size)
 }
 EXPORT_SYMBOL(drm_mm_init);
 
+/**
+ * drm_mm_takedown - clean up a drm_mm allocator
+ * @mm: drm_mm allocator to clean up
+ *
+ * Note that it is a bug to call this function on an allocator which is not
+ * clean.
+ */
 void drm_mm_takedown(struct drm_mm * mm)
 {
         WARN(!list_empty(&mm->head_node.node_list),
@@ -597,6 +750,11 @@ static unsigned long drm_mm_debug_hole(struct drm_mm_node *entry,
         return 0;
 }
 
+/**
+ * drm_mm_debug_table - dump allocator state to dmesg
+ * @mm: drm_mm allocator to dump
+ * @prefix: prefix to use for dumping to dmesg
+ */
 void drm_mm_debug_table(struct drm_mm *mm, const char *prefix)
 {
         struct drm_mm_node *entry;
@@ -635,6 +793,11 @@ static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *en
         return 0;
 }
 
+/**
+ * drm_mm_dump_table - dump allocator state to a seq_file
+ * @m: seq_file to dump to
+ * @mm: drm_mm allocator to dump
+ */
 int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
 {
         struct drm_mm_node *entry;
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index b0733153dfd2..8b410576fce4 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -37,15 +37,14 @@
 #include <drm/drm_crtc.h>
 #include <video/of_videomode.h>
 #include <video/videomode.h>
+#include <drm/drm_modes.h>
+
+#include "drm_crtc_internal.h"
 
 /**
- * drm_mode_debug_printmodeline - debug print a mode
- * @dev: DRM device
+ * drm_mode_debug_printmodeline - print a mode to dmesg
  * @mode: mode to print
  *
- * LOCKING:
- * None.
- *
  * Describe @mode using DRM_DEBUG.
  */
 void drm_mode_debug_printmodeline(const struct drm_display_mode *mode)
@@ -61,18 +60,77 @@ void drm_mode_debug_printmodeline(const struct drm_display_mode *mode)
 EXPORT_SYMBOL(drm_mode_debug_printmodeline);
 
 /**
- * drm_cvt_mode -create a modeline based on CVT algorithm
+ * drm_mode_create - create a new display mode
  * @dev: DRM device
- * @hdisplay: hdisplay size
- * @vdisplay: vdisplay size
- * @vrefresh  : vrefresh rate
- * @reduced : Whether the GTF calculation is simplified
- * @interlaced:Whether the interlace is supported
  *
- * LOCKING:
- * none.
+ * Create a new, cleared drm_display_mode with kzalloc, allocate an ID for it
+ * and return it.
  *
- * return the modeline based on CVT algorithm
+ * Returns:
+ * Pointer to new mode on success, NULL on error.
+ */
+struct drm_display_mode *drm_mode_create(struct drm_device *dev)
+{
+        struct drm_display_mode *nmode;
+
+        nmode = kzalloc(sizeof(struct drm_display_mode), GFP_KERNEL);
+        if (!nmode)
+                return NULL;
+
+        if (drm_mode_object_get(dev, &nmode->base, DRM_MODE_OBJECT_MODE)) {
+                kfree(nmode);
+                return NULL;
+        }
+
+        return nmode;
+}
+EXPORT_SYMBOL(drm_mode_create);
+
+/**
+ * drm_mode_destroy - remove a mode
+ * @dev: DRM device
+ * @mode: mode to remove
+ *
+ * Release @mode's unique ID, then free it @mode structure itself using kfree.
+ */
+void drm_mode_destroy(struct drm_device *dev, struct drm_display_mode *mode)
+{
+        if (!mode)
+                return;
+
+        drm_mode_object_put(dev, &mode->base);
+
+        kfree(mode);
+}
+EXPORT_SYMBOL(drm_mode_destroy);
+
+/**
+ * drm_mode_probed_add - add a mode to a connector's probed_mode list
+ * @connector: connector the new mode
+ * @mode: mode data
+ *
+ * Add @mode to @connector's probed_mode list for later use. This list should
+ * then in a second step get filtered and all the modes actually supported by
+ * the hardware moved to the @connector's modes list.
+ */
+void drm_mode_probed_add(struct drm_connector *connector,
+                         struct drm_display_mode *mode)
+{
+        WARN_ON(!mutex_is_locked(&connector->dev->mode_config.mutex));
+
+        list_add_tail(&mode->head, &connector->probed_modes);
+}
+EXPORT_SYMBOL(drm_mode_probed_add);
+
+/**
+ * drm_cvt_mode -create a modeline based on the CVT algorithm
+ * @dev: drm device
+ * @hdisplay: hdisplay size
+ * @vdisplay: vdisplay size
+ * @vrefresh: vrefresh rate
+ * @reduced: whether to use reduced blanking
+ * @interlaced: whether to compute an interlaced mode
+ * @margins: whether to add margins (borders)
  *
  * This function is called to generate the modeline based on CVT algorithm
  * according to the hdisplay, vdisplay, vrefresh.
@@ -82,12 +140,17 @@ EXPORT_SYMBOL(drm_mode_debug_printmodeline);
  *
  * And it is copied from xf86CVTmode in xserver/hw/xfree86/modes/xf86cvt.c.
  * What I have done is to translate it by using integer calculation.
+ *
+ * Returns:
+ * The modeline based on the CVT algorithm stored in a drm_display_mode object.
+ * The display mode object is allocated with drm_mode_create(). Returns NULL
+ * when no mode could be allocated.
  */
-#define HV_FACTOR                       1000
 struct drm_display_mode *drm_cvt_mode(struct drm_device *dev, int hdisplay,
                                       int vdisplay, int vrefresh,
                                       bool reduced, bool interlaced, bool margins)
 {
+#define HV_FACTOR                       1000
         /* 1) top/bottom margin size (% of height) - default: 1.8, */
 #define CVT_MARGIN_PERCENTAGE           18
         /* 2) character cell horizontal granularity (pixels) - default 8 */
@@ -281,23 +344,25 @@ struct drm_display_mode *drm_cvt_mode(struct drm_device *dev, int hdisplay,
 EXPORT_SYMBOL(drm_cvt_mode);
 
 /**
- * drm_gtf_mode_complex - create the modeline based on full GTF algorithm
- *
- * @dev         :drm device
- * @hdisplay    :hdisplay size
- * @vdisplay    :vdisplay size
- * @vrefresh    :vrefresh rate.
- * @interlaced  :whether the interlace is supported
- * @margins     :desired margin size
- * @GTF_[MCKJ]  :extended GTF formula parameters
- *
- * LOCKING.
- * none.
- *
- * return the modeline based on full GTF algorithm.
+ * drm_gtf_mode_complex - create the modeline based on the full GTF algorithm
+ * @dev: drm device
+ * @hdisplay: hdisplay size
+ * @vdisplay: vdisplay size
+ * @vrefresh: vrefresh rate.
+ * @interlaced: whether to compute an interlaced mode
+ * @margins: desired margin (borders) size
+ * @GTF_M: extended GTF formula parameters
+ * @GTF_2C: extended GTF formula parameters
+ * @GTF_K: extended GTF formula parameters
+ * @GTF_2J: extended GTF formula parameters
  *
  * GTF feature blocks specify C and J in multiples of 0.5, so we pass them
  * in here multiplied by two.  For a C of 40, pass in 80.
+ *
+ * Returns:
+ * The modeline based on the full GTF algorithm stored in a drm_display_mode object.
+ * The display mode object is allocated with drm_mode_create(). Returns NULL
+ * when no mode could be allocated.
  */
 struct drm_display_mode *
 drm_gtf_mode_complex(struct drm_device *dev, int hdisplay, int vdisplay,
@@ -467,17 +532,13 @@ drm_gtf_mode_complex(struct drm_device *dev, int hdisplay, int vdisplay,
 EXPORT_SYMBOL(drm_gtf_mode_complex);
 
 /**
- * drm_gtf_mode - create the modeline based on GTF algorithm
- *
- * @dev         :drm device
- * @hdisplay    :hdisplay size
- * @vdisplay    :vdisplay size
- * @vrefresh    :vrefresh rate.
- * @interlaced  :whether the interlace is supported
- * @margins     :whether the margin is supported
- *
- * LOCKING.
- * none.
+ * drm_gtf_mode - create the modeline based on the GTF algorithm
+ * @dev: drm device
+ * @hdisplay: hdisplay size
+ * @vdisplay: vdisplay size
+ * @vrefresh: vrefresh rate.
+ * @interlaced: whether to compute an interlaced mode
+ * @margins: desired margin (borders) size
  *
  * return the modeline based on GTF algorithm
  *
@@ -496,19 +557,32 @@ EXPORT_SYMBOL(drm_gtf_mode_complex);
  * C = 40
  * K = 128
  * J = 20
+ *
+ * Returns:
+ * The modeline based on the GTF algorithm stored in a drm_display_mode object.
+ * The display mode object is allocated with drm_mode_create(). Returns NULL
+ * when no mode could be allocated.
  */
 struct drm_display_mode *
 drm_gtf_mode(struct drm_device *dev, int hdisplay, int vdisplay, int vrefresh,
-             bool lace, int margins)
+             bool interlaced, int margins)
 {
-        return drm_gtf_mode_complex(dev, hdisplay, vdisplay, vrefresh, lace,
-                                    margins, 600, 40 * 2, 128, 20 * 2);
+        return drm_gtf_mode_complex(dev, hdisplay, vdisplay, vrefresh,
+                                    interlaced, margins,
+                                    600, 40 * 2, 128, 20 * 2);
 }
 EXPORT_SYMBOL(drm_gtf_mode);
 
 #ifdef CONFIG_VIDEOMODE_HELPERS
-int drm_display_mode_from_videomode(const struct videomode *vm,
-                                    struct drm_display_mode *dmode)
+/**
+ * drm_display_mode_from_videomode - fill in @dmode using @vm,
+ * @vm: videomode structure to use as source
+ * @dmode: drm_display_mode structure to use as destination
+ *
+ * Fills out @dmode using the display mode specified in @vm.
+ */
+void drm_display_mode_from_videomode(const struct videomode *vm,
+                                     struct drm_display_mode *dmode)
 {
         dmode->hdisplay = vm->hactive;
         dmode->hsync_start = dmode->hdisplay + vm->hfront_porch;
@@ -538,8 +612,6 @@ int drm_display_mode_from_videomode(const struct videomode *vm,
         if (vm->flags & DISPLAY_FLAGS_DOUBLECLK)
                 dmode->flags |= DRM_MODE_FLAG_DBLCLK;
         drm_mode_set_name(dmode);
-
-        return 0;
 }
 EXPORT_SYMBOL_GPL(drm_display_mode_from_videomode);
 
@@ -553,6 +625,9 @@ EXPORT_SYMBOL_GPL(drm_display_mode_from_videomode);
  * This function is expensive and should only be used, if only one mode is to be
  * read from DT. To get multiple modes start with of_get_display_timings and
  * work with that instead.
+ *
+ * Returns:
+ * 0 on success, a negative errno code when no of videomode node was found.
  */
 int of_get_drm_display_mode(struct device_node *np,
                             struct drm_display_mode *dmode, int index)
@@ -580,10 +655,8 @@ EXPORT_SYMBOL_GPL(of_get_drm_display_mode);
  * drm_mode_set_name - set the name on a mode
  * @mode: name will be set in this mode
  *
- * LOCKING:
- * None.
- *
- * Set the name of @mode to a standard format.
+ * Set the name of @mode to a standard format which is <hdisplay>x<vdisplay>
+ * with an optional 'i' suffix for interlaced modes.
  */
 void drm_mode_set_name(struct drm_display_mode *mode)
 {
@@ -595,54 +668,12 @@ void drm_mode_set_name(struct drm_display_mode *mode)
 }
 EXPORT_SYMBOL(drm_mode_set_name);
 
-/**
- * drm_mode_width - get the width of a mode
- * @mode: mode
- *
- * LOCKING:
- * None.
- *
- * Return @mode's width (hdisplay) value.
- *
- * FIXME: is this needed?
- *
- * RETURNS:
- * @mode->hdisplay
- */
-int drm_mode_width(const struct drm_display_mode *mode)
-{
-        return mode->hdisplay;
-
-}
-EXPORT_SYMBOL(drm_mode_width);
-
-/**
- * drm_mode_height - get the height of a mode
- * @mode: mode
- *
- * LOCKING:
- * None.
- *
- * Return @mode's height (vdisplay) value.
- *
- * FIXME: is this needed?
- *
- * RETURNS:
- * @mode->vdisplay
- */
-int drm_mode_height(const struct drm_display_mode *mode)
-{
-        return mode->vdisplay;
-}
-EXPORT_SYMBOL(drm_mode_height);
-
 /** drm_mode_hsync - get the hsync of a mode
  * @mode: mode
  *
- * LOCKING:
- * None.
- *
- * Return @modes's hsync rate in kHz, rounded to the nearest int.
+ * Returns:
+ * @modes's hsync rate in kHz, rounded to the nearest integer. Calculates the
+ * value first if it is not yet set.
  */
 int drm_mode_hsync(const struct drm_display_mode *mode)
 {
@@ -666,17 +697,9 @@ EXPORT_SYMBOL(drm_mode_hsync);
  * drm_mode_vrefresh - get the vrefresh of a mode
  * @mode: mode
  *
- * LOCKING:
- * None.
- *
- * Return @mode's vrefresh rate in Hz or calculate it if necessary.
- *
- * FIXME: why is this needed?  shouldn't vrefresh be set already?
- *
- * RETURNS:
- * Vertical refresh rate. It will be the result of actual value plus 0.5.
- * If it is 70.288, it will return 70Hz.
- * If it is 59.6, it will return 60Hz.
+ * Returns:
+ * @modes's vrefresh rate in Hz, rounded to the nearest integer. Calculates the
+ * value first if it is not yet set.
  */
 int drm_mode_vrefresh(const struct drm_display_mode *mode)
 {
@@ -705,14 +728,11 @@ int drm_mode_vrefresh(const struct drm_display_mode *mode)
 EXPORT_SYMBOL(drm_mode_vrefresh);
 
 /**
- * drm_mode_set_crtcinfo - set CRTC modesetting parameters
+ * drm_mode_set_crtcinfo - set CRTC modesetting timing parameters
  * @p: mode
  * @adjust_flags: a combination of adjustment flags
  *
- * LOCKING:
- * None.
- *
- * Setup the CRTC modesetting parameters for @p, adjusting if necessary.
+ * Setup the CRTC modesetting timing parameters for @p, adjusting if necessary.
  *
  * - The CRTC_INTERLACE_HALVE_V flag can be used to halve vertical timings of
  *   interlaced modes.
@@ -780,15 +800,11 @@ void drm_mode_set_crtcinfo(struct drm_display_mode *p, int adjust_flags)
 }
 EXPORT_SYMBOL(drm_mode_set_crtcinfo);
 
-
 /**
  * drm_mode_copy - copy the mode
  * @dst: mode to overwrite
  * @src: mode to copy
  *
- * LOCKING:
- * None.
- *
  * Copy an existing mode into another mode, preserving the object id and
  * list head of the destination mode.
  */
@@ -805,13 +821,14 @@ EXPORT_SYMBOL(drm_mode_copy);
 
 /**
  * drm_mode_duplicate - allocate and duplicate an existing mode
- * @m: mode to duplicate
- *
- * LOCKING:
- * None.
+ * @dev: drm_device to allocate the duplicated mode for
+ * @mode: mode to duplicate
  *
  * Just allocate a new mode, copy the existing mode into it, and return
  * a pointer to it.  Used to create new instances of established modes.
+ *
+ * Returns:
+ * Pointer to duplicated mode on success, NULL on error.
  */
 struct drm_display_mode *drm_mode_duplicate(struct drm_device *dev,
                                             const struct drm_display_mode *mode)
@@ -833,12 +850,9 @@ EXPORT_SYMBOL(drm_mode_duplicate);
  * @mode1: first mode
  * @mode2: second mode
  *
- * LOCKING:
- * None.
- *
  * Check to see if @mode1 and @mode2 are equivalent.
  *
- * RETURNS:
+ * Returns:
  * True if the modes are equal, false otherwise.
  */
 bool drm_mode_equal(const struct drm_display_mode *mode1, const struct drm_display_mode *mode2)
@@ -864,13 +878,10 @@ EXPORT_SYMBOL(drm_mode_equal);
  * @mode1: first mode
  * @mode2: second mode
  *
- * LOCKING:
- * None.
- *
  * Check to see if @mode1 and @mode2 are equivalent, but
  * don't check the pixel clocks nor the stereo layout.
  *
- * RETURNS:
+ * Returns:
  * True if the modes are equal, false otherwise.
  */
 bool drm_mode_equal_no_clocks_no_stereo(const struct drm_display_mode *mode1,
@@ -900,25 +911,19 @@ EXPORT_SYMBOL(drm_mode_equal_no_clocks_no_stereo);
  * @mode_list: list of modes to check
  * @maxX: maximum width
  * @maxY: maximum height
- * @maxPitch: max pitch
  *
- * LOCKING:
- * Caller must hold a lock protecting @mode_list.
- *
- * The DRM device (@dev) has size and pitch limits.  Here we validate the
- * modes we probed for @dev against those limits and set their status as
- * necessary.
+ * This function is a helper which can be used to validate modes against size
+ * limitations of the DRM device/connector. If a mode is too big its status
+ * memeber is updated with the appropriate validation failure code. The list
+ * itself is not changed.
  */
 void drm_mode_validate_size(struct drm_device *dev,
                             struct list_head *mode_list,
-                            int maxX, int maxY, int maxPitch)
+                            int maxX, int maxY)
 {
         struct drm_display_mode *mode;
 
         list_for_each_entry(mode, mode_list, head) {
-                if (maxPitch > 0 && mode->hdisplay > maxPitch)
-                        mode->status = MODE_BAD_WIDTH;
-
                 if (maxX > 0 && mode->hdisplay > maxX)
                         mode->status = MODE_VIRTUAL_X;
 
@@ -934,12 +939,10 @@ EXPORT_SYMBOL(drm_mode_validate_size);
  * @mode_list: list of modes to check
  * @verbose: be verbose about it
  *
- * LOCKING:
- * Caller must hold a lock protecting @mode_list.
- *
- * Once mode list generation is complete, a caller can use this routine to
- * remove invalid modes from a mode list.  If any of the modes have a
- * status other than %MODE_OK, they are removed from @mode_list and freed.
+ * This helper function can be used to prune a display mode list after
+ * validation has been completed. All modes who's status is not MODE_OK will be
+ * removed from the list, and if @verbose the status code and mode name is also
+ * printed to dmesg.
  */
 void drm_mode_prune_invalid(struct drm_device *dev,
                             struct list_head *mode_list, bool verbose)
@@ -966,13 +969,10 @@ EXPORT_SYMBOL(drm_mode_prune_invalid);
  * @lh_a: list_head for first mode
  * @lh_b: list_head for second mode
  *
- * LOCKING:
- * None.
- *
  * Compare two modes, given by @lh_a and @lh_b, returning a value indicating
  * which is better.
  *
- * RETURNS:
+ * Returns:
  * Negative if @lh_a is better than @lh_b, zero if they're equivalent, or
  * positive if @lh_b is better than @lh_a.
  */
@@ -1000,12 +1000,9 @@ static int drm_mode_compare(void *priv, struct list_head *lh_a, struct list_head
 
 /**
  * drm_mode_sort - sort mode list
- * @mode_list: list to sort
+ * @mode_list: list of drm_display_mode structures to sort
  *
- * LOCKING:
- * Caller must hold a lock protecting @mode_list.
- *
- * Sort @mode_list by favorability, putting good modes first.
+ * Sort @mode_list by favorability, moving good modes to the head of the list.
  */
 void drm_mode_sort(struct list_head *mode_list)
 {
@@ -1017,13 +1014,12 @@ EXPORT_SYMBOL(drm_mode_sort);
  * drm_mode_connector_list_update - update the mode list for the connector
  * @connector: the connector to update
  *
- * LOCKING:
- * Caller must hold a lock protecting @mode_list.
- *
  * This moves the modes from the @connector probed_modes list
  * to the actual mode list. It compares the probed mode against the current
- * list and only adds different modes. All modes unverified after this point
- * will be removed by the prune invalid modes.
+ * list and only adds different/new modes.
+ *
+ * This is just a helper functions doesn't validate any modes itself and also
+ * doesn't prune any invalid modes. Callers need to do that themselves.
  */
 void drm_mode_connector_list_update(struct drm_connector *connector)
 {
@@ -1031,6 +1027,8 @@ void drm_mode_connector_list_update(struct drm_connector *connector)
         struct drm_display_mode *pmode, *pt;
         int found_it;
 
+        WARN_ON(!mutex_is_locked(&connector->dev->mode_config.mutex));
+
         list_for_each_entry_safe(pmode, pt, &connector->probed_modes,
                                  head) {
                 found_it = 0;
@@ -1056,17 +1054,25 @@ void drm_mode_connector_list_update(struct drm_connector *connector)
 EXPORT_SYMBOL(drm_mode_connector_list_update);
 
 /**
- * drm_mode_parse_command_line_for_connector - parse command line for connector
- * @mode_option - per connector mode option
- * @connector - connector to parse line for
+ * drm_mode_parse_command_line_for_connector - parse command line modeline for connector
+ * @mode_option: optional per connector mode option
+ * @connector: connector to parse modeline for
+ * @mode: preallocated drm_cmdline_mode structure to fill out
+ *
+ * This parses @mode_option command line modeline for modes and options to
+ * configure the connector. If @mode_option is NULL the default command line
+ * modeline in fb_mode_option will be parsed instead.
  *
- * This parses the connector specific then generic command lines for
- * modes and options to configure the connector.
+ * This uses the same parameters as the fb modedb.c, except for an extra
+ * force-enable, force-enable-digital and force-disable bit at the end:
  *
- * This uses the same parameters as the fb modedb.c, except for extra
  *      <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m][eDd]
  *
- * enable/enable Digital/disable bit at the end
+ * The intermediate drm_cmdline_mode structure is required to store additional
+ * options from the command line modline like the force-enabel/disable flag.
+ *
+ * Returns:
+ * True if a valid modeline has been parsed, false otherwise.
  */
 bool drm_mode_parse_command_line_for_connector(const char *mode_option,
                                                struct drm_connector *connector,
@@ -1219,6 +1225,14 @@ done:
 }
 EXPORT_SYMBOL(drm_mode_parse_command_line_for_connector);
 
+/**
+ * drm_mode_create_from_cmdline_mode - convert a command line modeline into a DRM display mode
+ * @dev: DRM device to create the new mode for
+ * @cmd: input command line modeline
+ *
+ * Returns:
+ * Pointer to converted mode on success, NULL on error.
+ */
 struct drm_display_mode *
 drm_mode_create_from_cmdline_mode(struct drm_device *dev,
                                   struct drm_cmdline_mode *cmd)
diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
index 5736aaa7e86c..9c696a5ad74d 100644
--- a/drivers/gpu/drm/drm_pci.c
+++ b/drivers/gpu/drm/drm_pci.c
@@ -351,7 +351,7 @@ err_agp:
         drm_pci_agp_destroy(dev);
         pci_disable_device(pdev);
 err_free:
-        drm_dev_free(dev);
+        drm_dev_unref(dev);
         return ret;
 }
 EXPORT_SYMBOL(drm_get_pci_dev);
@@ -468,8 +468,8 @@ void drm_pci_exit(struct drm_driver *driver, struct pci_driver *pdriver)
         } else {
                 list_for_each_entry_safe(dev, tmp, &driver->legacy_dev_list,
                                          legacy_dev_list) {
-                        drm_put_dev(dev);
                         list_del(&dev->legacy_dev_list);
+                        drm_put_dev(dev);
                 }
         }
         DRM_INFO("Module unloaded\n");
diff --git a/drivers/gpu/drm/drm_platform.c b/drivers/gpu/drm/drm_platform.c
index 21fc82006b78..319ff5385601 100644
--- a/drivers/gpu/drm/drm_platform.c
+++ b/drivers/gpu/drm/drm_platform.c
@@ -64,7 +64,7 @@ static int drm_get_platform_dev(struct platform_device *platdev,
         return 0;
 
 err_free:
-        drm_dev_free(dev);
+        drm_dev_unref(dev);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
index 56805c39c906..f1437b6c8dbf 100644
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -68,7 +68,8 @@ struct drm_prime_attachment {
         enum dma_data_direction dir;
 };
 
-static int drm_prime_add_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t handle)
+static int drm_prime_add_buf_handle(struct drm_prime_file_private *prime_fpriv,
+                                    struct dma_buf *dma_buf, uint32_t handle)
 {
         struct drm_prime_member *member;
 
@@ -174,7 +175,7 @@ void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpr
 }
 
 static struct sg_table *drm_gem_map_dma_buf(struct dma_buf_attachment *attach,
-                enum dma_data_direction dir)
+                                            enum dma_data_direction dir)
 {
         struct drm_prime_attachment *prime_attach = attach->priv;
         struct drm_gem_object *obj = attach->dmabuf->priv;
@@ -211,11 +212,19 @@ static struct sg_table *drm_gem_map_dma_buf(struct dma_buf_attachment *attach,
 }
 
 static void drm_gem_unmap_dma_buf(struct dma_buf_attachment *attach,
-                struct sg_table *sgt, enum dma_data_direction dir)
+                                  struct sg_table *sgt,
+                                  enum dma_data_direction dir)
 {
         /* nothing to be done here */
 }
 
+/**
+ * drm_gem_dmabuf_release - dma_buf release implementation for GEM
+ * @dma_buf: buffer to be released
+ *
+ * Generic release function for dma_bufs exported as PRIME buffers. GEM drivers
+ * must use this in their dma_buf ops structure as the release callback.
+ */
 void drm_gem_dmabuf_release(struct dma_buf *dma_buf)
 {
         struct drm_gem_object *obj = dma_buf->priv;
@@ -242,30 +251,30 @@ static void drm_gem_dmabuf_vunmap(struct dma_buf *dma_buf, void *vaddr)
 }
 
 static void *drm_gem_dmabuf_kmap_atomic(struct dma_buf *dma_buf,
-                unsigned long page_num)
+                                        unsigned long page_num)
 {
         return NULL;
 }
 
 static void drm_gem_dmabuf_kunmap_atomic(struct dma_buf *dma_buf,
-                unsigned long page_num, void *addr)
+                                         unsigned long page_num, void *addr)
 {
 
 }
 static void *drm_gem_dmabuf_kmap(struct dma_buf *dma_buf,
-                unsigned long page_num)
+                                 unsigned long page_num)
 {
         return NULL;
 }
 
 static void drm_gem_dmabuf_kunmap(struct dma_buf *dma_buf,
-                unsigned long page_num, void *addr)
+                                  unsigned long page_num, void *addr)
 {
 
 }
 
 static int drm_gem_dmabuf_mmap(struct dma_buf *dma_buf,
-                struct vm_area_struct *vma)
+                               struct vm_area_struct *vma)
 {
         struct drm_gem_object *obj = dma_buf->priv;
         struct drm_device *dev = obj->dev;
@@ -315,6 +324,15 @@ static const struct dma_buf_ops drm_gem_prime_dmabuf_ops =  {
  *    driver's scatter/gather table
  */
 
+/**
+ * drm_gem_prime_export - helper library implemention of the export callback
+ * @dev: drm_device to export from
+ * @obj: GEM object to export
+ * @flags: flags like DRM_CLOEXEC
+ *
+ * This is the implementation of the gem_prime_export functions for GEM drivers
+ * using the PRIME helpers.
+ */
 struct dma_buf *drm_gem_prime_export(struct drm_device *dev,
                                      struct drm_gem_object *obj, int flags)
 {
@@ -355,9 +373,23 @@ static struct dma_buf *export_and_register_object(struct drm_device *dev,
         return dmabuf;
 }
 
+/**
+ * drm_gem_prime_handle_to_fd - PRIME export function for GEM drivers
+ * @dev: dev to export the buffer from
+ * @file_priv: drm file-private structure
+ * @handle: buffer handle to export
+ * @flags: flags like DRM_CLOEXEC
+ * @prime_fd: pointer to storage for the fd id of the create dma-buf
+ *
+ * This is the PRIME export function which must be used mandatorily by GEM
+ * drivers to ensure correct lifetime management of the underlying GEM object.
+ * The actual exporting from GEM object to a dma-buf is done through the
+ * gem_prime_export driver callback.
+ */
 int drm_gem_prime_handle_to_fd(struct drm_device *dev,
-                struct drm_file *file_priv, uint32_t handle, uint32_t flags,
-                int *prime_fd)
+                               struct drm_file *file_priv, uint32_t handle,
+                               uint32_t flags,
+                               int *prime_fd)
 {
         struct drm_gem_object *obj;
         int ret = 0;
@@ -441,6 +473,14 @@ out_unlock:
 }
 EXPORT_SYMBOL(drm_gem_prime_handle_to_fd);
 
+/**
+ * drm_gem_prime_import - helper library implemention of the import callback
+ * @dev: drm_device to import into
+ * @dma_buf: dma-buf object to import
+ *
+ * This is the implementation of the gem_prime_import functions for GEM drivers
+ * using the PRIME helpers.
+ */
 struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev,
                                             struct dma_buf *dma_buf)
 {
@@ -496,8 +536,21 @@ fail_detach:
 }
 EXPORT_SYMBOL(drm_gem_prime_import);
 
+/**
+ * drm_gem_prime_fd_to_handle - PRIME import function for GEM drivers
+ * @dev: dev to export the buffer from
+ * @file_priv: drm file-private structure
+ * @prime_fd: fd id of the dma-buf which should be imported
+ * @handle: pointer to storage for the handle of the imported buffer object
+ *
+ * This is the PRIME import function which must be used mandatorily by GEM
+ * drivers to ensure correct lifetime management of the underlying GEM object.
+ * The actual importing of GEM object from the dma-buf is done through the
+ * gem_import_export driver callback.
+ */
 int drm_gem_prime_fd_to_handle(struct drm_device *dev,
-                struct drm_file *file_priv, int prime_fd, uint32_t *handle)
+                               struct drm_file *file_priv, int prime_fd,
+                               uint32_t *handle)
 {
         struct dma_buf *dma_buf;
         struct drm_gem_object *obj;
@@ -598,12 +651,14 @@ int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, void *data,
                         args->fd, &args->handle);
 }
 
-/*
- * drm_prime_pages_to_sg
+/**
+ * drm_prime_pages_to_sg - converts a page array into an sg list
+ * @pages: pointer to the array of page pointers to convert
+ * @nr_pages: length of the page vector
  *
- * this helper creates an sg table object from a set of pages
+ * This helper creates an sg table object from a set of pages
  * the driver is responsible for mapping the pages into the
- * importers address space
+ * importers address space for use with dma_buf itself.
  */
 struct sg_table *drm_prime_pages_to_sg(struct page **pages, int nr_pages)
 {
@@ -628,9 +683,16 @@ out:
 }
 EXPORT_SYMBOL(drm_prime_pages_to_sg);
 
-/* export an sg table into an array of pages and addresses
-   this is currently required by the TTM driver in order to do correct fault
-   handling */
+/**
+ * drm_prime_sg_to_page_addr_arrays - convert an sg table into a page array
+ * @sgt: scatter-gather table to convert
+ * @pages: array of page pointers to store the page array in
+ * @addrs: optional array to store the dma bus address of each page
+ * @max_pages: size of both the passed-in arrays
+ *
+ * Exports an sg table into an array of pages and addresses. This is currently
+ * required by the TTM driver in order to do correct fault handling.
+ */
 int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages,
                                      dma_addr_t *addrs, int max_pages)
 {
@@ -663,7 +725,15 @@ int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages,
         return 0;
 }
 EXPORT_SYMBOL(drm_prime_sg_to_page_addr_arrays);
-/* helper function to cleanup a GEM/prime object */
+
+/**
+ * drm_prime_gem_destroy - helper to clean up a PRIME-imported GEM object
+ * @obj: GEM object which was created from a dma-buf
+ * @sg: the sg-table which was pinned at import time
+ *
+ * This is the cleanup functions which GEM drivers need to call when they use
+ * @drm_gem_prime_import to import dma-bufs.
+ */
 void drm_prime_gem_destroy(struct drm_gem_object *obj, struct sg_table *sg)
 {
         struct dma_buf_attachment *attach;
@@ -683,11 +753,9 @@ void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpriv)
         INIT_LIST_HEAD(&prime_fpriv->head);
         mutex_init(&prime_fpriv->lock);
 }
-EXPORT_SYMBOL(drm_prime_init_file_private);
 
 void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_fpriv)
 {
         /* by now drm_gem_release should've made sure the list is empty */
         WARN_ON(!list_empty(&prime_fpriv->head));
 }
-EXPORT_SYMBOL(drm_prime_destroy_file_private);
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 98a33c580ca1..dc2c6095d850 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -31,8 +31,10 @@
  * DEALINGS IN THE SOFTWARE.
  */
 
+#include <linux/fs.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
+#include <linux/mount.h>
 #include <linux/slab.h>
 #include <drm/drmP.h>
 #include <drm/drm_core.h>
@@ -70,6 +72,7 @@ module_param_named(vblankoffdelay, drm_vblank_offdelay, int, 0600);
 module_param_named(timestamp_precision_usec, drm_timestamp_precision, int, 0600);
 module_param_named(timestamp_monotonic, drm_timestamp_monotonic, int, 0600);
 
+static DEFINE_SPINLOCK(drm_minor_lock);
 struct idr drm_minors_idr;
 
 struct class *drm_class;
@@ -117,26 +120,6 @@ void drm_ut_debug_printk(unsigned int request_level,
 }
 EXPORT_SYMBOL(drm_ut_debug_printk);
 
-static int drm_minor_get_id(struct drm_device *dev, int type)
-{
-        int ret;
-        int base = 0, limit = 63;
-
-        if (type == DRM_MINOR_CONTROL) {
-                base += 64;
-                limit = base + 63;
-        } else if (type == DRM_MINOR_RENDER) {
-                base += 128;
-                limit = base + 63;
-        }
-
-        mutex_lock(&dev->struct_mutex);
-        ret = idr_alloc(&drm_minors_idr, NULL, base, limit, GFP_KERNEL);
-        mutex_unlock(&dev->struct_mutex);
-
-        return ret == -ENOSPC ? -EINVAL : ret;
-}
-
 struct drm_master *drm_master_create(struct drm_minor *minor)
 {
         struct drm_master *master;
@@ -260,119 +243,183 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
         return 0;
 }
 
-/**
- * drm_get_minor - Allocate and register new DRM minor
- * @dev: DRM device
- * @minor: Pointer to where new minor is stored
- * @type: Type of minor
- *
- * Allocate a new minor of the given type and register it. A pointer to the new
- * minor is returned in @minor.
- * Caller must hold the global DRM mutex.
+/*
+ * DRM Minors
+ * A DRM device can provide several char-dev interfaces on the DRM-Major. Each
+ * of them is represented by a drm_minor object. Depending on the capabilities
+ * of the device-driver, different interfaces are registered.
  *
- * RETURNS:
- * 0 on success, negative error code on failure.
+ * Minors can be accessed via dev->$minor_name. This pointer is either
+ * NULL or a valid drm_minor pointer and stays valid as long as the device is
+ * valid. This means, DRM minors have the same life-time as the underlying
+ * device. However, this doesn't mean that the minor is active. Minors are
+ * registered and unregistered dynamically according to device-state.
  */
-static int drm_get_minor(struct drm_device *dev, struct drm_minor **minor,
-                         int type)
+
+static struct drm_minor **drm_minor_get_slot(struct drm_device *dev,
+                                             unsigned int type)
+{
+        switch (type) {
+        case DRM_MINOR_LEGACY:
+                return &dev->primary;
+        case DRM_MINOR_RENDER:
+                return &dev->render;
+        case DRM_MINOR_CONTROL:
+                return &dev->control;
+        default:
+                return NULL;
+        }
+}
+
+static int drm_minor_alloc(struct drm_device *dev, unsigned int type)
+{
+        struct drm_minor *minor;
+
+        minor = kzalloc(sizeof(*minor), GFP_KERNEL);
+        if (!minor)
+                return -ENOMEM;
+
+        minor->type = type;
+        minor->dev = dev;
+        INIT_LIST_HEAD(&minor->master_list);
+
+        *drm_minor_get_slot(dev, type) = minor;
+        return 0;
+}
+
+static void drm_minor_free(struct drm_device *dev, unsigned int type)
+{
+        struct drm_minor **slot;
+
+        slot = drm_minor_get_slot(dev, type);
+        if (*slot) {
+                kfree(*slot);
+                *slot = NULL;
+        }
+}
+
+static int drm_minor_register(struct drm_device *dev, unsigned int type)
 {
         struct drm_minor *new_minor;
+        unsigned long flags;
         int ret;
         int minor_id;
 
         DRM_DEBUG("\n");
 
-        minor_id = drm_minor_get_id(dev, type);
+        new_minor = *drm_minor_get_slot(dev, type);
+        if (!new_minor)
+                return 0;
+
+        idr_preload(GFP_KERNEL);
+        spin_lock_irqsave(&drm_minor_lock, flags);
+        minor_id = idr_alloc(&drm_minors_idr,
+                             NULL,
+                             64 * type,
+                             64 * (type + 1),
+                             GFP_NOWAIT);
+        spin_unlock_irqrestore(&drm_minor_lock, flags);
+        idr_preload_end();
+
         if (minor_id < 0)
                 return minor_id;
 
-        new_minor = kzalloc(sizeof(struct drm_minor), GFP_KERNEL);
-        if (!new_minor) {
-                ret = -ENOMEM;
-                goto err_idr;
-        }
-
-        new_minor->type = type;
-        new_minor->device = MKDEV(DRM_MAJOR, minor_id);
-        new_minor->dev = dev;
         new_minor->index = minor_id;
-        INIT_LIST_HEAD(&new_minor->master_list);
-
-        idr_replace(&drm_minors_idr, new_minor, minor_id);
 
-#if defined(CONFIG_DEBUG_FS)
         ret = drm_debugfs_init(new_minor, minor_id, drm_debugfs_root);
         if (ret) {
                 DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n");
-                goto err_mem;
+                goto err_id;
         }
-#endif
 
         ret = drm_sysfs_device_add(new_minor);
         if (ret) {
-                printk(KERN_ERR
-                       "DRM: Error sysfs_device_add.\n");
+                DRM_ERROR("DRM: Error sysfs_device_add.\n");
                 goto err_debugfs;
         }
-        *minor = new_minor;
+
+        /* replace NULL with @minor so lookups will succeed from now on */
+        spin_lock_irqsave(&drm_minor_lock, flags);
+        idr_replace(&drm_minors_idr, new_minor, new_minor->index);
+        spin_unlock_irqrestore(&drm_minor_lock, flags);
 
         DRM_DEBUG("new minor assigned %d\n", minor_id);
         return 0;
 
-
 err_debugfs:
-#if defined(CONFIG_DEBUG_FS)
         drm_debugfs_cleanup(new_minor);
-err_mem:
-#endif
-        kfree(new_minor);
-err_idr:
+err_id:
+        spin_lock_irqsave(&drm_minor_lock, flags);
         idr_remove(&drm_minors_idr, minor_id);
-        *minor = NULL;
+        spin_unlock_irqrestore(&drm_minor_lock, flags);
+        new_minor->index = 0;
         return ret;
 }
 
-/**
- * drm_unplug_minor - Unplug DRM minor
- * @minor: Minor to unplug
- *
- * Unplugs the given DRM minor but keeps the object. So after this returns,
- * minor->dev is still valid so existing open-files can still access it to get
- * device information from their drm_file ojects.
- * If the minor is already unplugged or if @minor is NULL, nothing is done.
- * The global DRM mutex must be held by the caller.
- */
-static void drm_unplug_minor(struct drm_minor *minor)
+static void drm_minor_unregister(struct drm_device *dev, unsigned int type)
 {
+        struct drm_minor *minor;
+        unsigned long flags;
+
+        minor = *drm_minor_get_slot(dev, type);
         if (!minor || !minor->kdev)
                 return;
 
-#if defined(CONFIG_DEBUG_FS)
-        drm_debugfs_cleanup(minor);
-#endif
+        spin_lock_irqsave(&drm_minor_lock, flags);
+        idr_remove(&drm_minors_idr, minor->index);
+        spin_unlock_irqrestore(&drm_minor_lock, flags);
+        minor->index = 0;
 
+        drm_debugfs_cleanup(minor);
         drm_sysfs_device_remove(minor);
-        idr_remove(&drm_minors_idr, minor->index);
 }
 
 /**
- * drm_put_minor - Destroy DRM minor
- * @minor: Minor to destroy
+ * drm_minor_acquire - Acquire a DRM minor
+ * @minor_id: Minor ID of the DRM-minor
+ *
+ * Looks up the given minor-ID and returns the respective DRM-minor object. The
+ * refence-count of the underlying device is increased so you must release this
+ * object with drm_minor_release().
+ *
+ * As long as you hold this minor, it is guaranteed that the object and the
+ * minor->dev pointer will stay valid! However, the device may get unplugged and
+ * unregistered while you hold the minor.
  *
- * This calls drm_unplug_minor() on the given minor and then frees it. Nothing
- * is done if @minor is NULL. It is fine to call this on already unplugged
- * minors.
- * The global DRM mutex must be held by the caller.
+ * Returns:
+ * Pointer to minor-object with increased device-refcount, or PTR_ERR on
+ * failure.
  */
-static void drm_put_minor(struct drm_minor *minor)
+struct drm_minor *drm_minor_acquire(unsigned int minor_id)
 {
-        if (!minor)
-                return;
+        struct drm_minor *minor;
+        unsigned long flags;
+
+        spin_lock_irqsave(&drm_minor_lock, flags);
+        minor = idr_find(&drm_minors_idr, minor_id);
+        if (minor)
+                drm_dev_ref(minor->dev);
+        spin_unlock_irqrestore(&drm_minor_lock, flags);
+
+        if (!minor) {
+                return ERR_PTR(-ENODEV);
+        } else if (drm_device_is_unplugged(minor->dev)) {
+                drm_dev_unref(minor->dev);
+                return ERR_PTR(-ENODEV);
+        }
 
-        DRM_DEBUG("release secondary minor %d\n", minor->index);
+        return minor;
+}
 
-        drm_unplug_minor(minor);
-        kfree(minor);
+/**
+ * drm_minor_release - Release DRM minor
+ * @minor: Pointer to DRM minor object
+ *
+ * Release a minor that was previously acquired via drm_minor_acquire().
+ */
+void drm_minor_release(struct drm_minor *minor)
+{
+        drm_dev_unref(minor->dev);
 }
 
 /**
@@ -392,18 +439,16 @@ void drm_put_dev(struct drm_device *dev)
         }
 
         drm_dev_unregister(dev);
-        drm_dev_free(dev);
+        drm_dev_unref(dev);
 }
 EXPORT_SYMBOL(drm_put_dev);
 
 void drm_unplug_dev(struct drm_device *dev)
 {
         /* for a USB device */
-        if (drm_core_check_feature(dev, DRIVER_MODESET))
-                drm_unplug_minor(dev->control);
-        if (dev->render)
-                drm_unplug_minor(dev->render);
-        drm_unplug_minor(dev->primary);
+        drm_minor_unregister(dev, DRM_MINOR_LEGACY);
+        drm_minor_unregister(dev, DRM_MINOR_RENDER);
+        drm_minor_unregister(dev, DRM_MINOR_CONTROL);
 
         mutex_lock(&drm_global_mutex);
 
@@ -416,6 +461,78 @@ void drm_unplug_dev(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_unplug_dev);
 
+/*
+ * DRM internal mount
+ * We want to be able to allocate our own "struct address_space" to control
+ * memory-mappings in VRAM (or stolen RAM, ...). However, core MM does not allow
+ * stand-alone address_space objects, so we need an underlying inode. As there
+ * is no way to allocate an independent inode easily, we need a fake internal
+ * VFS mount-point.
+ *
+ * The drm_fs_inode_new() function allocates a new inode, drm_fs_inode_free()
+ * frees it again. You are allowed to use iget() and iput() to get references to
+ * the inode. But each drm_fs_inode_new() call must be paired with exactly one
+ * drm_fs_inode_free() call (which does not have to be the last iput()).
+ * We use drm_fs_inode_*() to manage our internal VFS mount-point and share it
+ * between multiple inode-users. You could, technically, call
+ * iget() + drm_fs_inode_free() directly after alloc and sometime later do an
+ * iput(), but this way you'd end up with a new vfsmount for each inode.
+ */
+
+static int drm_fs_cnt;
+static struct vfsmount *drm_fs_mnt;
+
+static const struct dentry_operations drm_fs_dops = {
+        .d_dname        = simple_dname,
+};
+
+static const struct super_operations drm_fs_sops = {
+        .statfs         = simple_statfs,
+};
+
+static struct dentry *drm_fs_mount(struct file_system_type *fs_type, int flags,
+                                   const char *dev_name, void *data)
+{
+        return mount_pseudo(fs_type,
+                            "drm:",
+                            &drm_fs_sops,
+                            &drm_fs_dops,
+                            0x010203ff);
+}
+
+static struct file_system_type drm_fs_type = {
+        .name           = "drm",
+        .owner          = THIS_MODULE,
+        .mount          = drm_fs_mount,
+        .kill_sb        = kill_anon_super,
+};
+
+static struct inode *drm_fs_inode_new(void)
+{
+        struct inode *inode;
+        int r;
+
+        r = simple_pin_fs(&drm_fs_type, &drm_fs_mnt, &drm_fs_cnt);
+        if (r < 0) {
+                DRM_ERROR("Cannot mount pseudo fs: %d\n", r);
+                return ERR_PTR(r);
+        }
+
+        inode = alloc_anon_inode(drm_fs_mnt->mnt_sb);
+        if (IS_ERR(inode))
+                simple_release_fs(&drm_fs_mnt, &drm_fs_cnt);
+
+        return inode;
+}
+
+static void drm_fs_inode_free(struct inode *inode)
+{
+        if (inode) {
+                iput(inode);
+                simple_release_fs(&drm_fs_mnt, &drm_fs_cnt);
+        }
+}
+
 /**
  * drm_dev_alloc - Allocate new drm device
  * @driver: DRM driver to allocate device for
@@ -425,6 +542,9 @@ EXPORT_SYMBOL(drm_unplug_dev);
  * Call drm_dev_register() to advertice the device to user space and register it
  * with other core subsystems.
  *
+ * The initial ref-count of the object is 1. Use drm_dev_ref() and
+ * drm_dev_unref() to take and drop further ref-counts.
+ *
  * RETURNS:
  * Pointer to new DRM device, or NULL if out of memory.
  */
@@ -438,6 +558,7 @@ struct drm_device *drm_dev_alloc(struct drm_driver *driver,
         if (!dev)
                 return NULL;
 
+        kref_init(&dev->ref);
         dev->dev = parent;
         dev->driver = driver;
 
@@ -452,8 +573,31 @@ struct drm_device *drm_dev_alloc(struct drm_driver *driver,
         mutex_init(&dev->struct_mutex);
         mutex_init(&dev->ctxlist_mutex);
 
-        if (drm_ht_create(&dev->map_hash, 12))
+        dev->anon_inode = drm_fs_inode_new();
+        if (IS_ERR(dev->anon_inode)) {
+                ret = PTR_ERR(dev->anon_inode);
+                DRM_ERROR("Cannot allocate anonymous inode: %d\n", ret);
                 goto err_free;
+        }
+
+        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+                ret = drm_minor_alloc(dev, DRM_MINOR_CONTROL);
+                if (ret)
+                        goto err_minors;
+        }
+
+        if (drm_core_check_feature(dev, DRIVER_RENDER) && drm_rnodes) {
+                ret = drm_minor_alloc(dev, DRM_MINOR_RENDER);
+                if (ret)
+                        goto err_minors;
+        }
+
+        ret = drm_minor_alloc(dev, DRM_MINOR_LEGACY);
+        if (ret)
+                goto err_minors;
+
+        if (drm_ht_create(&dev->map_hash, 12))
+                goto err_minors;
 
         ret = drm_ctxbitmap_init(dev);
         if (ret) {
@@ -475,38 +619,68 @@ err_ctxbitmap:
         drm_ctxbitmap_cleanup(dev);
 err_ht:
         drm_ht_remove(&dev->map_hash);
+err_minors:
+        drm_minor_free(dev, DRM_MINOR_LEGACY);
+        drm_minor_free(dev, DRM_MINOR_RENDER);
+        drm_minor_free(dev, DRM_MINOR_CONTROL);
+        drm_fs_inode_free(dev->anon_inode);
 err_free:
         kfree(dev);
         return NULL;
 }
 EXPORT_SYMBOL(drm_dev_alloc);
 
-/**
- * drm_dev_free - Free DRM device
- * @dev: DRM device to free
- *
- * Free a DRM device that has previously been allocated via drm_dev_alloc().
- * You must not use kfree() instead or you will leak memory.
- *
- * This must not be called once the device got registered. Use drm_put_dev()
- * instead, which then calls drm_dev_free().
- */
-void drm_dev_free(struct drm_device *dev)
+static void drm_dev_release(struct kref *ref)
 {
-        drm_put_minor(dev->control);
-        drm_put_minor(dev->render);
-        drm_put_minor(dev->primary);
+        struct drm_device *dev = container_of(ref, struct drm_device, ref);
 
         if (dev->driver->driver_features & DRIVER_GEM)
                 drm_gem_destroy(dev);
 
         drm_ctxbitmap_cleanup(dev);
         drm_ht_remove(&dev->map_hash);
+        drm_fs_inode_free(dev->anon_inode);
+
+        drm_minor_free(dev, DRM_MINOR_LEGACY);
+        drm_minor_free(dev, DRM_MINOR_RENDER);
+        drm_minor_free(dev, DRM_MINOR_CONTROL);
 
         kfree(dev->devname);
         kfree(dev);
 }
-EXPORT_SYMBOL(drm_dev_free);
+
+/**
+ * drm_dev_ref - Take reference of a DRM device
+ * @dev: device to take reference of or NULL
+ *
+ * This increases the ref-count of @dev by one. You *must* already own a
+ * reference when calling this. Use drm_dev_unref() to drop this reference
+ * again.
+ *
+ * This function never fails. However, this function does not provide *any*
+ * guarantee whether the device is alive or running. It only provides a
+ * reference to the object and the memory associated with it.
+ */
+void drm_dev_ref(struct drm_device *dev)
+{
+        if (dev)
+                kref_get(&dev->ref);
+}
+EXPORT_SYMBOL(drm_dev_ref);
+
+/**
+ * drm_dev_unref - Drop reference of a DRM device
+ * @dev: device to drop reference of or NULL
+ *
+ * This decreases the ref-count of @dev by one. The device is destroyed if the
+ * ref-count drops to zero.
+ */
+void drm_dev_unref(struct drm_device *dev)
+{
+        if (dev)
+                kref_put(&dev->ref, drm_dev_release);
+}
+EXPORT_SYMBOL(drm_dev_unref);
 
 /**
  * drm_dev_register - Register DRM device
@@ -527,26 +701,22 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
 
         mutex_lock(&drm_global_mutex);
 
-        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                ret = drm_get_minor(dev, &dev->control, DRM_MINOR_CONTROL);
-                if (ret)
-                        goto out_unlock;
-        }
+        ret = drm_minor_register(dev, DRM_MINOR_CONTROL);
+        if (ret)
+                goto err_minors;
 
-        if (drm_core_check_feature(dev, DRIVER_RENDER) && drm_rnodes) {
-                ret = drm_get_minor(dev, &dev->render, DRM_MINOR_RENDER);
-                if (ret)
-                        goto err_control_node;
-        }
+        ret = drm_minor_register(dev, DRM_MINOR_RENDER);
+        if (ret)
+                goto err_minors;
 
-        ret = drm_get_minor(dev, &dev->primary, DRM_MINOR_LEGACY);
+        ret = drm_minor_register(dev, DRM_MINOR_LEGACY);
         if (ret)
-                goto err_render_node;
+                goto err_minors;
 
         if (dev->driver->load) {
                 ret = dev->driver->load(dev, flags);
                 if (ret)
-                        goto err_primary_node;
+                        goto err_minors;
         }
 
         /* setup grouping for legacy outputs */
@@ -563,12 +733,10 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
 err_unload:
         if (dev->driver->unload)
                 dev->driver->unload(dev);
-err_primary_node:
-        drm_unplug_minor(dev->primary);
-err_render_node:
-        drm_unplug_minor(dev->render);
-err_control_node:
-        drm_unplug_minor(dev->control);
+err_minors:
+        drm_minor_unregister(dev, DRM_MINOR_LEGACY);
+        drm_minor_unregister(dev, DRM_MINOR_RENDER);
+        drm_minor_unregister(dev, DRM_MINOR_CONTROL);
 out_unlock:
         mutex_unlock(&drm_global_mutex);
         return ret;
@@ -581,7 +749,7 @@ EXPORT_SYMBOL(drm_dev_register);
  *
  * Unregister the DRM device from the system. This does the reverse of
  * drm_dev_register() but does not deallocate the device. The caller must call
- * drm_dev_free() to free all resources.
+ * drm_dev_unref() to drop their final reference.
  */
 void drm_dev_unregister(struct drm_device *dev)
 {
@@ -600,8 +768,8 @@ void drm_dev_unregister(struct drm_device *dev)
         list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
                 drm_rmmap(dev, r_list->map);
 
-        drm_unplug_minor(dev->control);
-        drm_unplug_minor(dev->render);
-        drm_unplug_minor(dev->primary);
+        drm_minor_unregister(dev, DRM_MINOR_LEGACY);
+        drm_minor_unregister(dev, DRM_MINOR_RENDER);
+        drm_minor_unregister(dev, DRM_MINOR_CONTROL);
 }
 EXPORT_SYMBOL(drm_dev_unregister);
diff --git a/drivers/gpu/drm/drm_usb.c b/drivers/gpu/drm/drm_usb.c
index 0f8cb1ae7607..c3406aad2944 100644
--- a/drivers/gpu/drm/drm_usb.c
+++ b/drivers/gpu/drm/drm_usb.c
@@ -30,7 +30,7 @@ int drm_get_usb_dev(struct usb_interface *interface,
         return 0;
 
 err_free:
-        drm_dev_free(dev);
+        drm_dev_unref(dev);
         return ret;
 
 }
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index faa77f543a07..48af5cac1902 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -19,6 +19,8 @@
 
 #include <linux/hdmi.h>
 #include <linux/module.h>
+#include <linux/irq.h>
+#include <sound/asoundef.h>
 
 #include <drm/drmP.h>
 #include <drm/drm_crtc_helper.h>
@@ -30,6 +32,7 @@
 
 struct tda998x_priv {
         struct i2c_client *cec;
+        struct i2c_client *hdmi;
         uint16_t rev;
         uint8_t current_page;
         int dpms;
@@ -38,6 +41,10 @@ struct tda998x_priv {
         u8 vip_cntrl_1;
         u8 vip_cntrl_2;
         struct tda998x_encoder_params params;
+
+        wait_queue_head_t wq_edid;
+        volatile int wq_edid_wait;
+        struct drm_encoder *encoder;
 };
 
 #define to_tda998x_priv(x)  ((struct tda998x_priv *)to_encoder_slave(x)->slave_priv)
@@ -120,6 +127,8 @@ struct tda998x_priv {
 # define VIP_CNTRL_5_CKCASE       (1 << 0)
 # define VIP_CNTRL_5_SP_CNT(x)    (((x) & 3) << 1)
 #define REG_MUX_AP                REG(0x00, 0x26)     /* read/write */
+# define MUX_AP_SELECT_I2S        0x64
+# define MUX_AP_SELECT_SPDIF      0x40
 #define REG_MUX_VP_VIP_OUT        REG(0x00, 0x27)     /* read/write */
 #define REG_MAT_CONTRL            REG(0x00, 0x80)     /* write */
 # define MAT_CONTRL_MAT_SC(x)     (((x) & 3) << 0)
@@ -197,10 +206,11 @@ struct tda998x_priv {
 #define REG_I2S_FORMAT            REG(0x00, 0xfc)     /* read/write */
 # define I2S_FORMAT(x)            (((x) & 3) << 0)
 #define REG_AIP_CLKSEL            REG(0x00, 0xfd)     /* write */
-# define AIP_CLKSEL_FS(x)         (((x) & 3) << 0)
-# define AIP_CLKSEL_CLK_POL(x)    (((x) & 1) << 2)
-# define AIP_CLKSEL_AIP(x)        (((x) & 7) << 3)
-
+# define AIP_CLKSEL_AIP_SPDIF     (0 << 3)
+# define AIP_CLKSEL_AIP_I2S       (1 << 3)
+# define AIP_CLKSEL_FS_ACLK       (0 << 0)
+# define AIP_CLKSEL_FS_MCLK       (1 << 0)
+# define AIP_CLKSEL_FS_FS64SPDIF  (2 << 0)
 
 /* Page 02h: PLL settings */
 #define REG_PLL_SERIAL_1          REG(0x02, 0x00)     /* read/write */
@@ -304,11 +314,16 @@ struct tda998x_priv {
 
 /* CEC registers: (not paged)
  */
+#define REG_CEC_INTSTATUS         0xee                /* read */
+# define CEC_INTSTATUS_CEC        (1 << 0)
+# define CEC_INTSTATUS_HDMI       (1 << 1)
 #define REG_CEC_FRO_IM_CLK_CTRL   0xfb                /* read/write */
 # define CEC_FRO_IM_CLK_CTRL_GHOST_DIS (1 << 7)
 # define CEC_FRO_IM_CLK_CTRL_ENA_OTP   (1 << 6)
 # define CEC_FRO_IM_CLK_CTRL_IMCLK_SEL (1 << 1)
 # define CEC_FRO_IM_CLK_CTRL_FRO_DIV   (1 << 0)
+#define REG_CEC_RXSHPDINTENA      0xfc                /* read/write */
+#define REG_CEC_RXSHPDINT         0xfd                /* read */
 #define REG_CEC_RXSHPDLEV         0xfe                /* read */
 # define CEC_RXSHPDLEV_RXSENS     (1 << 0)
 # define CEC_RXSHPDLEV_HPD        (1 << 1)
@@ -328,21 +343,21 @@ struct tda998x_priv {
 #define TDA19988                  0x0301
 
 static void
-cec_write(struct drm_encoder *encoder, uint16_t addr, uint8_t val)
+cec_write(struct tda998x_priv *priv, uint16_t addr, uint8_t val)
 {
-        struct i2c_client *client = to_tda998x_priv(encoder)->cec;
+        struct i2c_client *client = priv->cec;
         uint8_t buf[] = {addr, val};
         int ret;
 
-        ret = i2c_master_send(client, buf, ARRAY_SIZE(buf));
+        ret = i2c_master_send(client, buf, sizeof(buf));
         if (ret < 0)
                 dev_err(&client->dev, "Error %d writing to cec:0x%x\n", ret, addr);
 }
 
 static uint8_t
-cec_read(struct drm_encoder *encoder, uint8_t addr)
+cec_read(struct tda998x_priv *priv, uint8_t addr)
 {
-        struct i2c_client *client = to_tda998x_priv(encoder)->cec;
+        struct i2c_client *client = priv->cec;
         uint8_t val;
         int ret;
 
@@ -361,32 +376,36 @@ fail:
         return 0;
 }
 
-static void
-set_page(struct drm_encoder *encoder, uint16_t reg)
+static int
+set_page(struct tda998x_priv *priv, uint16_t reg)
 {
-        struct tda998x_priv *priv = to_tda998x_priv(encoder);
-
         if (REG2PAGE(reg) != priv->current_page) {
-                struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+                struct i2c_client *client = priv->hdmi;
                 uint8_t buf[] = {
                                 REG_CURPAGE, REG2PAGE(reg)
                 };
                 int ret = i2c_master_send(client, buf, sizeof(buf));
-                if (ret < 0)
-                        dev_err(&client->dev, "Error %d writing to REG_CURPAGE\n", ret);
+                if (ret < 0) {
+                        dev_err(&client->dev, "setpage %04x err %d\n",
+                                        reg, ret);
+                        return ret;
+                }
 
                 priv->current_page = REG2PAGE(reg);
         }
+        return 0;
 }
 
 static int
-reg_read_range(struct drm_encoder *encoder, uint16_t reg, char *buf, int cnt)
+reg_read_range(struct tda998x_priv *priv, uint16_t reg, char *buf, int cnt)
 {
-        struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+        struct i2c_client *client = priv->hdmi;
         uint8_t addr = REG2ADDR(reg);
         int ret;
 
-        set_page(encoder, reg);
+        ret = set_page(priv, reg);
+        if (ret < 0)
+                return ret;
 
         ret = i2c_master_send(client, &addr, sizeof(addr));
         if (ret < 0)
@@ -404,100 +423,147 @@ fail:
 }
 
 static void
-reg_write_range(struct drm_encoder *encoder, uint16_t reg, uint8_t *p, int cnt)
+reg_write_range(struct tda998x_priv *priv, uint16_t reg, uint8_t *p, int cnt)
 {
-        struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+        struct i2c_client *client = priv->hdmi;
         uint8_t buf[cnt+1];
         int ret;
 
         buf[0] = REG2ADDR(reg);
         memcpy(&buf[1], p, cnt);
 
-        set_page(encoder, reg);
+        ret = set_page(priv, reg);
+        if (ret < 0)
+                return;
 
         ret = i2c_master_send(client, buf, cnt + 1);
         if (ret < 0)
                 dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
 }
 
-static uint8_t
-reg_read(struct drm_encoder *encoder, uint16_t reg)
+static int
+reg_read(struct tda998x_priv *priv, uint16_t reg)
 {
         uint8_t val = 0;
-        reg_read_range(encoder, reg, &val, sizeof(val));
+        int ret;
+
+        ret = reg_read_range(priv, reg, &val, sizeof(val));
+        if (ret < 0)
+                return ret;
         return val;
 }
 
 static void
-reg_write(struct drm_encoder *encoder, uint16_t reg, uint8_t val)
+reg_write(struct tda998x_priv *priv, uint16_t reg, uint8_t val)
 {
-        struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+        struct i2c_client *client = priv->hdmi;
         uint8_t buf[] = {REG2ADDR(reg), val};
         int ret;
 
-        set_page(encoder, reg);
+        ret = set_page(priv, reg);
+        if (ret < 0)
+                return;
 
-        ret = i2c_master_send(client, buf, ARRAY_SIZE(buf));
+        ret = i2c_master_send(client, buf, sizeof(buf));
         if (ret < 0)
                 dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
 }
 
 static void
-reg_write16(struct drm_encoder *encoder, uint16_t reg, uint16_t val)
+reg_write16(struct tda998x_priv *priv, uint16_t reg, uint16_t val)
 {
-        struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+        struct i2c_client *client = priv->hdmi;
         uint8_t buf[] = {REG2ADDR(reg), val >> 8, val};
         int ret;
 
-        set_page(encoder, reg);
+        ret = set_page(priv, reg);
+        if (ret < 0)
+                return;
 
-        ret = i2c_master_send(client, buf, ARRAY_SIZE(buf));
+        ret = i2c_master_send(client, buf, sizeof(buf));
         if (ret < 0)
                 dev_err(&client->dev, "Error %d writing to 0x%x\n", ret, reg);
 }
 
 static void
-reg_set(struct drm_encoder *encoder, uint16_t reg, uint8_t val)
+reg_set(struct tda998x_priv *priv, uint16_t reg, uint8_t val)
 {
-        reg_write(encoder, reg, reg_read(encoder, reg) | val);
+        int old_val;
+
+        old_val = reg_read(priv, reg);
+        if (old_val >= 0)
+                reg_write(priv, reg, old_val | val);
 }
 
 static void
-reg_clear(struct drm_encoder *encoder, uint16_t reg, uint8_t val)
+reg_clear(struct tda998x_priv *priv, uint16_t reg, uint8_t val)
 {
-        reg_write(encoder, reg, reg_read(encoder, reg) & ~val);
+        int old_val;
+
+        old_val = reg_read(priv, reg);
+        if (old_val >= 0)
+                reg_write(priv, reg, old_val & ~val);
 }
 
 static void
-tda998x_reset(struct drm_encoder *encoder)
+tda998x_reset(struct tda998x_priv *priv)
 {
         /* reset audio and i2c master: */
-        reg_set(encoder, REG_SOFTRESET, SOFTRESET_AUDIO | SOFTRESET_I2C_MASTER);
+        reg_write(priv, REG_SOFTRESET, SOFTRESET_AUDIO | SOFTRESET_I2C_MASTER);
         msleep(50);
-        reg_clear(encoder, REG_SOFTRESET, SOFTRESET_AUDIO | SOFTRESET_I2C_MASTER);
+        reg_write(priv, REG_SOFTRESET, 0);
         msleep(50);
 
         /* reset transmitter: */
-        reg_set(encoder, REG_MAIN_CNTRL0, MAIN_CNTRL0_SR);
-        reg_clear(encoder, REG_MAIN_CNTRL0, MAIN_CNTRL0_SR);
+        reg_set(priv, REG_MAIN_CNTRL0, MAIN_CNTRL0_SR);
+        reg_clear(priv, REG_MAIN_CNTRL0, MAIN_CNTRL0_SR);
 
         /* PLL registers common configuration */
-        reg_write(encoder, REG_PLL_SERIAL_1, 0x00);
-        reg_write(encoder, REG_PLL_SERIAL_2, PLL_SERIAL_2_SRL_NOSC(1));
-        reg_write(encoder, REG_PLL_SERIAL_3, 0x00);
-        reg_write(encoder, REG_SERIALIZER,   0x00);
-        reg_write(encoder, REG_BUFFER_OUT,   0x00);
-        reg_write(encoder, REG_PLL_SCG1,     0x00);
-        reg_write(encoder, REG_AUDIO_DIV,    AUDIO_DIV_SERCLK_8);
-        reg_write(encoder, REG_SEL_CLK,      SEL_CLK_SEL_CLK1 | SEL_CLK_ENA_SC_CLK);
-        reg_write(encoder, REG_PLL_SCGN1,    0xfa);
-        reg_write(encoder, REG_PLL_SCGN2,    0x00);
-        reg_write(encoder, REG_PLL_SCGR1,    0x5b);
-        reg_write(encoder, REG_PLL_SCGR2,    0x00);
-        reg_write(encoder, REG_PLL_SCG2,     0x10);
+        reg_write(priv, REG_PLL_SERIAL_1, 0x00);
+        reg_write(priv, REG_PLL_SERIAL_2, PLL_SERIAL_2_SRL_NOSC(1));
+        reg_write(priv, REG_PLL_SERIAL_3, 0x00);
+        reg_write(priv, REG_SERIALIZER,   0x00);
+        reg_write(priv, REG_BUFFER_OUT,   0x00);
+        reg_write(priv, REG_PLL_SCG1,     0x00);
+        reg_write(priv, REG_AUDIO_DIV,    AUDIO_DIV_SERCLK_8);
+        reg_write(priv, REG_SEL_CLK,      SEL_CLK_SEL_CLK1 | SEL_CLK_ENA_SC_CLK);
+        reg_write(priv, REG_PLL_SCGN1,    0xfa);
+        reg_write(priv, REG_PLL_SCGN2,    0x00);
+        reg_write(priv, REG_PLL_SCGR1,    0x5b);
+        reg_write(priv, REG_PLL_SCGR2,    0x00);
+        reg_write(priv, REG_PLL_SCG2,     0x10);
 
         /* Write the default value MUX register */
-        reg_write(encoder, REG_MUX_VP_VIP_OUT, 0x24);
+        reg_write(priv, REG_MUX_VP_VIP_OUT, 0x24);
+}
+
+/*
+ * only 2 interrupts may occur: screen plug/unplug and EDID read
+ */
+static irqreturn_t tda998x_irq_thread(int irq, void *data)
+{
+        struct tda998x_priv *priv = data;
+        u8 sta, cec, lvl, flag0, flag1, flag2;
+
+        if (!priv)
+                return IRQ_HANDLED;
+        sta = cec_read(priv, REG_CEC_INTSTATUS);
+        cec = cec_read(priv, REG_CEC_RXSHPDINT);
+        lvl = cec_read(priv, REG_CEC_RXSHPDLEV);
+        flag0 = reg_read(priv, REG_INT_FLAGS_0);
+        flag1 = reg_read(priv, REG_INT_FLAGS_1);
+        flag2 = reg_read(priv, REG_INT_FLAGS_2);
+        DRM_DEBUG_DRIVER(
+                "tda irq sta %02x cec %02x lvl %02x f0 %02x f1 %02x f2 %02x\n",
+                sta, cec, lvl, flag0, flag1, flag2);
+        if ((flag2 & INT_FLAGS_2_EDID_BLK_RD) && priv->wq_edid_wait) {
+                priv->wq_edid_wait = 0;
+                wake_up(&priv->wq_edid);
+        } else if (cec != 0) {                  /* HPD change */
+                if (priv->encoder && priv->encoder->dev)
+                        drm_helper_hpd_irq_event(priv->encoder->dev);
+        }
+        return IRQ_HANDLED;
 }
 
 static uint8_t tda998x_cksum(uint8_t *buf, size_t bytes)
@@ -513,91 +579,88 @@ static uint8_t tda998x_cksum(uint8_t *buf, size_t bytes)
 #define PB(x) (HB(2) + 1 + (x))
 
 static void
-tda998x_write_if(struct drm_encoder *encoder, uint8_t bit, uint16_t addr,
+tda998x_write_if(struct tda998x_priv *priv, uint8_t bit, uint16_t addr,
                  uint8_t *buf, size_t size)
 {
         buf[PB(0)] = tda998x_cksum(buf, size);
 
-        reg_clear(encoder, REG_DIP_IF_FLAGS, bit);
-        reg_write_range(encoder, addr, buf, size);
-        reg_set(encoder, REG_DIP_IF_FLAGS, bit);
+        reg_clear(priv, REG_DIP_IF_FLAGS, bit);
+        reg_write_range(priv, addr, buf, size);
+        reg_set(priv, REG_DIP_IF_FLAGS, bit);
 }
 
 static void
-tda998x_write_aif(struct drm_encoder *encoder, struct tda998x_encoder_params *p)
+tda998x_write_aif(struct tda998x_priv *priv, struct tda998x_encoder_params *p)
 {
-        uint8_t buf[PB(5) + 1];
+        u8 buf[PB(HDMI_AUDIO_INFOFRAME_SIZE) + 1];
 
         memset(buf, 0, sizeof(buf));
-        buf[HB(0)] = 0x84;
+        buf[HB(0)] = HDMI_INFOFRAME_TYPE_AUDIO;
         buf[HB(1)] = 0x01;
-        buf[HB(2)] = 10;
+        buf[HB(2)] = HDMI_AUDIO_INFOFRAME_SIZE;
         buf[PB(1)] = p->audio_frame[1] & 0x07; /* CC */
         buf[PB(2)] = p->audio_frame[2] & 0x1c; /* SF */
         buf[PB(4)] = p->audio_frame[4];
         buf[PB(5)] = p->audio_frame[5] & 0xf8; /* DM_INH + LSV */
 
-        tda998x_write_if(encoder, DIP_IF_FLAGS_IF4, REG_IF4_HB0, buf,
+        tda998x_write_if(priv, DIP_IF_FLAGS_IF4, REG_IF4_HB0, buf,
                          sizeof(buf));
 }
 
 static void
-tda998x_write_avi(struct drm_encoder *encoder, struct drm_display_mode *mode)
+tda998x_write_avi(struct tda998x_priv *priv, struct drm_display_mode *mode)
 {
-        uint8_t buf[PB(13) + 1];
+        u8 buf[PB(HDMI_AVI_INFOFRAME_SIZE) + 1];
 
         memset(buf, 0, sizeof(buf));
-        buf[HB(0)] = 0x82;
+        buf[HB(0)] = HDMI_INFOFRAME_TYPE_AVI;
         buf[HB(1)] = 0x02;
-        buf[HB(2)] = 13;
+        buf[HB(2)] = HDMI_AVI_INFOFRAME_SIZE;
         buf[PB(1)] = HDMI_SCAN_MODE_UNDERSCAN;
+        buf[PB(2)] = HDMI_ACTIVE_ASPECT_PICTURE;
         buf[PB(3)] = HDMI_QUANTIZATION_RANGE_FULL << 2;
         buf[PB(4)] = drm_match_cea_mode(mode);
 
-        tda998x_write_if(encoder, DIP_IF_FLAGS_IF2, REG_IF2_HB0, buf,
+        tda998x_write_if(priv, DIP_IF_FLAGS_IF2, REG_IF2_HB0, buf,
                          sizeof(buf));
 }
 
-static void tda998x_audio_mute(struct drm_encoder *encoder, bool on)
+static void tda998x_audio_mute(struct tda998x_priv *priv, bool on)
 {
         if (on) {
-                reg_set(encoder, REG_SOFTRESET, SOFTRESET_AUDIO);
-                reg_clear(encoder, REG_SOFTRESET, SOFTRESET_AUDIO);
-                reg_set(encoder, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_FIFO);
+                reg_set(priv, REG_SOFTRESET, SOFTRESET_AUDIO);
+                reg_clear(priv, REG_SOFTRESET, SOFTRESET_AUDIO);
+                reg_set(priv, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_FIFO);
         } else {
-                reg_clear(encoder, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_FIFO);
+                reg_clear(priv, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_FIFO);
         }
 }
 
 static void
-tda998x_configure_audio(struct drm_encoder *encoder,
+tda998x_configure_audio(struct tda998x_priv *priv,
                 struct drm_display_mode *mode, struct tda998x_encoder_params *p)
 {
-        uint8_t buf[6], clksel_aip, clksel_fs, ca_i2s, cts_n, adiv;
+        uint8_t buf[6], clksel_aip, clksel_fs, cts_n, adiv;
         uint32_t n;
 
         /* Enable audio ports */
-        reg_write(encoder, REG_ENA_AP, p->audio_cfg);
-        reg_write(encoder, REG_ENA_ACLK, p->audio_clk_cfg);
+        reg_write(priv, REG_ENA_AP, p->audio_cfg);
+        reg_write(priv, REG_ENA_ACLK, p->audio_clk_cfg);
 
         /* Set audio input source */
         switch (p->audio_format) {
         case AFMT_SPDIF:
-                reg_write(encoder, REG_MUX_AP, 0x40);
-                clksel_aip = AIP_CLKSEL_AIP(0);
-                /* FS64SPDIF */
-                clksel_fs = AIP_CLKSEL_FS(2);
+                reg_write(priv, REG_MUX_AP, MUX_AP_SELECT_SPDIF);
+                clksel_aip = AIP_CLKSEL_AIP_SPDIF;
+                clksel_fs = AIP_CLKSEL_FS_FS64SPDIF;
                 cts_n = CTS_N_M(3) | CTS_N_K(3);
-                ca_i2s = 0;
                 break;
 
         case AFMT_I2S:
-                reg_write(encoder, REG_MUX_AP, 0x64);
-                clksel_aip = AIP_CLKSEL_AIP(1);
-                /* ACLK */
-                clksel_fs = AIP_CLKSEL_FS(0);
+                reg_write(priv, REG_MUX_AP, MUX_AP_SELECT_I2S);
+                clksel_aip = AIP_CLKSEL_AIP_I2S;
+                clksel_fs = AIP_CLKSEL_FS_ACLK;
                 cts_n = CTS_N_M(3) | CTS_N_K(3);
-                ca_i2s = CA_I2S_CA_I2S(0);
                 break;
 
         default:
@@ -605,12 +668,10 @@ tda998x_configure_audio(struct drm_encoder *encoder,
                 return;
         }
 
-        reg_write(encoder, REG_AIP_CLKSEL, clksel_aip);
-        reg_clear(encoder, REG_AIP_CNTRL_0, AIP_CNTRL_0_LAYOUT);
-
-        /* Enable automatic CTS generation */
-        reg_clear(encoder, REG_AIP_CNTRL_0, AIP_CNTRL_0_ACR_MAN);
-        reg_write(encoder, REG_CTS_N, cts_n);
+        reg_write(priv, REG_AIP_CLKSEL, clksel_aip);
+        reg_clear(priv, REG_AIP_CNTRL_0, AIP_CNTRL_0_LAYOUT |
+                                        AIP_CNTRL_0_ACR_MAN);   /* auto CTS */
+        reg_write(priv, REG_CTS_N, cts_n);
 
         /*
          * Audio input somehow depends on HDMI line rate which is
@@ -619,11 +680,15 @@ tda998x_configure_audio(struct drm_encoder *encoder,
          * There is no detailed info in the datasheet, so we just
          * assume 100MHz requires larger divider.
          */
+        adiv = AUDIO_DIV_SERCLK_8;
         if (mode->clock > 100000)
-                adiv = AUDIO_DIV_SERCLK_16;
-        else
-                adiv = AUDIO_DIV_SERCLK_8;
-        reg_write(encoder, REG_AUDIO_DIV, adiv);
+                adiv++;                 /* AUDIO_DIV_SERCLK_16 */
+
+        /* S/PDIF asks for a larger divider */
+        if (p->audio_format == AFMT_SPDIF)
+                adiv++;                 /* AUDIO_DIV_SERCLK_16 or _32 */
+
+        reg_write(priv, REG_AUDIO_DIV, adiv);
 
         /*
          * This is the approximate value of N, which happens to be
@@ -638,28 +703,29 @@ tda998x_configure_audio(struct drm_encoder *encoder,
         buf[3] = n;
         buf[4] = n >> 8;
         buf[5] = n >> 16;
-        reg_write_range(encoder, REG_ACR_CTS_0, buf, 6);
+        reg_write_range(priv, REG_ACR_CTS_0, buf, 6);
 
         /* Set CTS clock reference */
-        reg_write(encoder, REG_AIP_CLKSEL, clksel_aip | clksel_fs);
+        reg_write(priv, REG_AIP_CLKSEL, clksel_aip | clksel_fs);
 
         /* Reset CTS generator */
-        reg_set(encoder, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_CTS);
-        reg_clear(encoder, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_CTS);
+        reg_set(priv, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_CTS);
+        reg_clear(priv, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_CTS);
 
         /* Write the channel status */
-        buf[0] = 0x04;
+        buf[0] = IEC958_AES0_CON_NOT_COPYRIGHT;
         buf[1] = 0x00;
-        buf[2] = 0x00;
-        buf[3] = 0xf1;
-        reg_write_range(encoder, REG_CH_STAT_B(0), buf, 4);
+        buf[2] = IEC958_AES3_CON_FS_NOTID;
+        buf[3] = IEC958_AES4_CON_ORIGFS_NOTID |
+                        IEC958_AES4_CON_MAX_WORDLEN_24;
+        reg_write_range(priv, REG_CH_STAT_B(0), buf, 4);
 
-        tda998x_audio_mute(encoder, true);
-        mdelay(20);
-        tda998x_audio_mute(encoder, false);
+        tda998x_audio_mute(priv, true);
+        msleep(20);
+        tda998x_audio_mute(priv, false);
 
         /* Write the audio information packet */
-        tda998x_write_aif(encoder, p);
+        tda998x_write_aif(priv, p);
 }
 
 /* DRM encoder functions */
@@ -701,19 +767,19 @@ tda998x_encoder_dpms(struct drm_encoder *encoder, int mode)
         switch (mode) {
         case DRM_MODE_DPMS_ON:
                 /* enable video ports, audio will be enabled later */
-                reg_write(encoder, REG_ENA_VP_0, 0xff);
-                reg_write(encoder, REG_ENA_VP_1, 0xff);
-                reg_write(encoder, REG_ENA_VP_2, 0xff);
+                reg_write(priv, REG_ENA_VP_0, 0xff);
+                reg_write(priv, REG_ENA_VP_1, 0xff);
+                reg_write(priv, REG_ENA_VP_2, 0xff);
                 /* set muxing after enabling ports: */
-                reg_write(encoder, REG_VIP_CNTRL_0, priv->vip_cntrl_0);
-                reg_write(encoder, REG_VIP_CNTRL_1, priv->vip_cntrl_1);
-                reg_write(encoder, REG_VIP_CNTRL_2, priv->vip_cntrl_2);
+                reg_write(priv, REG_VIP_CNTRL_0, priv->vip_cntrl_0);
+                reg_write(priv, REG_VIP_CNTRL_1, priv->vip_cntrl_1);
+                reg_write(priv, REG_VIP_CNTRL_2, priv->vip_cntrl_2);
                 break;
         case DRM_MODE_DPMS_OFF:
                 /* disable video ports */
-                reg_write(encoder, REG_ENA_VP_0, 0x00);
-                reg_write(encoder, REG_ENA_VP_1, 0x00);
-                reg_write(encoder, REG_ENA_VP_2, 0x00);
+                reg_write(priv, REG_ENA_VP_0, 0x00);
+                reg_write(priv, REG_ENA_VP_1, 0x00);
+                reg_write(priv, REG_ENA_VP_2, 0x00);
                 break;
         }
 
@@ -831,110 +897,110 @@ tda998x_encoder_mode_set(struct drm_encoder *encoder,
         }
 
         /* mute the audio FIFO: */
-        reg_set(encoder, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_FIFO);
+        reg_set(priv, REG_AIP_CNTRL_0, AIP_CNTRL_0_RST_FIFO);
 
         /* set HDMI HDCP mode off: */
-        reg_set(encoder, REG_TBG_CNTRL_1, TBG_CNTRL_1_DWIN_DIS);
-        reg_clear(encoder, REG_TX33, TX33_HDMI);
+        reg_write(priv, REG_TBG_CNTRL_1, TBG_CNTRL_1_DWIN_DIS);
+        reg_clear(priv, REG_TX33, TX33_HDMI);
+        reg_write(priv, REG_ENC_CNTRL, ENC_CNTRL_CTL_CODE(0));
 
-        reg_write(encoder, REG_ENC_CNTRL, ENC_CNTRL_CTL_CODE(0));
         /* no pre-filter or interpolator: */
-        reg_write(encoder, REG_HVF_CNTRL_0, HVF_CNTRL_0_PREFIL(0) |
+        reg_write(priv, REG_HVF_CNTRL_0, HVF_CNTRL_0_PREFIL(0) |
                         HVF_CNTRL_0_INTPOL(0));
-        reg_write(encoder, REG_VIP_CNTRL_5, VIP_CNTRL_5_SP_CNT(0));
-        reg_write(encoder, REG_VIP_CNTRL_4, VIP_CNTRL_4_BLANKIT(0) |
+        reg_write(priv, REG_VIP_CNTRL_5, VIP_CNTRL_5_SP_CNT(0));
+        reg_write(priv, REG_VIP_CNTRL_4, VIP_CNTRL_4_BLANKIT(0) |
                         VIP_CNTRL_4_BLC(0));
-        reg_clear(encoder, REG_PLL_SERIAL_3, PLL_SERIAL_3_SRL_CCIR);
 
-        reg_clear(encoder, REG_PLL_SERIAL_1, PLL_SERIAL_1_SRL_MAN_IZ);
-        reg_clear(encoder, REG_PLL_SERIAL_3, PLL_SERIAL_3_SRL_DE);
-        reg_write(encoder, REG_SERIALIZER, 0);
-        reg_write(encoder, REG_HVF_CNTRL_1, HVF_CNTRL_1_VQR(0));
+        reg_clear(priv, REG_PLL_SERIAL_1, PLL_SERIAL_1_SRL_MAN_IZ);
+        reg_clear(priv, REG_PLL_SERIAL_3, PLL_SERIAL_3_SRL_CCIR |
+                                          PLL_SERIAL_3_SRL_DE);
+        reg_write(priv, REG_SERIALIZER, 0);
+        reg_write(priv, REG_HVF_CNTRL_1, HVF_CNTRL_1_VQR(0));
 
         /* TODO enable pixel repeat for pixel rates less than 25Msamp/s */
         rep = 0;
-        reg_write(encoder, REG_RPT_CNTRL, 0);
-        reg_write(encoder, REG_SEL_CLK, SEL_CLK_SEL_VRF_CLK(0) |
+        reg_write(priv, REG_RPT_CNTRL, 0);
+        reg_write(priv, REG_SEL_CLK, SEL_CLK_SEL_VRF_CLK(0) |
                         SEL_CLK_SEL_CLK1 | SEL_CLK_ENA_SC_CLK);
 
-        reg_write(encoder, REG_PLL_SERIAL_2, PLL_SERIAL_2_SRL_NOSC(div) |
+        reg_write(priv, REG_PLL_SERIAL_2, PLL_SERIAL_2_SRL_NOSC(div) |
                         PLL_SERIAL_2_SRL_PR(rep));
 
         /* set color matrix bypass flag: */
-        reg_set(encoder, REG_MAT_CONTRL, MAT_CONTRL_MAT_BP);
+        reg_write(priv, REG_MAT_CONTRL, MAT_CONTRL_MAT_BP |
+                                MAT_CONTRL_MAT_SC(1));
 
         /* set BIAS tmds value: */
-        reg_write(encoder, REG_ANA_GENERAL, 0x09);
-
-        reg_clear(encoder, REG_TBG_CNTRL_0, TBG_CNTRL_0_SYNC_MTHD);
+        reg_write(priv, REG_ANA_GENERAL, 0x09);
 
         /*
          * Sync on rising HSYNC/VSYNC
          */
-        reg_write(encoder, REG_VIP_CNTRL_3, 0);
-        reg_set(encoder, REG_VIP_CNTRL_3, VIP_CNTRL_3_SYNC_HS);
+        reg = VIP_CNTRL_3_SYNC_HS;
 
         /*
          * TDA19988 requires high-active sync at input stage,
          * so invert low-active sync provided by master encoder here
          */
         if (mode->flags & DRM_MODE_FLAG_NHSYNC)
-                reg_set(encoder, REG_VIP_CNTRL_3, VIP_CNTRL_3_H_TGL);
+                reg |= VIP_CNTRL_3_H_TGL;
         if (mode->flags & DRM_MODE_FLAG_NVSYNC)
-                reg_set(encoder, REG_VIP_CNTRL_3, VIP_CNTRL_3_V_TGL);
+                reg |= VIP_CNTRL_3_V_TGL;
+        reg_write(priv, REG_VIP_CNTRL_3, reg);
+
+        reg_write(priv, REG_VIDFORMAT, 0x00);
+        reg_write16(priv, REG_REFPIX_MSB, ref_pix);
+        reg_write16(priv, REG_REFLINE_MSB, ref_line);
+        reg_write16(priv, REG_NPIX_MSB, n_pix);
+        reg_write16(priv, REG_NLINE_MSB, n_line);
+        reg_write16(priv, REG_VS_LINE_STRT_1_MSB, vs1_line_s);
+        reg_write16(priv, REG_VS_PIX_STRT_1_MSB, vs1_pix_s);
+        reg_write16(priv, REG_VS_LINE_END_1_MSB, vs1_line_e);
+        reg_write16(priv, REG_VS_PIX_END_1_MSB, vs1_pix_e);
+        reg_write16(priv, REG_VS_LINE_STRT_2_MSB, vs2_line_s);
+        reg_write16(priv, REG_VS_PIX_STRT_2_MSB, vs2_pix_s);
+        reg_write16(priv, REG_VS_LINE_END_2_MSB, vs2_line_e);
+        reg_write16(priv, REG_VS_PIX_END_2_MSB, vs2_pix_e);
+        reg_write16(priv, REG_HS_PIX_START_MSB, hs_pix_s);
+        reg_write16(priv, REG_HS_PIX_STOP_MSB, hs_pix_e);
+        reg_write16(priv, REG_VWIN_START_1_MSB, vwin1_line_s);
+        reg_write16(priv, REG_VWIN_END_1_MSB, vwin1_line_e);
+        reg_write16(priv, REG_VWIN_START_2_MSB, vwin2_line_s);
+        reg_write16(priv, REG_VWIN_END_2_MSB, vwin2_line_e);
+        reg_write16(priv, REG_DE_START_MSB, de_pix_s);
+        reg_write16(priv, REG_DE_STOP_MSB, de_pix_e);
+
+        if (priv->rev == TDA19988) {
+                /* let incoming pixels fill the active space (if any) */
+                reg_write(priv, REG_ENABLE_SPACE, 0x00);
+        }
 
         /*
          * Always generate sync polarity relative to input sync and
          * revert input stage toggled sync at output stage
          */
-        reg = TBG_CNTRL_1_TGL_EN;
+        reg = TBG_CNTRL_1_DWIN_DIS | TBG_CNTRL_1_TGL_EN;
         if (mode->flags & DRM_MODE_FLAG_NHSYNC)
                 reg |= TBG_CNTRL_1_H_TGL;
         if (mode->flags & DRM_MODE_FLAG_NVSYNC)
                 reg |= TBG_CNTRL_1_V_TGL;
-        reg_write(encoder, REG_TBG_CNTRL_1, reg);
-
-        reg_write(encoder, REG_VIDFORMAT, 0x00);
-        reg_write16(encoder, REG_REFPIX_MSB, ref_pix);
-        reg_write16(encoder, REG_REFLINE_MSB, ref_line);
-        reg_write16(encoder, REG_NPIX_MSB, n_pix);
-        reg_write16(encoder, REG_NLINE_MSB, n_line);
-        reg_write16(encoder, REG_VS_LINE_STRT_1_MSB, vs1_line_s);
-        reg_write16(encoder, REG_VS_PIX_STRT_1_MSB, vs1_pix_s);
-        reg_write16(encoder, REG_VS_LINE_END_1_MSB, vs1_line_e);
-        reg_write16(encoder, REG_VS_PIX_END_1_MSB, vs1_pix_e);
-        reg_write16(encoder, REG_VS_LINE_STRT_2_MSB, vs2_line_s);
-        reg_write16(encoder, REG_VS_PIX_STRT_2_MSB, vs2_pix_s);
-        reg_write16(encoder, REG_VS_LINE_END_2_MSB, vs2_line_e);
-        reg_write16(encoder, REG_VS_PIX_END_2_MSB, vs2_pix_e);
-        reg_write16(encoder, REG_HS_PIX_START_MSB, hs_pix_s);
-        reg_write16(encoder, REG_HS_PIX_STOP_MSB, hs_pix_e);
-        reg_write16(encoder, REG_VWIN_START_1_MSB, vwin1_line_s);
-        reg_write16(encoder, REG_VWIN_END_1_MSB, vwin1_line_e);
-        reg_write16(encoder, REG_VWIN_START_2_MSB, vwin2_line_s);
-        reg_write16(encoder, REG_VWIN_END_2_MSB, vwin2_line_e);
-        reg_write16(encoder, REG_DE_START_MSB, de_pix_s);
-        reg_write16(encoder, REG_DE_STOP_MSB, de_pix_e);
-
-        if (priv->rev == TDA19988) {
-                /* let incoming pixels fill the active space (if any) */
-                reg_write(encoder, REG_ENABLE_SPACE, 0x00);
-        }
+        reg_write(priv, REG_TBG_CNTRL_1, reg);
 
         /* must be last register set: */
-        reg_clear(encoder, REG_TBG_CNTRL_0, TBG_CNTRL_0_SYNC_ONCE);
+        reg_write(priv, REG_TBG_CNTRL_0, 0);
 
         /* Only setup the info frames if the sink is HDMI */
         if (priv->is_hdmi_sink) {
                 /* We need to turn HDMI HDCP stuff on to get audio through */
-                reg_clear(encoder, REG_TBG_CNTRL_1, TBG_CNTRL_1_DWIN_DIS);
-                reg_write(encoder, REG_ENC_CNTRL, ENC_CNTRL_CTL_CODE(1));
-                reg_set(encoder, REG_TX33, TX33_HDMI);
+                reg &= ~TBG_CNTRL_1_DWIN_DIS;
+                reg_write(priv, REG_TBG_CNTRL_1, reg);
+                reg_write(priv, REG_ENC_CNTRL, ENC_CNTRL_CTL_CODE(1));
+                reg_set(priv, REG_TX33, TX33_HDMI);
 
-                tda998x_write_avi(encoder, adjusted_mode);
+                tda998x_write_avi(priv, adjusted_mode);
 
                 if (priv->params.audio_cfg)
-                        tda998x_configure_audio(encoder, adjusted_mode,
+                        tda998x_configure_audio(priv, adjusted_mode,
                                                 &priv->params);
         }
 }
@@ -943,7 +1009,9 @@ static enum drm_connector_status
 tda998x_encoder_detect(struct drm_encoder *encoder,
                       struct drm_connector *connector)
 {
-        uint8_t val = cec_read(encoder, REG_CEC_RXSHPDLEV);
+        struct tda998x_priv *priv = to_tda998x_priv(encoder);
+        uint8_t val = cec_read(priv, REG_CEC_RXSHPDLEV);
+
         return (val & CEC_RXSHPDLEV_HPD) ? connector_status_connected :
                         connector_status_disconnected;
 }
@@ -951,46 +1019,57 @@ tda998x_encoder_detect(struct drm_encoder *encoder,
 static int
 read_edid_block(struct drm_encoder *encoder, uint8_t *buf, int blk)
 {
+        struct tda998x_priv *priv = to_tda998x_priv(encoder);
         uint8_t offset, segptr;
         int ret, i;
 
-        /* enable EDID read irq: */
-        reg_set(encoder, REG_INT_FLAGS_2, INT_FLAGS_2_EDID_BLK_RD);
-
         offset = (blk & 1) ? 128 : 0;
         segptr = blk / 2;
 
-        reg_write(encoder, REG_DDC_ADDR, 0xa0);
-        reg_write(encoder, REG_DDC_OFFS, offset);
-        reg_write(encoder, REG_DDC_SEGM_ADDR, 0x60);
-        reg_write(encoder, REG_DDC_SEGM, segptr);
+        reg_write(priv, REG_DDC_ADDR, 0xa0);
+        reg_write(priv, REG_DDC_OFFS, offset);
+        reg_write(priv, REG_DDC_SEGM_ADDR, 0x60);
+        reg_write(priv, REG_DDC_SEGM, segptr);
 
         /* enable reading EDID: */
-        reg_write(encoder, REG_EDID_CTRL, 0x1);
+        priv->wq_edid_wait = 1;
+        reg_write(priv, REG_EDID_CTRL, 0x1);
 
         /* flag must be cleared by sw: */
-        reg_write(encoder, REG_EDID_CTRL, 0x0);
+        reg_write(priv, REG_EDID_CTRL, 0x0);
 
         /* wait for block read to complete: */
-        for (i = 100; i > 0; i--) {
-                uint8_t val = reg_read(encoder, REG_INT_FLAGS_2);
-                if (val & INT_FLAGS_2_EDID_BLK_RD)
-                        break;
-                msleep(1);
+        if (priv->hdmi->irq) {
+                i = wait_event_timeout(priv->wq_edid,
+                                        !priv->wq_edid_wait,
+                                        msecs_to_jiffies(100));
+                if (i < 0) {
+                        dev_err(&priv->hdmi->dev, "read edid wait err %d\n", i);
+                        return i;
+                }
+        } else {
+                for (i = 10; i > 0; i--) {
+                        msleep(10);
+                        ret = reg_read(priv, REG_INT_FLAGS_2);
+                        if (ret < 0)
+                                return ret;
+                        if (ret & INT_FLAGS_2_EDID_BLK_RD)
+                                break;
+                }
         }
 
-        if (i == 0)
+        if (i == 0) {
+                dev_err(&priv->hdmi->dev, "read edid timeout\n");
                 return -ETIMEDOUT;
+        }
 
-        ret = reg_read_range(encoder, REG_EDID_DATA_0, buf, EDID_LENGTH);
+        ret = reg_read_range(priv, REG_EDID_DATA_0, buf, EDID_LENGTH);
         if (ret != EDID_LENGTH) {
-                dev_err(encoder->dev->dev, "failed to read edid block %d: %d",
-                                blk, ret);
+                dev_err(&priv->hdmi->dev, "failed to read edid block %d: %d\n",
+                        blk, ret);
                 return ret;
         }
 
-        reg_clear(encoder, REG_INT_FLAGS_2, INT_FLAGS_2_EDID_BLK_RD);
-
         return 0;
 }
 
@@ -998,7 +1077,7 @@ static uint8_t *
 do_get_edid(struct drm_encoder *encoder)
 {
         struct tda998x_priv *priv = to_tda998x_priv(encoder);
-        int j = 0, valid_extensions = 0;
+        int j, valid_extensions = 0;
         uint8_t *block, *new;
         bool print_bad_edid = drm_debug & DRM_UT_KMS;
 
@@ -1006,7 +1085,7 @@ do_get_edid(struct drm_encoder *encoder)
                 return NULL;
 
         if (priv->rev == TDA19988)
-                reg_clear(encoder, REG_TX4, TX4_PD_RAM);
+                reg_clear(priv, REG_TX4, TX4_PD_RAM);
 
         /* base block fetch */
         if (read_edid_block(encoder, block, 0))
@@ -1046,14 +1125,14 @@ do_get_edid(struct drm_encoder *encoder)
 
 done:
         if (priv->rev == TDA19988)
-                reg_set(encoder, REG_TX4, TX4_PD_RAM);
+                reg_set(priv, REG_TX4, TX4_PD_RAM);
 
         return block;
 
 fail:
         if (priv->rev == TDA19988)
-                reg_set(encoder, REG_TX4, TX4_PD_RAM);
-        dev_warn(encoder->dev->dev, "failed to read EDID\n");
+                reg_set(priv, REG_TX4, TX4_PD_RAM);
+        dev_warn(&priv->hdmi->dev, "failed to read EDID\n");
         kfree(block);
         return NULL;
 }
@@ -1080,7 +1159,13 @@ static int
 tda998x_encoder_create_resources(struct drm_encoder *encoder,
                                 struct drm_connector *connector)
 {
-        DBG("");
+        struct tda998x_priv *priv = to_tda998x_priv(encoder);
+
+        if (priv->hdmi->irq)
+                connector->polled = DRM_CONNECTOR_POLL_HPD;
+        else
+                connector->polled = DRM_CONNECTOR_POLL_CONNECT |
+                        DRM_CONNECTOR_POLL_DISCONNECT;
         return 0;
 }
 
@@ -1099,6 +1184,13 @@ tda998x_encoder_destroy(struct drm_encoder *encoder)
 {
         struct tda998x_priv *priv = to_tda998x_priv(encoder);
         drm_i2c_encoder_destroy(encoder);
+
+        /* disable all IRQs and free the IRQ handler */
+        cec_write(priv, REG_CEC_RXSHPDINTENA, 0);
+        reg_clear(priv, REG_INT_FLAGS_2, INT_FLAGS_2_EDID_BLK_RD);
+        if (priv->hdmi->irq)
+                free_irq(priv->hdmi->irq, priv);
+
         if (priv->cec)
                 i2c_unregister_device(priv->cec);
         kfree(priv);
@@ -1138,8 +1230,10 @@ tda998x_encoder_init(struct i2c_client *client,
                     struct drm_device *dev,
                     struct drm_encoder_slave *encoder_slave)
 {
-        struct drm_encoder *encoder = &encoder_slave->base;
         struct tda998x_priv *priv;
+        struct device_node *np = client->dev.of_node;
+        u32 video;
+        int rev_lo, rev_hi, ret;
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv)
@@ -1150,52 +1244,113 @@ tda998x_encoder_init(struct i2c_client *client,
         priv->vip_cntrl_2 = VIP_CNTRL_2_SWAP_E(4) | VIP_CNTRL_2_SWAP_F(5);
 
         priv->current_page = 0xff;
+        priv->hdmi = client;
         priv->cec = i2c_new_dummy(client->adapter, 0x34);
         if (!priv->cec) {
                 kfree(priv);
                 return -ENODEV;
         }
+
+        priv->encoder = &encoder_slave->base;
         priv->dpms = DRM_MODE_DPMS_OFF;
 
         encoder_slave->slave_priv = priv;
         encoder_slave->slave_funcs = &tda998x_encoder_funcs;
 
         /* wake up the device: */
-        cec_write(encoder, REG_CEC_ENAMODS,
+        cec_write(priv, REG_CEC_ENAMODS,
                         CEC_ENAMODS_EN_RXSENS | CEC_ENAMODS_EN_HDMI);
 
-        tda998x_reset(encoder);
+        tda998x_reset(priv);
 
         /* read version: */
-        priv->rev = reg_read(encoder, REG_VERSION_LSB) |
-                        reg_read(encoder, REG_VERSION_MSB) << 8;
+        rev_lo = reg_read(priv, REG_VERSION_LSB);
+        rev_hi = reg_read(priv, REG_VERSION_MSB);
+        if (rev_lo < 0 || rev_hi < 0) {
+                ret = rev_lo < 0 ? rev_lo : rev_hi;
+                goto fail;
+        }
+
+        priv->rev = rev_lo | rev_hi << 8;
 
         /* mask off feature bits: */
         priv->rev &= ~0x30; /* not-hdcp and not-scalar bit */
 
         switch (priv->rev) {
-        case TDA9989N2:  dev_info(dev->dev, "found TDA9989 n2");  break;
-        case TDA19989:   dev_info(dev->dev, "found TDA19989");    break;
-        case TDA19989N2: dev_info(dev->dev, "found TDA19989 n2"); break;
-        case TDA19988:   dev_info(dev->dev, "found TDA19988");    break;
+        case TDA9989N2:
+                dev_info(&client->dev, "found TDA9989 n2");
+                break;
+        case TDA19989:
+                dev_info(&client->dev, "found TDA19989");
+                break;
+        case TDA19989N2:
+                dev_info(&client->dev, "found TDA19989 n2");
+                break;
+        case TDA19988:
+                dev_info(&client->dev, "found TDA19988");
+                break;
         default:
-                DBG("found unsupported device: %04x", priv->rev);
+                dev_err(&client->dev, "found unsupported device: %04x\n",
+                        priv->rev);
                 goto fail;
         }
 
         /* after reset, enable DDC: */
-        reg_write(encoder, REG_DDC_DISABLE, 0x00);
+        reg_write(priv, REG_DDC_DISABLE, 0x00);
 
         /* set clock on DDC channel: */
-        reg_write(encoder, REG_TX3, 39);
+        reg_write(priv, REG_TX3, 39);
 
         /* if necessary, disable multi-master: */
         if (priv->rev == TDA19989)
-                reg_set(encoder, REG_I2C_MASTER, I2C_MASTER_DIS_MM);
+                reg_set(priv, REG_I2C_MASTER, I2C_MASTER_DIS_MM);
 
-        cec_write(encoder, REG_CEC_FRO_IM_CLK_CTRL,
+        cec_write(priv, REG_CEC_FRO_IM_CLK_CTRL,
                         CEC_FRO_IM_CLK_CTRL_GHOST_DIS | CEC_FRO_IM_CLK_CTRL_IMCLK_SEL);
 
+        /* initialize the optional IRQ */
+        if (client->irq) {
+                int irqf_trigger;
+
+                /* init read EDID waitqueue */
+                init_waitqueue_head(&priv->wq_edid);
+
+                /* clear pending interrupts */
+                reg_read(priv, REG_INT_FLAGS_0);
+                reg_read(priv, REG_INT_FLAGS_1);
+                reg_read(priv, REG_INT_FLAGS_2);
+
+                irqf_trigger =
+                        irqd_get_trigger_type(irq_get_irq_data(client->irq));
+                ret = request_threaded_irq(client->irq, NULL,
+                                           tda998x_irq_thread,
+                                           irqf_trigger | IRQF_ONESHOT,
+                                           "tda998x", priv);
+                if (ret) {
+                        dev_err(&client->dev,
+                                "failed to request IRQ#%u: %d\n",
+                                client->irq, ret);
+                        goto fail;
+                }
+
+                /* enable HPD irq */
+                cec_write(priv, REG_CEC_RXSHPDINTENA, CEC_RXSHPDLEV_HPD);
+        }
+
+        /* enable EDID read irq: */
+        reg_set(priv, REG_INT_FLAGS_2, INT_FLAGS_2_EDID_BLK_RD);
+
+        if (!np)
+                return 0;               /* non-DT */
+
+        /* get the optional video properties */
+        ret = of_property_read_u32(np, "video-ports", &video);
+        if (ret == 0) {
+                priv->vip_cntrl_0 = video >> 16;
+                priv->vip_cntrl_1 = video >> 8;
+                priv->vip_cntrl_2 = video;
+        }
+
         return 0;
 
 fail:
@@ -1210,6 +1365,14 @@ fail:
         return -ENXIO;
 }
 
+#ifdef CONFIG_OF
+static const struct of_device_id tda998x_dt_ids[] = {
+        { .compatible = "nxp,tda998x", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, tda998x_dt_ids);
+#endif
+
 static struct i2c_device_id tda998x_ids[] = {
         { "tda998x", 0 },
         { }
@@ -1222,6 +1385,7 @@ static struct drm_i2c_encoder_driver tda998x_driver = {
                 .remove = tda998x_remove,
                 .driver = {
                         .name = "tda998x",
+                        .of_match_table = of_match_ptr(tda998x_dt_ids),
                 },
                 .id_table = tda998x_ids,
         },
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 70384c8d1404..338fa6799ecf 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1526,7 +1526,8 @@ i915_gem_release_mmap(struct drm_i915_gem_object *obj)
         if (!obj->fault_mappable)
                 return;
 
-        drm_vma_node_unmap(&obj->base.vma_node, obj->base.dev->dev_mapping);
+        drm_vma_node_unmap(&obj->base.vma_node,
+                           obj->base.dev->anon_inode->i_mapping);
         obj->fault_mappable = false;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index fb8a967df027..bbb1327644d4 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -91,6 +91,7 @@ static struct intel_dp *intel_attached_dp(struct drm_connector *connector)
 }
 
 static void intel_dp_link_down(struct intel_dp *intel_dp);
+static bool _edp_panel_vdd_on(struct intel_dp *intel_dp);
 static void edp_panel_vdd_off(struct intel_dp *intel_dp, bool sync);
 
 static int
@@ -459,6 +460,9 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
         uint32_t status;
         int try, clock = 0;
         bool has_aux_irq = HAS_AUX_IRQ(dev);
+        bool vdd;
+
+        vdd = _edp_panel_vdd_on(intel_dp);
 
         /* dp aux is extremely sensitive to irq latency, hence request the
          * lowest possible wakeup latency and so prevent the cpu from going into
@@ -564,223 +568,130 @@ out:
         pm_qos_update_request(&dev_priv->pm_qos, PM_QOS_DEFAULT_VALUE);
         intel_aux_display_runtime_put(dev_priv);
 
+        if (vdd)
+                edp_panel_vdd_off(intel_dp, false);
+
         return ret;
 }
 
-/* Write data to the aux channel in native mode */
-static int
-intel_dp_aux_native_write(struct intel_dp *intel_dp,
-                          uint16_t address, uint8_t *send, int send_bytes)
+#define HEADER_SIZE     4
+static ssize_t
+intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
 {
+        struct intel_dp *intel_dp = container_of(aux, struct intel_dp, aux);
+        uint8_t txbuf[20], rxbuf[20];
+        size_t txsize, rxsize;
         int ret;
-        uint8_t msg[20];
-        int msg_bytes;
-        uint8_t ack;
-        int retry;
 
-        if (WARN_ON(send_bytes > 16))
-                return -E2BIG;
+        txbuf[0] = msg->request << 4;
+        txbuf[1] = msg->address >> 8;
+        txbuf[2] = msg->address & 0xff;
+        txbuf[3] = msg->size - 1;
 
-        intel_dp_check_edp(intel_dp);
-        msg[0] = DP_AUX_NATIVE_WRITE << 4;
-        msg[1] = address >> 8;
-        msg[2] = address & 0xff;
-        msg[3] = send_bytes - 1;
-        memcpy(&msg[4], send, send_bytes);
-        msg_bytes = send_bytes + 4;
-        for (retry = 0; retry < 7; retry++) {
-                ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes, &ack, 1);
-                if (ret < 0)
-                        return ret;
-                ack >>= 4;
-                if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_ACK)
-                        return send_bytes;
-                else if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_DEFER)
-                        usleep_range(400, 500);
-                else
-                        return -EIO;
-        }
+        switch (msg->request & ~DP_AUX_I2C_MOT) {
+        case DP_AUX_NATIVE_WRITE:
+        case DP_AUX_I2C_WRITE:
+                txsize = HEADER_SIZE + msg->size;
+                rxsize = 1;
 
-        DRM_ERROR("too many retries, giving up\n");
-        return -EIO;
-}
+                if (WARN_ON(txsize > 20))
+                        return -E2BIG;
 
-/* Write a single byte to the aux channel in native mode */
-static int
-intel_dp_aux_native_write_1(struct intel_dp *intel_dp,
-                            uint16_t address, uint8_t byte)
-{
-        return intel_dp_aux_native_write(intel_dp, address, &byte, 1);
-}
+                memcpy(txbuf + HEADER_SIZE, msg->buffer, msg->size);
 
-/* read bytes from a native aux channel */
-static int
-intel_dp_aux_native_read(struct intel_dp *intel_dp,
-                         uint16_t address, uint8_t *recv, int recv_bytes)
-{
-        uint8_t msg[4];
-        int msg_bytes;
-        uint8_t reply[20];
-        int reply_bytes;
-        uint8_t ack;
-        int ret;
-        int retry;
+                ret = intel_dp_aux_ch(intel_dp, txbuf, txsize, rxbuf, rxsize);
+                if (ret > 0) {
+                        msg->reply = rxbuf[0] >> 4;
 
-        if (WARN_ON(recv_bytes > 19))
-                return -E2BIG;
+                        /* Return payload size. */
+                        ret = msg->size;
+                }
+                break;
 
-        intel_dp_check_edp(intel_dp);
-        msg[0] = DP_AUX_NATIVE_READ << 4;
-        msg[1] = address >> 8;
-        msg[2] = address & 0xff;
-        msg[3] = recv_bytes - 1;
-
-        msg_bytes = 4;
-        reply_bytes = recv_bytes + 1;
-
-        for (retry = 0; retry < 7; retry++) {
-                ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes,
-                                      reply, reply_bytes);
-                if (ret == 0)
-                        return -EPROTO;
-                if (ret < 0)
-                        return ret;
-                ack = reply[0] >> 4;
-                if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_ACK) {
-                        memcpy(recv, reply + 1, ret - 1);
-                        return ret - 1;
+        case DP_AUX_NATIVE_READ:
+        case DP_AUX_I2C_READ:
+                txsize = HEADER_SIZE;
+                rxsize = msg->size + 1;
+
+                if (WARN_ON(rxsize > 20))
+                        return -E2BIG;
+
+                ret = intel_dp_aux_ch(intel_dp, txbuf, txsize, rxbuf, rxsize);
+                if (ret > 0) {
+                        msg->reply = rxbuf[0] >> 4;
+                        /*
+                         * Assume happy day, and copy the data. The caller is
+                         * expected to check msg->reply before touching it.
+                         *
+                         * Return payload size.
+                         */
+                        ret--;
+                        memcpy(msg->buffer, rxbuf + 1, ret);
                 }
-                else if ((ack & DP_AUX_NATIVE_REPLY_MASK) == DP_AUX_NATIVE_REPLY_DEFER)
-                        usleep_range(400, 500);
-                else
-                        return -EIO;
+                break;
+
+        default:
+                ret = -EINVAL;
+                break;
         }
 
-        DRM_ERROR("too many retries, giving up\n");
-        return -EIO;
+        return ret;
 }
 
-static int
-intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
-                    uint8_t write_byte, uint8_t *read_byte)
-{
-        struct i2c_algo_dp_aux_data *algo_data = adapter->algo_data;
-        struct intel_dp *intel_dp = container_of(adapter,
-                                                struct intel_dp,
-                                                adapter);
-        uint16_t address = algo_data->address;
-        uint8_t msg[5];
-        uint8_t reply[2];
-        unsigned retry;
-        int msg_bytes;
-        int reply_bytes;
+static void
+intel_dp_aux_init(struct intel_dp *intel_dp, struct intel_connector *connector)
+{
+        struct drm_device *dev = intel_dp_to_dev(intel_dp);
+        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
+        enum port port = intel_dig_port->port;
+        const char *name = NULL;
         int ret;
 
-        intel_edp_panel_vdd_on(intel_dp);
-        intel_dp_check_edp(intel_dp);
-        /* Set up the command byte */
-        if (mode & MODE_I2C_READ)
-                msg[0] = DP_AUX_I2C_READ << 4;
-        else
-                msg[0] = DP_AUX_I2C_WRITE << 4;
-
-        if (!(mode & MODE_I2C_STOP))
-                msg[0] |= DP_AUX_I2C_MOT << 4;
-
-        msg[1] = address >> 8;
-        msg[2] = address;
-
-        switch (mode) {
-        case MODE_I2C_WRITE:
-                msg[3] = 0;
-                msg[4] = write_byte;
-                msg_bytes = 5;
-                reply_bytes = 1;
+        switch (port) {
+        case PORT_A:
+                intel_dp->aux_ch_ctl_reg = DPA_AUX_CH_CTL;
+                name = "DPDDC-A";
                 break;
-        case MODE_I2C_READ:
-                msg[3] = 0;
-                msg_bytes = 4;
-                reply_bytes = 2;
+        case PORT_B:
+                intel_dp->aux_ch_ctl_reg = PCH_DPB_AUX_CH_CTL;
+                name = "DPDDC-B";
                 break;
-        default:
-                msg_bytes = 3;
-                reply_bytes = 1;
+        case PORT_C:
+                intel_dp->aux_ch_ctl_reg = PCH_DPC_AUX_CH_CTL;
+                name = "DPDDC-C";
                 break;
+        case PORT_D:
+                intel_dp->aux_ch_ctl_reg = PCH_DPD_AUX_CH_CTL;
+                name = "DPDDC-D";
+                break;
+        default:
+                BUG();
         }
 
-        /*
-         * DP1.2 sections 2.7.7.1.5.6.1 and 2.7.7.1.6.6.1: A DP Source device is
-         * required to retry at least seven times upon receiving AUX_DEFER
-         * before giving up the AUX transaction.
-         */
-        for (retry = 0; retry < 7; retry++) {
-                ret = intel_dp_aux_ch(intel_dp,
-                                      msg, msg_bytes,
-                                      reply, reply_bytes);
-                if (ret < 0) {
-                        DRM_DEBUG_KMS("aux_ch failed %d\n", ret);
-                        goto out;
-                }
+        if (!HAS_DDI(dev))
+                intel_dp->aux_ch_ctl_reg = intel_dp->output_reg + 0x10;
 
-                switch ((reply[0] >> 4) & DP_AUX_NATIVE_REPLY_MASK) {
-                case DP_AUX_NATIVE_REPLY_ACK:
-                        /* I2C-over-AUX Reply field is only valid
-                         * when paired with AUX ACK.
-                         */
-                        break;
-                case DP_AUX_NATIVE_REPLY_NACK:
-                        DRM_DEBUG_KMS("aux_ch native nack\n");
-                        ret = -EREMOTEIO;
-                        goto out;
-                case DP_AUX_NATIVE_REPLY_DEFER:
-                        /*
-                         * For now, just give more slack to branch devices. We
-                         * could check the DPCD for I2C bit rate capabilities,
-                         * and if available, adjust the interval. We could also
-                         * be more careful with DP-to-Legacy adapters where a
-                         * long legacy cable may force very low I2C bit rates.
-                         */
-                        if (intel_dp->dpcd[DP_DOWNSTREAMPORT_PRESENT] &
-                            DP_DWN_STRM_PORT_PRESENT)
-                                usleep_range(500, 600);
-                        else
-                                usleep_range(300, 400);
-                        continue;
-                default:
-                        DRM_ERROR("aux_ch invalid native reply 0x%02x\n",
-                                  reply[0]);
-                        ret = -EREMOTEIO;
-                        goto out;
-                }
+        intel_dp->aux.name = name;
+        intel_dp->aux.dev = dev->dev;
+        intel_dp->aux.transfer = intel_dp_aux_transfer;
 
-                switch ((reply[0] >> 4) & DP_AUX_I2C_REPLY_MASK) {
-                case DP_AUX_I2C_REPLY_ACK:
-                        if (mode == MODE_I2C_READ) {
-                                *read_byte = reply[1];
-                        }
-                        ret = reply_bytes - 1;
-                        goto out;
-                case DP_AUX_I2C_REPLY_NACK:
-                        DRM_DEBUG_KMS("aux_i2c nack\n");
-                        ret = -EREMOTEIO;
-                        goto out;
-                case DP_AUX_I2C_REPLY_DEFER:
-                        DRM_DEBUG_KMS("aux_i2c defer\n");
-                        udelay(100);
-                        break;
-                default:
-                        DRM_ERROR("aux_i2c invalid reply 0x%02x\n", reply[0]);
-                        ret = -EREMOTEIO;
-                        goto out;
-                }
-        }
+        DRM_DEBUG_KMS("registering %s bus for %s\n", name,
+                      connector->base.kdev->kobj.name);
 
-        DRM_ERROR("too many retries, giving up\n");
-        ret = -EREMOTEIO;
+        ret = drm_dp_aux_register_i2c_bus(&intel_dp->aux);
+        if (ret < 0) {
+                DRM_ERROR("drm_dp_aux_register_i2c_bus() for %s failed (%d)\n",
+                          name, ret);
+                return;
+        }
 
-out:
-        edp_panel_vdd_off(intel_dp, false);
-        return ret;
+        ret = sysfs_create_link(&connector->base.kdev->kobj,
+                                &intel_dp->aux.ddc.dev.kobj,
+                                intel_dp->aux.ddc.dev.kobj.name);
+        if (ret < 0) {
+                DRM_ERROR("sysfs_create_link() for %s failed (%d)\n", name, ret);
+                drm_dp_aux_unregister_i2c_bus(&intel_dp->aux);
+        }
 }
 
 static void
@@ -789,43 +700,10 @@ intel_dp_connector_unregister(struct intel_connector *intel_connector)
         struct intel_dp *intel_dp = intel_attached_dp(&intel_connector->base);
 
         sysfs_remove_link(&intel_connector->base.kdev->kobj,
-                          intel_dp->adapter.dev.kobj.name);
+                          intel_dp->aux.ddc.dev.kobj.name);
         intel_connector_unregister(intel_connector);
 }
 
-static int
-intel_dp_i2c_init(struct intel_dp *intel_dp,
-                  struct intel_connector *intel_connector, const char *name)
-{
-        int     ret;
-
-        DRM_DEBUG_KMS("i2c_init %s\n", name);
-        intel_dp->algo.running = false;
-        intel_dp->algo.address = 0;
-        intel_dp->algo.aux_ch = intel_dp_i2c_aux_ch;
-
-        memset(&intel_dp->adapter, '\0', sizeof(intel_dp->adapter));
-        intel_dp->adapter.owner = THIS_MODULE;
-        intel_dp->adapter.class = I2C_CLASS_DDC;
-        strncpy(intel_dp->adapter.name, name, sizeof(intel_dp->adapter.name) - 1);
-        intel_dp->adapter.name[sizeof(intel_dp->adapter.name) - 1] = '\0';
-        intel_dp->adapter.algo_data = &intel_dp->algo;
-        intel_dp->adapter.dev.parent = intel_connector->base.dev->dev;
-
-        ret = i2c_dp_aux_add_bus(&intel_dp->adapter);
-        if (ret < 0)
-                return ret;
-
-        ret = sysfs_create_link(&intel_connector->base.kdev->kobj,
-                                &intel_dp->adapter.dev.kobj,
-                                intel_dp->adapter.dev.kobj.name);
-
-        if (ret < 0)
-                i2c_del_adapter(&intel_dp->adapter);
-
-        return ret;
-}
-
 static void
 intel_dp_set_clock(struct intel_encoder *encoder,
                    struct intel_crtc_config *pipe_config, int link_bw)
@@ -1161,23 +1039,21 @@ static  u32 ironlake_get_pp_control(struct intel_dp *intel_dp)
         return control;
 }
 
-void intel_edp_panel_vdd_on(struct intel_dp *intel_dp)
+static bool _edp_panel_vdd_on(struct intel_dp *intel_dp)
 {
         struct drm_device *dev = intel_dp_to_dev(intel_dp);
         struct drm_i915_private *dev_priv = dev->dev_private;
         u32 pp;
         u32 pp_stat_reg, pp_ctrl_reg;
+        bool need_to_disable = !intel_dp->want_panel_vdd;
 
         if (!is_edp(intel_dp))
-                return;
-
-        WARN(intel_dp->want_panel_vdd,
-             "eDP VDD already requested on\n");
+                return false;
 
         intel_dp->want_panel_vdd = true;
 
         if (edp_have_panel_vdd(intel_dp))
-                return;
+                return need_to_disable;
 
         intel_runtime_pm_get(dev_priv);
 
@@ -1203,6 +1079,17 @@ void intel_edp_panel_vdd_on(struct intel_dp *intel_dp)
                 DRM_DEBUG_KMS("eDP was not running\n");
                 msleep(intel_dp->panel_power_up_delay);
         }
+
+        return need_to_disable;
+}
+
+void intel_edp_panel_vdd_on(struct intel_dp *intel_dp)
+{
+        if (is_edp(intel_dp)) {
+                bool vdd = _edp_panel_vdd_on(intel_dp);
+
+                WARN(!vdd, "eDP VDD already requested on\n");
+        }
 }
 
 static void edp_panel_vdd_off_sync(struct intel_dp *intel_dp)
@@ -1465,8 +1352,8 @@ void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode)
                 return;
 
         if (mode != DRM_MODE_DPMS_ON) {
-                ret = intel_dp_aux_native_write_1(intel_dp, DP_SET_POWER,
-                                                  DP_SET_POWER_D3);
+                ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER,
+                                         DP_SET_POWER_D3);
                 if (ret != 1)
                         DRM_DEBUG_DRIVER("failed to write sink power state\n");
         } else {
@@ -1475,9 +1362,8 @@ void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode)
                  * time to wake up.
                  */
                 for (i = 0; i < 3; i++) {
-                        ret = intel_dp_aux_native_write_1(intel_dp,
-                                                          DP_SET_POWER,
-                                                          DP_SET_POWER_D0);
+                        ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER,
+                                                 DP_SET_POWER_D0);
                         if (ret == 1)
                                 break;
                         msleep(1);
@@ -1701,13 +1587,11 @@ static void intel_edp_psr_enable_sink(struct intel_dp *intel_dp)
 
         /* Enable PSR in sink */
         if (intel_dp->psr_dpcd[1] & DP_PSR_NO_TRAIN_ON_EXIT)
-                intel_dp_aux_native_write_1(intel_dp, DP_PSR_EN_CFG,
-                                            DP_PSR_ENABLE &
-                                            ~DP_PSR_MAIN_LINK_ACTIVE);
+                drm_dp_dpcd_writeb(&intel_dp->aux, DP_PSR_EN_CFG,
+                                   DP_PSR_ENABLE & ~DP_PSR_MAIN_LINK_ACTIVE);
         else
-                intel_dp_aux_native_write_1(intel_dp, DP_PSR_EN_CFG,
-                                            DP_PSR_ENABLE |
-                                            DP_PSR_MAIN_LINK_ACTIVE);
+                drm_dp_dpcd_writeb(&intel_dp->aux, DP_PSR_EN_CFG,
+                                   DP_PSR_ENABLE | DP_PSR_MAIN_LINK_ACTIVE);
 
         /* Setup AUX registers */
         I915_WRITE(EDP_PSR_AUX_DATA1(dev), EDP_PSR_DPCD_COMMAND);
@@ -2018,26 +1902,25 @@ static void vlv_dp_pre_pll_enable(struct intel_encoder *encoder)
 /*
  * Native read with retry for link status and receiver capability reads for
  * cases where the sink may still be asleep.
+ *
+ * Sinks are *supposed* to come up within 1ms from an off state, but we're also
+ * supposed to retry 3 times per the spec.
  */
-static bool
-intel_dp_aux_native_read_retry(struct intel_dp *intel_dp, uint16_t address,
-                               uint8_t *recv, int recv_bytes)
+static ssize_t
+intel_dp_dpcd_read_wake(struct drm_dp_aux *aux, unsigned int offset,
+                        void *buffer, size_t size)
 {
-        int ret, i;
+        ssize_t ret;
+        int i;
 
-        /*
-         * Sinks are *supposed* to come up within 1ms from an off state,
-         * but we're also supposed to retry 3 times per the spec.
-         */
         for (i = 0; i < 3; i++) {
-                ret = intel_dp_aux_native_read(intel_dp, address, recv,
-                                               recv_bytes);
-                if (ret == recv_bytes)
-                        return true;
+                ret = drm_dp_dpcd_read(aux, offset, buffer, size);
+                if (ret == size)
+                        return ret;
                 msleep(1);
         }
 
-        return false;
+        return ret;
 }
 
 /*
@@ -2047,10 +1930,10 @@ intel_dp_aux_native_read_retry(struct intel_dp *intel_dp, uint16_t address,
 static bool
 intel_dp_get_link_status(struct intel_dp *intel_dp, uint8_t link_status[DP_LINK_STATUS_SIZE])
 {
-        return intel_dp_aux_native_read_retry(intel_dp,
-                                              DP_LANE0_1_STATUS,
-                                              link_status,
-                                              DP_LINK_STATUS_SIZE);
+        return intel_dp_dpcd_read_wake(&intel_dp->aux,
+                                       DP_LANE0_1_STATUS,
+                                       link_status,
+                                       DP_LINK_STATUS_SIZE) == DP_LINK_STATUS_SIZE;
 }
 
 /*
@@ -2564,8 +2447,8 @@ intel_dp_set_link_train(struct intel_dp *intel_dp,
                 len = intel_dp->lane_count + 1;
         }
 
-        ret = intel_dp_aux_native_write(intel_dp, DP_TRAINING_PATTERN_SET,
-                                        buf, len);
+        ret = drm_dp_dpcd_write(&intel_dp->aux, DP_TRAINING_PATTERN_SET,
+                                buf, len);
 
         return ret == len;
 }
@@ -2594,9 +2477,8 @@ intel_dp_update_link_train(struct intel_dp *intel_dp, uint32_t *DP,
         I915_WRITE(intel_dp->output_reg, *DP);
         POSTING_READ(intel_dp->output_reg);
 
-        ret = intel_dp_aux_native_write(intel_dp, DP_TRAINING_LANE0_SET,
-                                        intel_dp->train_set,
-                                        intel_dp->lane_count);
+        ret = drm_dp_dpcd_write(&intel_dp->aux, DP_TRAINING_LANE0_SET,
+                                intel_dp->train_set, intel_dp->lane_count);
 
         return ret == intel_dp->lane_count;
 }
@@ -2652,11 +2534,11 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
         link_config[1] = intel_dp->lane_count;
         if (drm_dp_enhanced_frame_cap(intel_dp->dpcd))
                 link_config[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
-        intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET, link_config, 2);
+        drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_BW_SET, link_config, 2);
 
         link_config[0] = 0;
         link_config[1] = DP_SET_ANSI_8B10B;
-        intel_dp_aux_native_write(intel_dp, DP_DOWNSPREAD_CTRL, link_config, 2);
+        drm_dp_dpcd_write(&intel_dp->aux, DP_DOWNSPREAD_CTRL, link_config, 2);
 
         DP |= DP_PORT_EN;
 
@@ -2899,8 +2781,8 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)
 
         char dpcd_hex_dump[sizeof(intel_dp->dpcd) * 3];
 
-        if (intel_dp_aux_native_read_retry(intel_dp, 0x000, intel_dp->dpcd,
-                                           sizeof(intel_dp->dpcd)) == 0)
+        if (intel_dp_dpcd_read_wake(&intel_dp->aux, 0x000, intel_dp->dpcd,
+                                    sizeof(intel_dp->dpcd)) < 0)
                 return false; /* aux transfer failed */
 
         hex_dump_to_buffer(intel_dp->dpcd, sizeof(intel_dp->dpcd),
@@ -2913,9 +2795,9 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)
         /* Check if the panel supports PSR */
         memset(intel_dp->psr_dpcd, 0, sizeof(intel_dp->psr_dpcd));
         if (is_edp(intel_dp)) {
-                intel_dp_aux_native_read_retry(intel_dp, DP_PSR_SUPPORT,
-                                               intel_dp->psr_dpcd,
-                                               sizeof(intel_dp->psr_dpcd));
+                intel_dp_dpcd_read_wake(&intel_dp->aux, DP_PSR_SUPPORT,
+                                        intel_dp->psr_dpcd,
+                                        sizeof(intel_dp->psr_dpcd));
                 if (intel_dp->psr_dpcd[0] & DP_PSR_IS_SUPPORTED) {
                         dev_priv->psr.sink_support = true;
                         DRM_DEBUG_KMS("Detected EDP PSR Panel.\n");
@@ -2937,9 +2819,9 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)
         if (intel_dp->dpcd[DP_DPCD_REV] == 0x10)
                 return true; /* no per-port downstream info */
 
-        if (intel_dp_aux_native_read_retry(intel_dp, DP_DOWNSTREAM_PORT_0,
-                                           intel_dp->downstream_ports,
-                                           DP_MAX_DOWNSTREAM_PORTS) == 0)
+        if (intel_dp_dpcd_read_wake(&intel_dp->aux, DP_DOWNSTREAM_PORT_0,
+                                    intel_dp->downstream_ports,
+                                    DP_MAX_DOWNSTREAM_PORTS) < 0)
                 return false; /* downstream port status fetch failed */
 
         return true;
@@ -2955,11 +2837,11 @@ intel_dp_probe_oui(struct intel_dp *intel_dp)
 
         intel_edp_panel_vdd_on(intel_dp);
 
-        if (intel_dp_aux_native_read_retry(intel_dp, DP_SINK_OUI, buf, 3))
+        if (intel_dp_dpcd_read_wake(&intel_dp->aux, DP_SINK_OUI, buf, 3) == 3)
                 DRM_DEBUG_KMS("Sink OUI: %02hx%02hx%02hx\n",
                               buf[0], buf[1], buf[2]);
 
-        if (intel_dp_aux_native_read_retry(intel_dp, DP_BRANCH_OUI, buf, 3))
+        if (intel_dp_dpcd_read_wake(&intel_dp->aux, DP_BRANCH_OUI, buf, 3) == 3)
                 DRM_DEBUG_KMS("Branch OUI: %02hx%02hx%02hx\n",
                               buf[0], buf[1], buf[2]);
 
@@ -2974,46 +2856,40 @@ int intel_dp_sink_crc(struct intel_dp *intel_dp, u8 *crc)
                 to_intel_crtc(intel_dig_port->base.base.crtc);
         u8 buf[1];
 
-        if (!intel_dp_aux_native_read(intel_dp, DP_TEST_SINK_MISC, buf, 1))
+        if (drm_dp_dpcd_readb(&intel_dp->aux, DP_TEST_SINK_MISC, buf) < 0)
                 return -EAGAIN;
 
         if (!(buf[0] & DP_TEST_CRC_SUPPORTED))
                 return -ENOTTY;
 
-        if (!intel_dp_aux_native_write_1(intel_dp, DP_TEST_SINK,
-                                         DP_TEST_SINK_START))
+        if (drm_dp_dpcd_writeb(&intel_dp->aux, DP_TEST_SINK,
+                               DP_TEST_SINK_START) < 0)
                 return -EAGAIN;
 
         /* Wait 2 vblanks to be sure we will have the correct CRC value */
         intel_wait_for_vblank(dev, intel_crtc->pipe);
         intel_wait_for_vblank(dev, intel_crtc->pipe);
 
-        if (!intel_dp_aux_native_read(intel_dp, DP_TEST_CRC_R_CR, crc, 6))
+        if (drm_dp_dpcd_read(&intel_dp->aux, DP_TEST_CRC_R_CR, crc, 6) < 0)
                 return -EAGAIN;
 
-        intel_dp_aux_native_write_1(intel_dp, DP_TEST_SINK, 0);
+        drm_dp_dpcd_writeb(&intel_dp->aux, DP_TEST_SINK, 0);
         return 0;
 }
 
 static bool
 intel_dp_get_sink_irq(struct intel_dp *intel_dp, u8 *sink_irq_vector)
 {
-        int ret;
-
-        ret = intel_dp_aux_native_read_retry(intel_dp,
-                                             DP_DEVICE_SERVICE_IRQ_VECTOR,
-                                             sink_irq_vector, 1);
-        if (!ret)
-                return false;
-
-        return true;
+        return intel_dp_dpcd_read_wake(&intel_dp->aux,
+                                       DP_DEVICE_SERVICE_IRQ_VECTOR,
+                                       sink_irq_vector, 1) == 1;
 }
 
 static void
 intel_dp_handle_test_request(struct intel_dp *intel_dp)
 {
         /* NAK by default */
-        intel_dp_aux_native_write_1(intel_dp, DP_TEST_RESPONSE, DP_TEST_NAK);
+        drm_dp_dpcd_writeb(&intel_dp->aux, DP_TEST_RESPONSE, DP_TEST_NAK);
 }
 
 /*
@@ -3052,9 +2928,9 @@ intel_dp_check_link_status(struct intel_dp *intel_dp)
         if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11 &&
             intel_dp_get_sink_irq(intel_dp, &sink_irq_vector)) {
                 /* Clear interrupt source */
-                intel_dp_aux_native_write_1(intel_dp,
-                                            DP_DEVICE_SERVICE_IRQ_VECTOR,
-                                            sink_irq_vector);
+                drm_dp_dpcd_writeb(&intel_dp->aux,
+                                   DP_DEVICE_SERVICE_IRQ_VECTOR,
+                                   sink_irq_vector);
 
                 if (sink_irq_vector & DP_AUTOMATED_TEST_REQUEST)
                         intel_dp_handle_test_request(intel_dp);
@@ -3089,15 +2965,17 @@ intel_dp_detect_dpcd(struct intel_dp *intel_dp)
         if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11 &&
             intel_dp->downstream_ports[0] & DP_DS_PORT_HPD) {
                 uint8_t reg;
-                if (!intel_dp_aux_native_read_retry(intel_dp, DP_SINK_COUNT,
-                                                    &reg, 1))
+
+                if (intel_dp_dpcd_read_wake(&intel_dp->aux, DP_SINK_COUNT,
+                                            &reg, 1) < 0)
                         return connector_status_unknown;
+
                 return DP_GET_SINK_COUNT(reg) ? connector_status_connected
                                               : connector_status_disconnected;
         }
 
         /* If no HPD, poke DDC gently */
-        if (drm_probe_ddc(&intel_dp->adapter))
+        if (drm_probe_ddc(&intel_dp->aux.ddc))
                 return connector_status_connected;
 
         /* Well we tried, say unknown for unreliable port types */
@@ -3265,7 +3143,7 @@ intel_dp_detect(struct drm_connector *connector, bool force)
         if (intel_dp->force_audio != HDMI_AUDIO_AUTO) {
                 intel_dp->has_audio = (intel_dp->force_audio == HDMI_AUDIO_ON);
         } else {
-                edid = intel_dp_get_edid(connector, &intel_dp->adapter);
+                edid = intel_dp_get_edid(connector, &intel_dp->aux.ddc);
                 if (edid) {
                         intel_dp->has_audio = drm_detect_monitor_audio(edid);
                         kfree(edid);
@@ -3301,7 +3179,7 @@ static int intel_dp_get_modes(struct drm_connector *connector)
         power_domain = intel_display_port_power_domain(intel_encoder);
         intel_display_power_get(dev_priv, power_domain);
 
-        ret = intel_dp_get_edid_modes(connector, &intel_dp->adapter);
+        ret = intel_dp_get_edid_modes(connector, &intel_dp->aux.ddc);
         intel_display_power_put(dev_priv, power_domain);
         if (ret)
                 return ret;
@@ -3334,7 +3212,7 @@ intel_dp_detect_audio(struct drm_connector *connector)
         power_domain = intel_display_port_power_domain(intel_encoder);
         intel_display_power_get(dev_priv, power_domain);
 
-        edid = intel_dp_get_edid(connector, &intel_dp->adapter);
+        edid = intel_dp_get_edid(connector, &intel_dp->aux.ddc);
         if (edid) {
                 has_audio = drm_detect_monitor_audio(edid);
                 kfree(edid);
@@ -3456,7 +3334,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
         struct intel_dp *intel_dp = &intel_dig_port->dp;
         struct drm_device *dev = intel_dp_to_dev(intel_dp);
 
-        i2c_del_adapter(&intel_dp->adapter);
+        drm_dp_aux_unregister_i2c_bus(&intel_dp->aux);
         drm_encoder_cleanup(encoder);
         if (is_edp(intel_dp)) {
                 cancel_delayed_work_sync(&intel_dp->panel_vdd_work);
@@ -3768,7 +3646,7 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
         /* We now know it's not a ghost, init power sequence regs. */
         intel_dp_init_panel_power_sequencer_registers(dev, intel_dp, power_seq);
 
-        edid = drm_get_edid(connector, &intel_dp->adapter);
+        edid = drm_get_edid(connector, &intel_dp->aux.ddc);
         if (edid) {
                 if (drm_add_edid_modes(connector, edid)) {
                         drm_mode_connector_update_edid_property(connector,
@@ -3816,8 +3694,7 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
         struct drm_i915_private *dev_priv = dev->dev_private;
         enum port port = intel_dig_port->port;
         struct edp_power_seq power_seq = { 0 };
-        const char *name = NULL;
-        int type, error;
+        int type;
 
         /* intel_dp vfuncs */
         if (IS_VALLEYVIEW(dev))
@@ -3870,43 +3747,19 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
                 intel_connector->get_hw_state = intel_connector_get_hw_state;
         intel_connector->unregister = intel_dp_connector_unregister;
 
-        intel_dp->aux_ch_ctl_reg = intel_dp->output_reg + 0x10;
-        if (HAS_DDI(dev)) {
-                switch (intel_dig_port->port) {
-                case PORT_A:
-                        intel_dp->aux_ch_ctl_reg = DPA_AUX_CH_CTL;
-                        break;
-                case PORT_B:
-                        intel_dp->aux_ch_ctl_reg = PCH_DPB_AUX_CH_CTL;
-                        break;
-                case PORT_C:
-                        intel_dp->aux_ch_ctl_reg = PCH_DPC_AUX_CH_CTL;
-                        break;
-                case PORT_D:
-                        intel_dp->aux_ch_ctl_reg = PCH_DPD_AUX_CH_CTL;
-                        break;
-                default:
-                        BUG();
-                }
-        }
-
-        /* Set up the DDC bus. */
+        /* Set up the hotplug pin. */
         switch (port) {
         case PORT_A:
                 intel_encoder->hpd_pin = HPD_PORT_A;
-                name = "DPDDC-A";
                 break;
         case PORT_B:
                 intel_encoder->hpd_pin = HPD_PORT_B;
-                name = "DPDDC-B";
                 break;
         case PORT_C:
                 intel_encoder->hpd_pin = HPD_PORT_C;
-                name = "DPDDC-C";
                 break;
         case PORT_D:
                 intel_encoder->hpd_pin = HPD_PORT_D;
-                name = "DPDDC-D";
                 break;
         default:
                 BUG();
@@ -3917,14 +3770,12 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
                 intel_dp_init_panel_power_sequencer(dev, intel_dp, &power_seq);
         }
 
-        error = intel_dp_i2c_init(intel_dp, intel_connector, name);
-        WARN(error, "intel_dp_i2c_init failed with error %d for port %c\n",
-             error, port_name(port));
+        intel_dp_aux_init(intel_dp, intel_connector);
 
         intel_dp->psr_setup_done = false;
 
         if (!intel_edp_init_connector(intel_dp, intel_connector, &power_seq)) {
-                i2c_del_adapter(&intel_dp->adapter);
+                drm_dp_aux_unregister_i2c_bus(&intel_dp->aux);
                 if (is_edp(intel_dp)) {
                         cancel_delayed_work_sync(&intel_dp->panel_vdd_work);
                         mutex_lock(&dev->mode_config.mutex);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index e0064a18352d..890c5cd98268 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -489,8 +489,7 @@ struct intel_dp {
         uint8_t dpcd[DP_RECEIVER_CAP_SIZE];
         uint8_t psr_dpcd[EDP_PSR_RECEIVER_CAP_SIZE];
         uint8_t downstream_ports[DP_MAX_DOWNSTREAM_PORTS];
-        struct i2c_adapter adapter;
-        struct i2c_algo_dp_aux_data algo;
+        struct drm_dp_aux aux;
         uint8_t train_set[4];
         int panel_power_up_delay;
         int panel_power_down_delay;
diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
index adb5166a5dfd..5a00e90696de 100644
--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
@@ -259,7 +259,9 @@ int mgag200_mm_init(struct mga_device *mdev)
 
         ret = ttm_bo_device_init(&mdev->ttm.bdev,
                                  mdev->ttm.bo_global_ref.ref.object,
-                                 &mgag200_bo_driver, DRM_FILE_PAGE_OFFSET,
+                                 &mgag200_bo_driver,
+                                 dev->anon_inode->i_mapping,
+                                 DRM_FILE_PAGE_OFFSET,
                                  true);
         if (ret) {
                 DRM_ERROR("Error initialising bo driver; %d\n", ret);
@@ -324,7 +326,6 @@ int mgag200_bo_create(struct drm_device *dev, int size, int align,
         }
 
         mgabo->bo.bdev = &mdev->ttm.bdev;
-        mgabo->bo.bdev->dev_mapping = dev->dev_mapping;
 
         mgag200_ttm_placement(mgabo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 27c3fd89e8ce..c90c0dc0afe8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -228,8 +228,6 @@ nouveau_gem_ioctl_new(struct drm_device *dev, void *data,
         struct nouveau_bo *nvbo = NULL;
         int ret = 0;
 
-        drm->ttm.bdev.dev_mapping = drm->dev->dev_mapping;
-
         if (!pfb->memtype_valid(pfb, req->info.tile_flags)) {
                 NV_ERROR(cli, "bad page flags: 0x%08x\n", req->info.tile_flags);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index d45d50da978f..be3a3c9feafa 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -376,7 +376,9 @@ nouveau_ttm_init(struct nouveau_drm *drm)
 
         ret = ttm_bo_device_init(&drm->ttm.bdev,
                                   drm->ttm.bo_global_ref.ref.object,
-                                  &nouveau_bo_driver, DRM_FILE_PAGE_OFFSET,
+                                  &nouveau_bo_driver,
+                                  dev->anon_inode->i_mapping,
+                                  DRM_FILE_PAGE_OFFSET,
                                   bits <= 32 ? true : false);
         if (ret) {
                 NV_ERROR(drm, "error initialising bo driver, %d\n", ret);
diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
index 5aec3e81fe24..c8d972763889 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem.c
@@ -153,24 +153,24 @@ static struct {
 static void evict_entry(struct drm_gem_object *obj,
                 enum tiler_fmt fmt, struct usergart_entry *entry)
 {
-        if (obj->dev->dev_mapping) {
-                struct omap_gem_object *omap_obj = to_omap_bo(obj);
-                int n = usergart[fmt].height;
-                size_t size = PAGE_SIZE * n;
-                loff_t off = mmap_offset(obj) +
-                                (entry->obj_pgoff << PAGE_SHIFT);
-                const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE);
-                if (m > 1) {
-                        int i;
-                        /* if stride > than PAGE_SIZE then sparse mapping: */
-                        for (i = n; i > 0; i--) {
-                                unmap_mapping_range(obj->dev->dev_mapping,
-                                                off, PAGE_SIZE, 1);
-                                off += PAGE_SIZE * m;
-                        }
-                } else {
-                        unmap_mapping_range(obj->dev->dev_mapping, off, size, 1);
+        struct omap_gem_object *omap_obj = to_omap_bo(obj);
+        int n = usergart[fmt].height;
+        size_t size = PAGE_SIZE * n;
+        loff_t off = mmap_offset(obj) +
+                        (entry->obj_pgoff << PAGE_SHIFT);
+        const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE);
+
+        if (m > 1) {
+                int i;
+                /* if stride > than PAGE_SIZE then sparse mapping: */
+                for (i = n; i > 0; i--) {
+                        unmap_mapping_range(obj->dev->anon_inode->i_mapping,
+                                            off, PAGE_SIZE, 1);
+                        off += PAGE_SIZE * m;
                 }
+        } else {
+                unmap_mapping_range(obj->dev->anon_inode->i_mapping,
+                                    off, size, 1);
         }
 
         entry->obj = NULL;
diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
index 8691c76c5ef0..b95f144f0b49 100644
--- a/drivers/gpu/drm/qxl/qxl_object.c
+++ b/drivers/gpu/drm/qxl/qxl_object.c
@@ -82,8 +82,6 @@ int qxl_bo_create(struct qxl_device *qdev,
         enum ttm_bo_type type;
         int r;
 
-        if (unlikely(qdev->mman.bdev.dev_mapping == NULL))
-                qdev->mman.bdev.dev_mapping = qdev->ddev->dev_mapping;
         if (kernel)
                 type = ttm_bo_type_kernel;
         else
diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
index c7e7e6590c2b..29c02e0e857f 100644
--- a/drivers/gpu/drm/qxl/qxl_ttm.c
+++ b/drivers/gpu/drm/qxl/qxl_ttm.c
@@ -493,7 +493,9 @@ int qxl_ttm_init(struct qxl_device *qdev)
         /* No others user of address space so set it to 0 */
         r = ttm_bo_device_init(&qdev->mman.bdev,
                                qdev->mman.bo_global_ref.ref.object,
-                               &qxl_bo_driver, DRM_FILE_PAGE_OFFSET, 0);
+                               &qxl_bo_driver,
+                               qdev->ddev->anon_inode->i_mapping,
+                               DRM_FILE_PAGE_OFFSET, 0);
         if (r) {
                 DRM_ERROR("failed initializing buffer object driver(%d).\n", r);
                 return r;
@@ -518,8 +520,6 @@ int qxl_ttm_init(struct qxl_device *qdev)
                  ((unsigned)num_io_pages * PAGE_SIZE) / (1024 * 1024));
         DRM_INFO("qxl: %uM of Surface memory size\n",
                  (unsigned)qdev->surfaceram_size / (1024 * 1024));
-        if (unlikely(qdev->mman.bdev.dev_mapping == NULL))
-                qdev->mman.bdev.dev_mapping = qdev->ddev->dev_mapping;
         r = qxl_ttm_debugfs_init(qdev);
         if (r) {
                 DRM_ERROR("Failed to init debugfs\n");
diff --git a/drivers/gpu/drm/radeon/Makefile b/drivers/gpu/drm/radeon/Makefile
index 306364a1ecda..09433534dc47 100644
--- a/drivers/gpu/drm/radeon/Makefile
+++ b/drivers/gpu/drm/radeon/Makefile
@@ -80,7 +80,7 @@ radeon-y += radeon_device.o radeon_asic.o radeon_kms.o \
         r600_dpm.o rs780_dpm.o rv6xx_dpm.o rv770_dpm.o rv730_dpm.o rv740_dpm.o \
         rv770_smc.o cypress_dpm.o btc_dpm.o sumo_dpm.o sumo_smc.o trinity_dpm.o \
         trinity_smc.o ni_dpm.o si_smc.o si_dpm.o kv_smc.o kv_dpm.o ci_smc.o \
-        ci_dpm.o dce6_afmt.o
+        ci_dpm.o dce6_afmt.o radeon_vm.o
 
 # add async DMA block
 radeon-y += \
@@ -99,6 +99,12 @@ radeon-y += \
         uvd_v3_1.o \
         uvd_v4_2.o
 
+# add VCE block
+radeon-y += \
+        radeon_vce.o \
+        vce_v1_0.o \
+        vce_v2_0.o \
+
 radeon-$(CONFIG_COMPAT) += radeon_ioc32.o
 radeon-$(CONFIG_VGA_SWITCHEROO) += radeon_atpx_handler.o
 radeon-$(CONFIG_ACPI) += radeon_acpi.o
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index ea103ccdf4bd..f81d7ca134db 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -2601,6 +2601,10 @@ int btc_dpm_init(struct radeon_device *rdev)
         pi->min_vddc_in_table = 0;
         pi->max_vddc_in_table = 0;
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = rv7xx_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 8d49104ca6c2..cad89a977527 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -172,6 +172,8 @@ extern void si_trim_voltage_table_to_fit_state_table(struct radeon_device *rdev,
 extern void cik_enter_rlc_safe_mode(struct radeon_device *rdev);
 extern void cik_exit_rlc_safe_mode(struct radeon_device *rdev);
 extern int ci_mc_load_microcode(struct radeon_device *rdev);
+extern void cik_update_cg(struct radeon_device *rdev,
+                          u32 block, bool enable);
 
 static int ci_get_std_voltage_value_sidd(struct radeon_device *rdev,
                                          struct atom_voltage_table_entry *voltage_table,
@@ -746,6 +748,14 @@ static void ci_apply_state_adjust_rules(struct radeon_device *rdev,
         u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
         int i;
 
+        if (rps->vce_active) {
+                rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
+                rps->ecclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].ecclk;
+        } else {
+                rps->evclk = 0;
+                rps->ecclk = 0;
+        }
+
         if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
             ci_dpm_vblank_too_short(rdev))
                 disable_mclk_switching = true;
@@ -804,6 +814,13 @@ static void ci_apply_state_adjust_rules(struct radeon_device *rdev,
                 sclk = ps->performance_levels[0].sclk;
         }
 
+        if (rps->vce_active) {
+                if (sclk < rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].sclk)
+                        sclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].sclk;
+                if (mclk < rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].mclk)
+                        mclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].mclk;
+        }
+
         ps->performance_levels[0].sclk = sclk;
         ps->performance_levels[0].mclk = mclk;
 
@@ -3468,7 +3485,6 @@ static int ci_enable_uvd_dpm(struct radeon_device *rdev, bool enable)
                 0 : -EINVAL;
 }
 
-#if 0
 static int ci_enable_vce_dpm(struct radeon_device *rdev, bool enable)
 {
         struct ci_power_info *pi = ci_get_pi(rdev);
@@ -3501,6 +3517,7 @@ static int ci_enable_vce_dpm(struct radeon_device *rdev, bool enable)
                 0 : -EINVAL;
 }
 
+#if 0
 static int ci_enable_samu_dpm(struct radeon_device *rdev, bool enable)
 {
         struct ci_power_info *pi = ci_get_pi(rdev);
@@ -3587,7 +3604,6 @@ static int ci_update_uvd_dpm(struct radeon_device *rdev, bool gate)
         return ci_enable_uvd_dpm(rdev, !gate);
 }
 
-#if 0
 static u8 ci_get_vce_boot_level(struct radeon_device *rdev)
 {
         u8 i;
@@ -3608,15 +3624,15 @@ static int ci_update_vce_dpm(struct radeon_device *rdev,
                              struct radeon_ps *radeon_current_state)
 {
         struct ci_power_info *pi = ci_get_pi(rdev);
-        bool new_vce_clock_non_zero = (radeon_new_state->evclk != 0);
-        bool old_vce_clock_non_zero = (radeon_current_state->evclk != 0);
         int ret = 0;
         u32 tmp;
 
-        if (new_vce_clock_non_zero != old_vce_clock_non_zero) {
-                if (new_vce_clock_non_zero) {
-                        pi->smc_state_table.VceBootLevel = ci_get_vce_boot_level(rdev);
+        if (radeon_current_state->evclk != radeon_new_state->evclk) {
+                if (radeon_new_state->evclk) {
+                        /* turn the clocks on when encoding */
+                        cik_update_cg(rdev, RADEON_CG_BLOCK_VCE, false);
 
+                        pi->smc_state_table.VceBootLevel = ci_get_vce_boot_level(rdev);
                         tmp = RREG32_SMC(DPM_TABLE_475);
                         tmp &= ~VceBootLevel_MASK;
                         tmp |= VceBootLevel(pi->smc_state_table.VceBootLevel);
@@ -3624,12 +3640,16 @@ static int ci_update_vce_dpm(struct radeon_device *rdev,
 
                         ret = ci_enable_vce_dpm(rdev, true);
                 } else {
+                        /* turn the clocks off when not encoding */
+                        cik_update_cg(rdev, RADEON_CG_BLOCK_VCE, true);
+
                         ret = ci_enable_vce_dpm(rdev, false);
                 }
         }
         return ret;
 }
 
+#if 0
 static int ci_update_samu_dpm(struct radeon_device *rdev, bool gate)
 {
         return ci_enable_samu_dpm(rdev, gate);
@@ -4752,13 +4772,13 @@ int ci_dpm_set_power_state(struct radeon_device *rdev)
                 DRM_ERROR("ci_generate_dpm_level_enable_mask failed\n");
                 return ret;
         }
-#if 0
+
         ret = ci_update_vce_dpm(rdev, new_ps, old_ps);
         if (ret) {
                 DRM_ERROR("ci_update_vce_dpm failed\n");
                 return ret;
         }
-#endif
+
         ret = ci_update_sclk_t(rdev);
         if (ret) {
                 DRM_ERROR("ci_update_sclk_t failed\n");
@@ -4959,9 +4979,6 @@ static int ci_parse_power_table(struct radeon_device *rdev)
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
         for (i = 0; i < state_array->ucNumEntries; i++) {
                 u8 *idx;
                 power_state = (union pplib_power_state *)power_state_offset;
@@ -4998,6 +5015,21 @@ static int ci_parse_power_table(struct radeon_device *rdev)
                 power_state_offset += 2 + power_state->v2.ucNumDPMLevels;
         }
         rdev->pm.dpm.num_ps = state_array->ucNumEntries;
+
+        /* fill in the vce power states */
+        for (i = 0; i < RADEON_MAX_VCE_LEVELS; i++) {
+                u32 sclk, mclk;
+                clock_array_index = rdev->pm.dpm.vce_states[i].clk_idx;
+                clock_info = (union pplib_clock_info *)
+                        &clock_info_array->clockInfo[clock_array_index * clock_info_array->ucEntrySize];
+                sclk = le16_to_cpu(clock_info->ci.usEngineClockLow);
+                sclk |= clock_info->ci.ucEngineClockHigh << 16;
+                mclk = le16_to_cpu(clock_info->ci.usMemoryClockLow);
+                mclk |= clock_info->ci.ucMemoryClockHigh << 16;
+                rdev->pm.dpm.vce_states[i].sclk = sclk;
+                rdev->pm.dpm.vce_states[i].mclk = mclk;
+        }
+
         return 0;
 }
 
@@ -5077,17 +5109,25 @@ int ci_dpm_init(struct radeon_device *rdev)
                 ci_dpm_fini(rdev);
                 return ret;
         }
-        ret = ci_parse_power_table(rdev);
+
+        ret = r600_get_platform_caps(rdev);
         if (ret) {
                 ci_dpm_fini(rdev);
                 return ret;
         }
+
         ret = r600_parse_extended_power_table(rdev);
         if (ret) {
                 ci_dpm_fini(rdev);
                 return ret;
         }
 
+        ret = ci_parse_power_table(rdev);
+        if (ret) {
+                ci_dpm_fini(rdev);
+                return ret;
+        }
+
         pi->dll_default_on = false;
         pi->sram_end = SMC_RAM_END;
 
@@ -5120,6 +5160,7 @@ int ci_dpm_init(struct radeon_device *rdev)
         pi->caps_sclk_throttle_low_notification = false;
 
         pi->caps_uvd_dpm = true;
+        pi->caps_vce_dpm = true;
 
         ci_get_leakage_voltages(rdev);
         ci_patch_dependency_tables_with_leakage(rdev);
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e22be8458d92..0ae991d3289a 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -75,6 +75,7 @@ extern void si_init_uvd_internal_cg(struct radeon_device *rdev);
 extern int cik_sdma_resume(struct radeon_device *rdev);
 extern void cik_sdma_enable(struct radeon_device *rdev, bool enable);
 extern void cik_sdma_fini(struct radeon_device *rdev);
+extern void vce_v2_0_enable_mgcg(struct radeon_device *rdev, bool enable);
 static void cik_rlc_stop(struct radeon_device *rdev);
 static void cik_pcie_gen3_enable(struct radeon_device *rdev);
 static void cik_program_aspm(struct radeon_device *rdev);
@@ -4030,8 +4031,6 @@ static int cik_cp_gfx_resume(struct radeon_device *rdev)
         WREG32(CP_RB0_BASE, rb_addr);
         WREG32(CP_RB0_BASE_HI, upper_32_bits(rb_addr));
 
-        ring->rptr = RREG32(CP_RB0_RPTR);
-
         /* start the ring */
         cik_cp_gfx_start(rdev);
         rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready = true;
@@ -4134,8 +4133,11 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
 {
         if (enable)
                 WREG32(CP_MEC_CNTL, 0);
-        else
+        else {
                 WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
+                rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
+                rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
+        }
         udelay(50);
 }
 
@@ -4586,8 +4588,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                 rdev->ring[idx].wptr = 0;
                 mqd->queue_state.cp_hqd_pq_wptr = rdev->ring[idx].wptr;
                 WREG32(CP_HQD_PQ_WPTR, mqd->queue_state.cp_hqd_pq_wptr);
-                rdev->ring[idx].rptr = RREG32(CP_HQD_PQ_RPTR);
-                mqd->queue_state.cp_hqd_pq_rptr = rdev->ring[idx].rptr;
+                mqd->queue_state.cp_hqd_pq_rptr = RREG32(CP_HQD_PQ_RPTR);
 
                 /* set the vmid for the queue */
                 mqd->queue_state.cp_hqd_vmid = 0;
@@ -5117,11 +5118,9 @@ bool cik_gfx_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
         if (!(reset_mask & (RADEON_RESET_GFX |
                             RADEON_RESET_COMPUTE |
                             RADEON_RESET_CP))) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force CP activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
@@ -6141,6 +6140,10 @@ void cik_update_cg(struct radeon_device *rdev,
                 cik_enable_hdp_mgcg(rdev, enable);
                 cik_enable_hdp_ls(rdev, enable);
         }
+
+        if (block & RADEON_CG_BLOCK_VCE) {
+                vce_v2_0_enable_mgcg(rdev, enable);
+        }
 }
 
 static void cik_init_cg(struct radeon_device *rdev)
@@ -7490,6 +7493,20 @@ restart_ih:
                         /* reset addr and status */
                         WREG32_P(VM_CONTEXT1_CNTL2, 1, ~1);
                         break;
+                case 167: /* VCE */
+                        DRM_DEBUG("IH: VCE int: 0x%08x\n", src_data);
+                        switch (src_data) {
+                        case 0:
+                                radeon_fence_process(rdev, TN_RING_TYPE_VCE1_INDEX);
+                                break;
+                        case 1:
+                                radeon_fence_process(rdev, TN_RING_TYPE_VCE2_INDEX);
+                                break;
+                        default:
+                                DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
+                                break;
+                        }
+                        break;
                 case 176: /* GFX RB CP_INT */
                 case 177: /* GFX IB CP_INT */
                         radeon_fence_process(rdev, RADEON_RING_TYPE_GFX_INDEX);
@@ -7789,6 +7806,22 @@ static int cik_startup(struct radeon_device *rdev)
         if (r)
                 rdev->ring[R600_RING_TYPE_UVD_INDEX].ring_size = 0;
 
+        r = radeon_vce_resume(rdev);
+        if (!r) {
+                r = vce_v2_0_resume(rdev);
+                if (!r)
+                        r = radeon_fence_driver_start_ring(rdev,
+                                                           TN_RING_TYPE_VCE1_INDEX);
+                if (!r)
+                        r = radeon_fence_driver_start_ring(rdev,
+                                                           TN_RING_TYPE_VCE2_INDEX);
+        }
+        if (r) {
+                dev_err(rdev->dev, "VCE init error (%d).\n", r);
+                rdev->ring[TN_RING_TYPE_VCE1_INDEX].ring_size = 0;
+                rdev->ring[TN_RING_TYPE_VCE2_INDEX].ring_size = 0;
+        }
+
         /* Enable IRQ */
         if (!rdev->irq.installed) {
                 r = radeon_irq_kms_init(rdev);
@@ -7864,6 +7897,23 @@ static int cik_startup(struct radeon_device *rdev)
                         DRM_ERROR("radeon: failed initializing UVD (%d).\n", r);
         }
 
+        r = -ENOENT;
+
+        ring = &rdev->ring[TN_RING_TYPE_VCE1_INDEX];
+        if (ring->ring_size)
+                r = radeon_ring_init(rdev, ring, ring->ring_size, 0,
+                                     VCE_CMD_NO_OP);
+
+        ring = &rdev->ring[TN_RING_TYPE_VCE2_INDEX];
+        if (ring->ring_size)
+                r = radeon_ring_init(rdev, ring, ring->ring_size, 0,
+                                     VCE_CMD_NO_OP);
+
+        if (!r)
+                r = vce_v1_0_init(rdev);
+        else if (r != -ENOENT)
+                DRM_ERROR("radeon: failed initializing VCE (%d).\n", r);
+
         r = radeon_ib_pool_init(rdev);
         if (r) {
                 dev_err(rdev->dev, "IB initialization failed (%d).\n", r);
@@ -7935,6 +7985,7 @@ int cik_suspend(struct radeon_device *rdev)
         cik_sdma_enable(rdev, false);
         uvd_v1_0_fini(rdev);
         radeon_uvd_suspend(rdev);
+        radeon_vce_suspend(rdev);
         cik_fini_pg(rdev);
         cik_fini_cg(rdev);
         cik_irq_suspend(rdev);
@@ -8067,6 +8118,17 @@ int cik_init(struct radeon_device *rdev)
                 r600_ring_init(rdev, ring, 4096);
         }
 
+        r = radeon_vce_init(rdev);
+        if (!r) {
+                ring = &rdev->ring[TN_RING_TYPE_VCE1_INDEX];
+                ring->ring_obj = NULL;
+                r600_ring_init(rdev, ring, 4096);
+
+                ring = &rdev->ring[TN_RING_TYPE_VCE2_INDEX];
+                ring->ring_obj = NULL;
+                r600_ring_init(rdev, ring, 4096);
+        }
+
         rdev->ih.ring_obj = NULL;
         r600_ih_ring_init(rdev, 64 * 1024);
 
@@ -8128,6 +8190,7 @@ void cik_fini(struct radeon_device *rdev)
         radeon_irq_kms_fini(rdev);
         uvd_v1_0_fini(rdev);
         radeon_uvd_fini(rdev);
+        radeon_vce_fini(rdev);
         cik_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
@@ -8866,6 +8929,41 @@ int cik_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
         return r;
 }
 
+int cik_set_vce_clocks(struct radeon_device *rdev, u32 evclk, u32 ecclk)
+{
+        int r, i;
+        struct atom_clock_dividers dividers;
+        u32 tmp;
+
+        r = radeon_atom_get_clock_dividers(rdev, COMPUTE_GPUCLK_INPUT_FLAG_DEFAULT_GPUCLK,
+                                           ecclk, false, &dividers);
+        if (r)
+                return r;
+
+        for (i = 0; i < 100; i++) {
+                if (RREG32_SMC(CG_ECLK_STATUS) & ECLK_STATUS)
+                        break;
+                mdelay(10);
+        }
+        if (i == 100)
+                return -ETIMEDOUT;
+
+        tmp = RREG32_SMC(CG_ECLK_CNTL);
+        tmp &= ~(ECLK_DIR_CNTL_EN|ECLK_DIVIDER_MASK);
+        tmp |= dividers.post_divider;
+        WREG32_SMC(CG_ECLK_CNTL, tmp);
+
+        for (i = 0; i < 100; i++) {
+                if (RREG32_SMC(CG_ECLK_STATUS) & ECLK_STATUS)
+                        break;
+                mdelay(10);
+        }
+        if (i == 100)
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
 static void cik_pcie_gen3_enable(struct radeon_device *rdev)
 {
         struct pci_dev *root = rdev->pdev->bus->self;
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 1ecb3f1070e3..89b4afa5041c 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -264,6 +264,8 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
                 WREG32(SDMA0_GFX_RB_CNTL + reg_offset, rb_cntl);
                 WREG32(SDMA0_GFX_IB_CNTL + reg_offset, 0);
         }
+        rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
+        rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
 }
 
 /**
@@ -291,6 +293,11 @@ void cik_sdma_enable(struct radeon_device *rdev, bool enable)
         u32 me_cntl, reg_offset;
         int i;
 
+        if (enable == false) {
+                cik_sdma_gfx_stop(rdev);
+                cik_sdma_rlc_stop(rdev);
+        }
+
         for (i = 0; i < 2; i++) {
                 if (i == 0)
                         reg_offset = SDMA0_REGISTER_OFFSET;
@@ -362,8 +369,6 @@ static int cik_sdma_gfx_resume(struct radeon_device *rdev)
                 ring->wptr = 0;
                 WREG32(SDMA0_GFX_RB_WPTR + reg_offset, ring->wptr << 2);
 
-                ring->rptr = RREG32(SDMA0_GFX_RB_RPTR + reg_offset) >> 2;
-
                 /* enable DMA RB */
                 WREG32(SDMA0_GFX_RB_CNTL + reg_offset, rb_cntl | SDMA_RB_ENABLE);
 
@@ -420,10 +425,6 @@ static int cik_sdma_load_microcode(struct radeon_device *rdev)
         if (!rdev->sdma_fw)
                 return -EINVAL;
 
-        /* stop the gfx rings and rlc compute queues */
-        cik_sdma_gfx_stop(rdev);
-        cik_sdma_rlc_stop(rdev);
-
         /* halt the MEs */
         cik_sdma_enable(rdev, false);
 
@@ -492,9 +493,6 @@ int cik_sdma_resume(struct radeon_device *rdev)
  */
 void cik_sdma_fini(struct radeon_device *rdev)
 {
-        /* stop the gfx rings and rlc compute queues */
-        cik_sdma_gfx_stop(rdev);
-        cik_sdma_rlc_stop(rdev);
         /* halt the MEs */
         cik_sdma_enable(rdev, false);
         radeon_ring_fini(rdev, &rdev->ring[R600_RING_TYPE_DMA_INDEX]);
@@ -713,11 +711,9 @@ bool cik_sdma_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
                 mask = RADEON_RESET_DMA1;
 
         if (!(reset_mask & mask)) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force ring activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index 98bae9d7b74d..213873270d5f 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -203,6 +203,12 @@
 #define         CTF_TEMP_MASK                           0x0003fe00
 #define         CTF_TEMP_SHIFT                          9
 
+#define CG_ECLK_CNTL                                    0xC05000AC
+#       define ECLK_DIVIDER_MASK                        0x7f
+#       define ECLK_DIR_CNTL_EN                         (1 << 8)
+#define CG_ECLK_STATUS                                  0xC05000B0
+#       define ECLK_STATUS                              (1 << 0)
+
 #define CG_SPLL_FUNC_CNTL                               0xC0500140
 #define         SPLL_RESET                              (1 << 0)
 #define         SPLL_PWRON                              (1 << 1)
@@ -2010,4 +2016,47 @@
 /* UVD CTX indirect */
 #define UVD_CGC_MEM_CTRL                                0xC0
 
+/* VCE */
+
+#define VCE_VCPU_CACHE_OFFSET0          0x20024
+#define VCE_VCPU_CACHE_SIZE0            0x20028
+#define VCE_VCPU_CACHE_OFFSET1          0x2002c
+#define VCE_VCPU_CACHE_SIZE1            0x20030
+#define VCE_VCPU_CACHE_OFFSET2          0x20034
+#define VCE_VCPU_CACHE_SIZE2            0x20038
+#define VCE_RB_RPTR2                    0x20178
+#define VCE_RB_WPTR2                    0x2017c
+#define VCE_RB_RPTR                     0x2018c
+#define VCE_RB_WPTR                     0x20190
+#define VCE_CLOCK_GATING_A              0x202f8
+#       define CGC_CLK_GATE_DLY_TIMER_MASK      (0xf << 0)
+#       define CGC_CLK_GATE_DLY_TIMER(x)        ((x) << 0)
+#       define CGC_CLK_GATER_OFF_DLY_TIMER_MASK (0xff << 4)
+#       define CGC_CLK_GATER_OFF_DLY_TIMER(x)   ((x) << 4)
+#       define CGC_UENC_WAIT_AWAKE      (1 << 18)
+#define VCE_CLOCK_GATING_B              0x202fc
+#define VCE_CGTT_CLK_OVERRIDE           0x207a0
+#define VCE_UENC_CLOCK_GATING           0x207bc
+#       define CLOCK_ON_DELAY_MASK      (0xf << 0)
+#       define CLOCK_ON_DELAY(x)        ((x) << 0)
+#       define CLOCK_OFF_DELAY_MASK     (0xff << 4)
+#       define CLOCK_OFF_DELAY(x)       ((x) << 4)
+#define VCE_UENC_REG_CLOCK_GATING       0x207c0
+#define VCE_SYS_INT_EN                  0x21300
+#       define VCE_SYS_INT_TRAP_INTERRUPT_EN    (1 << 3)
+#define VCE_LMI_CTRL2                   0x21474
+#define VCE_LMI_CTRL                    0x21498
+#define VCE_LMI_VM_CTRL                 0x214a0
+#define VCE_LMI_SWAP_CNTL               0x214b4
+#define VCE_LMI_SWAP_CNTL1              0x214b8
+#define VCE_LMI_CACHE_CTRL              0x214f4
+
+#define VCE_CMD_NO_OP           0x00000000
+#define VCE_CMD_END             0x00000001
+#define VCE_CMD_IB              0x00000002
+#define VCE_CMD_FENCE           0x00000003
+#define VCE_CMD_TRAP            0x00000004
+#define VCE_CMD_IB_AUTO         0x00000005
+#define VCE_CMD_SEMAPHORE       0x00000006
+
 #endif
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index cf783fc0ef21..5a9a5f4d7888 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -2036,6 +2036,10 @@ int cypress_dpm_init(struct radeon_device *rdev)
         pi->min_vddc_in_table = 0;
         pi->max_vddc_in_table = 0;
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = rv7xx_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 27b0ff16082e..b406546440da 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2990,8 +2990,6 @@ static int evergreen_cp_resume(struct radeon_device *rdev)
         WREG32(CP_RB_BASE, ring->gpu_addr >> 8);
         WREG32(CP_DEBUG, (1 << 27) | (1 << 28));
 
-        ring->rptr = RREG32(CP_RB_RPTR);
-
         evergreen_cp_start(rdev);
         ring->ready = true;
         r = radeon_ring_test(rdev, RADEON_RING_TYPE_GFX_INDEX, ring);
@@ -3952,11 +3950,9 @@ bool evergreen_gfx_is_lockup(struct radeon_device *rdev, struct radeon_ring *rin
         if (!(reset_mask & (RADEON_RESET_GFX |
                             RADEON_RESET_COMPUTE |
                             RADEON_RESET_CP))) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force CP activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index c7cac07f139b..5c8b358f9fba 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -1165,7 +1165,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 break;
         case DB_DEPTH_CONTROL:
                 track->db_depth_control = radeon_get_ib_value(p, idx);
@@ -1196,12 +1196,12 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         }
                         ib[idx] &= ~Z_ARRAY_MODE(0xf);
                         track->db_z_info &= ~Z_ARRAY_MODE(0xf);
-                        ib[idx] |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
-                        track->db_z_info |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
+                        ib[idx] |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
+                        track->db_z_info |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO) {
                                 unsigned bankw, bankh, mtaspect, tile_split;
 
-                                evergreen_tiling_fields(reloc->lobj.tiling_flags,
+                                evergreen_tiling_fields(reloc->tiling_flags,
                                                         &bankw, &bankh, &mtaspect,
                                                         &tile_split);
                                 ib[idx] |= DB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
@@ -1237,7 +1237,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 track->db_z_read_offset = radeon_get_ib_value(p, idx);
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->db_z_read_bo = reloc->robj;
                 track->db_dirty = true;
                 break;
@@ -1249,7 +1249,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 track->db_z_write_offset = radeon_get_ib_value(p, idx);
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->db_z_write_bo = reloc->robj;
                 track->db_dirty = true;
                 break;
@@ -1261,7 +1261,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 track->db_s_read_offset = radeon_get_ib_value(p, idx);
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->db_s_read_bo = reloc->robj;
                 track->db_dirty = true;
                 break;
@@ -1273,7 +1273,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 track->db_s_write_offset = radeon_get_ib_value(p, idx);
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->db_s_write_bo = reloc->robj;
                 track->db_dirty = true;
                 break;
@@ -1297,7 +1297,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                 }
                 tmp = (reg - VGT_STRMOUT_BUFFER_BASE_0) / 16;
                 track->vgt_strmout_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->vgt_strmout_bo[tmp] = reloc->robj;
                 track->streamout_dirty = true;
                 break;
@@ -1317,7 +1317,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
         case CB_TARGET_MASK:
                 track->cb_target_mask = radeon_get_ib_value(p, idx);
                 track->cb_dirty = true;
@@ -1381,8 +1381,8 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                                 "0x%04X\n", reg);
                                 return -EINVAL;
                         }
-                        ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
-                        track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
+                        ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
+                        track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
                 }
                 track->cb_dirty = true;
                 break;
@@ -1399,8 +1399,8 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                                 "0x%04X\n", reg);
                                 return -EINVAL;
                         }
-                        ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
-                        track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
+                        ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
+                        track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
                 }
                 track->cb_dirty = true;
                 break;
@@ -1461,10 +1461,10 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO) {
                                 unsigned bankw, bankh, mtaspect, tile_split;
 
-                                evergreen_tiling_fields(reloc->lobj.tiling_flags,
+                                evergreen_tiling_fields(reloc->tiling_flags,
                                                         &bankw, &bankh, &mtaspect,
                                                         &tile_split);
                                 ib[idx] |= CB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
@@ -1489,10 +1489,10 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO) {
                                 unsigned bankw, bankh, mtaspect, tile_split;
 
-                                evergreen_tiling_fields(reloc->lobj.tiling_flags,
+                                evergreen_tiling_fields(reloc->tiling_flags,
                                                         &bankw, &bankh, &mtaspect,
                                                         &tile_split);
                                 ib[idx] |= CB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
@@ -1520,7 +1520,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         dev_err(p->dev, "bad SET_CONTEXT_REG 0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->cb_color_fmask_bo[tmp] = reloc->robj;
                 break;
         case CB_COLOR0_CMASK:
@@ -1537,7 +1537,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         dev_err(p->dev, "bad SET_CONTEXT_REG 0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->cb_color_cmask_bo[tmp] = reloc->robj;
                 break;
         case CB_COLOR0_FMASK_SLICE:
@@ -1578,7 +1578,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                 }
                 tmp = (reg - CB_COLOR0_BASE) / 0x3c;
                 track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx);
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->cb_color_bo[tmp] = reloc->robj;
                 track->cb_dirty = true;
                 break;
@@ -1594,7 +1594,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                 }
                 tmp = ((reg - CB_COLOR8_BASE) / 0x1c) + 8;
                 track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx);
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->cb_color_bo[tmp] = reloc->robj;
                 track->cb_dirty = true;
                 break;
@@ -1606,7 +1606,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 track->htile_offset = radeon_get_ib_value(p, idx);
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->htile_bo = reloc->robj;
                 track->db_dirty = true;
                 break;
@@ -1723,7 +1723,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 break;
         case SX_MEMORY_EXPORT_BASE:
                 if (p->rdev->family >= CHIP_CAYMAN) {
@@ -1737,7 +1737,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 break;
         case CAYMAN_SX_SCATTER_EXPORT_BASE:
                 if (p->rdev->family < CHIP_CAYMAN) {
@@ -1751,7 +1751,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 break;
         case SX_MISC:
                 track->sx_misc_kill_all_prims = (radeon_get_ib_value(p, idx) & 0x1) != 0;
@@ -1836,7 +1836,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          (idx_value & 0xfffffff0) +
                          ((u64)(tmp & 0xff) << 32);
 
@@ -1882,7 +1882,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          idx_value +
                          ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
 
@@ -1909,7 +1909,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          idx_value +
                          ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
 
@@ -1937,7 +1937,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          radeon_get_ib_value(p, idx+1) +
                          ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
 
@@ -2027,7 +2027,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                         DRM_ERROR("bad DISPATCH_INDIRECT\n");
                         return -EINVAL;
                 }
-                ib[idx+0] = idx_value + (u32)(reloc->lobj.gpu_offset & 0xffffffff);
+                ib[idx+0] = idx_value + (u32)(reloc->gpu_offset & 0xffffffff);
                 r = evergreen_cs_track_check(p);
                 if (r) {
                         dev_warn(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
@@ -2049,7 +2049,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                 return -EINVAL;
                         }
 
-                        offset = reloc->lobj.gpu_offset +
+                        offset = reloc->gpu_offset +
                                  (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
                                  ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
 
@@ -2106,7 +2106,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                 tmp = radeon_get_ib_value(p, idx) +
                                         ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
 
-                                offset = reloc->lobj.gpu_offset + tmp;
+                                offset = reloc->gpu_offset + tmp;
 
                                 if ((tmp + size) > radeon_bo_size(reloc->robj)) {
                                         dev_warn(p->dev, "CP DMA src buffer too small (%llu %lu)\n",
@@ -2144,7 +2144,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                 tmp = radeon_get_ib_value(p, idx+2) +
                                         ((u64)(radeon_get_ib_value(p, idx+3) & 0xff) << 32);
 
-                                offset = reloc->lobj.gpu_offset + tmp;
+                                offset = reloc->gpu_offset + tmp;
 
                                 if ((tmp + size) > radeon_bo_size(reloc->robj)) {
                                         dev_warn(p->dev, "CP DMA dst buffer too small (%llu %lu)\n",
@@ -2174,7 +2174,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                 DRM_ERROR("bad SURFACE_SYNC\n");
                                 return -EINVAL;
                         }
-                        ib[idx+2] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                        ib[idx+2] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 }
                 break;
         case PACKET3_EVENT_WRITE:
@@ -2190,7 +2190,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                 DRM_ERROR("bad EVENT_WRITE\n");
                                 return -EINVAL;
                         }
-                        offset = reloc->lobj.gpu_offset +
+                        offset = reloc->gpu_offset +
                                  (radeon_get_ib_value(p, idx+1) & 0xfffffff8) +
                                  ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
 
@@ -2212,7 +2212,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
                          ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
 
@@ -2234,7 +2234,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
                          ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
 
@@ -2302,11 +2302,11 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                 }
                                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
                                         ib[idx+1+(i*8)+1] |=
-                                                TEX_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
-                                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
+                                                TEX_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->tiling_flags));
+                                        if (reloc->tiling_flags & RADEON_TILING_MACRO) {
                                                 unsigned bankw, bankh, mtaspect, tile_split;
 
-                                                evergreen_tiling_fields(reloc->lobj.tiling_flags,
+                                                evergreen_tiling_fields(reloc->tiling_flags,
                                                                         &bankw, &bankh, &mtaspect,
                                                                         &tile_split);
                                                 ib[idx+1+(i*8)+6] |= TEX_TILE_SPLIT(tile_split);
@@ -2318,7 +2318,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                         }
                                 }
                                 texture = reloc->robj;
-                                toffset = (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                                toffset = (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
 
                                 /* tex mip base */
                                 tex_dim = ib[idx+1+(i*8)+0] & 0x7;
@@ -2337,7 +2337,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                                 DRM_ERROR("bad SET_RESOURCE (tex)\n");
                                                 return -EINVAL;
                                         }
-                                        moffset = (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                                        moffset = (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                                         mipmap = reloc->robj;
                                 }
 
@@ -2364,7 +2364,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                         ib[idx+1+(i*8)+1] = radeon_bo_size(reloc->robj) - offset;
                                 }
 
-                                offset64 = reloc->lobj.gpu_offset + offset;
+                                offset64 = reloc->gpu_offset + offset;
                                 ib[idx+1+(i*8)+0] = offset64;
                                 ib[idx+1+(i*8)+2] = (ib[idx+1+(i*8)+2] & 0xffffff00) |
                                                     (upper_32_bits(offset64) & 0xff);
@@ -2445,7 +2445,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        offset += reloc->lobj.gpu_offset;
+                        offset += reloc->gpu_offset;
                         ib[idx+1] = offset;
                         ib[idx+2] = upper_32_bits(offset) & 0xff;
                 }
@@ -2464,7 +2464,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        offset += reloc->lobj.gpu_offset;
+                        offset += reloc->gpu_offset;
                         ib[idx+3] = offset;
                         ib[idx+4] = upper_32_bits(offset) & 0xff;
                 }
@@ -2493,7 +2493,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                   offset + 8, radeon_bo_size(reloc->robj));
                         return -EINVAL;
                 }
-                offset += reloc->lobj.gpu_offset;
+                offset += reloc->gpu_offset;
                 ib[idx+0] = offset;
                 ib[idx+1] = upper_32_bits(offset) & 0xff;
                 break;
@@ -2518,7 +2518,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        offset += reloc->lobj.gpu_offset;
+                        offset += reloc->gpu_offset;
                         ib[idx+1] = offset;
                         ib[idx+2] = upper_32_bits(offset) & 0xff;
                 } else {
@@ -2542,7 +2542,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        offset += reloc->lobj.gpu_offset;
+                        offset += reloc->gpu_offset;
                         ib[idx+3] = offset;
                         ib[idx+4] = upper_32_bits(offset) & 0xff;
                 } else {
@@ -2717,7 +2717,7 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                 dst_offset = radeon_get_ib_value(p, idx+1);
                                 dst_offset <<= 8;
 
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
                                 p->idx += count + 7;
                                 break;
                         /* linear */
@@ -2725,8 +2725,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                 dst_offset = radeon_get_ib_value(p, idx+1);
                                 dst_offset |= ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
 
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+2] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+2] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
                                 p->idx += count + 3;
                                 break;
                         default:
@@ -2768,10 +2768,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
                                         return -EINVAL;
                                 }
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+3] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
-                                ib[idx+4] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+2] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+3] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
+                                ib[idx+4] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
                                 p->idx += 5;
                                 break;
                         /* Copy L2T/T2L */
@@ -2781,22 +2781,22 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                         /* tiled src, linear dst */
                                         src_offset = radeon_get_ib_value(p, idx+1);
                                         src_offset <<= 8;
-                                        ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
+                                        ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
 
                                         dst_offset = radeon_get_ib_value(p, idx + 7);
                                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
-                                        ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+7] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+8] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
                                 } else {
                                         /* linear src, tiled dst */
                                         src_offset = radeon_get_ib_value(p, idx+7);
                                         src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
-                                        ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+7] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+8] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
 
                                         dst_offset = radeon_get_ib_value(p, idx+1);
                                         dst_offset <<= 8;
-                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
+                                        ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
                                 }
                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                         dev_warn(p->dev, "DMA L2T, src buffer too small (%llu %lu)\n",
@@ -2827,10 +2827,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         dst_offset + count, radeon_bo_size(dst_reloc->robj));
                                         return -EINVAL;
                                 }
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xffffffff);
-                                ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xffffffff);
-                                ib[idx+3] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
-                                ib[idx+4] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xffffffff);
+                                ib[idx+2] += (u32)(src_reloc->gpu_offset & 0xffffffff);
+                                ib[idx+3] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
+                                ib[idx+4] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
                                 p->idx += 5;
                                 break;
                         /* Copy L2L, partial */
@@ -2840,10 +2840,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                         DRM_ERROR("L2L Partial is cayman only !\n");
                                         return -EINVAL;
                                 }
-                                ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset & 0xffffffff);
-                                ib[idx+2] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
-                                ib[idx+4] += (u32)(dst_reloc->lobj.gpu_offset & 0xffffffff);
-                                ib[idx+5] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(src_reloc->gpu_offset & 0xffffffff);
+                                ib[idx+2] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
+                                ib[idx+4] += (u32)(dst_reloc->gpu_offset & 0xffffffff);
+                                ib[idx+5] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
 
                                 p->idx += 9;
                                 break;
@@ -2876,12 +2876,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
                                         return -EINVAL;
                                 }
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+2] += (u32)(dst2_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+3] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+4] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
-                                ib[idx+5] += upper_32_bits(dst2_reloc->lobj.gpu_offset) & 0xff;
-                                ib[idx+6] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+2] += (u32)(dst2_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+3] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+4] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
+                                ib[idx+5] += upper_32_bits(dst2_reloc->gpu_offset) & 0xff;
+                                ib[idx+6] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
                                 p->idx += 7;
                                 break;
                         /* Copy L2T Frame to Field */
@@ -2916,10 +2916,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
                                         return -EINVAL;
                                 }
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
-                                ib[idx+2] += (u32)(dst2_reloc->lobj.gpu_offset >> 8);
-                                ib[idx+8] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+9] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
+                                ib[idx+2] += (u32)(dst2_reloc->gpu_offset >> 8);
+                                ib[idx+8] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+9] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
                                 p->idx += 10;
                                 break;
                         /* Copy L2T/T2L, partial */
@@ -2932,16 +2932,16 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                 /* detile bit */
                                 if (radeon_get_ib_value(p, idx + 2) & (1 << 31)) {
                                         /* tiled src, linear dst */
-                                        ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
+                                        ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
 
-                                        ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+7] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+8] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
                                 } else {
                                         /* linear src, tiled dst */
-                                        ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+7] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+8] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
 
-                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
+                                        ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
                                 }
                                 p->idx += 12;
                                 break;
@@ -2978,10 +2978,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
                                         return -EINVAL;
                                 }
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
-                                ib[idx+2] += (u32)(dst2_reloc->lobj.gpu_offset >> 8);
-                                ib[idx+8] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+9] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
+                                ib[idx+2] += (u32)(dst2_reloc->gpu_offset >> 8);
+                                ib[idx+8] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+9] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
                                 p->idx += 10;
                                 break;
                         /* Copy L2T/T2L (tile units) */
@@ -2992,22 +2992,22 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                         /* tiled src, linear dst */
                                         src_offset = radeon_get_ib_value(p, idx+1);
                                         src_offset <<= 8;
-                                        ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
+                                        ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
 
                                         dst_offset = radeon_get_ib_value(p, idx+7);
                                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
-                                        ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+7] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+8] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
                                 } else {
                                         /* linear src, tiled dst */
                                         src_offset = radeon_get_ib_value(p, idx+7);
                                         src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
-                                        ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+7] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+8] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
 
                                         dst_offset = radeon_get_ib_value(p, idx+1);
                                         dst_offset <<= 8;
-                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
+                                        ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
                                 }
                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                         dev_warn(p->dev, "DMA L2T, T2L src buffer too small (%llu %lu)\n",
@@ -3028,8 +3028,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                         DRM_ERROR("L2T, T2L Partial is cayman only !\n");
                                         return -EINVAL;
                                 }
-                                ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
-                                ib[idx+4] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
+                                ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
+                                ib[idx+4] += (u32)(dst_reloc->gpu_offset >> 8);
                                 p->idx += 13;
                                 break;
                         /* Copy L2T broadcast (tile units) */
@@ -3065,10 +3065,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
                                         return -EINVAL;
                                 }
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
-                                ib[idx+2] += (u32)(dst2_reloc->lobj.gpu_offset >> 8);
-                                ib[idx+8] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+9] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
+                                ib[idx+2] += (u32)(dst2_reloc->gpu_offset >> 8);
+                                ib[idx+8] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+9] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
                                 p->idx += 10;
                                 break;
                         default:
@@ -3089,8 +3089,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                          dst_offset, radeon_bo_size(dst_reloc->robj));
                                 return -EINVAL;
                         }
-                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                        ib[idx+3] += (upper_32_bits(dst_reloc->lobj.gpu_offset) << 16) & 0x00ff0000;
+                        ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                        ib[idx+3] += (upper_32_bits(dst_reloc->gpu_offset) << 16) & 0x00ff0000;
                         p->idx += 4;
                         break;
                 case DMA_PACKET_NOP:
diff --git a/drivers/gpu/drm/radeon/evergreen_dma.c b/drivers/gpu/drm/radeon/evergreen_dma.c
index a37b54436382..287fe966d7de 100644
--- a/drivers/gpu/drm/radeon/evergreen_dma.c
+++ b/drivers/gpu/drm/radeon/evergreen_dma.c
@@ -174,11 +174,9 @@ bool evergreen_dma_is_lockup(struct radeon_device *rdev, struct radeon_ring *rin
         u32 reset_mask = evergreen_gpu_check_soft_reset(rdev);
 
         if (!(reset_mask & RADEON_RESET_DMA)) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force ring activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 351db361239d..16ec9d56a234 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -1338,13 +1338,11 @@ static int kv_enable_uvd_dpm(struct radeon_device *rdev, bool enable)
                                         PPSMC_MSG_UVDDPM_Enable : PPSMC_MSG_UVDDPM_Disable);
 }
 
-#if 0
 static int kv_enable_vce_dpm(struct radeon_device *rdev, bool enable)
 {
         return kv_notify_message_to_smu(rdev, enable ?
                                         PPSMC_MSG_VCEDPM_Enable : PPSMC_MSG_VCEDPM_Disable);
 }
-#endif
 
 static int kv_enable_samu_dpm(struct radeon_device *rdev, bool enable)
 {
@@ -1389,7 +1387,6 @@ static int kv_update_uvd_dpm(struct radeon_device *rdev, bool gate)
         return kv_enable_uvd_dpm(rdev, !gate);
 }
 
-#if 0
 static u8 kv_get_vce_boot_level(struct radeon_device *rdev)
 {
         u8 i;
@@ -1414,6 +1411,9 @@ static int kv_update_vce_dpm(struct radeon_device *rdev,
         int ret;
 
         if (radeon_new_state->evclk > 0 && radeon_current_state->evclk == 0) {
+                kv_dpm_powergate_vce(rdev, false);
+                /* turn the clocks on when encoding */
+                cik_update_cg(rdev, RADEON_CG_BLOCK_VCE, false);
                 if (pi->caps_stable_p_state)
                         pi->vce_boot_level = table->count - 1;
                 else
@@ -1436,11 +1436,13 @@ static int kv_update_vce_dpm(struct radeon_device *rdev,
                 kv_enable_vce_dpm(rdev, true);
         } else if (radeon_new_state->evclk == 0 && radeon_current_state->evclk > 0) {
                 kv_enable_vce_dpm(rdev, false);
+                /* turn the clocks off when not encoding */
+                cik_update_cg(rdev, RADEON_CG_BLOCK_VCE, true);
+                kv_dpm_powergate_vce(rdev, true);
         }
 
         return 0;
 }
-#endif
 
 static int kv_update_samu_dpm(struct radeon_device *rdev, bool gate)
 {
@@ -1575,11 +1577,16 @@ static void kv_dpm_powergate_vce(struct radeon_device *rdev, bool gate)
         pi->vce_power_gated = gate;
 
         if (gate) {
-                if (pi->caps_vce_pg)
+                if (pi->caps_vce_pg) {
+                        /* XXX do we need a vce_v1_0_stop() ?  */
                         kv_notify_message_to_smu(rdev, PPSMC_MSG_VCEPowerOFF);
+                }
         } else {
-                if (pi->caps_vce_pg)
+                if (pi->caps_vce_pg) {
                         kv_notify_message_to_smu(rdev, PPSMC_MSG_VCEPowerON);
+                        vce_v2_0_resume(rdev);
+                        vce_v1_0_start(rdev);
+                }
         }
 }
 
@@ -1768,7 +1775,7 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
 {
         struct kv_power_info *pi = kv_get_pi(rdev);
         struct radeon_ps *new_ps = &pi->requested_rps;
-        /*struct radeon_ps *old_ps = &pi->current_rps;*/
+        struct radeon_ps *old_ps = &pi->current_rps;
         int ret;
 
         if (pi->bapm_enable) {
@@ -1798,13 +1805,12 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                         kv_set_enabled_levels(rdev);
                         kv_force_lowest_valid(rdev);
                         kv_unforce_levels(rdev);
-#if 0
+
                         ret = kv_update_vce_dpm(rdev, new_ps, old_ps);
                         if (ret) {
                                 DRM_ERROR("kv_update_vce_dpm failed\n");
                                 return ret;
                         }
-#endif
                         kv_update_sclk_t(rdev);
                 }
         } else {
@@ -1823,13 +1829,11 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                         kv_program_nbps_index_settings(rdev, new_ps);
                         kv_freeze_sclk_dpm(rdev, false);
                         kv_set_enabled_levels(rdev);
-#if 0
                         ret = kv_update_vce_dpm(rdev, new_ps, old_ps);
                         if (ret) {
                                 DRM_ERROR("kv_update_vce_dpm failed\n");
                                 return ret;
                         }
-#endif
                         kv_update_acp_boot_level(rdev);
                         kv_update_sclk_t(rdev);
                         kv_enable_nb_dpm(rdev);
@@ -2037,6 +2041,14 @@ static void kv_apply_state_adjust_rules(struct radeon_device *rdev,
         struct radeon_clock_and_voltage_limits *max_limits =
                 &rdev->pm.dpm.dyn_state.max_clock_voltage_on_ac;
 
+        if (new_rps->vce_active) {
+                new_rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
+                new_rps->ecclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].ecclk;
+        } else {
+                new_rps->evclk = 0;
+                new_rps->ecclk = 0;
+        }
+
         mclk = max_limits->mclk;
         sclk = min_sclk;
 
@@ -2056,6 +2068,11 @@ static void kv_apply_state_adjust_rules(struct radeon_device *rdev,
                 sclk = stable_p_state_sclk;
         }
 
+        if (new_rps->vce_active) {
+                if (sclk < rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].sclk)
+                        sclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].sclk;
+        }
+
         ps->need_dfs_bypass = true;
 
         for (i = 0; i < ps->num_levels; i++) {
@@ -2092,7 +2109,8 @@ static void kv_apply_state_adjust_rules(struct radeon_device *rdev,
                 }
         }
 
-        pi->video_start = new_rps->dclk || new_rps->vclk;
+        pi->video_start = new_rps->dclk || new_rps->vclk ||
+                new_rps->evclk || new_rps->ecclk;
 
         if ((new_rps->class & ATOM_PPLIB_CLASSIFICATION_UI_MASK) ==
             ATOM_PPLIB_CLASSIFICATION_UI_BATTERY)
@@ -2538,9 +2556,6 @@ static int kv_parse_power_table(struct radeon_device *rdev)
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
         for (i = 0; i < state_array->ucNumEntries; i++) {
                 u8 *idx;
                 power_state = (union pplib_power_state *)power_state_offset;
@@ -2577,6 +2592,19 @@ static int kv_parse_power_table(struct radeon_device *rdev)
                 power_state_offset += 2 + power_state->v2.ucNumDPMLevels;
         }
         rdev->pm.dpm.num_ps = state_array->ucNumEntries;
+
+        /* fill in the vce power states */
+        for (i = 0; i < RADEON_MAX_VCE_LEVELS; i++) {
+                u32 sclk;
+                clock_array_index = rdev->pm.dpm.vce_states[i].clk_idx;
+                clock_info = (union pplib_clock_info *)
+                        &clock_info_array->clockInfo[clock_array_index * clock_info_array->ucEntrySize];
+                sclk = le16_to_cpu(clock_info->sumo.usEngineClockLow);
+                sclk |= clock_info->sumo.ucEngineClockHigh << 16;
+                rdev->pm.dpm.vce_states[i].sclk = sclk;
+                rdev->pm.dpm.vce_states[i].mclk = 0;
+        }
+
         return 0;
 }
 
@@ -2590,6 +2618,10 @@ int kv_dpm_init(struct radeon_device *rdev)
                 return -ENOMEM;
         rdev->pm.dpm.priv = pi;
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = r600_parse_extended_power_table(rdev);
         if (ret)
                 return ret;
@@ -2623,7 +2655,7 @@ int kv_dpm_init(struct radeon_device *rdev)
         pi->caps_fps = false; /* true? */
         pi->caps_uvd_pg = true;
         pi->caps_uvd_dpm = true;
-        pi->caps_vce_pg = false;
+        pi->caps_vce_pg = false; /* XXX true */
         pi->caps_samu_pg = false;
         pi->caps_acp_pg = false;
         pi->caps_stable_p_state = false;
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index bf6300cfd62d..d246e043421a 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1642,8 +1642,8 @@ static int cayman_cp_resume(struct radeon_device *rdev)
                 ring = &rdev->ring[ridx[i]];
                 WREG32_P(cp_rb_cntl[i], RB_RPTR_WR_ENA, ~RB_RPTR_WR_ENA);
 
-                ring->rptr = ring->wptr = 0;
-                WREG32(cp_rb_rptr[i], ring->rptr);
+                ring->wptr = 0;
+                WREG32(cp_rb_rptr[i], 0);
                 WREG32(cp_rb_wptr[i], ring->wptr);
 
                 mdelay(1);
@@ -1917,11 +1917,9 @@ bool cayman_gfx_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
         if (!(reset_mask & (RADEON_RESET_GFX |
                             RADEON_RESET_COMPUTE |
                             RADEON_RESET_CP))) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force CP activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/ni_dma.c b/drivers/gpu/drm/radeon/ni_dma.c
index 7cf96b15377f..6378e0276691 100644
--- a/drivers/gpu/drm/radeon/ni_dma.c
+++ b/drivers/gpu/drm/radeon/ni_dma.c
@@ -248,8 +248,6 @@ int cayman_dma_resume(struct radeon_device *rdev)
                 ring->wptr = 0;
                 WREG32(DMA_RB_WPTR + reg_offset, ring->wptr << 2);
 
-                ring->rptr = RREG32(DMA_RB_RPTR + reg_offset) >> 2;
-
                 WREG32(DMA_RB_CNTL + reg_offset, rb_cntl | DMA_RB_ENABLE);
 
                 ring->ready = true;
@@ -302,11 +300,9 @@ bool cayman_dma_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
                 mask = RADEON_RESET_DMA1;
 
         if (!(reset_mask & mask)) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force ring activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index ca814276b075..004c931606c4 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -4025,9 +4025,6 @@ static int ni_parse_power_table(struct radeon_device *rdev)
                                   power_info->pplib.ucNumStates, GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
 
         for (i = 0; i < power_info->pplib.ucNumStates; i++) {
                 power_state = (union pplib_power_state *)
@@ -4089,6 +4086,10 @@ int ni_dpm_init(struct radeon_device *rdev)
         pi->min_vddc_in_table = 0;
         pi->max_vddc_in_table = 0;
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = ni_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 3cc78bb66042..030f8e49c5ee 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1193,7 +1193,6 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
 
         WREG32(RADEON_CP_RB_CNTL, tmp);
         udelay(10);
-        ring->rptr = RREG32(RADEON_CP_RB_RPTR);
         /* Set cp mode to bus mastering & enable cp*/
         WREG32(RADEON_CP_CSQ_MODE,
                REG_SET(RADEON_INDIRECT2_START, indirect2_start) |
@@ -1275,12 +1274,12 @@ int r100_reloc_pitch_offset(struct radeon_cs_parser *p,
 
         value = radeon_get_ib_value(p, idx);
         tmp = value & 0x003fffff;
-        tmp += (((u32)reloc->lobj.gpu_offset) >> 10);
+        tmp += (((u32)reloc->gpu_offset) >> 10);
 
         if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
-                if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                if (reloc->tiling_flags & RADEON_TILING_MACRO)
                         tile_flags |= RADEON_DST_TILE_MACRO;
-                if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO) {
+                if (reloc->tiling_flags & RADEON_TILING_MICRO) {
                         if (reg == RADEON_SRC_PITCH_OFFSET) {
                                 DRM_ERROR("Cannot src blit from microtiled surface\n");
                                 radeon_cs_dump_packet(p, pkt);
@@ -1326,7 +1325,7 @@ int r100_packet3_load_vbpntr(struct radeon_cs_parser *p,
                         return r;
                 }
                 idx_value = radeon_get_ib_value(p, idx);
-                ib[idx+1] = radeon_get_ib_value(p, idx + 1) + ((u32)reloc->lobj.gpu_offset);
+                ib[idx+1] = radeon_get_ib_value(p, idx + 1) + ((u32)reloc->gpu_offset);
 
                 track->arrays[i + 0].esize = idx_value >> 8;
                 track->arrays[i + 0].robj = reloc->robj;
@@ -1338,7 +1337,7 @@ int r100_packet3_load_vbpntr(struct radeon_cs_parser *p,
                         radeon_cs_dump_packet(p, pkt);
                         return r;
                 }
-                ib[idx+2] = radeon_get_ib_value(p, idx + 2) + ((u32)reloc->lobj.gpu_offset);
+                ib[idx+2] = radeon_get_ib_value(p, idx + 2) + ((u32)reloc->gpu_offset);
                 track->arrays[i + 1].robj = reloc->robj;
                 track->arrays[i + 1].esize = idx_value >> 24;
                 track->arrays[i + 1].esize &= 0x7F;
@@ -1352,7 +1351,7 @@ int r100_packet3_load_vbpntr(struct radeon_cs_parser *p,
                         return r;
                 }
                 idx_value = radeon_get_ib_value(p, idx);
-                ib[idx+1] = radeon_get_ib_value(p, idx + 1) + ((u32)reloc->lobj.gpu_offset);
+                ib[idx+1] = radeon_get_ib_value(p, idx + 1) + ((u32)reloc->gpu_offset);
                 track->arrays[i + 0].robj = reloc->robj;
                 track->arrays[i + 0].esize = idx_value >> 8;
                 track->arrays[i + 0].esize &= 0x7F;
@@ -1595,7 +1594,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                 track->zb.robj = reloc->robj;
                 track->zb.offset = idx_value;
                 track->zb_dirty = true;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case RADEON_RB3D_COLOROFFSET:
                 r = radeon_cs_packet_next_reloc(p, &reloc, 0);
@@ -1608,7 +1607,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                 track->cb[0].robj = reloc->robj;
                 track->cb[0].offset = idx_value;
                 track->cb_dirty = true;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case RADEON_PP_TXOFFSET_0:
         case RADEON_PP_TXOFFSET_1:
@@ -1622,16 +1621,16 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         return r;
                 }
                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO)
                                 tile_flags |= RADEON_TXO_MACRO_TILE;
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MICRO)
                                 tile_flags |= RADEON_TXO_MICRO_TILE_X2;
 
                         tmp = idx_value & ~(0x7 << 2);
                         tmp |= tile_flags;
-                        ib[idx] = tmp + ((u32)reloc->lobj.gpu_offset);
+                        ib[idx] = tmp + ((u32)reloc->gpu_offset);
                 } else
-                        ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                        ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 track->textures[i].robj = reloc->robj;
                 track->tex_dirty = true;
                 break;
@@ -1649,7 +1648,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         return r;
                 }
                 track->textures[0].cube_info[i].offset = idx_value;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 track->textures[0].cube_info[i].robj = reloc->robj;
                 track->tex_dirty = true;
                 break;
@@ -1667,7 +1666,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         return r;
                 }
                 track->textures[1].cube_info[i].offset = idx_value;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 track->textures[1].cube_info[i].robj = reloc->robj;
                 track->tex_dirty = true;
                 break;
@@ -1685,7 +1684,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         return r;
                 }
                 track->textures[2].cube_info[i].offset = idx_value;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 track->textures[2].cube_info[i].robj = reloc->robj;
                 track->tex_dirty = true;
                 break;
@@ -1703,9 +1702,9 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         return r;
                 }
                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO)
                                 tile_flags |= RADEON_COLOR_TILE_ENABLE;
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MICRO)
                                 tile_flags |= RADEON_COLOR_MICROTILE_ENABLE;
 
                         tmp = idx_value & ~(0x7 << 16);
@@ -1773,7 +1772,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         radeon_cs_dump_packet(p, pkt);
                         return r;
                 }
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case RADEON_PP_CNTL:
                 {
@@ -1933,7 +1932,7 @@ static int r100_packet3_check(struct radeon_cs_parser *p,
                         radeon_cs_dump_packet(p, pkt);
                         return r;
                 }
-                ib[idx+1] = radeon_get_ib_value(p, idx+1) + ((u32)reloc->lobj.gpu_offset);
+                ib[idx+1] = radeon_get_ib_value(p, idx+1) + ((u32)reloc->gpu_offset);
                 r = r100_cs_track_check_pkt3_indx_buffer(p, pkt, reloc->robj);
                 if (r) {
                         return r;
@@ -1947,7 +1946,7 @@ static int r100_packet3_check(struct radeon_cs_parser *p,
                         radeon_cs_dump_packet(p, pkt);
                         return r;
                 }
-                ib[idx] = radeon_get_ib_value(p, idx) + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = radeon_get_ib_value(p, idx) + ((u32)reloc->gpu_offset);
                 track->num_arrays = 1;
                 track->vtx_size = r100_get_vtx_size(radeon_get_ib_value(p, idx + 2));
 
@@ -2523,11 +2522,9 @@ bool r100_gpu_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
 
         rbbm_status = RREG32(R_000E40_RBBM_STATUS);
         if (!G_000E40_GUI_ACTIVE(rbbm_status)) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force CP activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index b3807edb1936..58f0473aa73f 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -185,7 +185,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 track->zb.robj = reloc->robj;
                 track->zb.offset = idx_value;
                 track->zb_dirty = true;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case RADEON_RB3D_COLOROFFSET:
                 r = radeon_cs_packet_next_reloc(p, &reloc, 0);
@@ -198,7 +198,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 track->cb[0].robj = reloc->robj;
                 track->cb[0].offset = idx_value;
                 track->cb_dirty = true;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case R200_PP_TXOFFSET_0:
         case R200_PP_TXOFFSET_1:
@@ -215,16 +215,16 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                         return r;
                 }
                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO)
                                 tile_flags |= R200_TXO_MACRO_TILE;
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MICRO)
                                 tile_flags |= R200_TXO_MICRO_TILE;
 
                         tmp = idx_value & ~(0x7 << 2);
                         tmp |= tile_flags;
-                        ib[idx] = tmp + ((u32)reloc->lobj.gpu_offset);
+                        ib[idx] = tmp + ((u32)reloc->gpu_offset);
                 } else
-                        ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                        ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 track->textures[i].robj = reloc->robj;
                 track->tex_dirty = true;
                 break;
@@ -268,7 +268,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                         return r;
                 }
                 track->textures[i].cube_info[face - 1].offset = idx_value;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 track->textures[i].cube_info[face - 1].robj = reloc->robj;
                 track->tex_dirty = true;
                 break;
@@ -287,9 +287,9 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 }
 
                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO)
                                 tile_flags |= RADEON_COLOR_TILE_ENABLE;
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MICRO)
                                 tile_flags |= RADEON_COLOR_MICROTILE_ENABLE;
 
                         tmp = idx_value & ~(0x7 << 16);
@@ -362,7 +362,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                         radeon_cs_dump_packet(p, pkt);
                         return r;
                 }
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case RADEON_PP_CNTL:
                 {
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 0b658b34b33a..206caf9700b7 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -640,7 +640,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 track->cb[i].robj = reloc->robj;
                 track->cb[i].offset = idx_value;
                 track->cb_dirty = true;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case R300_ZB_DEPTHOFFSET:
                 r = radeon_cs_packet_next_reloc(p, &reloc, 0);
@@ -653,7 +653,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 track->zb.robj = reloc->robj;
                 track->zb.offset = idx_value;
                 track->zb_dirty = true;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case R300_TX_OFFSET_0:
         case R300_TX_OFFSET_0+4:
@@ -682,16 +682,16 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
 
                 if (p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS) {
                         ib[idx] = (idx_value & 31) | /* keep the 1st 5 bits */
-                                  ((idx_value & ~31) + (u32)reloc->lobj.gpu_offset);
+                                  ((idx_value & ~31) + (u32)reloc->gpu_offset);
                 } else {
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO)
                                 tile_flags |= R300_TXO_MACRO_TILE;
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MICRO)
                                 tile_flags |= R300_TXO_MICRO_TILE;
-                        else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO_SQUARE)
+                        else if (reloc->tiling_flags & RADEON_TILING_MICRO_SQUARE)
                                 tile_flags |= R300_TXO_MICRO_TILE_SQUARE;
 
-                        tmp = idx_value + ((u32)reloc->lobj.gpu_offset);
+                        tmp = idx_value + ((u32)reloc->gpu_offset);
                         tmp |= tile_flags;
                         ib[idx] = tmp;
                 }
@@ -753,11 +753,11 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                                 return r;
                         }
 
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO)
                                 tile_flags |= R300_COLOR_TILE_ENABLE;
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MICRO)
                                 tile_flags |= R300_COLOR_MICROTILE_ENABLE;
-                        else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO_SQUARE)
+                        else if (reloc->tiling_flags & RADEON_TILING_MICRO_SQUARE)
                                 tile_flags |= R300_COLOR_MICROTILE_SQUARE_ENABLE;
 
                         tmp = idx_value & ~(0x7 << 16);
@@ -838,11 +838,11 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                                 return r;
                         }
 
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO)
                                 tile_flags |= R300_DEPTHMACROTILE_ENABLE;
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        if (reloc->tiling_flags & RADEON_TILING_MICRO)
                                 tile_flags |= R300_DEPTHMICROTILE_TILED;
-                        else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO_SQUARE)
+                        else if (reloc->tiling_flags & RADEON_TILING_MICRO_SQUARE)
                                 tile_flags |= R300_DEPTHMICROTILE_TILED_SQUARE;
 
                         tmp = idx_value & ~(0x7 << 16);
@@ -1052,7 +1052,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                         radeon_cs_dump_packet(p, pkt);
                         return r;
                 }
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case 0x4e0c:
                 /* RB3D_COLOR_CHANNEL_MASK */
@@ -1097,7 +1097,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 track->aa.robj = reloc->robj;
                 track->aa.offset = idx_value;
                 track->aa_dirty = true;
-                ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+                ib[idx] = idx_value + ((u32)reloc->gpu_offset);
                 break;
         case R300_RB3D_AARESOLVE_PITCH:
                 track->aa.pitch = idx_value & 0x3FFE;
@@ -1162,7 +1162,7 @@ static int r300_packet3_check(struct radeon_cs_parser *p,
                         radeon_cs_dump_packet(p, pkt);
                         return r;
                 }
-                ib[idx+1] = radeon_get_ib_value(p, idx + 1) + ((u32)reloc->lobj.gpu_offset);
+                ib[idx+1] = radeon_get_ib_value(p, idx + 1) + ((u32)reloc->gpu_offset);
                 r = r100_cs_track_check_pkt3_indx_buffer(p, pkt, reloc->robj);
                 if (r) {
                         return r;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 647ef4079217..6e887d004eba 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1748,11 +1748,9 @@ bool r600_gfx_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
         if (!(reset_mask & (RADEON_RESET_GFX |
                             RADEON_RESET_COMPUTE |
                             RADEON_RESET_CP))) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force CP activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
@@ -2604,8 +2602,6 @@ int r600_cp_resume(struct radeon_device *rdev)
         WREG32(CP_RB_BASE, ring->gpu_addr >> 8);
         WREG32(CP_DEBUG, (1 << 27) | (1 << 28));
 
-        ring->rptr = RREG32(CP_RB_RPTR);
-
         r600_cp_start(rdev);
         ring->ready = true;
         r = radeon_ring_test(rdev, RADEON_RING_TYPE_GFX_INDEX, ring);
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 2812c7d1ae6f..12511bb5fd6f 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1022,7 +1022,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 break;
         case SQ_CONFIG:
                 track->sq_config = radeon_get_ib_value(p, idx);
@@ -1043,7 +1043,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         track->db_depth_info = radeon_get_ib_value(p, idx);
                         ib[idx] &= C_028010_ARRAY_MODE;
                         track->db_depth_info &= C_028010_ARRAY_MODE;
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO) {
                                 ib[idx] |= S_028010_ARRAY_MODE(V_028010_ARRAY_2D_TILED_THIN1);
                                 track->db_depth_info |= S_028010_ARRAY_MODE(V_028010_ARRAY_2D_TILED_THIN1);
                         } else {
@@ -1084,9 +1084,9 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                 }
                 tmp = (reg - VGT_STRMOUT_BUFFER_BASE_0) / 16;
                 track->vgt_strmout_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->vgt_strmout_bo[tmp] = reloc->robj;
-                track->vgt_strmout_bo_mc[tmp] = reloc->lobj.gpu_offset;
+                track->vgt_strmout_bo_mc[tmp] = reloc->gpu_offset;
                 track->streamout_dirty = true;
                 break;
         case VGT_STRMOUT_BUFFER_SIZE_0:
@@ -1105,7 +1105,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 break;
         case R_028238_CB_TARGET_MASK:
                 track->cb_target_mask = radeon_get_ib_value(p, idx);
@@ -1142,10 +1142,10 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         }
                         tmp = (reg - R_0280A0_CB_COLOR0_INFO) / 4;
                         track->cb_color_info[tmp] = radeon_get_ib_value(p, idx);
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
+                        if (reloc->tiling_flags & RADEON_TILING_MACRO) {
                                 ib[idx] |= S_0280A0_ARRAY_MODE(V_0280A0_ARRAY_2D_TILED_THIN1);
                                 track->cb_color_info[tmp] |= S_0280A0_ARRAY_MODE(V_0280A0_ARRAY_2D_TILED_THIN1);
-                        } else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO) {
+                        } else if (reloc->tiling_flags & RADEON_TILING_MICRO) {
                                 ib[idx] |= S_0280A0_ARRAY_MODE(V_0280A0_ARRAY_1D_TILED_THIN1);
                                 track->cb_color_info[tmp] |= S_0280A0_ARRAY_MODE(V_0280A0_ARRAY_1D_TILED_THIN1);
                         }
@@ -1214,7 +1214,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         }
                         track->cb_color_frag_bo[tmp] = reloc->robj;
                         track->cb_color_frag_offset[tmp] = (u64)ib[idx] << 8;
-                        ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                        ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 }
                 if (G_0280A0_TILE_MODE(track->cb_color_info[tmp])) {
                         track->cb_dirty = true;
@@ -1245,7 +1245,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         }
                         track->cb_color_tile_bo[tmp] = reloc->robj;
                         track->cb_color_tile_offset[tmp] = (u64)ib[idx] << 8;
-                        ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                        ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 }
                 if (G_0280A0_TILE_MODE(track->cb_color_info[tmp])) {
                         track->cb_dirty = true;
@@ -1281,10 +1281,10 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                 }
                 tmp = (reg - CB_COLOR0_BASE) / 4;
                 track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->cb_color_base_last[tmp] = ib[idx];
                 track->cb_color_bo[tmp] = reloc->robj;
-                track->cb_color_bo_mc[tmp] = reloc->lobj.gpu_offset;
+                track->cb_color_bo_mc[tmp] = reloc->gpu_offset;
                 track->cb_dirty = true;
                 break;
         case DB_DEPTH_BASE:
@@ -1295,9 +1295,9 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 track->db_offset = radeon_get_ib_value(p, idx) << 8;
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->db_bo = reloc->robj;
-                track->db_bo_mc = reloc->lobj.gpu_offset;
+                track->db_bo_mc = reloc->gpu_offset;
                 track->db_dirty = true;
                 break;
         case DB_HTILE_DATA_BASE:
@@ -1308,7 +1308,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         return -EINVAL;
                 }
                 track->htile_offset = radeon_get_ib_value(p, idx) << 8;
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 track->htile_bo = reloc->robj;
                 track->db_dirty = true;
                 break;
@@ -1377,7 +1377,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 break;
         case SX_MEMORY_EXPORT_BASE:
                 r = radeon_cs_packet_next_reloc(p, &reloc, r600_nomm);
@@ -1386,7 +1386,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                         "0x%04X\n", reg);
                         return -EINVAL;
                 }
-                ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 break;
         case SX_MISC:
                 track->sx_misc_kill_all_prims = (radeon_get_ib_value(p, idx) & 0x1) != 0;
@@ -1672,7 +1672,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          (idx_value & 0xfffffff0) +
                          ((u64)(tmp & 0xff) << 32);
 
@@ -1713,7 +1713,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          idx_value +
                          ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
 
@@ -1765,7 +1765,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                 return -EINVAL;
                         }
 
-                        offset = reloc->lobj.gpu_offset +
+                        offset = reloc->gpu_offset +
                                  (radeon_get_ib_value(p, idx+1) & 0xfffffff0) +
                                  ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
 
@@ -1805,7 +1805,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                         tmp = radeon_get_ib_value(p, idx) +
                                 ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
 
-                        offset = reloc->lobj.gpu_offset + tmp;
+                        offset = reloc->gpu_offset + tmp;
 
                         if ((tmp + size) > radeon_bo_size(reloc->robj)) {
                                 dev_warn(p->dev, "CP DMA src buffer too small (%llu %lu)\n",
@@ -1835,7 +1835,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                         tmp = radeon_get_ib_value(p, idx+2) +
                                 ((u64)(radeon_get_ib_value(p, idx+3) & 0xff) << 32);
 
-                        offset = reloc->lobj.gpu_offset + tmp;
+                        offset = reloc->gpu_offset + tmp;
 
                         if ((tmp + size) > radeon_bo_size(reloc->robj)) {
                                 dev_warn(p->dev, "CP DMA dst buffer too small (%llu %lu)\n",
@@ -1861,7 +1861,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                 DRM_ERROR("bad SURFACE_SYNC\n");
                                 return -EINVAL;
                         }
-                        ib[idx+2] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                        ib[idx+2] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 }
                 break;
         case PACKET3_EVENT_WRITE:
@@ -1877,7 +1877,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                 DRM_ERROR("bad EVENT_WRITE\n");
                                 return -EINVAL;
                         }
-                        offset = reloc->lobj.gpu_offset +
+                        offset = reloc->gpu_offset +
                                  (radeon_get_ib_value(p, idx+1) & 0xfffffff8) +
                                  ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
 
@@ -1899,7 +1899,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                         return -EINVAL;
                 }
 
-                offset = reloc->lobj.gpu_offset +
+                offset = reloc->gpu_offset +
                          (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
                          ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
 
@@ -1964,11 +1964,11 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                         DRM_ERROR("bad SET_RESOURCE\n");
                                         return -EINVAL;
                                 }
-                                base_offset = (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                                base_offset = (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
-                                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                                        if (reloc->tiling_flags & RADEON_TILING_MACRO)
                                                 ib[idx+1+(i*7)+0] |= S_038000_TILE_MODE(V_038000_ARRAY_2D_TILED_THIN1);
-                                        else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                                        else if (reloc->tiling_flags & RADEON_TILING_MICRO)
                                                 ib[idx+1+(i*7)+0] |= S_038000_TILE_MODE(V_038000_ARRAY_1D_TILED_THIN1);
                                 }
                                 texture = reloc->robj;
@@ -1978,13 +1978,13 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                         DRM_ERROR("bad SET_RESOURCE\n");
                                         return -EINVAL;
                                 }
-                                mip_offset = (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                                mip_offset = (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                                 mipmap = reloc->robj;
                                 r = r600_check_texture_resource(p,  idx+(i*7)+1,
                                                                 texture, mipmap,
                                                                 base_offset + radeon_get_ib_value(p, idx+1+(i*7)+2),
                                                                 mip_offset + radeon_get_ib_value(p, idx+1+(i*7)+3),
-                                                                reloc->lobj.tiling_flags);
+                                                                reloc->tiling_flags);
                                 if (r)
                                         return r;
                                 ib[idx+1+(i*7)+2] += base_offset;
@@ -2008,7 +2008,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                         ib[idx+1+(i*7)+1] = radeon_bo_size(reloc->robj) - offset;
                                 }
 
-                                offset64 = reloc->lobj.gpu_offset + offset;
+                                offset64 = reloc->gpu_offset + offset;
                                 ib[idx+1+(i*8)+0] = offset64;
                                 ib[idx+1+(i*8)+2] = (ib[idx+1+(i*8)+2] & 0xffffff00) |
                                                     (upper_32_bits(offset64) & 0xff);
@@ -2118,7 +2118,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        ib[idx+1] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                        ib[idx+1] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
                 }
                 break;
         case PACKET3_SURFACE_BASE_UPDATE:
@@ -2151,7 +2151,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        offset += reloc->lobj.gpu_offset;
+                        offset += reloc->gpu_offset;
                         ib[idx+1] = offset;
                         ib[idx+2] = upper_32_bits(offset) & 0xff;
                 }
@@ -2170,7 +2170,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        offset += reloc->lobj.gpu_offset;
+                        offset += reloc->gpu_offset;
                         ib[idx+3] = offset;
                         ib[idx+4] = upper_32_bits(offset) & 0xff;
                 }
@@ -2199,7 +2199,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                   offset + 8, radeon_bo_size(reloc->robj));
                         return -EINVAL;
                 }
-                offset += reloc->lobj.gpu_offset;
+                offset += reloc->gpu_offset;
                 ib[idx+0] = offset;
                 ib[idx+1] = upper_32_bits(offset) & 0xff;
                 break;
@@ -2224,7 +2224,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        offset += reloc->lobj.gpu_offset;
+                        offset += reloc->gpu_offset;
                         ib[idx+1] = offset;
                         ib[idx+2] = upper_32_bits(offset) & 0xff;
                 } else {
@@ -2248,7 +2248,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
                                           offset + 4, radeon_bo_size(reloc->robj));
                                 return -EINVAL;
                         }
-                        offset += reloc->lobj.gpu_offset;
+                        offset += reloc->gpu_offset;
                         ib[idx+3] = offset;
                         ib[idx+4] = upper_32_bits(offset) & 0xff;
                 } else {
@@ -2505,14 +2505,14 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                 dst_offset = radeon_get_ib_value(p, idx+1);
                                 dst_offset <<= 8;
 
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
                                 p->idx += count + 5;
                         } else {
                                 dst_offset = radeon_get_ib_value(p, idx+1);
                                 dst_offset |= ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
 
-                                ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                ib[idx+2] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
+                                ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                ib[idx+2] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
                                 p->idx += count + 3;
                         }
                         if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
@@ -2539,22 +2539,22 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                         /* tiled src, linear dst */
                                         src_offset = radeon_get_ib_value(p, idx+1);
                                         src_offset <<= 8;
-                                        ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
+                                        ib[idx+1] += (u32)(src_reloc->gpu_offset >> 8);
 
                                         dst_offset = radeon_get_ib_value(p, idx+5);
                                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
-                                        ib[idx+5] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+6] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+5] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+6] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
                                 } else {
                                         /* linear src, tiled dst */
                                         src_offset = radeon_get_ib_value(p, idx+5);
                                         src_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
-                                        ib[idx+5] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+6] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+5] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+6] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
 
                                         dst_offset = radeon_get_ib_value(p, idx+1);
                                         dst_offset <<= 8;
-                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
+                                        ib[idx+1] += (u32)(dst_reloc->gpu_offset >> 8);
                                 }
                                 p->idx += 7;
                         } else {
@@ -2564,10 +2564,10 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                         dst_offset = radeon_get_ib_value(p, idx+1);
                                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
 
-                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+3] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
-                                        ib[idx+4] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
+                                        ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+2] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+3] += upper_32_bits(dst_reloc->gpu_offset) & 0xff;
+                                        ib[idx+4] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
                                         p->idx += 5;
                                 } else {
                                         src_offset = radeon_get_ib_value(p, idx+2);
@@ -2575,10 +2575,10 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                         dst_offset = radeon_get_ib_value(p, idx+1);
                                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff0000)) << 16;
 
-                                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
-                                        ib[idx+3] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
-                                        ib[idx+3] += (upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff) << 16;
+                                        ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+2] += (u32)(src_reloc->gpu_offset & 0xfffffffc);
+                                        ib[idx+3] += upper_32_bits(src_reloc->gpu_offset) & 0xff;
+                                        ib[idx+3] += (upper_32_bits(dst_reloc->gpu_offset) & 0xff) << 16;
                                         p->idx += 4;
                                 }
                         }
@@ -2610,8 +2610,8 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                          dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
                                 return -EINVAL;
                         }
-                        ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
-                        ib[idx+3] += (upper_32_bits(dst_reloc->lobj.gpu_offset) << 16) & 0x00ff0000;
+                        ib[idx+1] += (u32)(dst_reloc->gpu_offset & 0xfffffffc);
+                        ib[idx+3] += (upper_32_bits(dst_reloc->gpu_offset) << 16) & 0x00ff0000;
                         p->idx += 4;
                         break;
                 case DMA_PACKET_NOP:
diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
index b2d4c91e6272..53fcb28f5578 100644
--- a/drivers/gpu/drm/radeon/r600_dma.c
+++ b/drivers/gpu/drm/radeon/r600_dma.c
@@ -176,8 +176,6 @@ int r600_dma_resume(struct radeon_device *rdev)
         ring->wptr = 0;
         WREG32(DMA_RB_WPTR, ring->wptr << 2);
 
-        ring->rptr = RREG32(DMA_RB_RPTR) >> 2;
-
         WREG32(DMA_RB_CNTL, rb_cntl | DMA_RB_ENABLE);
 
         ring->ready = true;
@@ -221,11 +219,9 @@ bool r600_dma_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
         u32 reset_mask = r600_gpu_check_soft_reset(rdev);
 
         if (!(reset_mask & RADEON_RESET_DMA)) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force ring activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index e4cc9b314ce9..cbf7e3269f84 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -834,6 +834,26 @@ static int r600_parse_clk_voltage_dep_table(struct radeon_clock_voltage_dependen
         return 0;
 }
 
+int r600_get_platform_caps(struct radeon_device *rdev)
+{
+        struct radeon_mode_info *mode_info = &rdev->mode_info;
+        union power_info *power_info;
+        int index = GetIndexIntoMasterTable(DATA, PowerPlayInfo);
+        u16 data_offset;
+        u8 frev, crev;
+
+        if (!atom_parse_data_header(mode_info->atom_context, index, NULL,
+                                   &frev, &crev, &data_offset))
+                return -EINVAL;
+        power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
+
+        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
+        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
+        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
+
+        return 0;
+}
+
 /* sizeof(ATOM_PPLIB_EXTENDEDHEADER) */
 #define SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V2 12
 #define SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V3 14
@@ -1043,7 +1063,15 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                                 (mode_info->atom_context->bios + data_offset +
                                  le16_to_cpu(ext_hdr->usVCETableOffset) + 1 +
                                  1 + array->ucNumEntries * sizeof(VCEClockInfo));
+                        ATOM_PPLIB_VCE_State_Table *states =
+                                (ATOM_PPLIB_VCE_State_Table *)
+                                (mode_info->atom_context->bios + data_offset +
+                                 le16_to_cpu(ext_hdr->usVCETableOffset) + 1 +
+                                 1 + (array->ucNumEntries * sizeof (VCEClockInfo)) +
+                                 1 + (limits->numEntries * sizeof(ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record)));
                         ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record *entry;
+                        ATOM_PPLIB_VCE_State_Record *state_entry;
+                        VCEClockInfo *vce_clk;
                         u32 size = limits->numEntries *
                                 sizeof(struct radeon_vce_clock_voltage_dependency_entry);
                         rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries =
@@ -1055,8 +1083,9 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                         rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.count =
                                 limits->numEntries;
                         entry = &limits->entries[0];
+                        state_entry = &states->entries[0];
                         for (i = 0; i < limits->numEntries; i++) {
-                                VCEClockInfo *vce_clk = (VCEClockInfo *)
+                                vce_clk = (VCEClockInfo *)
                                         ((u8 *)&array->entries[0] +
                                          (entry->ucVCEClockInfoIndex * sizeof(VCEClockInfo)));
                                 rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries[i].evclk =
@@ -1068,6 +1097,23 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                                 entry = (ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record *)
                                         ((u8 *)entry + sizeof(ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record));
                         }
+                        for (i = 0; i < states->numEntries; i++) {
+                                if (i >= RADEON_MAX_VCE_LEVELS)
+                                        break;
+                                vce_clk = (VCEClockInfo *)
+                                        ((u8 *)&array->entries[0] +
+                                         (state_entry->ucVCEClockInfoIndex * sizeof(VCEClockInfo)));
+                                rdev->pm.dpm.vce_states[i].evclk =
+                                        le16_to_cpu(vce_clk->usEVClkLow) | (vce_clk->ucEVClkHigh << 16);
+                                rdev->pm.dpm.vce_states[i].ecclk =
+                                        le16_to_cpu(vce_clk->usECClkLow) | (vce_clk->ucECClkHigh << 16);
+                                rdev->pm.dpm.vce_states[i].clk_idx =
+                                        state_entry->ucClockInfoIndex & 0x3f;
+                                rdev->pm.dpm.vce_states[i].pstate =
+                                        (state_entry->ucClockInfoIndex & 0xc0) >> 6;
+                                state_entry = (ATOM_PPLIB_VCE_State_Record *)
+                                        ((u8 *)state_entry + sizeof(ATOM_PPLIB_VCE_State_Record));
+                        }
                 }
                 if ((le16_to_cpu(ext_hdr->usSize) >= SIZE_OF_ATOM_PPLIB_EXTENDEDHEADER_V3) &&
                         ext_hdr->usUVDTableOffset) {
diff --git a/drivers/gpu/drm/radeon/r600_dpm.h b/drivers/gpu/drm/radeon/r600_dpm.h
index 07eab2b04e81..46b9d2a03018 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.h
+++ b/drivers/gpu/drm/radeon/r600_dpm.h
@@ -215,6 +215,8 @@ void r600_stop_dpm(struct radeon_device *rdev);
 
 bool r600_is_internal_thermal_sensor(enum radeon_int_thermal_type sensor);
 
+int r600_get_platform_caps(struct radeon_device *rdev);
+
 int r600_parse_extended_power_table(struct radeon_device *rdev);
 void r600_free_extended_power_table(struct radeon_device *rdev);
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index e887d027b6d0..f21db7a0b34d 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -113,19 +113,16 @@ extern int radeon_hard_reset;
 #define RADEONFB_CONN_LIMIT                     4
 #define RADEON_BIOS_NUM_SCRATCH                 8
 
-/* max number of rings */
-#define RADEON_NUM_RINGS                        6
-
 /* fence seq are set to this number when signaled */
 #define RADEON_FENCE_SIGNALED_SEQ               0LL
 
 /* internal ring indices */
 /* r1xx+ has gfx CP ring */
-#define RADEON_RING_TYPE_GFX_INDEX      0
+#define RADEON_RING_TYPE_GFX_INDEX              0
 
 /* cayman has 2 compute CP rings */
-#define CAYMAN_RING_TYPE_CP1_INDEX      1
-#define CAYMAN_RING_TYPE_CP2_INDEX      2
+#define CAYMAN_RING_TYPE_CP1_INDEX              1
+#define CAYMAN_RING_TYPE_CP2_INDEX              2
 
 /* R600+ has an async dma ring */
 #define R600_RING_TYPE_DMA_INDEX                3
@@ -133,7 +130,17 @@ extern int radeon_hard_reset;
 #define CAYMAN_RING_TYPE_DMA1_INDEX             4
 
 /* R600+ */
-#define R600_RING_TYPE_UVD_INDEX        5
+#define R600_RING_TYPE_UVD_INDEX                5
+
+/* TN+ */
+#define TN_RING_TYPE_VCE1_INDEX                 6
+#define TN_RING_TYPE_VCE2_INDEX                 7
+
+/* max number of rings */
+#define RADEON_NUM_RINGS                        8
+
+/* number of hw syncs before falling back on blocking */
+#define RADEON_NUM_SYNCS                        4
 
 /* number of hw syncs before falling back on blocking */
 #define RADEON_NUM_SYNCS                        4
@@ -356,9 +363,8 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence **fence, i
 void radeon_fence_process(struct radeon_device *rdev, int ring);
 bool radeon_fence_signaled(struct radeon_fence *fence);
 int radeon_fence_wait(struct radeon_fence *fence, bool interruptible);
-int radeon_fence_wait_locked(struct radeon_fence *fence);
-int radeon_fence_wait_next_locked(struct radeon_device *rdev, int ring);
-int radeon_fence_wait_empty_locked(struct radeon_device *rdev, int ring);
+int radeon_fence_wait_next(struct radeon_device *rdev, int ring);
+int radeon_fence_wait_empty(struct radeon_device *rdev, int ring);
 int radeon_fence_wait_any(struct radeon_device *rdev,
                           struct radeon_fence **fences,
                           bool intr);
@@ -450,6 +456,7 @@ struct radeon_bo {
         /* Protected by gem.mutex */
         struct list_head                list;
         /* Protected by tbo.reserved */
+        u32                             initial_domain;
         u32                             placements[3];
         struct ttm_placement            placement;
         struct ttm_buffer_object        tbo;
@@ -472,16 +479,6 @@ struct radeon_bo {
 };
 #define gem_to_radeon_bo(gobj) container_of((gobj), struct radeon_bo, gem_base)
 
-struct radeon_bo_list {
-        struct ttm_validate_buffer tv;
-        struct radeon_bo        *bo;
-        uint64_t                gpu_offset;
-        bool                    written;
-        unsigned                domain;
-        unsigned                alt_domain;
-        u32                     tiling_flags;
-};
-
 int radeon_gem_debugfs_init(struct radeon_device *rdev);
 
 /* sub-allocation manager, it has to be protected by another lock.
@@ -789,7 +786,6 @@ struct radeon_ib {
 struct radeon_ring {
         struct radeon_bo        *ring_obj;
         volatile uint32_t       *ring;
-        unsigned                rptr;
         unsigned                rptr_offs;
         unsigned                rptr_save_reg;
         u64                     next_rptr_gpu_addr;
@@ -799,8 +795,8 @@ struct radeon_ring {
         unsigned                ring_size;
         unsigned                ring_free_dw;
         int                     count_dw;
-        unsigned long           last_activity;
-        unsigned                last_rptr;
+        atomic_t                last_rptr;
+        atomic64_t              last_activity;
         uint64_t                gpu_addr;
         uint32_t                align_mask;
         uint32_t                ptr_mask;
@@ -852,17 +848,22 @@ struct radeon_mec {
 #define R600_PTE_READABLE       (1 << 5)
 #define R600_PTE_WRITEABLE      (1 << 6)
 
+struct radeon_vm_pt {
+        struct radeon_bo                *bo;
+        uint64_t                        addr;
+};
+
 struct radeon_vm {
-        struct list_head                list;
         struct list_head                va;
         unsigned                        id;
 
         /* contains the page directory */
-        struct radeon_sa_bo             *page_directory;
+        struct radeon_bo                *page_directory;
         uint64_t                        pd_gpu_addr;
+        unsigned                        max_pde_used;
 
         /* array of page tables, one for each page directory entry */
-        struct radeon_sa_bo             **page_tables;
+        struct radeon_vm_pt             *page_tables;
 
         struct mutex                    mutex;
         /* last fence for cs using this vm */
@@ -874,10 +875,7 @@ struct radeon_vm {
 };
 
 struct radeon_vm_manager {
-        struct mutex                    lock;
-        struct list_head                lru_vm;
         struct radeon_fence             *active[RADEON_NUM_VM];
-        struct radeon_sa_manager        sa_manager;
         uint32_t                        max_pfn;
         /* number of VMIDs */
         unsigned                        nvm;
@@ -953,8 +951,8 @@ void radeon_ring_unlock_commit(struct radeon_device *rdev, struct radeon_ring *c
 void radeon_ring_undo(struct radeon_ring *ring);
 void radeon_ring_unlock_undo(struct radeon_device *rdev, struct radeon_ring *cp);
 int radeon_ring_test(struct radeon_device *rdev, struct radeon_ring *cp);
-void radeon_ring_force_activity(struct radeon_device *rdev, struct radeon_ring *ring);
-void radeon_ring_lockup_update(struct radeon_ring *ring);
+void radeon_ring_lockup_update(struct radeon_device *rdev,
+                               struct radeon_ring *ring);
 bool radeon_ring_test_lockup(struct radeon_device *rdev, struct radeon_ring *ring);
 unsigned radeon_ring_backup(struct radeon_device *rdev, struct radeon_ring *ring,
                             uint32_t **data);
@@ -980,9 +978,12 @@ void cayman_dma_fini(struct radeon_device *rdev);
 struct radeon_cs_reloc {
         struct drm_gem_object           *gobj;
         struct radeon_bo                *robj;
-        struct radeon_bo_list           lobj;
+        struct ttm_validate_buffer      tv;
+        uint64_t                        gpu_offset;
+        unsigned                        domain;
+        unsigned                        alt_domain;
+        uint32_t                        tiling_flags;
         uint32_t                        handle;
-        uint32_t                        flags;
 };
 
 struct radeon_cs_chunk {
@@ -1006,6 +1007,7 @@ struct radeon_cs_parser {
         unsigned                nrelocs;
         struct radeon_cs_reloc  *relocs;
         struct radeon_cs_reloc  **relocs_ptr;
+        struct radeon_cs_reloc  *vm_bos;
         struct list_head        validated;
         unsigned                dma_reloc_idx;
         /* indices of various chunks */
@@ -1255,6 +1257,17 @@ enum radeon_dpm_event_src {
         RADEON_DPM_EVENT_SRC_DIGIAL_OR_EXTERNAL = 4
 };
 
+#define RADEON_MAX_VCE_LEVELS 6
+
+enum radeon_vce_level {
+        RADEON_VCE_LEVEL_AC_ALL = 0,     /* AC, All cases */
+        RADEON_VCE_LEVEL_DC_EE = 1,      /* DC, entropy encoding */
+        RADEON_VCE_LEVEL_DC_LL_LOW = 2,  /* DC, low latency queue, res <= 720 */
+        RADEON_VCE_LEVEL_DC_LL_HIGH = 3, /* DC, low latency queue, 1080 >= res > 720 */
+        RADEON_VCE_LEVEL_DC_GP_LOW = 4,  /* DC, general purpose queue, res <= 720 */
+        RADEON_VCE_LEVEL_DC_GP_HIGH = 5, /* DC, general purpose queue, 1080 >= res > 720 */
+};
+
 struct radeon_ps {
         u32 caps; /* vbios flags */
         u32 class; /* vbios flags */
@@ -1265,6 +1278,8 @@ struct radeon_ps {
         /* VCE clocks */
         u32 evclk;
         u32 ecclk;
+        bool vce_active;
+        enum radeon_vce_level vce_level;
         /* asic priv */
         void *ps_priv;
 };
@@ -1439,6 +1454,17 @@ enum radeon_dpm_forced_level {
         RADEON_DPM_FORCED_LEVEL_HIGH = 2,
 };
 
+struct radeon_vce_state {
+        /* vce clocks */
+        u32 evclk;
+        u32 ecclk;
+        /* gpu clocks */
+        u32 sclk;
+        u32 mclk;
+        u8 clk_idx;
+        u8 pstate;
+};
+
 struct radeon_dpm {
         struct radeon_ps        *ps;
         /* number of valid power states */
@@ -1451,6 +1477,9 @@ struct radeon_dpm {
         struct radeon_ps        *boot_ps;
         /* default uvd power state */
         struct radeon_ps        *uvd_ps;
+        /* vce requirements */
+        struct radeon_vce_state vce_states[RADEON_MAX_VCE_LEVELS];
+        enum radeon_vce_level vce_level;
         enum radeon_pm_state_type state;
         enum radeon_pm_state_type user_state;
         u32                     platform_caps;
@@ -1476,6 +1505,7 @@ struct radeon_dpm {
         /* special states active */
         bool                    thermal_active;
         bool                    uvd_active;
+        bool                    vce_active;
         /* thermal handling */
         struct radeon_dpm_thermal thermal;
         /* forced levels */
@@ -1486,6 +1516,7 @@ struct radeon_dpm {
 };
 
 void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable);
+void radeon_dpm_enable_vce(struct radeon_device *rdev, bool enable);
 
 struct radeon_pm {
         struct mutex            mutex;
@@ -1591,6 +1622,45 @@ int radeon_uvd_calc_upll_dividers(struct radeon_device *rdev,
 int radeon_uvd_send_upll_ctlreq(struct radeon_device *rdev,
                                 unsigned cg_upll_func_cntl);
 
+/*
+ * VCE
+ */
+#define RADEON_MAX_VCE_HANDLES  16
+#define RADEON_VCE_STACK_SIZE   (1024*1024)
+#define RADEON_VCE_HEAP_SIZE    (4*1024*1024)
+
+struct radeon_vce {
+        struct radeon_bo        *vcpu_bo;
+        uint64_t                gpu_addr;
+        unsigned                fw_version;
+        unsigned                fb_version;
+        atomic_t                handles[RADEON_MAX_VCE_HANDLES];
+        struct drm_file         *filp[RADEON_MAX_VCE_HANDLES];
+        struct delayed_work     idle_work;
+};
+
+int radeon_vce_init(struct radeon_device *rdev);
+void radeon_vce_fini(struct radeon_device *rdev);
+int radeon_vce_suspend(struct radeon_device *rdev);
+int radeon_vce_resume(struct radeon_device *rdev);
+int radeon_vce_get_create_msg(struct radeon_device *rdev, int ring,
+                              uint32_t handle, struct radeon_fence **fence);
+int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
+                               uint32_t handle, struct radeon_fence **fence);
+void radeon_vce_free_handles(struct radeon_device *rdev, struct drm_file *filp);
+void radeon_vce_note_usage(struct radeon_device *rdev);
+int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi);
+int radeon_vce_cs_parse(struct radeon_cs_parser *p);
+bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
+                               struct radeon_ring *ring,
+                               struct radeon_semaphore *semaphore,
+                               bool emit_wait);
+void radeon_vce_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);
+void radeon_vce_fence_emit(struct radeon_device *rdev,
+                           struct radeon_fence *fence);
+int radeon_vce_ring_test(struct radeon_device *rdev, struct radeon_ring *ring);
+int radeon_vce_ib_test(struct radeon_device *rdev, struct radeon_ring *ring);
+
 struct r600_audio_pin {
         int                     channels;
         int                     rate;
@@ -1780,6 +1850,7 @@ struct radeon_asic {
                 void (*set_pcie_lanes)(struct radeon_device *rdev, int lanes);
                 void (*set_clock_gating)(struct radeon_device *rdev, int enable);
                 int (*set_uvd_clocks)(struct radeon_device *rdev, u32 vclk, u32 dclk);
+                int (*set_vce_clocks)(struct radeon_device *rdev, u32 evclk, u32 ecclk);
                 int (*get_temperature)(struct radeon_device *rdev);
         } pm;
         /* dynamic power management */
@@ -2041,6 +2112,8 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
                               struct drm_file *filp);
 int radeon_gem_va_ioctl(struct drm_device *dev, void *data,
                           struct drm_file *filp);
+int radeon_gem_op_ioctl(struct drm_device *dev, void *data,
+                        struct drm_file *filp);
 int radeon_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp);
 int radeon_gem_set_tiling_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *filp);
@@ -2186,6 +2259,7 @@ struct radeon_device {
         struct radeon_gem               gem;
         struct radeon_pm                pm;
         struct radeon_uvd               uvd;
+        struct radeon_vce               vce;
         uint32_t                        bios_scratch[RADEON_BIOS_NUM_SCRATCH];
         struct radeon_wb                wb;
         struct radeon_dummy_page        dummy_page;
@@ -2205,6 +2279,7 @@ struct radeon_device {
         const struct firmware *sdma_fw; /* CIK SDMA firmware */
         const struct firmware *smc_fw;  /* SMC firmware */
         const struct firmware *uvd_fw;  /* UVD firmware */
+        const struct firmware *vce_fw;  /* VCE firmware */
         struct r600_vram_scratch vram_scratch;
         int msi_enabled; /* msi enabled */
         struct r600_ih ih; /* r6/700 interrupt ring */
@@ -2229,6 +2304,10 @@ struct radeon_device {
         /* virtual memory */
         struct radeon_vm_manager        vm_manager;
         struct mutex                    gpu_clock_mutex;
+        /* memory stats */
+        atomic64_t                      vram_usage;
+        atomic64_t                      gtt_usage;
+        atomic64_t                      num_bytes_moved;
         /* ACPI interface */
         struct radeon_atif              atif;
         struct radeon_atcs              atcs;
@@ -2639,6 +2718,7 @@ void radeon_ring_write(struct radeon_ring *ring, uint32_t v);
 #define radeon_set_pcie_lanes(rdev, l) (rdev)->asic->pm.set_pcie_lanes((rdev), (l))
 #define radeon_set_clock_gating(rdev, e) (rdev)->asic->pm.set_clock_gating((rdev), (e))
 #define radeon_set_uvd_clocks(rdev, v, d) (rdev)->asic->pm.set_uvd_clocks((rdev), (v), (d))
+#define radeon_set_vce_clocks(rdev, ev, ec) (rdev)->asic->pm.set_vce_clocks((rdev), (ev), (ec))
 #define radeon_get_temperature(rdev) (rdev)->asic->pm.get_temperature((rdev))
 #define radeon_set_surface_reg(rdev, r, f, p, o, s) ((rdev)->asic->surface.set_reg((rdev), (r), (f), (p), (o), (s)))
 #define radeon_clear_surface_reg(rdev, r) ((rdev)->asic->surface.clear_reg((rdev), (r)))
@@ -2715,16 +2795,22 @@ extern void radeon_program_register_sequence(struct radeon_device *rdev,
  */
 int radeon_vm_manager_init(struct radeon_device *rdev);
 void radeon_vm_manager_fini(struct radeon_device *rdev);
-void radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm);
+int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm);
 void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm);
-int radeon_vm_alloc_pt(struct radeon_device *rdev, struct radeon_vm *vm);
-void radeon_vm_add_to_lru(struct radeon_device *rdev, struct radeon_vm *vm);
+struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
+                                          struct radeon_vm *vm,
+                                          struct list_head *head);
 struct radeon_fence *radeon_vm_grab_id(struct radeon_device *rdev,
                                        struct radeon_vm *vm, int ring);
+void radeon_vm_flush(struct radeon_device *rdev,
+                     struct radeon_vm *vm,
+                     int ring);
 void radeon_vm_fence(struct radeon_device *rdev,
                      struct radeon_vm *vm,
                      struct radeon_fence *fence);
 uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr);
+int radeon_vm_update_page_directory(struct radeon_device *rdev,
+                                    struct radeon_vm *vm);
 int radeon_vm_bo_update(struct radeon_device *rdev,
                         struct radeon_vm *vm,
                         struct radeon_bo *bo,
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index dda02bfc10a4..b8a24a75d4ff 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -1987,6 +1987,19 @@ static struct radeon_asic_ring ci_dma_ring = {
         .set_wptr = &cik_sdma_set_wptr,
 };
 
+static struct radeon_asic_ring ci_vce_ring = {
+        .ib_execute = &radeon_vce_ib_execute,
+        .emit_fence = &radeon_vce_fence_emit,
+        .emit_semaphore = &radeon_vce_semaphore_emit,
+        .cs_parse = &radeon_vce_cs_parse,
+        .ring_test = &radeon_vce_ring_test,
+        .ib_test = &radeon_vce_ib_test,
+        .is_lockup = &radeon_ring_test_lockup,
+        .get_rptr = &vce_v1_0_get_rptr,
+        .get_wptr = &vce_v1_0_get_wptr,
+        .set_wptr = &vce_v1_0_set_wptr,
+};
+
 static struct radeon_asic ci_asic = {
         .init = &cik_init,
         .fini = &cik_fini,
@@ -2015,6 +2028,8 @@ static struct radeon_asic ci_asic = {
                 [R600_RING_TYPE_DMA_INDEX] = &ci_dma_ring,
                 [CAYMAN_RING_TYPE_DMA1_INDEX] = &ci_dma_ring,
                 [R600_RING_TYPE_UVD_INDEX] = &cayman_uvd_ring,
+                [TN_RING_TYPE_VCE1_INDEX] = &ci_vce_ring,
+                [TN_RING_TYPE_VCE2_INDEX] = &ci_vce_ring,
         },
         .irq = {
                 .set = &cik_irq_set,
@@ -2061,6 +2076,7 @@ static struct radeon_asic ci_asic = {
                 .set_pcie_lanes = NULL,
                 .set_clock_gating = NULL,
                 .set_uvd_clocks = &cik_set_uvd_clocks,
+                .set_vce_clocks = &cik_set_vce_clocks,
                 .get_temperature = &ci_get_temp,
         },
         .dpm = {
@@ -2117,6 +2133,8 @@ static struct radeon_asic kv_asic = {
                 [R600_RING_TYPE_DMA_INDEX] = &ci_dma_ring,
                 [CAYMAN_RING_TYPE_DMA1_INDEX] = &ci_dma_ring,
                 [R600_RING_TYPE_UVD_INDEX] = &cayman_uvd_ring,
+                [TN_RING_TYPE_VCE1_INDEX] = &ci_vce_ring,
+                [TN_RING_TYPE_VCE2_INDEX] = &ci_vce_ring,
         },
         .irq = {
                 .set = &cik_irq_set,
@@ -2163,6 +2181,7 @@ static struct radeon_asic kv_asic = {
                 .set_pcie_lanes = NULL,
                 .set_clock_gating = NULL,
                 .set_uvd_clocks = &cik_set_uvd_clocks,
+                .set_vce_clocks = &cik_set_vce_clocks,
                 .get_temperature = &kv_get_temp,
         },
         .dpm = {
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index ae637cfda783..3d55a3a39e82 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -717,6 +717,7 @@ u32 cik_get_xclk(struct radeon_device *rdev);
 uint32_t cik_pciep_rreg(struct radeon_device *rdev, uint32_t reg);
 void cik_pciep_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 int cik_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk);
+int cik_set_vce_clocks(struct radeon_device *rdev, u32 evclk, u32 ecclk);
 void cik_sdma_fence_ring_emit(struct radeon_device *rdev,
                               struct radeon_fence *fence);
 bool cik_sdma_semaphore_ring_emit(struct radeon_device *rdev,
@@ -863,4 +864,17 @@ bool uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
 /* uvd v4.2 */
 int uvd_v4_2_resume(struct radeon_device *rdev);
 
+/* vce v1.0 */
+uint32_t vce_v1_0_get_rptr(struct radeon_device *rdev,
+                           struct radeon_ring *ring);
+uint32_t vce_v1_0_get_wptr(struct radeon_device *rdev,
+                           struct radeon_ring *ring);
+void vce_v1_0_set_wptr(struct radeon_device *rdev,
+                       struct radeon_ring *ring);
+int vce_v1_0_init(struct radeon_device *rdev);
+int vce_v1_0_start(struct radeon_device *rdev);
+
+/* vce v2.0 */
+int vce_v2_0_resume(struct radeon_device *rdev);
+
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index dfb5a1db87d4..2b6e0ebcc13a 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -24,16 +24,59 @@
  * Authors:
  *    Jerome Glisse <glisse@freedesktop.org>
  */
+#include <linux/list_sort.h>
 #include <drm/drmP.h>
 #include <drm/radeon_drm.h>
 #include "radeon_reg.h"
 #include "radeon.h"
 #include "radeon_trace.h"
 
+#define RADEON_CS_MAX_PRIORITY          32u
+#define RADEON_CS_NUM_BUCKETS           (RADEON_CS_MAX_PRIORITY + 1)
+
+/* This is based on the bucket sort with O(n) time complexity.
+ * An item with priority "i" is added to bucket[i]. The lists are then
+ * concatenated in descending order.
+ */
+struct radeon_cs_buckets {
+        struct list_head bucket[RADEON_CS_NUM_BUCKETS];
+};
+
+static void radeon_cs_buckets_init(struct radeon_cs_buckets *b)
+{
+        unsigned i;
+
+        for (i = 0; i < RADEON_CS_NUM_BUCKETS; i++)
+                INIT_LIST_HEAD(&b->bucket[i]);
+}
+
+static void radeon_cs_buckets_add(struct radeon_cs_buckets *b,
+                                  struct list_head *item, unsigned priority)
+{
+        /* Since buffers which appear sooner in the relocation list are
+         * likely to be used more often than buffers which appear later
+         * in the list, the sort mustn't change the ordering of buffers
+         * with the same priority, i.e. it must be stable.
+         */
+        list_add_tail(item, &b->bucket[min(priority, RADEON_CS_MAX_PRIORITY)]);
+}
+
+static void radeon_cs_buckets_get_list(struct radeon_cs_buckets *b,
+                                       struct list_head *out_list)
+{
+        unsigned i;
+
+        /* Connect the sorted buckets in the output list. */
+        for (i = 0; i < RADEON_CS_NUM_BUCKETS; i++) {
+                list_splice(&b->bucket[i], out_list);
+        }
+}
+
 static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
 {
         struct drm_device *ddev = p->rdev->ddev;
         struct radeon_cs_chunk *chunk;
+        struct radeon_cs_buckets buckets;
         unsigned i, j;
         bool duplicate;
 
@@ -52,8 +95,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
         if (p->relocs == NULL) {
                 return -ENOMEM;
         }
+
+        radeon_cs_buckets_init(&buckets);
+
         for (i = 0; i < p->nrelocs; i++) {
                 struct drm_radeon_cs_reloc *r;
+                unsigned priority;
 
                 duplicate = false;
                 r = (struct drm_radeon_cs_reloc *)&chunk->kdata[i*4];
@@ -78,8 +125,14 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                 }
                 p->relocs_ptr[i] = &p->relocs[i];
                 p->relocs[i].robj = gem_to_radeon_bo(p->relocs[i].gobj);
-                p->relocs[i].lobj.bo = p->relocs[i].robj;
-                p->relocs[i].lobj.written = !!r->write_domain;
+
+                /* The userspace buffer priorities are from 0 to 15. A higher
+                 * number means the buffer is more important.
+                 * Also, the buffers used for write have a higher priority than
+                 * the buffers used for read only, which doubles the range
+                 * to 0 to 31. 32 is reserved for the kernel driver.
+                 */
+                priority = (r->flags & 0xf) * 2 + !!r->write_domain;
 
                 /* the first reloc of an UVD job is the msg and that must be in
                    VRAM, also but everything into VRAM on AGP cards to avoid
@@ -87,29 +140,38 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                 if (p->ring == R600_RING_TYPE_UVD_INDEX &&
                     (i == 0 || drm_pci_device_is_agp(p->rdev->ddev))) {
                         /* TODO: is this still needed for NI+ ? */
-                        p->relocs[i].lobj.domain =
+                        p->relocs[i].domain =
                                 RADEON_GEM_DOMAIN_VRAM;
 
-                        p->relocs[i].lobj.alt_domain =
+                        p->relocs[i].alt_domain =
                                 RADEON_GEM_DOMAIN_VRAM;
 
+                        /* prioritize this over any other relocation */
+                        priority = RADEON_CS_MAX_PRIORITY;
                 } else {
                         uint32_t domain = r->write_domain ?
                                 r->write_domain : r->read_domains;
 
-                        p->relocs[i].lobj.domain = domain;
+                        p->relocs[i].domain = domain;
                         if (domain == RADEON_GEM_DOMAIN_VRAM)
                                 domain |= RADEON_GEM_DOMAIN_GTT;
-                        p->relocs[i].lobj.alt_domain = domain;
+                        p->relocs[i].alt_domain = domain;
                 }
 
-                p->relocs[i].lobj.tv.bo = &p->relocs[i].robj->tbo;
+                p->relocs[i].tv.bo = &p->relocs[i].robj->tbo;
                 p->relocs[i].handle = r->handle;
 
-                radeon_bo_list_add_object(&p->relocs[i].lobj,
-                                          &p->validated);
+                radeon_cs_buckets_add(&buckets, &p->relocs[i].tv.head,
+                                      priority);
         }
-        return radeon_bo_list_validate(&p->ticket, &p->validated, p->ring);
+
+        radeon_cs_buckets_get_list(&buckets, &p->validated);
+
+        if (p->cs_flags & RADEON_CS_USE_VM)
+                p->vm_bos = radeon_vm_get_bos(p->rdev, p->ib.vm,
+                                              &p->validated);
+
+        return radeon_bo_list_validate(p->rdev, &p->ticket, &p->validated, p->ring);
 }
 
 static int radeon_cs_get_ring(struct radeon_cs_parser *p, u32 ring, s32 priority)
@@ -147,6 +209,10 @@ static int radeon_cs_get_ring(struct radeon_cs_parser *p, u32 ring, s32 priority
         case RADEON_CS_RING_UVD:
                 p->ring = R600_RING_TYPE_UVD_INDEX;
                 break;
+        case RADEON_CS_RING_VCE:
+                /* TODO: only use the low priority ring for now */
+                p->ring = TN_RING_TYPE_VCE1_INDEX;
+                break;
         }
         return 0;
 }
@@ -286,6 +352,16 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
         return 0;
 }
 
+static int cmp_size_smaller_first(void *priv, struct list_head *a,
+                                  struct list_head *b)
+{
+        struct radeon_cs_reloc *la = list_entry(a, struct radeon_cs_reloc, tv.head);
+        struct radeon_cs_reloc *lb = list_entry(b, struct radeon_cs_reloc, tv.head);
+
+        /* Sort A before B if A is smaller. */
+        return (int)la->robj->tbo.num_pages - (int)lb->robj->tbo.num_pages;
+}
+
 /**
  * cs_parser_fini() - clean parser states
  * @parser:     parser structure holding parsing context.
@@ -299,6 +375,18 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error, bo
         unsigned i;
 
         if (!error) {
+                /* Sort the buffer list from the smallest to largest buffer,
+                 * which affects the order of buffers in the LRU list.
+                 * This assures that the smallest buffers are added first
+                 * to the LRU list, so they are likely to be later evicted
+                 * first, instead of large buffers whose eviction is more
+                 * expensive.
+                 *
+                 * This slightly lowers the number of bytes moved by TTM
+                 * per frame under memory pressure.
+                 */
+                list_sort(NULL, &parser->validated, cmp_size_smaller_first);
+
                 ttm_eu_fence_buffer_objects(&parser->ticket,
                                             &parser->validated,
                                             parser->ib.fence);
@@ -316,6 +404,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error, bo
         kfree(parser->track);
         kfree(parser->relocs);
         kfree(parser->relocs_ptr);
+        kfree(parser->vm_bos);
         for (i = 0; i < parser->nchunks; i++)
                 drm_free_large(parser->chunks[i].kdata);
         kfree(parser->chunks);
@@ -343,6 +432,9 @@ static int radeon_cs_ib_chunk(struct radeon_device *rdev,
 
         if (parser->ring == R600_RING_TYPE_UVD_INDEX)
                 radeon_uvd_note_usage(rdev);
+        else if ((parser->ring == TN_RING_TYPE_VCE1_INDEX) ||
+                 (parser->ring == TN_RING_TYPE_VCE2_INDEX))
+                radeon_vce_note_usage(rdev);
 
         radeon_cs_sync_rings(parser);
         r = radeon_ib_schedule(rdev, &parser->ib, NULL);
@@ -352,24 +444,32 @@ static int radeon_cs_ib_chunk(struct radeon_device *rdev,
         return r;
 }
 
-static int radeon_bo_vm_update_pte(struct radeon_cs_parser *parser,
+static int radeon_bo_vm_update_pte(struct radeon_cs_parser *p,
                                    struct radeon_vm *vm)
 {
-        struct radeon_device *rdev = parser->rdev;
-        struct radeon_bo_list *lobj;
-        struct radeon_bo *bo;
-        int r;
+        struct radeon_device *rdev = p->rdev;
+        int i, r;
 
-        r = radeon_vm_bo_update(rdev, vm, rdev->ring_tmp_bo.bo, &rdev->ring_tmp_bo.bo->tbo.mem);
-        if (r) {
+        r = radeon_vm_update_page_directory(rdev, vm);
+        if (r)
                 return r;
-        }
-        list_for_each_entry(lobj, &parser->validated, tv.head) {
-                bo = lobj->bo;
-                r = radeon_vm_bo_update(parser->rdev, vm, bo, &bo->tbo.mem);
-                if (r) {
+
+        r = radeon_vm_bo_update(rdev, vm, rdev->ring_tmp_bo.bo,
+                                &rdev->ring_tmp_bo.bo->tbo.mem);
+        if (r)
+                return r;
+
+        for (i = 0; i < p->nrelocs; i++) {
+                struct radeon_bo *bo;
+
+                /* ignore duplicates */
+                if (p->relocs_ptr[i] != &p->relocs[i])
+                        continue;
+
+                bo = p->relocs[i].robj;
+                r = radeon_vm_bo_update(rdev, vm, bo, &bo->tbo.mem);
+                if (r)
                         return r;
-                }
         }
         return 0;
 }
@@ -401,20 +501,13 @@ static int radeon_cs_ib_vm_chunk(struct radeon_device *rdev,
         if (parser->ring == R600_RING_TYPE_UVD_INDEX)
                 radeon_uvd_note_usage(rdev);
 
-        mutex_lock(&rdev->vm_manager.lock);
         mutex_lock(&vm->mutex);
-        r = radeon_vm_alloc_pt(rdev, vm);
-        if (r) {
-                goto out;
-        }
         r = radeon_bo_vm_update_pte(parser, vm);
         if (r) {
                 goto out;
         }
         radeon_cs_sync_rings(parser);
         radeon_semaphore_sync_to(parser->ib.semaphore, vm->fence);
-        radeon_semaphore_sync_to(parser->ib.semaphore,
-                                 radeon_vm_grab_id(rdev, vm, parser->ring));
 
         if ((rdev->family >= CHIP_TAHITI) &&
             (parser->chunk_const_ib_idx != -1)) {
@@ -423,14 +516,8 @@ static int radeon_cs_ib_vm_chunk(struct radeon_device *rdev,
                 r = radeon_ib_schedule(rdev, &parser->ib, NULL);
         }
 
-        if (!r) {
-                radeon_vm_fence(rdev, vm, parser->ib.fence);
-        }
-
 out:
-        radeon_vm_add_to_lru(rdev, vm);
         mutex_unlock(&vm->mutex);
-        mutex_unlock(&rdev->vm_manager.lock);
         return r;
 }
 
@@ -698,9 +785,9 @@ int radeon_cs_packet_next_reloc(struct radeon_cs_parser *p,
         /* FIXME: we assume reloc size is 4 dwords */
         if (nomm) {
                 *cs_reloc = p->relocs;
-                (*cs_reloc)->lobj.gpu_offset =
+                (*cs_reloc)->gpu_offset =
                         (u64)relocs_chunk->kdata[idx + 3] << 32;
-                (*cs_reloc)->lobj.gpu_offset |= relocs_chunk->kdata[idx + 0];
+                (*cs_reloc)->gpu_offset |= relocs_chunk->kdata[idx + 0];
         } else
                 *cs_reloc = p->relocs_ptr[(idx / 4)];
         return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 044bc98fb459..2e72dcd94b13 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1191,14 +1191,12 @@ int radeon_device_init(struct radeon_device *rdev,
         r = radeon_gem_init(rdev);
         if (r)
                 return r;
-        /* initialize vm here */
-        mutex_init(&rdev->vm_manager.lock);
+
         /* Adjust VM size here.
          * Currently set to 4GB ((1 << 20) 4k pages).
          * Max GPUVM size for cayman and SI is 40 bits.
          */
         rdev->vm_manager.max_pfn = 1 << 20;
-        INIT_LIST_HEAD(&rdev->vm_manager.lru_vm);
 
         /* Set asic functions */
         r = radeon_asic_init(rdev);
@@ -1445,10 +1443,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, bool fbcon)
         /* evict vram memory */
         radeon_bo_evict_vram(rdev);
 
-        mutex_lock(&rdev->ring_lock);
         /* wait for gpu to finish processing current batch */
         for (i = 0; i < RADEON_NUM_RINGS; i++) {
-                r = radeon_fence_wait_empty_locked(rdev, i);
+                r = radeon_fence_wait_empty(rdev, i);
                 if (r) {
                         /* delay GPU reset to resume */
                         force_completion = true;
@@ -1457,7 +1454,6 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, bool fbcon)
         if (force_completion) {
                 radeon_fence_driver_force_completion(rdev);
         }
-        mutex_unlock(&rdev->ring_lock);
 
         radeon_save_bios_scratch_regs(rdev);
 
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 84a1bbb75f91..4392b7c95ee6 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -79,9 +79,10 @@
  *   2.35.0 - Add CIK macrotile mode array query
  *   2.36.0 - Fix CIK DCE tiling setup
  *   2.37.0 - allow GS ring setup on r6xx/r7xx
+ *   2.38.0 - RADEON_GEM_OP (GET_INITIAL_DOMAIN, SET_INITIAL_DOMAIN)
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        37
+#define KMS_DRIVER_MINOR        38
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index c37cb79a9489..a77b1c13ea43 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -288,7 +288,6 @@ static bool radeon_fence_any_seq_signaled(struct radeon_device *rdev, u64 *seq)
  * @rdev: radeon device pointer
  * @target_seq: sequence number(s) we want to wait for
  * @intr: use interruptable sleep
- * @lock_ring: whether the ring should be locked or not
  *
  * Wait for the requested sequence number(s) to be written by any ring
  * (all asics).  Sequnce number array is indexed by ring id.
@@ -299,7 +298,7 @@ static bool radeon_fence_any_seq_signaled(struct radeon_device *rdev, u64 *seq)
  * -EDEADLK is returned when a GPU lockup has been detected.
  */
 static int radeon_fence_wait_seq(struct radeon_device *rdev, u64 *target_seq,
-                                 bool intr, bool lock_ring)
+                                 bool intr)
 {
         uint64_t last_seq[RADEON_NUM_RINGS];
         bool signaled;
@@ -358,9 +357,6 @@ static int radeon_fence_wait_seq(struct radeon_device *rdev, u64 *target_seq,
                         if (i != RADEON_NUM_RINGS)
                                 continue;
 
-                        if (lock_ring)
-                                mutex_lock(&rdev->ring_lock);
-
                         for (i = 0; i < RADEON_NUM_RINGS; ++i) {
                                 if (!target_seq[i])
                                         continue;
@@ -378,14 +374,9 @@ static int radeon_fence_wait_seq(struct radeon_device *rdev, u64 *target_seq,
 
                                 /* remember that we need an reset */
                                 rdev->needs_reset = true;
-                                if (lock_ring)
-                                        mutex_unlock(&rdev->ring_lock);
                                 wake_up_all(&rdev->fence_queue);
                                 return -EDEADLK;
                         }
-
-                        if (lock_ring)
-                                mutex_unlock(&rdev->ring_lock);
                 }
         }
         return 0;
@@ -416,7 +407,7 @@ int radeon_fence_wait(struct radeon_fence *fence, bool intr)
         if (seq[fence->ring] == RADEON_FENCE_SIGNALED_SEQ)
                 return 0;
 
-        r = radeon_fence_wait_seq(fence->rdev, seq, intr, true);
+        r = radeon_fence_wait_seq(fence->rdev, seq, intr);
         if (r)
                 return r;
 
@@ -464,7 +455,7 @@ int radeon_fence_wait_any(struct radeon_device *rdev,
         if (num_rings == 0)
                 return -ENOENT;
 
-        r = radeon_fence_wait_seq(rdev, seq, intr, true);
+        r = radeon_fence_wait_seq(rdev, seq, intr);
         if (r) {
                 return r;
         }
@@ -472,37 +463,7 @@ int radeon_fence_wait_any(struct radeon_device *rdev,
 }
 
 /**
- * radeon_fence_wait_locked - wait for a fence to signal
- *
- * @fence: radeon fence object
- *
- * Wait for the requested fence to signal (all asics).
- * Returns 0 if the fence has passed, error for all other cases.
- */
-int radeon_fence_wait_locked(struct radeon_fence *fence)
-{
-        uint64_t seq[RADEON_NUM_RINGS] = {};
-        int r;
-
-        if (fence == NULL) {
-                WARN(1, "Querying an invalid fence : %p !\n", fence);
-                return -EINVAL;
-        }
-
-        seq[fence->ring] = fence->seq;
-        if (seq[fence->ring] == RADEON_FENCE_SIGNALED_SEQ)
-                return 0;
-
-        r = radeon_fence_wait_seq(fence->rdev, seq, false, false);
-        if (r)
-                return r;
-
-        fence->seq = RADEON_FENCE_SIGNALED_SEQ;
-        return 0;
-}
-
-/**
- * radeon_fence_wait_next_locked - wait for the next fence to signal
+ * radeon_fence_wait_next - wait for the next fence to signal
  *
  * @rdev: radeon device pointer
  * @ring: ring index the fence is associated with
@@ -511,7 +472,7 @@ int radeon_fence_wait_locked(struct radeon_fence *fence)
  * Returns 0 if the next fence has passed, error for all other cases.
  * Caller must hold ring lock.
  */
-int radeon_fence_wait_next_locked(struct radeon_device *rdev, int ring)
+int radeon_fence_wait_next(struct radeon_device *rdev, int ring)
 {
         uint64_t seq[RADEON_NUM_RINGS] = {};
 
@@ -521,11 +482,11 @@ int radeon_fence_wait_next_locked(struct radeon_device *rdev, int ring)
                    already the last emited fence */
                 return -ENOENT;
         }
-        return radeon_fence_wait_seq(rdev, seq, false, false);
+        return radeon_fence_wait_seq(rdev, seq, false);
 }
 
 /**
- * radeon_fence_wait_empty_locked - wait for all fences to signal
+ * radeon_fence_wait_empty - wait for all fences to signal
  *
  * @rdev: radeon device pointer
  * @ring: ring index the fence is associated with
@@ -534,7 +495,7 @@ int radeon_fence_wait_next_locked(struct radeon_device *rdev, int ring)
  * Returns 0 if the fences have passed, error for all other cases.
  * Caller must hold ring lock.
  */
-int radeon_fence_wait_empty_locked(struct radeon_device *rdev, int ring)
+int radeon_fence_wait_empty(struct radeon_device *rdev, int ring)
 {
         uint64_t seq[RADEON_NUM_RINGS] = {};
         int r;
@@ -543,7 +504,7 @@ int radeon_fence_wait_empty_locked(struct radeon_device *rdev, int ring)
         if (!seq[ring])
                 return 0;
 
-        r = radeon_fence_wait_seq(rdev, seq, false, false);
+        r = radeon_fence_wait_seq(rdev, seq, false);
         if (r) {
                 if (r == -EDEADLK)
                         return -EDEADLK;
@@ -794,7 +755,7 @@ void radeon_fence_driver_fini(struct radeon_device *rdev)
         for (ring = 0; ring < RADEON_NUM_RINGS; ring++) {
                 if (!rdev->fence_drv[ring].initialized)
                         continue;
-                r = radeon_fence_wait_empty_locked(rdev, ring);
+                r = radeon_fence_wait_empty(rdev, ring);
                 if (r) {
                         /* no need to trigger GPU reset as we are unloading */
                         radeon_fence_driver_force_completion(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index a8f9b463bf2a..2e723651069b 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -28,8 +28,6 @@
 #include <drm/drmP.h>
 #include <drm/radeon_drm.h>
 #include "radeon.h"
-#include "radeon_reg.h"
-#include "radeon_trace.h"
 
 /*
  * GART
@@ -394,959 +392,3 @@ void radeon_gart_fini(struct radeon_device *rdev)
 
         radeon_dummy_page_fini(rdev);
 }
-
-/*
- * GPUVM
- * GPUVM is similar to the legacy gart on older asics, however
- * rather than there being a single global gart table
- * for the entire GPU, there are multiple VM page tables active
- * at any given time.  The VM page tables can contain a mix
- * vram pages and system memory pages and system memory pages
- * can be mapped as snooped (cached system pages) or unsnooped
- * (uncached system pages).
- * Each VM has an ID associated with it and there is a page table
- * associated with each VMID.  When execting a command buffer,
- * the kernel tells the the ring what VMID to use for that command
- * buffer.  VMIDs are allocated dynamically as commands are submitted.
- * The userspace drivers maintain their own address space and the kernel
- * sets up their pages tables accordingly when they submit their
- * command buffers and a VMID is assigned.
- * Cayman/Trinity support up to 8 active VMs at any given time;
- * SI supports 16.
- */
-
-/*
- * vm helpers
- *
- * TODO bind a default page at vm initialization for default address
- */
-
-/**
- * radeon_vm_num_pde - return the number of page directory entries
- *
- * @rdev: radeon_device pointer
- *
- * Calculate the number of page directory entries (cayman+).
- */
-static unsigned radeon_vm_num_pdes(struct radeon_device *rdev)
-{
-        return rdev->vm_manager.max_pfn >> RADEON_VM_BLOCK_SIZE;
-}
-
-/**
- * radeon_vm_directory_size - returns the size of the page directory in bytes
- *
- * @rdev: radeon_device pointer
- *
- * Calculate the size of the page directory in bytes (cayman+).
- */
-static unsigned radeon_vm_directory_size(struct radeon_device *rdev)
-{
-        return RADEON_GPU_PAGE_ALIGN(radeon_vm_num_pdes(rdev) * 8);
-}
-
-/**
- * radeon_vm_manager_init - init the vm manager
- *
- * @rdev: radeon_device pointer
- *
- * Init the vm manager (cayman+).
- * Returns 0 for success, error for failure.
- */
-int radeon_vm_manager_init(struct radeon_device *rdev)
-{
-        struct radeon_vm *vm;
-        struct radeon_bo_va *bo_va;
-        int r;
-        unsigned size;
-
-        if (!rdev->vm_manager.enabled) {
-                /* allocate enough for 2 full VM pts */
-                size = radeon_vm_directory_size(rdev);
-                size += rdev->vm_manager.max_pfn * 8;
-                size *= 2;
-                r = radeon_sa_bo_manager_init(rdev, &rdev->vm_manager.sa_manager,
-                                              RADEON_GPU_PAGE_ALIGN(size),
-                                              RADEON_VM_PTB_ALIGN_SIZE,
-                                              RADEON_GEM_DOMAIN_VRAM);
-                if (r) {
-                        dev_err(rdev->dev, "failed to allocate vm bo (%dKB)\n",
-                                (rdev->vm_manager.max_pfn * 8) >> 10);
-                        return r;
-                }
-
-                r = radeon_asic_vm_init(rdev);
-                if (r)
-                        return r;
-
-                rdev->vm_manager.enabled = true;
-
-                r = radeon_sa_bo_manager_start(rdev, &rdev->vm_manager.sa_manager);
-                if (r)
-                        return r;
-        }
-
-        /* restore page table */
-        list_for_each_entry(vm, &rdev->vm_manager.lru_vm, list) {
-                if (vm->page_directory == NULL)
-                        continue;
-
-                list_for_each_entry(bo_va, &vm->va, vm_list) {
-                        bo_va->valid = false;
-                }
-        }
-        return 0;
-}
-
-/**
- * radeon_vm_free_pt - free the page table for a specific vm
- *
- * @rdev: radeon_device pointer
- * @vm: vm to unbind
- *
- * Free the page table of a specific vm (cayman+).
- *
- * Global and local mutex must be lock!
- */
-static void radeon_vm_free_pt(struct radeon_device *rdev,
-                                    struct radeon_vm *vm)
-{
-        struct radeon_bo_va *bo_va;
-        int i;
-
-        if (!vm->page_directory)
-                return;
-
-        list_del_init(&vm->list);
-        radeon_sa_bo_free(rdev, &vm->page_directory, vm->fence);
-
-        list_for_each_entry(bo_va, &vm->va, vm_list) {
-                bo_va->valid = false;
-        }
-
-        if (vm->page_tables == NULL)
-                return;
-
-        for (i = 0; i < radeon_vm_num_pdes(rdev); i++)
-                radeon_sa_bo_free(rdev, &vm->page_tables[i], vm->fence);
-
-        kfree(vm->page_tables);
-}
-
-/**
- * radeon_vm_manager_fini - tear down the vm manager
- *
- * @rdev: radeon_device pointer
- *
- * Tear down the VM manager (cayman+).
- */
-void radeon_vm_manager_fini(struct radeon_device *rdev)
-{
-        struct radeon_vm *vm, *tmp;
-        int i;
-
-        if (!rdev->vm_manager.enabled)
-                return;
-
-        mutex_lock(&rdev->vm_manager.lock);
-        /* free all allocated page tables */
-        list_for_each_entry_safe(vm, tmp, &rdev->vm_manager.lru_vm, list) {
-                mutex_lock(&vm->mutex);
-                radeon_vm_free_pt(rdev, vm);
-                mutex_unlock(&vm->mutex);
-        }
-        for (i = 0; i < RADEON_NUM_VM; ++i) {
-                radeon_fence_unref(&rdev->vm_manager.active[i]);
-        }
-        radeon_asic_vm_fini(rdev);
-        mutex_unlock(&rdev->vm_manager.lock);
-
-        radeon_sa_bo_manager_suspend(rdev, &rdev->vm_manager.sa_manager);
-        radeon_sa_bo_manager_fini(rdev, &rdev->vm_manager.sa_manager);
-        rdev->vm_manager.enabled = false;
-}
-
-/**
- * radeon_vm_evict - evict page table to make room for new one
- *
- * @rdev: radeon_device pointer
- * @vm: VM we want to allocate something for
- *
- * Evict a VM from the lru, making sure that it isn't @vm. (cayman+).
- * Returns 0 for success, -ENOMEM for failure.
- *
- * Global and local mutex must be locked!
- */
-static int radeon_vm_evict(struct radeon_device *rdev, struct radeon_vm *vm)
-{
-        struct radeon_vm *vm_evict;
-
-        if (list_empty(&rdev->vm_manager.lru_vm))
-                return -ENOMEM;
-
-        vm_evict = list_first_entry(&rdev->vm_manager.lru_vm,
-                                    struct radeon_vm, list);
-        if (vm_evict == vm)
-                return -ENOMEM;
-
-        mutex_lock(&vm_evict->mutex);
-        radeon_vm_free_pt(rdev, vm_evict);
-        mutex_unlock(&vm_evict->mutex);
-        return 0;
-}
-
-/**
- * radeon_vm_alloc_pt - allocates a page table for a VM
- *
- * @rdev: radeon_device pointer
- * @vm: vm to bind
- *
- * Allocate a page table for the requested vm (cayman+).
- * Returns 0 for success, error for failure.
- *
- * Global and local mutex must be locked!
- */
-int radeon_vm_alloc_pt(struct radeon_device *rdev, struct radeon_vm *vm)
-{
-        unsigned pd_size, pd_entries, pts_size;
-        struct radeon_ib ib;
-        int r;
-
-        if (vm == NULL) {
-                return -EINVAL;
-        }
-
-        if (vm->page_directory != NULL) {
-                return 0;
-        }
-
-        pd_size = radeon_vm_directory_size(rdev);
-        pd_entries = radeon_vm_num_pdes(rdev);
-
-retry:
-        r = radeon_sa_bo_new(rdev, &rdev->vm_manager.sa_manager,
-                             &vm->page_directory, pd_size,
-                             RADEON_VM_PTB_ALIGN_SIZE, false);
-        if (r == -ENOMEM) {
-                r = radeon_vm_evict(rdev, vm);
-                if (r)
-                        return r;
-                goto retry;
-
-        } else if (r) {
-                return r;
-        }
-
-        vm->pd_gpu_addr = radeon_sa_bo_gpu_addr(vm->page_directory);
-
-        /* Initially clear the page directory */
-        r = radeon_ib_get(rdev, R600_RING_TYPE_DMA_INDEX, &ib,
-                          NULL, pd_entries * 2 + 64);
-        if (r) {
-                radeon_sa_bo_free(rdev, &vm->page_directory, vm->fence);
-                return r;
-        }
-
-        ib.length_dw = 0;
-
-        radeon_asic_vm_set_page(rdev, &ib, vm->pd_gpu_addr,
-                                0, pd_entries, 0, 0);
-
-        radeon_semaphore_sync_to(ib.semaphore, vm->fence);
-        r = radeon_ib_schedule(rdev, &ib, NULL);
-        if (r) {
-                radeon_ib_free(rdev, &ib);
-                radeon_sa_bo_free(rdev, &vm->page_directory, vm->fence);
-                return r;
-        }
-        radeon_fence_unref(&vm->fence);
-        vm->fence = radeon_fence_ref(ib.fence);
-        radeon_ib_free(rdev, &ib);
-        radeon_fence_unref(&vm->last_flush);
-
-        /* allocate page table array */
-        pts_size = radeon_vm_num_pdes(rdev) * sizeof(struct radeon_sa_bo *);
-        vm->page_tables = kzalloc(pts_size, GFP_KERNEL);
-
-        if (vm->page_tables == NULL) {
-                DRM_ERROR("Cannot allocate memory for page table array\n");
-                radeon_sa_bo_free(rdev, &vm->page_directory, vm->fence);
-                return -ENOMEM;
-        }
-
-        return 0;
-}
-
-/**
- * radeon_vm_add_to_lru - add VMs page table to LRU list
- *
- * @rdev: radeon_device pointer
- * @vm: vm to add to LRU
- *
- * Add the allocated page table to the LRU list (cayman+).
- *
- * Global mutex must be locked!
- */
-void radeon_vm_add_to_lru(struct radeon_device *rdev, struct radeon_vm *vm)
-{
-        list_del_init(&vm->list);
-        list_add_tail(&vm->list, &rdev->vm_manager.lru_vm);
-}
-
-/**
- * radeon_vm_grab_id - allocate the next free VMID
- *
- * @rdev: radeon_device pointer
- * @vm: vm to allocate id for
- * @ring: ring we want to submit job to
- *
- * Allocate an id for the vm (cayman+).
- * Returns the fence we need to sync to (if any).
- *
- * Global and local mutex must be locked!
- */
-struct radeon_fence *radeon_vm_grab_id(struct radeon_device *rdev,
-                                       struct radeon_vm *vm, int ring)
-{
-        struct radeon_fence *best[RADEON_NUM_RINGS] = {};
-        unsigned choices[2] = {};
-        unsigned i;
-
-        /* check if the id is still valid */
-        if (vm->last_id_use && vm->last_id_use == rdev->vm_manager.active[vm->id])
-                return NULL;
-
-        /* we definately need to flush */
-        radeon_fence_unref(&vm->last_flush);
-
-        /* skip over VMID 0, since it is the system VM */
-        for (i = 1; i < rdev->vm_manager.nvm; ++i) {
-                struct radeon_fence *fence = rdev->vm_manager.active[i];
-
-                if (fence == NULL) {
-                        /* found a free one */
-                        vm->id = i;
-                        trace_radeon_vm_grab_id(vm->id, ring);
-                        return NULL;
-                }
-
-                if (radeon_fence_is_earlier(fence, best[fence->ring])) {
-                        best[fence->ring] = fence;
-                        choices[fence->ring == ring ? 0 : 1] = i;
-                }
-        }
-
-        for (i = 0; i < 2; ++i) {
-                if (choices[i]) {
-                        vm->id = choices[i];
-                        trace_radeon_vm_grab_id(vm->id, ring);
-                        return rdev->vm_manager.active[choices[i]];
-                }
-        }
-
-        /* should never happen */
-        BUG();
-        return NULL;
-}
-
-/**
- * radeon_vm_fence - remember fence for vm
- *
- * @rdev: radeon_device pointer
- * @vm: vm we want to fence
- * @fence: fence to remember
- *
- * Fence the vm (cayman+).
- * Set the fence used to protect page table and id.
- *
- * Global and local mutex must be locked!
- */
-void radeon_vm_fence(struct radeon_device *rdev,
-                     struct radeon_vm *vm,
-                     struct radeon_fence *fence)
-{
-        radeon_fence_unref(&rdev->vm_manager.active[vm->id]);
-        rdev->vm_manager.active[vm->id] = radeon_fence_ref(fence);
-
-        radeon_fence_unref(&vm->fence);
-        vm->fence = radeon_fence_ref(fence);
-
-        radeon_fence_unref(&vm->last_id_use);
-        vm->last_id_use = radeon_fence_ref(fence);
-}
-
-/**
- * radeon_vm_bo_find - find the bo_va for a specific vm & bo
- *
- * @vm: requested vm
- * @bo: requested buffer object
- *
- * Find @bo inside the requested vm (cayman+).
- * Search inside the @bos vm list for the requested vm
- * Returns the found bo_va or NULL if none is found
- *
- * Object has to be reserved!
- */
-struct radeon_bo_va *radeon_vm_bo_find(struct radeon_vm *vm,
-                                       struct radeon_bo *bo)
-{
-        struct radeon_bo_va *bo_va;
-
-        list_for_each_entry(bo_va, &bo->va, bo_list) {
-                if (bo_va->vm == vm) {
-                        return bo_va;
-                }
-        }
-        return NULL;
-}
-
-/**
- * radeon_vm_bo_add - add a bo to a specific vm
- *
- * @rdev: radeon_device pointer
- * @vm: requested vm
- * @bo: radeon buffer object
- *
- * Add @bo into the requested vm (cayman+).
- * Add @bo to the list of bos associated with the vm
- * Returns newly added bo_va or NULL for failure
- *
- * Object has to be reserved!
- */
-struct radeon_bo_va *radeon_vm_bo_add(struct radeon_device *rdev,
-                                      struct radeon_vm *vm,
-                                      struct radeon_bo *bo)
-{
-        struct radeon_bo_va *bo_va;
-
-        bo_va = kzalloc(sizeof(struct radeon_bo_va), GFP_KERNEL);
-        if (bo_va == NULL) {
-                return NULL;
-        }
-        bo_va->vm = vm;
-        bo_va->bo = bo;
-        bo_va->soffset = 0;
-        bo_va->eoffset = 0;
-        bo_va->flags = 0;
-        bo_va->valid = false;
-        bo_va->ref_count = 1;
-        INIT_LIST_HEAD(&bo_va->bo_list);
-        INIT_LIST_HEAD(&bo_va->vm_list);
-
-        mutex_lock(&vm->mutex);
-        list_add(&bo_va->vm_list, &vm->va);
-        list_add_tail(&bo_va->bo_list, &bo->va);
-        mutex_unlock(&vm->mutex);
-
-        return bo_va;
-}
-
-/**
- * radeon_vm_bo_set_addr - set bos virtual address inside a vm
- *
- * @rdev: radeon_device pointer
- * @bo_va: bo_va to store the address
- * @soffset: requested offset of the buffer in the VM address space
- * @flags: attributes of pages (read/write/valid/etc.)
- *
- * Set offset of @bo_va (cayman+).
- * Validate and set the offset requested within the vm address space.
- * Returns 0 for success, error for failure.
- *
- * Object has to be reserved!
- */
-int radeon_vm_bo_set_addr(struct radeon_device *rdev,
-                          struct radeon_bo_va *bo_va,
-                          uint64_t soffset,
-                          uint32_t flags)
-{
-        uint64_t size = radeon_bo_size(bo_va->bo);
-        uint64_t eoffset, last_offset = 0;
-        struct radeon_vm *vm = bo_va->vm;
-        struct radeon_bo_va *tmp;
-        struct list_head *head;
-        unsigned last_pfn;
-
-        if (soffset) {
-                /* make sure object fit at this offset */
-                eoffset = soffset + size;
-                if (soffset >= eoffset) {
-                        return -EINVAL;
-                }
-
-                last_pfn = eoffset / RADEON_GPU_PAGE_SIZE;
-                if (last_pfn > rdev->vm_manager.max_pfn) {
-                        dev_err(rdev->dev, "va above limit (0x%08X > 0x%08X)\n",
-                                last_pfn, rdev->vm_manager.max_pfn);
-                        return -EINVAL;
-                }
-
-        } else {
-                eoffset = last_pfn = 0;
-        }
-
-        mutex_lock(&vm->mutex);
-        head = &vm->va;
-        last_offset = 0;
-        list_for_each_entry(tmp, &vm->va, vm_list) {
-                if (bo_va == tmp) {
-                        /* skip over currently modified bo */
-                        continue;
-                }
-
-                if (soffset >= last_offset && eoffset <= tmp->soffset) {
-                        /* bo can be added before this one */
-                        break;
-                }
-                if (eoffset > tmp->soffset && soffset < tmp->eoffset) {
-                        /* bo and tmp overlap, invalid offset */
-                        dev_err(rdev->dev, "bo %p va 0x%08X conflict with (bo %p 0x%08X 0x%08X)\n",
-                                bo_va->bo, (unsigned)bo_va->soffset, tmp->bo,
-                                (unsigned)tmp->soffset, (unsigned)tmp->eoffset);
-                        mutex_unlock(&vm->mutex);
-                        return -EINVAL;
-                }
-                last_offset = tmp->eoffset;
-                head = &tmp->vm_list;
-        }
-
-        bo_va->soffset = soffset;
-        bo_va->eoffset = eoffset;
-        bo_va->flags = flags;
-        bo_va->valid = false;
-        list_move(&bo_va->vm_list, head);
-
-        mutex_unlock(&vm->mutex);
-        return 0;
-}
-
-/**
- * radeon_vm_map_gart - get the physical address of a gart page
- *
- * @rdev: radeon_device pointer
- * @addr: the unmapped addr
- *
- * Look up the physical address of the page that the pte resolves
- * to (cayman+).
- * Returns the physical address of the page.
- */
-uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr)
-{
-        uint64_t result;
-
-        /* page table offset */
-        result = rdev->gart.pages_addr[addr >> PAGE_SHIFT];
-
-        /* in case cpu page size != gpu page size*/
-        result |= addr & (~PAGE_MASK);
-
-        return result;
-}
-
-/**
- * radeon_vm_page_flags - translate page flags to what the hw uses
- *
- * @flags: flags comming from userspace
- *
- * Translate the flags the userspace ABI uses to hw flags.
- */
-static uint32_t radeon_vm_page_flags(uint32_t flags)
-{
-        uint32_t hw_flags = 0;
-        hw_flags |= (flags & RADEON_VM_PAGE_VALID) ? R600_PTE_VALID : 0;
-        hw_flags |= (flags & RADEON_VM_PAGE_READABLE) ? R600_PTE_READABLE : 0;
-        hw_flags |= (flags & RADEON_VM_PAGE_WRITEABLE) ? R600_PTE_WRITEABLE : 0;
-        if (flags & RADEON_VM_PAGE_SYSTEM) {
-                hw_flags |= R600_PTE_SYSTEM;
-                hw_flags |= (flags & RADEON_VM_PAGE_SNOOPED) ? R600_PTE_SNOOPED : 0;
-        }
-        return hw_flags;
-}
-
-/**
- * radeon_vm_update_pdes - make sure that page directory is valid
- *
- * @rdev: radeon_device pointer
- * @vm: requested vm
- * @start: start of GPU address range
- * @end: end of GPU address range
- *
- * Allocates new page tables if necessary
- * and updates the page directory (cayman+).
- * Returns 0 for success, error for failure.
- *
- * Global and local mutex must be locked!
- */
-static int radeon_vm_update_pdes(struct radeon_device *rdev,
-                                 struct radeon_vm *vm,
-                                 struct radeon_ib *ib,
-                                 uint64_t start, uint64_t end)
-{
-        static const uint32_t incr = RADEON_VM_PTE_COUNT * 8;
-
-        uint64_t last_pde = ~0, last_pt = ~0;
-        unsigned count = 0;
-        uint64_t pt_idx;
-        int r;
-
-        start = (start / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE;
-        end = (end / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE;
-
-        /* walk over the address space and update the page directory */
-        for (pt_idx = start; pt_idx <= end; ++pt_idx) {
-                uint64_t pde, pt;
-
-                if (vm->page_tables[pt_idx])
-                        continue;
-
-retry:
-                r = radeon_sa_bo_new(rdev, &rdev->vm_manager.sa_manager,
-                                     &vm->page_tables[pt_idx],
-                                     RADEON_VM_PTE_COUNT * 8,
-                                     RADEON_GPU_PAGE_SIZE, false);
-
-                if (r == -ENOMEM) {
-                        r = radeon_vm_evict(rdev, vm);
-                        if (r)
-                                return r;
-                        goto retry;
-                } else if (r) {
-                        return r;
-                }
-
-                pde = vm->pd_gpu_addr + pt_idx * 8;
-
-                pt = radeon_sa_bo_gpu_addr(vm->page_tables[pt_idx]);
-
-                if (((last_pde + 8 * count) != pde) ||
-                    ((last_pt + incr * count) != pt)) {
-
-                        if (count) {
-                                radeon_asic_vm_set_page(rdev, ib, last_pde,
-                                                        last_pt, count, incr,
-                                                        R600_PTE_VALID);
-
-                                count *= RADEON_VM_PTE_COUNT;
-                                radeon_asic_vm_set_page(rdev, ib, last_pt, 0,
-                                                        count, 0, 0);
-                        }
-
-                        count = 1;
-                        last_pde = pde;
-                        last_pt = pt;
-                } else {
-                        ++count;
-                }
-        }
-
-        if (count) {
-                radeon_asic_vm_set_page(rdev, ib, last_pde, last_pt, count,
-                                        incr, R600_PTE_VALID);
-
-                count *= RADEON_VM_PTE_COUNT;
-                radeon_asic_vm_set_page(rdev, ib, last_pt, 0,
-                                        count, 0, 0);
-        }
-
-        return 0;
-}
-
-/**
- * radeon_vm_update_ptes - make sure that page tables are valid
- *
- * @rdev: radeon_device pointer
- * @vm: requested vm
- * @start: start of GPU address range
- * @end: end of GPU address range
- * @dst: destination address to map to
- * @flags: mapping flags
- *
- * Update the page tables in the range @start - @end (cayman+).
- *
- * Global and local mutex must be locked!
- */
-static void radeon_vm_update_ptes(struct radeon_device *rdev,
-                                  struct radeon_vm *vm,
-                                  struct radeon_ib *ib,
-                                  uint64_t start, uint64_t end,
-                                  uint64_t dst, uint32_t flags)
-{
-        static const uint64_t mask = RADEON_VM_PTE_COUNT - 1;
-
-        uint64_t last_pte = ~0, last_dst = ~0;
-        unsigned count = 0;
-        uint64_t addr;
-
-        start = start / RADEON_GPU_PAGE_SIZE;
-        end = end / RADEON_GPU_PAGE_SIZE;
-
-        /* walk over the address space and update the page tables */
-        for (addr = start; addr < end; ) {
-                uint64_t pt_idx = addr >> RADEON_VM_BLOCK_SIZE;
-                unsigned nptes;
-                uint64_t pte;
-
-                if ((addr & ~mask) == (end & ~mask))
-                        nptes = end - addr;
-                else
-                        nptes = RADEON_VM_PTE_COUNT - (addr & mask);
-
-                pte = radeon_sa_bo_gpu_addr(vm->page_tables[pt_idx]);
-                pte += (addr & mask) * 8;
-
-                if ((last_pte + 8 * count) != pte) {
-
-                        if (count) {
-                                radeon_asic_vm_set_page(rdev, ib, last_pte,
-                                                        last_dst, count,
-                                                        RADEON_GPU_PAGE_SIZE,
-                                                        flags);
-                        }
-
-                        count = nptes;
-                        last_pte = pte;
-                        last_dst = dst;
-                } else {
-                        count += nptes;
-                }
-
-                addr += nptes;
-                dst += nptes * RADEON_GPU_PAGE_SIZE;
-        }
-
-        if (count) {
-                radeon_asic_vm_set_page(rdev, ib, last_pte,
-                                        last_dst, count,
-                                        RADEON_GPU_PAGE_SIZE, flags);
-        }
-}
-
-/**
- * radeon_vm_bo_update - map a bo into the vm page table
- *
- * @rdev: radeon_device pointer
- * @vm: requested vm
- * @bo: radeon buffer object
- * @mem: ttm mem
- *
- * Fill in the page table entries for @bo (cayman+).
- * Returns 0 for success, -EINVAL for failure.
- *
- * Object have to be reserved & global and local mutex must be locked!
- */
-int radeon_vm_bo_update(struct radeon_device *rdev,
-                        struct radeon_vm *vm,
-                        struct radeon_bo *bo,
-                        struct ttm_mem_reg *mem)
-{
-        struct radeon_ib ib;
-        struct radeon_bo_va *bo_va;
-        unsigned nptes, npdes, ndw;
-        uint64_t addr;
-        int r;
-
-        /* nothing to do if vm isn't bound */
-        if (vm->page_directory == NULL)
-                return 0;
-
-        bo_va = radeon_vm_bo_find(vm, bo);
-        if (bo_va == NULL) {
-                dev_err(rdev->dev, "bo %p not in vm %p\n", bo, vm);
-                return -EINVAL;
-        }
-
-        if (!bo_va->soffset) {
-                dev_err(rdev->dev, "bo %p don't has a mapping in vm %p\n",
-                        bo, vm);
-                return -EINVAL;
-        }
-
-        if ((bo_va->valid && mem) || (!bo_va->valid && mem == NULL))
-                return 0;
-
-        bo_va->flags &= ~RADEON_VM_PAGE_VALID;
-        bo_va->flags &= ~RADEON_VM_PAGE_SYSTEM;
-        if (mem) {
-                addr = mem->start << PAGE_SHIFT;
-                if (mem->mem_type != TTM_PL_SYSTEM) {
-                        bo_va->flags |= RADEON_VM_PAGE_VALID;
-                        bo_va->valid = true;
-                }
-                if (mem->mem_type == TTM_PL_TT) {
-                        bo_va->flags |= RADEON_VM_PAGE_SYSTEM;
-                } else {
-                        addr += rdev->vm_manager.vram_base_offset;
-                }
-        } else {
-                addr = 0;
-                bo_va->valid = false;
-        }
-
-        trace_radeon_vm_bo_update(bo_va);
-
-        nptes = radeon_bo_ngpu_pages(bo);
-
-        /* assume two extra pdes in case the mapping overlaps the borders */
-        npdes = (nptes >> RADEON_VM_BLOCK_SIZE) + 2;
-
-        /* padding, etc. */
-        ndw = 64;
-
-        if (RADEON_VM_BLOCK_SIZE > 11)
-                /* reserve space for one header for every 2k dwords */
-                ndw += (nptes >> 11) * 4;
-        else
-                /* reserve space for one header for
-                    every (1 << BLOCK_SIZE) entries */
-                ndw += (nptes >> RADEON_VM_BLOCK_SIZE) * 4;
-
-        /* reserve space for pte addresses */
-        ndw += nptes * 2;
-
-        /* reserve space for one header for every 2k dwords */
-        ndw += (npdes >> 11) * 4;
-
-        /* reserve space for pde addresses */
-        ndw += npdes * 2;
-
-        /* reserve space for clearing new page tables */
-        ndw += npdes * 2 * RADEON_VM_PTE_COUNT;
-
-        /* update too big for an IB */
-        if (ndw > 0xfffff)
-                return -ENOMEM;
-
-        r = radeon_ib_get(rdev, R600_RING_TYPE_DMA_INDEX, &ib, NULL, ndw * 4);
-        if (r)
-                return r;
-        ib.length_dw = 0;
-
-        r = radeon_vm_update_pdes(rdev, vm, &ib, bo_va->soffset, bo_va->eoffset);
-        if (r) {
-                radeon_ib_free(rdev, &ib);
-                return r;
-        }
-
-        radeon_vm_update_ptes(rdev, vm, &ib, bo_va->soffset, bo_va->eoffset,
-                              addr, radeon_vm_page_flags(bo_va->flags));
-
-        radeon_semaphore_sync_to(ib.semaphore, vm->fence);
-        r = radeon_ib_schedule(rdev, &ib, NULL);
-        if (r) {
-                radeon_ib_free(rdev, &ib);
-                return r;
-        }
-        radeon_fence_unref(&vm->fence);
-        vm->fence = radeon_fence_ref(ib.fence);
-        radeon_ib_free(rdev, &ib);
-        radeon_fence_unref(&vm->last_flush);
-
-        return 0;
-}
-
-/**
- * radeon_vm_bo_rmv - remove a bo to a specific vm
- *
- * @rdev: radeon_device pointer
- * @bo_va: requested bo_va
- *
- * Remove @bo_va->bo from the requested vm (cayman+).
- * Remove @bo_va->bo from the list of bos associated with the bo_va->vm and
- * remove the ptes for @bo_va in the page table.
- * Returns 0 for success.
- *
- * Object have to be reserved!
- */
-int radeon_vm_bo_rmv(struct radeon_device *rdev,
-                     struct radeon_bo_va *bo_va)
-{
-        int r = 0;
-
-        mutex_lock(&rdev->vm_manager.lock);
-        mutex_lock(&bo_va->vm->mutex);
-        if (bo_va->soffset) {
-                r = radeon_vm_bo_update(rdev, bo_va->vm, bo_va->bo, NULL);
-        }
-        mutex_unlock(&rdev->vm_manager.lock);
-        list_del(&bo_va->vm_list);
-        mutex_unlock(&bo_va->vm->mutex);
-        list_del(&bo_va->bo_list);
-
-        kfree(bo_va);
-        return r;
-}
-
-/**
- * radeon_vm_bo_invalidate - mark the bo as invalid
- *
- * @rdev: radeon_device pointer
- * @vm: requested vm
- * @bo: radeon buffer object
- *
- * Mark @bo as invalid (cayman+).
- */
-void radeon_vm_bo_invalidate(struct radeon_device *rdev,
-                             struct radeon_bo *bo)
-{
-        struct radeon_bo_va *bo_va;
-
-        list_for_each_entry(bo_va, &bo->va, bo_list) {
-                bo_va->valid = false;
-        }
-}
-
-/**
- * radeon_vm_init - initialize a vm instance
- *
- * @rdev: radeon_device pointer
- * @vm: requested vm
- *
- * Init @vm fields (cayman+).
- */
-void radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
-{
-        vm->id = 0;
-        vm->fence = NULL;
-        vm->last_flush = NULL;
-        vm->last_id_use = NULL;
-        mutex_init(&vm->mutex);
-        INIT_LIST_HEAD(&vm->list);
-        INIT_LIST_HEAD(&vm->va);
-}
-
-/**
- * radeon_vm_fini - tear down a vm instance
- *
- * @rdev: radeon_device pointer
- * @vm: requested vm
- *
- * Tear down @vm (cayman+).
- * Unbind the VM and remove all bos from the vm bo list
- */
-void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
-{
-        struct radeon_bo_va *bo_va, *tmp;
-        int r;
-
-        mutex_lock(&rdev->vm_manager.lock);
-        mutex_lock(&vm->mutex);
-        radeon_vm_free_pt(rdev, vm);
-        mutex_unlock(&rdev->vm_manager.lock);
-
-        if (!list_empty(&vm->va)) {
-                dev_err(rdev->dev, "still active bo inside vm\n");
-        }
-        list_for_each_entry_safe(bo_va, tmp, &vm->va, vm_list) {
-                list_del_init(&bo_va->vm_list);
-                r = radeon_bo_reserve(bo_va->bo, false);
-                if (!r) {
-                        list_del_init(&bo_va->bo_list);
-                        radeon_bo_unreserve(bo_va->bo);
-                        kfree(bo_va);
-                }
-        }
-        radeon_fence_unref(&vm->fence);
-        radeon_fence_unref(&vm->last_flush);
-        radeon_fence_unref(&vm->last_id_use);
-        mutex_unlock(&vm->mutex);
-}
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index b96c819024b3..d09650c1d720 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -344,18 +344,7 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
         }
         robj = gem_to_radeon_bo(gobj);
         r = radeon_bo_wait(robj, &cur_placement, true);
-        switch (cur_placement) {
-        case TTM_PL_VRAM:
-                args->domain = RADEON_GEM_DOMAIN_VRAM;
-                break;
-        case TTM_PL_TT:
-                args->domain = RADEON_GEM_DOMAIN_GTT;
-                break;
-        case TTM_PL_SYSTEM:
-                args->domain = RADEON_GEM_DOMAIN_CPU;
-        default:
-                break;
-        }
+        args->domain = radeon_mem_type_to_domain(cur_placement);
         drm_gem_object_unreference_unlocked(gobj);
         r = radeon_gem_handle_lockup(rdev, r);
         return r;
@@ -533,6 +522,42 @@ out:
         return r;
 }
 
+int radeon_gem_op_ioctl(struct drm_device *dev, void *data,
+                        struct drm_file *filp)
+{
+        struct drm_radeon_gem_op *args = data;
+        struct drm_gem_object *gobj;
+        struct radeon_bo *robj;
+        int r;
+
+        gobj = drm_gem_object_lookup(dev, filp, args->handle);
+        if (gobj == NULL) {
+                return -ENOENT;
+        }
+        robj = gem_to_radeon_bo(gobj);
+        r = radeon_bo_reserve(robj, false);
+        if (unlikely(r))
+                goto out;
+
+        switch (args->op) {
+        case RADEON_GEM_OP_GET_INITIAL_DOMAIN:
+                args->value = robj->initial_domain;
+                break;
+        case RADEON_GEM_OP_SET_INITIAL_DOMAIN:
+                robj->initial_domain = args->value & (RADEON_GEM_DOMAIN_VRAM |
+                                                      RADEON_GEM_DOMAIN_GTT |
+                                                      RADEON_GEM_DOMAIN_CPU);
+                break;
+        default:
+                r = -EINVAL;
+        }
+
+        radeon_bo_unreserve(robj);
+out:
+        drm_gem_object_unreference_unlocked(gobj);
+        return r;
+}
+
 int radeon_mode_dumb_create(struct drm_file *file_priv,
                             struct drm_device *dev,
                             struct drm_mode_create_dumb *args)
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 2aecd6dc2610..6f1dfac17507 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -33,6 +33,13 @@
 #include <linux/vga_switcheroo.h>
 #include <linux/slab.h>
 #include <linux/pm_runtime.h>
+
+#if defined(CONFIG_VGA_SWITCHEROO)
+bool radeon_is_px(void);
+#else
+static inline bool radeon_is_px(void) { return false; }
+#endif
+
 /**
  * radeon_driver_unload_kms - Main unload function for KMS.
  *
@@ -130,7 +137,8 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
                                 "Error during ACPI methods call\n");
         }
 
-        if (radeon_runtime_pm != 0) {
+        if ((radeon_runtime_pm == 1) ||
+            ((radeon_runtime_pm == -1) && radeon_is_px())) {
                 pm_runtime_use_autosuspend(dev->dev);
                 pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                 pm_runtime_set_active(dev->dev);
@@ -433,6 +441,9 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                 case RADEON_CS_RING_UVD:
                         *value = rdev->ring[R600_RING_TYPE_UVD_INDEX].ready;
                         break;
+                case RADEON_CS_RING_VCE:
+                        *value = rdev->ring[TN_RING_TYPE_VCE1_INDEX].ready;
+                        break;
                 default:
                         return -EINVAL;
                 }
@@ -477,6 +488,27 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                 else
                         *value = rdev->pm.default_sclk * 10;
                 break;
+        case RADEON_INFO_VCE_FW_VERSION:
+                *value = rdev->vce.fw_version;
+                break;
+        case RADEON_INFO_VCE_FB_VERSION:
+                *value = rdev->vce.fb_version;
+                break;
+        case RADEON_INFO_NUM_BYTES_MOVED:
+                value = (uint32_t*)&value64;
+                value_size = sizeof(uint64_t);
+                value64 = atomic64_read(&rdev->num_bytes_moved);
+                break;
+        case RADEON_INFO_VRAM_USAGE:
+                value = (uint32_t*)&value64;
+                value_size = sizeof(uint64_t);
+                value64 = atomic64_read(&rdev->vram_usage);
+                break;
+        case RADEON_INFO_GTT_USAGE:
+                value = (uint32_t*)&value64;
+                value_size = sizeof(uint64_t);
+                value64 = atomic64_read(&rdev->gtt_usage);
+                break;
         default:
                 DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                 return -EINVAL;
@@ -535,7 +567,13 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                         return -ENOMEM;
                 }
 
-                radeon_vm_init(rdev, &fpriv->vm);
+                r = radeon_vm_init(rdev, &fpriv->vm);
+                if (r)
+                        return r;
+
+                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                if (r)
+                        return r;
 
                 r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
                 if (r)
@@ -616,6 +654,7 @@ void radeon_driver_preclose_kms(struct drm_device *dev,
         if (rdev->cmask_filp == file_priv)
                 rdev->cmask_filp = NULL;
         radeon_uvd_free_handles(rdev, file_priv);
+        radeon_vce_free_handles(rdev, file_priv);
 }
 
 /*
@@ -810,5 +849,6 @@ const struct drm_ioctl_desc radeon_ioctls_kms[] = {
         DRM_IOCTL_DEF_DRV(RADEON_GEM_GET_TILING, radeon_gem_get_tiling_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
         DRM_IOCTL_DEF_DRV(RADEON_GEM_BUSY, radeon_gem_busy_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
         DRM_IOCTL_DEF_DRV(RADEON_GEM_VA, radeon_gem_va_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
+        DRM_IOCTL_DEF_DRV(RADEON_GEM_OP, radeon_gem_op_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
 };
 int radeon_max_kms_ioctl = DRM_ARRAY_SIZE(radeon_ioctls_kms);
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 08595cf90b01..1375ff85b08a 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -56,11 +56,36 @@ static void radeon_bo_clear_va(struct radeon_bo *bo)
         }
 }
 
+static void radeon_update_memory_usage(struct radeon_bo *bo,
+                                       unsigned mem_type, int sign)
+{
+        struct radeon_device *rdev = bo->rdev;
+        u64 size = (u64)bo->tbo.num_pages << PAGE_SHIFT;
+
+        switch (mem_type) {
+        case TTM_PL_TT:
+                if (sign > 0)
+                        atomic64_add(size, &rdev->gtt_usage);
+                else
+                        atomic64_sub(size, &rdev->gtt_usage);
+                break;
+        case TTM_PL_VRAM:
+                if (sign > 0)
+                        atomic64_add(size, &rdev->vram_usage);
+                else
+                        atomic64_sub(size, &rdev->vram_usage);
+                break;
+        }
+}
+
 static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
 {
         struct radeon_bo *bo;
 
         bo = container_of(tbo, struct radeon_bo, tbo);
+
+        radeon_update_memory_usage(bo, bo->tbo.mem.mem_type, -1);
+
         mutex_lock(&bo->rdev->gem.mutex);
         list_del_init(&bo->list);
         mutex_unlock(&bo->rdev->gem.mutex);
@@ -120,7 +145,6 @@ int radeon_bo_create(struct radeon_device *rdev,
 
         size = ALIGN(size, PAGE_SIZE);
 
-        rdev->mman.bdev.dev_mapping = rdev->ddev->dev_mapping;
         if (kernel) {
                 type = ttm_bo_type_kernel;
         } else if (sg) {
@@ -145,6 +169,9 @@ int radeon_bo_create(struct radeon_device *rdev,
         bo->surface_reg = -1;
         INIT_LIST_HEAD(&bo->list);
         INIT_LIST_HEAD(&bo->va);
+        bo->initial_domain = domain & (RADEON_GEM_DOMAIN_VRAM |
+                                       RADEON_GEM_DOMAIN_GTT |
+                                       RADEON_GEM_DOMAIN_CPU);
         radeon_ttm_placement_from_domain(bo, domain);
         /* Kernel allocation are uninterruptible */
         down_read(&rdev->pm.mclk_lock);
@@ -338,39 +365,105 @@ void radeon_bo_fini(struct radeon_device *rdev)
         arch_phys_wc_del(rdev->mc.vram_mtrr);
 }
 
-void radeon_bo_list_add_object(struct radeon_bo_list *lobj,
-                                struct list_head *head)
+/* Returns how many bytes TTM can move per IB.
+ */
+static u64 radeon_bo_get_threshold_for_moves(struct radeon_device *rdev)
 {
-        if (lobj->written) {
-                list_add(&lobj->tv.head, head);
-        } else {
-                list_add_tail(&lobj->tv.head, head);
-        }
+        u64 real_vram_size = rdev->mc.real_vram_size;
+        u64 vram_usage = atomic64_read(&rdev->vram_usage);
+
+        /* This function is based on the current VRAM usage.
+         *
+         * - If all of VRAM is free, allow relocating the number of bytes that
+         *   is equal to 1/4 of the size of VRAM for this IB.
+
+         * - If more than one half of VRAM is occupied, only allow relocating
+         *   1 MB of data for this IB.
+         *
+         * - From 0 to one half of used VRAM, the threshold decreases
+         *   linearly.
+         *         __________________
+         * 1/4 of -|\               |
+         * VRAM    | \              |
+         *         |  \             |
+         *         |   \            |
+         *         |    \           |
+         *         |     \          |
+         *         |      \         |
+         *         |       \________|1 MB
+         *         |----------------|
+         *    VRAM 0 %             100 %
+         *         used            used
+         *
+         * Note: It's a threshold, not a limit. The threshold must be crossed
+         * for buffer relocations to stop, so any buffer of an arbitrary size
+         * can be moved as long as the threshold isn't crossed before
+         * the relocation takes place. We don't want to disable buffer
+         * relocations completely.
+         *
+         * The idea is that buffers should be placed in VRAM at creation time
+         * and TTM should only do a minimum number of relocations during
+         * command submission. In practice, you need to submit at least
+         * a dozen IBs to move all buffers to VRAM if they are in GTT.
+         *
+         * Also, things can get pretty crazy under memory pressure and actual
+         * VRAM usage can change a lot, so playing safe even at 50% does
+         * consistently increase performance.
+         */
+
+        u64 half_vram = real_vram_size >> 1;
+        u64 half_free_vram = vram_usage >= half_vram ? 0 : half_vram - vram_usage;
+        u64 bytes_moved_threshold = half_free_vram >> 1;
+        return max(bytes_moved_threshold, 1024*1024ull);
 }
 
-int radeon_bo_list_validate(struct ww_acquire_ctx *ticket,
+int radeon_bo_list_validate(struct radeon_device *rdev,
+                            struct ww_acquire_ctx *ticket,
                             struct list_head *head, int ring)
 {
-        struct radeon_bo_list *lobj;
+        struct radeon_cs_reloc *lobj;
         struct radeon_bo *bo;
-        u32 domain;
         int r;
+        u64 bytes_moved = 0, initial_bytes_moved;
+        u64 bytes_moved_threshold = radeon_bo_get_threshold_for_moves(rdev);
 
         r = ttm_eu_reserve_buffers(ticket, head);
         if (unlikely(r != 0)) {
                 return r;
         }
+
         list_for_each_entry(lobj, head, tv.head) {
-                bo = lobj->bo;
+                bo = lobj->robj;
                 if (!bo->pin_count) {
-                        domain = lobj->domain;
-                        
+                        u32 domain = lobj->domain;
+                        u32 current_domain =
+                                radeon_mem_type_to_domain(bo->tbo.mem.mem_type);
+
+                        /* Check if this buffer will be moved and don't move it
+                         * if we have moved too many buffers for this IB already.
+                         *
+                         * Note that this allows moving at least one buffer of
+                         * any size, because it doesn't take the current "bo"
+                         * into account. We don't want to disallow buffer moves
+                         * completely.
+                         */
+                        if (current_domain != RADEON_GEM_DOMAIN_CPU &&
+                            (domain & current_domain) == 0 && /* will be moved */
+                            bytes_moved > bytes_moved_threshold) {
+                                /* don't move it */
+                                domain = current_domain;
+                        }
+
                 retry:
                         radeon_ttm_placement_from_domain(bo, domain);
                         if (ring == R600_RING_TYPE_UVD_INDEX)
                                 radeon_uvd_force_into_uvd_segment(bo);
-                        r = ttm_bo_validate(&bo->tbo, &bo->placement,
-                                                true, false);
+
+                        initial_bytes_moved = atomic64_read(&rdev->num_bytes_moved);
+                        r = ttm_bo_validate(&bo->tbo, &bo->placement, true, false);
+                        bytes_moved += atomic64_read(&rdev->num_bytes_moved) -
+                                       initial_bytes_moved;
+
                         if (unlikely(r)) {
                                 if (r != -ERESTARTSYS && domain != lobj->alt_domain) {
                                         domain = lobj->alt_domain;
@@ -564,14 +657,23 @@ int radeon_bo_check_tiling(struct radeon_bo *bo, bool has_moved,
 }
 
 void radeon_bo_move_notify(struct ttm_buffer_object *bo,
-                           struct ttm_mem_reg *mem)
+                           struct ttm_mem_reg *new_mem)
 {
         struct radeon_bo *rbo;
+
         if (!radeon_ttm_bo_is_radeon_bo(bo))
                 return;
+
         rbo = container_of(bo, struct radeon_bo, tbo);
         radeon_bo_check_tiling(rbo, 0, 1);
         radeon_vm_bo_invalidate(rbo->rdev, rbo);
+
+        /* update statistics */
+        if (!new_mem)
+                return;
+
+        radeon_update_memory_usage(rbo, bo->mem.mem_type, -1);
+        radeon_update_memory_usage(rbo, new_mem->mem_type, 1);
 }
 
 int radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo)
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index 209b11150263..9e7b25a0629d 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -138,9 +138,8 @@ extern int radeon_bo_evict_vram(struct radeon_device *rdev);
 extern void radeon_bo_force_delete(struct radeon_device *rdev);
 extern int radeon_bo_init(struct radeon_device *rdev);
 extern void radeon_bo_fini(struct radeon_device *rdev);
-extern void radeon_bo_list_add_object(struct radeon_bo_list *lobj,
-                                struct list_head *head);
-extern int radeon_bo_list_validate(struct ww_acquire_ctx *ticket,
+extern int radeon_bo_list_validate(struct radeon_device *rdev,
+                                   struct ww_acquire_ctx *ticket,
                                    struct list_head *head, int ring);
 extern int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
                                 struct vm_area_struct *vma);
@@ -151,7 +150,7 @@ extern void radeon_bo_get_tiling_flags(struct radeon_bo *bo,
 extern int radeon_bo_check_tiling(struct radeon_bo *bo, bool has_moved,
                                 bool force_drop);
 extern void radeon_bo_move_notify(struct ttm_buffer_object *bo,
-                                        struct ttm_mem_reg *mem);
+                                  struct ttm_mem_reg *new_mem);
 extern int radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo);
 extern int radeon_bo_get_surface_reg(struct radeon_bo *bo);
 
@@ -181,7 +180,7 @@ extern int radeon_sa_bo_manager_suspend(struct radeon_device *rdev,
 extern int radeon_sa_bo_new(struct radeon_device *rdev,
                             struct radeon_sa_manager *sa_manager,
                             struct radeon_sa_bo **sa_bo,
-                            unsigned size, unsigned align, bool block);
+                            unsigned size, unsigned align);
 extern void radeon_sa_bo_free(struct radeon_device *rdev,
                               struct radeon_sa_bo **sa_bo,
                               struct radeon_fence *fence);
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 8e8153e471c2..ee738a524639 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -260,7 +260,7 @@ static void radeon_pm_set_clocks(struct radeon_device *rdev)
                 if (!ring->ready) {
                         continue;
                 }
-                r = radeon_fence_wait_empty_locked(rdev, i);
+                r = radeon_fence_wait_empty(rdev, i);
                 if (r) {
                         /* needs a GPU reset dont reset here */
                         mutex_unlock(&rdev->ring_lock);
@@ -826,6 +826,9 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
 
         /* no need to reprogram if nothing changed unless we are on BTC+ */
         if (rdev->pm.dpm.current_ps == rdev->pm.dpm.requested_ps) {
+                /* vce just modifies an existing state so force a change */
+                if (ps->vce_active != rdev->pm.dpm.vce_active)
+                        goto force;
                 if ((rdev->family < CHIP_BARTS) || (rdev->flags & RADEON_IS_IGP)) {
                         /* for pre-BTC and APUs if the num crtcs changed but state is the same,
                          * all we need to do is update the display configuration.
@@ -862,16 +865,21 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
                 }
         }
 
+force:
         if (radeon_dpm == 1) {
                 printk("switching from power state:\n");
                 radeon_dpm_print_power_state(rdev, rdev->pm.dpm.current_ps);
                 printk("switching to power state:\n");
                 radeon_dpm_print_power_state(rdev, rdev->pm.dpm.requested_ps);
         }
+
         mutex_lock(&rdev->ddev->struct_mutex);
         down_write(&rdev->pm.mclk_lock);
         mutex_lock(&rdev->ring_lock);
 
+        /* update whether vce is active */
+        ps->vce_active = rdev->pm.dpm.vce_active;
+
         ret = radeon_dpm_pre_set_power_state(rdev);
         if (ret)
                 goto done;
@@ -888,7 +896,7 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
         for (i = 0; i < RADEON_NUM_RINGS; i++) {
                 struct radeon_ring *ring = &rdev->ring[i];
                 if (ring->ready)
-                        radeon_fence_wait_empty_locked(rdev, i);
+                        radeon_fence_wait_empty(rdev, i);
         }
 
         /* program the new power state */
@@ -935,8 +943,6 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
                 if (enable) {
                         mutex_lock(&rdev->pm.mutex);
                         rdev->pm.dpm.uvd_active = true;
-                        /* disable this for now */
-#if 0
                         if ((rdev->pm.dpm.sd == 1) && (rdev->pm.dpm.hd == 0))
                                 dpm_state = POWER_STATE_TYPE_INTERNAL_UVD_SD;
                         else if ((rdev->pm.dpm.sd == 2) && (rdev->pm.dpm.hd == 0))
@@ -946,7 +952,6 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
                         else if ((rdev->pm.dpm.sd == 0) && (rdev->pm.dpm.hd == 2))
                                 dpm_state = POWER_STATE_TYPE_INTERNAL_UVD_HD2;
                         else
-#endif
                                 dpm_state = POWER_STATE_TYPE_INTERNAL_UVD;
                         rdev->pm.dpm.state = dpm_state;
                         mutex_unlock(&rdev->pm.mutex);
@@ -960,6 +965,23 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
         }
 }
 
+void radeon_dpm_enable_vce(struct radeon_device *rdev, bool enable)
+{
+        if (enable) {
+                mutex_lock(&rdev->pm.mutex);
+                rdev->pm.dpm.vce_active = true;
+                /* XXX select vce level based on ring/task */
+                rdev->pm.dpm.vce_level = RADEON_VCE_LEVEL_AC_ALL;
+                mutex_unlock(&rdev->pm.mutex);
+        } else {
+                mutex_lock(&rdev->pm.mutex);
+                rdev->pm.dpm.vce_active = false;
+                mutex_unlock(&rdev->pm.mutex);
+        }
+
+        radeon_pm_compute_clocks(rdev);
+}
+
 static void radeon_pm_suspend_old(struct radeon_device *rdev)
 {
         mutex_lock(&rdev->pm.mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 15e44a7281ab..8b0dfdd23793 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -63,7 +63,7 @@ int radeon_ib_get(struct radeon_device *rdev, int ring,
 {
         int r;
 
-        r = radeon_sa_bo_new(rdev, &rdev->ring_tmp_bo, &ib->sa_bo, size, 256, true);
+        r = radeon_sa_bo_new(rdev, &rdev->ring_tmp_bo, &ib->sa_bo, size, 256);
         if (r) {
                 dev_err(rdev->dev, "failed to get a new IB (%d)\n", r);
                 return r;
@@ -145,6 +145,13 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
                 return r;
         }
 
+        /* grab a vm id if necessary */
+        if (ib->vm) {
+                struct radeon_fence *vm_id_fence;
+                vm_id_fence = radeon_vm_grab_id(rdev, ib->vm, ib->ring);
+                radeon_semaphore_sync_to(ib->semaphore, vm_id_fence);
+        }
+
         /* sync with other rings */
         r = radeon_semaphore_sync_rings(rdev, ib->semaphore, ib->ring);
         if (r) {
@@ -153,11 +160,9 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
                 return r;
         }
 
-        /* if we can't remember our last VM flush then flush now! */
-        /* XXX figure out why we have to flush for every IB */
-        if (ib->vm /*&& !ib->vm->last_flush*/) {
-                radeon_ring_vm_flush(rdev, ib->ring, ib->vm);
-        }
+        if (ib->vm)
+                radeon_vm_flush(rdev, ib->vm, ib->ring);
+
         if (const_ib) {
                 radeon_ring_ib_execute(rdev, const_ib->ring, const_ib);
                 radeon_semaphore_free(rdev, &const_ib->semaphore, NULL);
@@ -172,10 +177,10 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
         if (const_ib) {
                 const_ib->fence = radeon_fence_ref(ib->fence);
         }
-        /* we just flushed the VM, remember that */
-        if (ib->vm && !ib->vm->last_flush) {
-                ib->vm->last_flush = radeon_fence_ref(ib->fence);
-        }
+
+        if (ib->vm)
+                radeon_vm_fence(rdev, ib->vm, ib->fence);
+
         radeon_ring_unlock_commit(rdev, ring);
         return 0;
 }
@@ -342,13 +347,17 @@ bool radeon_ring_supports_scratch_reg(struct radeon_device *rdev,
  */
 void radeon_ring_free_size(struct radeon_device *rdev, struct radeon_ring *ring)
 {
-        ring->rptr = radeon_ring_get_rptr(rdev, ring);
+        uint32_t rptr = radeon_ring_get_rptr(rdev, ring);
+
         /* This works because ring_size is a power of 2 */
-        ring->ring_free_dw = (ring->rptr + (ring->ring_size / 4));
+        ring->ring_free_dw = rptr + (ring->ring_size / 4);
         ring->ring_free_dw -= ring->wptr;
         ring->ring_free_dw &= ring->ptr_mask;
         if (!ring->ring_free_dw) {
+                /* this is an empty ring */
                 ring->ring_free_dw = ring->ring_size / 4;
+                /*  update lockup info to avoid false positive */
+                radeon_ring_lockup_update(rdev, ring);
         }
 }
 
@@ -372,19 +381,13 @@ int radeon_ring_alloc(struct radeon_device *rdev, struct radeon_ring *ring, unsi
         /* Align requested size with padding so unlock_commit can
          * pad safely */
         radeon_ring_free_size(rdev, ring);
-        if (ring->ring_free_dw == (ring->ring_size / 4)) {
-                /* This is an empty ring update lockup info to avoid
-                 * false positive.
-                 */
-                radeon_ring_lockup_update(ring);
-        }
         ndw = (ndw + ring->align_mask) & ~ring->align_mask;
         while (ndw > (ring->ring_free_dw - 1)) {
                 radeon_ring_free_size(rdev, ring);
                 if (ndw < ring->ring_free_dw) {
                         break;
                 }
-                r = radeon_fence_wait_next_locked(rdev, ring->idx);
+                r = radeon_fence_wait_next(rdev, ring->idx);
                 if (r)
                         return r;
         }
@@ -478,39 +481,17 @@ void radeon_ring_unlock_undo(struct radeon_device *rdev, struct radeon_ring *rin
 }
 
 /**
- * radeon_ring_force_activity - add some nop packets to the ring
- *
- * @rdev: radeon_device pointer
- * @ring: radeon_ring structure holding ring information
- *
- * Add some nop packets to the ring to force activity (all asics).
- * Used for lockup detection to see if the rptr is advancing.
- */
-void radeon_ring_force_activity(struct radeon_device *rdev, struct radeon_ring *ring)
-{
-        int r;
-
-        radeon_ring_free_size(rdev, ring);
-        if (ring->rptr == ring->wptr) {
-                r = radeon_ring_alloc(rdev, ring, 1);
-                if (!r) {
-                        radeon_ring_write(ring, ring->nop);
-                        radeon_ring_commit(rdev, ring);
-                }
-        }
-}
-
-/**
  * radeon_ring_lockup_update - update lockup variables
  *
  * @ring: radeon_ring structure holding ring information
  *
  * Update the last rptr value and timestamp (all asics).
  */
-void radeon_ring_lockup_update(struct radeon_ring *ring)
+void radeon_ring_lockup_update(struct radeon_device *rdev,
+                               struct radeon_ring *ring)
 {
-        ring->last_rptr = ring->rptr;
-        ring->last_activity = jiffies;
+        atomic_set(&ring->last_rptr, radeon_ring_get_rptr(rdev, ring));
+        atomic64_set(&ring->last_activity, jiffies_64);
 }
 
 /**
@@ -518,40 +499,23 @@ void radeon_ring_lockup_update(struct radeon_ring *ring)
  * @rdev:       radeon device structure
  * @ring:       radeon_ring structure holding ring information
  *
- * We don't need to initialize the lockup tracking information as we will either
- * have CP rptr to a different value of jiffies wrap around which will force
- * initialization of the lockup tracking informations.
- *
- * A possible false positivie is if we get call after while and last_cp_rptr ==
- * the current CP rptr, even if it's unlikely it might happen. To avoid this
- * if the elapsed time since last call is bigger than 2 second than we return
- * false and update the tracking information. Due to this the caller must call
- * radeon_ring_test_lockup several time in less than 2sec for lockup to be reported
- * the fencing code should be cautious about that.
- *
- * Caller should write to the ring to force CP to do something so we don't get
- * false positive when CP is just gived nothing to do.
- *
- **/
+ */
 bool radeon_ring_test_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
 {
-        unsigned long cjiffies, elapsed;
+        uint32_t rptr = radeon_ring_get_rptr(rdev, ring);
+        uint64_t last = atomic64_read(&ring->last_activity);
+        uint64_t elapsed;
 
-        cjiffies = jiffies;
-        if (!time_after(cjiffies, ring->last_activity)) {
-                /* likely a wrap around */
-                radeon_ring_lockup_update(ring);
+        if (rptr != atomic_read(&ring->last_rptr)) {
+                /* ring is still working, no lockup */
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        ring->rptr = radeon_ring_get_rptr(rdev, ring);
-        if (ring->rptr != ring->last_rptr) {
-                /* CP is still working no lockup */
-                radeon_ring_lockup_update(ring);
-                return false;
-        }
-        elapsed = jiffies_to_msecs(cjiffies - ring->last_activity);
+
+        elapsed = jiffies_to_msecs(jiffies_64 - last);
         if (radeon_lockup_timeout && elapsed >= radeon_lockup_timeout) {
-                dev_err(rdev->dev, "GPU lockup CP stall for more than %lumsec\n", elapsed);
+                dev_err(rdev->dev, "ring %d stalled for more than %llumsec\n",
+                        ring->idx, elapsed);
                 return true;
         }
         /* give a chance to the GPU ... */
@@ -709,7 +673,7 @@ int radeon_ring_init(struct radeon_device *rdev, struct radeon_ring *ring, unsig
         if (radeon_debugfs_ring_init(rdev, ring)) {
                 DRM_ERROR("Failed to register debugfs file for rings !\n");
         }
-        radeon_ring_lockup_update(ring);
+        radeon_ring_lockup_update(rdev, ring);
         return 0;
 }
 
@@ -780,8 +744,6 @@ static int radeon_debugfs_ring_info(struct seq_file *m, void *data)
 
         seq_printf(m, "driver's copy of the wptr: 0x%08x [%5d]\n",
                    ring->wptr, ring->wptr);
-        seq_printf(m, "driver's copy of the rptr: 0x%08x [%5d]\n",
-                   ring->rptr, ring->rptr);
         seq_printf(m, "last semaphore signal addr : 0x%016llx\n",
                    ring->last_semaphore_signal_addr);
         seq_printf(m, "last semaphore wait addr   : 0x%016llx\n",
@@ -814,6 +776,8 @@ static int cayman_cp2_index = CAYMAN_RING_TYPE_CP2_INDEX;
 static int radeon_dma1_index = R600_RING_TYPE_DMA_INDEX;
 static int radeon_dma2_index = CAYMAN_RING_TYPE_DMA1_INDEX;
 static int r600_uvd_index = R600_RING_TYPE_UVD_INDEX;
+static int si_vce1_index = TN_RING_TYPE_VCE1_INDEX;
+static int si_vce2_index = TN_RING_TYPE_VCE2_INDEX;
 
 static struct drm_info_list radeon_debugfs_ring_info_list[] = {
         {"radeon_ring_gfx", radeon_debugfs_ring_info, 0, &radeon_gfx_index},
@@ -822,6 +786,8 @@ static struct drm_info_list radeon_debugfs_ring_info_list[] = {
         {"radeon_ring_dma1", radeon_debugfs_ring_info, 0, &radeon_dma1_index},
         {"radeon_ring_dma2", radeon_debugfs_ring_info, 0, &radeon_dma2_index},
         {"radeon_ring_uvd", radeon_debugfs_ring_info, 0, &r600_uvd_index},
+        {"radeon_ring_vce1", radeon_debugfs_ring_info, 0, &si_vce1_index},
+        {"radeon_ring_vce2", radeon_debugfs_ring_info, 0, &si_vce2_index},
 };
 
 static int radeon_debugfs_sa_info(struct seq_file *m, void *data)
diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
index c0625805cdd7..adcf3e2f07da 100644
--- a/drivers/gpu/drm/radeon/radeon_sa.c
+++ b/drivers/gpu/drm/radeon/radeon_sa.c
@@ -312,7 +312,7 @@ static bool radeon_sa_bo_next_hole(struct radeon_sa_manager *sa_manager,
 int radeon_sa_bo_new(struct radeon_device *rdev,
                      struct radeon_sa_manager *sa_manager,
                      struct radeon_sa_bo **sa_bo,
-                     unsigned size, unsigned align, bool block)
+                     unsigned size, unsigned align)
 {
         struct radeon_fence *fences[RADEON_NUM_RINGS];
         unsigned tries[RADEON_NUM_RINGS];
@@ -353,14 +353,11 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
                 r = radeon_fence_wait_any(rdev, fences, false);
                 spin_lock(&sa_manager->wq.lock);
                 /* if we have nothing to wait for block */
-                if (r == -ENOENT && block) {
+                if (r == -ENOENT) {
                         r = wait_event_interruptible_locked(
                                 sa_manager->wq, 
                                 radeon_sa_event(sa_manager, size, align)
                         );
-
-                } else if (r == -ENOENT) {
-                        r = -ENOMEM;
                 }
 
         } while (!r);
diff --git a/drivers/gpu/drm/radeon/radeon_semaphore.c b/drivers/gpu/drm/radeon/radeon_semaphore.c
index 9006b32d5eed..dbd6bcde92de 100644
--- a/drivers/gpu/drm/radeon/radeon_semaphore.c
+++ b/drivers/gpu/drm/radeon/radeon_semaphore.c
@@ -42,7 +42,7 @@ int radeon_semaphore_create(struct radeon_device *rdev,
                 return -ENOMEM;
         }
         r = radeon_sa_bo_new(rdev, &rdev->ring_tmp_bo, &(*semaphore)->sa_bo,
-                             8 * RADEON_NUM_SYNCS, 8, true);
+                             8 * RADEON_NUM_SYNCS, 8);
         if (r) {
                 kfree(*semaphore);
                 *semaphore = NULL;
@@ -147,7 +147,9 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
 
                 if (++count > RADEON_NUM_SYNCS) {
                         /* not enough room, wait manually */
-                        radeon_fence_wait_locked(fence);
+                        r = radeon_fence_wait(fence, false);
+                        if (r)
+                                return r;
                         continue;
                 }
 
@@ -161,7 +163,9 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                 if (!radeon_semaphore_emit_signal(rdev, i, semaphore)) {
                         /* signaling wasn't successful wait manually */
                         radeon_ring_undo(&rdev->ring[i]);
-                        radeon_fence_wait_locked(fence);
+                        r = radeon_fence_wait(fence, false);
+                        if (r)
+                                return r;
                         continue;
                 }
 
@@ -169,7 +173,9 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                 if (!radeon_semaphore_emit_wait(rdev, ring, semaphore)) {
                         /* waiting wasn't successful wait manually */
                         radeon_ring_undo(&rdev->ring[i]);
-                        radeon_fence_wait_locked(fence);
+                        r = radeon_fence_wait(fence, false);
+                        if (r)
+                                return r;
                         continue;
                 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index 12e8099a0823..3a13e0d1055c 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -257,20 +257,36 @@ static int radeon_test_create_and_emit_fence(struct radeon_device *rdev,
                                              struct radeon_ring *ring,
                                              struct radeon_fence **fence)
 {
+        uint32_t handle = ring->idx ^ 0xdeafbeef;
         int r;
 
         if (ring->idx == R600_RING_TYPE_UVD_INDEX) {
-                r = radeon_uvd_get_create_msg(rdev, ring->idx, 1, NULL);
+                r = radeon_uvd_get_create_msg(rdev, ring->idx, handle, NULL);
                 if (r) {
                         DRM_ERROR("Failed to get dummy create msg\n");
                         return r;
                 }
 
-                r = radeon_uvd_get_destroy_msg(rdev, ring->idx, 1, fence);
+                r = radeon_uvd_get_destroy_msg(rdev, ring->idx, handle, fence);
                 if (r) {
                         DRM_ERROR("Failed to get dummy destroy msg\n");
                         return r;
                 }
+
+        } else if (ring->idx == TN_RING_TYPE_VCE1_INDEX ||
+                   ring->idx == TN_RING_TYPE_VCE2_INDEX) {
+                r = radeon_vce_get_create_msg(rdev, ring->idx, handle, NULL);
+                if (r) {
+                        DRM_ERROR("Failed to get dummy create msg\n");
+                        return r;
+                }
+
+                r = radeon_vce_get_destroy_msg(rdev, ring->idx, handle, fence);
+                if (r) {
+                        DRM_ERROR("Failed to get dummy destroy msg\n");
+                        return r;
+                }
+
         } else {
                 r = radeon_ring_lock(rdev, ring, 64);
                 if (r) {
@@ -486,6 +502,16 @@ out_cleanup:
                 printk(KERN_WARNING "Error while testing ring sync (%d).\n", r);
 }
 
+static bool radeon_test_sync_possible(struct radeon_ring *ringA,
+                                      struct radeon_ring *ringB)
+{
+        if (ringA->idx == TN_RING_TYPE_VCE2_INDEX &&
+            ringB->idx == TN_RING_TYPE_VCE1_INDEX)
+                return false;
+
+        return true;
+}
+
 void radeon_test_syncing(struct radeon_device *rdev)
 {
         int i, j, k;
@@ -500,6 +526,9 @@ void radeon_test_syncing(struct radeon_device *rdev)
                         if (!ringB->ready)
                                 continue;
 
+                        if (!radeon_test_sync_possible(ringA, ringB))
+                                continue;
+
                         DRM_INFO("Testing syncing between rings %d and %d...\n", i, j);
                         radeon_test_ring_sync(rdev, ringA, ringB);
 
@@ -511,6 +540,12 @@ void radeon_test_syncing(struct radeon_device *rdev)
                                 if (!ringC->ready)
                                         continue;
 
+                                if (!radeon_test_sync_possible(ringA, ringC))
+                                        continue;
+
+                                if (!radeon_test_sync_possible(ringB, ringC))
+                                        continue;
+
                                 DRM_INFO("Testing syncing between rings %d, %d and %d...\n", i, j, k);
                                 radeon_test_ring_sync2(rdev, ringA, ringB, ringC);
 
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 040a2a10ea17..c8a8a5144ec1 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -406,8 +406,14 @@ static int radeon_bo_move(struct ttm_buffer_object *bo,
         if (r) {
 memcpy:
                 r = ttm_bo_move_memcpy(bo, evict, no_wait_gpu, new_mem);
+                if (r) {
+                        return r;
+                }
         }
-        return r;
+
+        /* update statistics */
+        atomic64_add((u64)bo->num_pages << PAGE_SHIFT, &rdev->num_bytes_moved);
+        return 0;
 }
 
 static int radeon_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *mem)
@@ -701,7 +707,9 @@ int radeon_ttm_init(struct radeon_device *rdev)
         /* No others user of address space so set it to 0 */
         r = ttm_bo_device_init(&rdev->mman.bdev,
                                rdev->mman.bo_global_ref.ref.object,
-                               &radeon_bo_driver, DRM_FILE_PAGE_OFFSET,
+                               &radeon_bo_driver,
+                               rdev->ddev->anon_inode->i_mapping,
+                               DRM_FILE_PAGE_OFFSET,
                                rdev->need_dma32);
         if (r) {
                 DRM_ERROR("failed initializing buffer object driver(%d).\n", r);
@@ -742,7 +750,6 @@ int radeon_ttm_init(struct radeon_device *rdev)
         }
         DRM_INFO("radeon: %uM of GTT memory ready.\n",
                  (unsigned)(rdev->mc.gtt_size / (1024 * 1024)));
-        rdev->mman.bdev.dev_mapping = rdev->ddev->dev_mapping;
 
         r = radeon_ttm_debugfs_init(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 3e6804b2b2ef..5748bdaeacce 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -455,7 +455,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
         }
 
         reloc = p->relocs_ptr[(idx / 4)];
-        start = reloc->lobj.gpu_offset;
+        start = reloc->gpu_offset;
         end = start + radeon_bo_size(reloc->robj);
         start += offset;
 
@@ -807,8 +807,7 @@ void radeon_uvd_note_usage(struct radeon_device *rdev)
                     (rdev->pm.dpm.hd != hd)) {
                         rdev->pm.dpm.sd = sd;
                         rdev->pm.dpm.hd = hd;
-                        /* disable this for now */
-                        /*streams_changed = true;*/
+                        streams_changed = true;
                 }
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
new file mode 100644
index 000000000000..76e9904bc537
--- /dev/null
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -0,0 +1,699 @@
+/*
+ * Copyright 2013 Advanced Micro Devices, Inc.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * Authors: Christian König <christian.koenig@amd.com>
+ */
+
+#include <linux/firmware.h>
+#include <linux/module.h>
+#include <drm/drmP.h>
+#include <drm/drm.h>
+
+#include "radeon.h"
+#include "radeon_asic.h"
+#include "sid.h"
+
+/* 1 second timeout */
+#define VCE_IDLE_TIMEOUT_MS     1000
+
+/* Firmware Names */
+#define FIRMWARE_BONAIRE        "radeon/BONAIRE_vce.bin"
+
+MODULE_FIRMWARE(FIRMWARE_BONAIRE);
+
+static void radeon_vce_idle_work_handler(struct work_struct *work);
+
+/**
+ * radeon_vce_init - allocate memory, load vce firmware
+ *
+ * @rdev: radeon_device pointer
+ *
+ * First step to get VCE online, allocate memory and load the firmware
+ */
+int radeon_vce_init(struct radeon_device *rdev)
+{
+        static const char *fw_version = "[ATI LIB=VCEFW,";
+        static const char *fb_version = "[ATI LIB=VCEFWSTATS,";
+        unsigned long size;
+        const char *fw_name, *c;
+        uint8_t start, mid, end;
+        int i, r;
+
+        INIT_DELAYED_WORK(&rdev->vce.idle_work, radeon_vce_idle_work_handler);
+
+        switch (rdev->family) {
+        case CHIP_BONAIRE:
+        case CHIP_KAVERI:
+        case CHIP_KABINI:
+                fw_name = FIRMWARE_BONAIRE;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        r = request_firmware(&rdev->vce_fw, fw_name, rdev->dev);
+        if (r) {
+                dev_err(rdev->dev, "radeon_vce: Can't load firmware \"%s\"\n",
+                        fw_name);
+                return r;
+        }
+
+        /* search for firmware version */
+
+        size = rdev->vce_fw->size - strlen(fw_version) - 9;
+        c = rdev->vce_fw->data;
+        for (;size > 0; --size, ++c)
+                if (strncmp(c, fw_version, strlen(fw_version)) == 0)
+                        break;
+
+        if (size == 0)
+                return -EINVAL;
+
+        c += strlen(fw_version);
+        if (sscanf(c, "%2hhd.%2hhd.%2hhd]", &start, &mid, &end) != 3)
+                return -EINVAL;
+
+        /* search for feedback version */
+
+        size = rdev->vce_fw->size - strlen(fb_version) - 3;
+        c = rdev->vce_fw->data;
+        for (;size > 0; --size, ++c)
+                if (strncmp(c, fb_version, strlen(fb_version)) == 0)
+                        break;
+
+        if (size == 0)
+                return -EINVAL;
+
+        c += strlen(fb_version);
+        if (sscanf(c, "%2u]", &rdev->vce.fb_version) != 1)
+                return -EINVAL;
+
+        DRM_INFO("Found VCE firmware/feedback version %hhd.%hhd.%hhd / %d!\n",
+                 start, mid, end, rdev->vce.fb_version);
+
+        rdev->vce.fw_version = (start << 24) | (mid << 16) | (end << 8);
+
+        /* we can only work with this fw version for now */
+        if (rdev->vce.fw_version != ((40 << 24) | (2 << 16) | (2 << 8)))
+                return -EINVAL;
+
+        /* allocate firmware, stack and heap BO */
+
+        size = RADEON_GPU_PAGE_ALIGN(rdev->vce_fw->size) +
+               RADEON_VCE_STACK_SIZE + RADEON_VCE_HEAP_SIZE;
+        r = radeon_bo_create(rdev, size, PAGE_SIZE, true,
+                             RADEON_GEM_DOMAIN_VRAM, NULL, &rdev->vce.vcpu_bo);
+        if (r) {
+                dev_err(rdev->dev, "(%d) failed to allocate VCE bo\n", r);
+                return r;
+        }
+
+        r = radeon_bo_reserve(rdev->vce.vcpu_bo, false);
+        if (r) {
+                radeon_bo_unref(&rdev->vce.vcpu_bo);
+                dev_err(rdev->dev, "(%d) failed to reserve VCE bo\n", r);
+                return r;
+        }
+
+        r = radeon_bo_pin(rdev->vce.vcpu_bo, RADEON_GEM_DOMAIN_VRAM,
+                          &rdev->vce.gpu_addr);
+        radeon_bo_unreserve(rdev->vce.vcpu_bo);
+        if (r) {
+                radeon_bo_unref(&rdev->vce.vcpu_bo);
+                dev_err(rdev->dev, "(%d) VCE bo pin failed\n", r);
+                return r;
+        }
+
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+                atomic_set(&rdev->vce.handles[i], 0);
+                rdev->vce.filp[i] = NULL;
+        }
+
+        return 0;
+}
+
+/**
+ * radeon_vce_fini - free memory
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Last step on VCE teardown, free firmware memory
+ */
+void radeon_vce_fini(struct radeon_device *rdev)
+{
+        if (rdev->vce.vcpu_bo == NULL)
+                return;
+
+        radeon_bo_unref(&rdev->vce.vcpu_bo);
+
+        release_firmware(rdev->vce_fw);
+}
+
+/**
+ * radeon_vce_suspend - unpin VCE fw memory
+ *
+ * @rdev: radeon_device pointer
+ *
+ */
+int radeon_vce_suspend(struct radeon_device *rdev)
+{
+        int i;
+
+        if (rdev->vce.vcpu_bo == NULL)
+                return 0;
+
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i)
+                if (atomic_read(&rdev->vce.handles[i]))
+                        break;
+
+        if (i == RADEON_MAX_VCE_HANDLES)
+                return 0;
+
+        /* TODO: suspending running encoding sessions isn't supported */
+        return -EINVAL;
+}
+
+/**
+ * radeon_vce_resume - pin VCE fw memory
+ *
+ * @rdev: radeon_device pointer
+ *
+ */
+int radeon_vce_resume(struct radeon_device *rdev)
+{
+        void *cpu_addr;
+        int r;
+
+        if (rdev->vce.vcpu_bo == NULL)
+                return -EINVAL;
+
+        r = radeon_bo_reserve(rdev->vce.vcpu_bo, false);
+        if (r) {
+                dev_err(rdev->dev, "(%d) failed to reserve VCE bo\n", r);
+                return r;
+        }
+
+        r = radeon_bo_kmap(rdev->vce.vcpu_bo, &cpu_addr);
+        if (r) {
+                radeon_bo_unreserve(rdev->vce.vcpu_bo);
+                dev_err(rdev->dev, "(%d) VCE map failed\n", r);
+                return r;
+        }
+
+        memcpy(cpu_addr, rdev->vce_fw->data, rdev->vce_fw->size);
+
+        radeon_bo_kunmap(rdev->vce.vcpu_bo);
+
+        radeon_bo_unreserve(rdev->vce.vcpu_bo);
+
+        return 0;
+}
+
+/**
+ * radeon_vce_idle_work_handler - power off VCE
+ *
+ * @work: pointer to work structure
+ *
+ * power of VCE when it's not used any more
+ */
+static void radeon_vce_idle_work_handler(struct work_struct *work)
+{
+        struct radeon_device *rdev =
+                container_of(work, struct radeon_device, vce.idle_work.work);
+
+        if ((radeon_fence_count_emitted(rdev, TN_RING_TYPE_VCE1_INDEX) == 0) &&
+            (radeon_fence_count_emitted(rdev, TN_RING_TYPE_VCE2_INDEX) == 0)) {
+                if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
+                        radeon_dpm_enable_vce(rdev, false);
+                } else {
+                        radeon_set_vce_clocks(rdev, 0, 0);
+                }
+        } else {
+                schedule_delayed_work(&rdev->vce.idle_work,
+                                      msecs_to_jiffies(VCE_IDLE_TIMEOUT_MS));
+        }
+}
+
+/**
+ * radeon_vce_note_usage - power up VCE
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Make sure VCE is powerd up when we want to use it
+ */
+void radeon_vce_note_usage(struct radeon_device *rdev)
+{
+        bool streams_changed = false;
+        bool set_clocks = !cancel_delayed_work_sync(&rdev->vce.idle_work);
+        set_clocks &= schedule_delayed_work(&rdev->vce.idle_work,
+                                            msecs_to_jiffies(VCE_IDLE_TIMEOUT_MS));
+
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
+                /* XXX figure out if the streams changed */
+                streams_changed = false;
+        }
+
+        if (set_clocks || streams_changed) {
+                if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
+                        radeon_dpm_enable_vce(rdev, true);
+                } else {
+                        radeon_set_vce_clocks(rdev, 53300, 40000);
+                }
+        }
+}
+
+/**
+ * radeon_vce_free_handles - free still open VCE handles
+ *
+ * @rdev: radeon_device pointer
+ * @filp: drm file pointer
+ *
+ * Close all VCE handles still open by this file pointer
+ */
+void radeon_vce_free_handles(struct radeon_device *rdev, struct drm_file *filp)
+{
+        int i, r;
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+                uint32_t handle = atomic_read(&rdev->vce.handles[i]);
+                if (!handle || rdev->vce.filp[i] != filp)
+                        continue;
+
+                radeon_vce_note_usage(rdev);
+
+                r = radeon_vce_get_destroy_msg(rdev, TN_RING_TYPE_VCE1_INDEX,
+                                               handle, NULL);
+                if (r)
+                        DRM_ERROR("Error destroying VCE handle (%d)!\n", r);
+
+                rdev->vce.filp[i] = NULL;
+                atomic_set(&rdev->vce.handles[i], 0);
+        }
+}
+
+/**
+ * radeon_vce_get_create_msg - generate a VCE create msg
+ *
+ * @rdev: radeon_device pointer
+ * @ring: ring we should submit the msg to
+ * @handle: VCE session handle to use
+ * @fence: optional fence to return
+ *
+ * Open up a stream for HW test
+ */
+int radeon_vce_get_create_msg(struct radeon_device *rdev, int ring,
+                              uint32_t handle, struct radeon_fence **fence)
+{
+        const unsigned ib_size_dw = 1024;
+        struct radeon_ib ib;
+        uint64_t dummy;
+        int i, r;
+
+        r = radeon_ib_get(rdev, ring, &ib, NULL, ib_size_dw * 4);
+        if (r) {
+                DRM_ERROR("radeon: failed to get ib (%d).\n", r);
+                return r;
+        }
+
+        dummy = ib.gpu_addr + 1024;
+
+        /* stitch together an VCE create msg */
+        ib.length_dw = 0;
+        ib.ptr[ib.length_dw++] = 0x0000000c; /* len */
+        ib.ptr[ib.length_dw++] = 0x00000001; /* session cmd */
+        ib.ptr[ib.length_dw++] = handle;
+
+        ib.ptr[ib.length_dw++] = 0x00000030; /* len */
+        ib.ptr[ib.length_dw++] = 0x01000001; /* create cmd */
+        ib.ptr[ib.length_dw++] = 0x00000000;
+        ib.ptr[ib.length_dw++] = 0x00000042;
+        ib.ptr[ib.length_dw++] = 0x0000000a;
+        ib.ptr[ib.length_dw++] = 0x00000001;
+        ib.ptr[ib.length_dw++] = 0x00000080;
+        ib.ptr[ib.length_dw++] = 0x00000060;
+        ib.ptr[ib.length_dw++] = 0x00000100;
+        ib.ptr[ib.length_dw++] = 0x00000100;
+        ib.ptr[ib.length_dw++] = 0x0000000c;
+        ib.ptr[ib.length_dw++] = 0x00000000;
+
+        ib.ptr[ib.length_dw++] = 0x00000014; /* len */
+        ib.ptr[ib.length_dw++] = 0x05000005; /* feedback buffer */
+        ib.ptr[ib.length_dw++] = upper_32_bits(dummy);
+        ib.ptr[ib.length_dw++] = dummy;
+        ib.ptr[ib.length_dw++] = 0x00000001;
+
+        for (i = ib.length_dw; i < ib_size_dw; ++i)
+                ib.ptr[i] = 0x0;
+
+        r = radeon_ib_schedule(rdev, &ib, NULL);
+        if (r) {
+                DRM_ERROR("radeon: failed to schedule ib (%d).\n", r);
+        }
+
+        if (fence)
+                *fence = radeon_fence_ref(ib.fence);
+
+        radeon_ib_free(rdev, &ib);
+
+        return r;
+}
+
+/**
+ * radeon_vce_get_destroy_msg - generate a VCE destroy msg
+ *
+ * @rdev: radeon_device pointer
+ * @ring: ring we should submit the msg to
+ * @handle: VCE session handle to use
+ * @fence: optional fence to return
+ *
+ * Close up a stream for HW test or if userspace failed to do so
+ */
+int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
+                               uint32_t handle, struct radeon_fence **fence)
+{
+        const unsigned ib_size_dw = 1024;
+        struct radeon_ib ib;
+        uint64_t dummy;
+        int i, r;
+
+        r = radeon_ib_get(rdev, ring, &ib, NULL, ib_size_dw * 4);
+        if (r) {
+                DRM_ERROR("radeon: failed to get ib (%d).\n", r);
+                return r;
+        }
+
+        dummy = ib.gpu_addr + 1024;
+
+        /* stitch together an VCE destroy msg */
+        ib.length_dw = 0;
+        ib.ptr[ib.length_dw++] = 0x0000000c; /* len */
+        ib.ptr[ib.length_dw++] = 0x00000001; /* session cmd */
+        ib.ptr[ib.length_dw++] = handle;
+
+        ib.ptr[ib.length_dw++] = 0x00000014; /* len */
+        ib.ptr[ib.length_dw++] = 0x05000005; /* feedback buffer */
+        ib.ptr[ib.length_dw++] = upper_32_bits(dummy);
+        ib.ptr[ib.length_dw++] = dummy;
+        ib.ptr[ib.length_dw++] = 0x00000001;
+
+        ib.ptr[ib.length_dw++] = 0x00000008; /* len */
+        ib.ptr[ib.length_dw++] = 0x02000001; /* destroy cmd */
+
+        for (i = ib.length_dw; i < ib_size_dw; ++i)
+                ib.ptr[i] = 0x0;
+
+        r = radeon_ib_schedule(rdev, &ib, NULL);
+        if (r) {
+                DRM_ERROR("radeon: failed to schedule ib (%d).\n", r);
+        }
+
+        if (fence)
+                *fence = radeon_fence_ref(ib.fence);
+
+        radeon_ib_free(rdev, &ib);
+
+        return r;
+}
+
+/**
+ * radeon_vce_cs_reloc - command submission relocation
+ *
+ * @p: parser context
+ * @lo: address of lower dword
+ * @hi: address of higher dword
+ *
+ * Patch relocation inside command stream with real buffer address
+ */
+int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi)
+{
+        struct radeon_cs_chunk *relocs_chunk;
+        uint64_t offset;
+        unsigned idx;
+
+        relocs_chunk = &p->chunks[p->chunk_relocs_idx];
+        offset = radeon_get_ib_value(p, lo);
+        idx = radeon_get_ib_value(p, hi);
+
+        if (idx >= relocs_chunk->length_dw) {
+                DRM_ERROR("Relocs at %d after relocations chunk end %d !\n",
+                          idx, relocs_chunk->length_dw);
+                return -EINVAL;
+        }
+
+        offset += p->relocs_ptr[(idx / 4)]->gpu_offset;
+
+        p->ib.ptr[lo] = offset & 0xFFFFFFFF;
+        p->ib.ptr[hi] = offset >> 32;
+
+        return 0;
+}
+
+/**
+ * radeon_vce_cs_parse - parse and validate the command stream
+ *
+ * @p: parser context
+ *
+ */
+int radeon_vce_cs_parse(struct radeon_cs_parser *p)
+{
+        uint32_t handle = 0;
+        bool destroy = false;
+        int i, r;
+
+        while (p->idx < p->chunks[p->chunk_ib_idx].length_dw) {
+                uint32_t len = radeon_get_ib_value(p, p->idx);
+                uint32_t cmd = radeon_get_ib_value(p, p->idx + 1);
+
+                if ((len < 8) || (len & 3)) {
+                        DRM_ERROR("invalid VCE command length (%d)!\n", len);
+                        return -EINVAL;
+                }
+
+                switch (cmd) {
+                case 0x00000001: // session
+                        handle = radeon_get_ib_value(p, p->idx + 2);
+                        break;
+
+                case 0x00000002: // task info
+                case 0x01000001: // create
+                case 0x04000001: // config extension
+                case 0x04000002: // pic control
+                case 0x04000005: // rate control
+                case 0x04000007: // motion estimation
+                case 0x04000008: // rdo
+                        break;
+
+                case 0x03000001: // encode
+                        r = radeon_vce_cs_reloc(p, p->idx + 10, p->idx + 9);
+                        if (r)
+                                return r;
+
+                        r = radeon_vce_cs_reloc(p, p->idx + 12, p->idx + 11);
+                        if (r)
+                                return r;
+                        break;
+
+                case 0x02000001: // destroy
+                        destroy = true;
+                        break;
+
+                case 0x05000001: // context buffer
+                case 0x05000004: // video bitstream buffer
+                case 0x05000005: // feedback buffer
+                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2);
+                        if (r)
+                                return r;
+                        break;
+
+                default:
+                        DRM_ERROR("invalid VCE command (0x%x)!\n", cmd);
+                        return -EINVAL;
+                }
+
+                p->idx += len / 4;
+        }
+
+        if (destroy) {
+                /* IB contains a destroy msg, free the handle */
+                for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i)
+                        atomic_cmpxchg(&p->rdev->vce.handles[i], handle, 0);
+
+                return 0;
+        }
+
+        /* create or encode, validate the handle */
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+                if (atomic_read(&p->rdev->vce.handles[i]) == handle)
+                        return 0;
+        }
+
+        /* handle not found try to alloc a new one */
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+                if (!atomic_cmpxchg(&p->rdev->vce.handles[i], 0, handle)) {
+                        p->rdev->vce.filp[i] = p->filp;
+                        return 0;
+                }
+        }
+
+        DRM_ERROR("No more free VCE handles!\n");
+        return -EINVAL;
+}
+
+/**
+ * radeon_vce_semaphore_emit - emit a semaphore command
+ *
+ * @rdev: radeon_device pointer
+ * @ring: engine to use
+ * @semaphore: address of semaphore
+ * @emit_wait: true=emit wait, false=emit signal
+ *
+ */
+bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
+                               struct radeon_ring *ring,
+                               struct radeon_semaphore *semaphore,
+                               bool emit_wait)
+{
+        uint64_t addr = semaphore->gpu_addr;
+
+        radeon_ring_write(ring, VCE_CMD_SEMAPHORE);
+        radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF);
+        radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF);
+        radeon_ring_write(ring, 0x01003000 | (emit_wait ? 1 : 0));
+        if (!emit_wait)
+                radeon_ring_write(ring, VCE_CMD_END);
+
+        return true;
+}
+
+/**
+ * radeon_vce_ib_execute - execute indirect buffer
+ *
+ * @rdev: radeon_device pointer
+ * @ib: the IB to execute
+ *
+ */
+void radeon_vce_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
+{
+        struct radeon_ring *ring = &rdev->ring[ib->ring];
+        radeon_ring_write(ring, VCE_CMD_IB);
+        radeon_ring_write(ring, ib->gpu_addr);
+        radeon_ring_write(ring, upper_32_bits(ib->gpu_addr));
+        radeon_ring_write(ring, ib->length_dw);
+}
+
+/**
+ * radeon_vce_fence_emit - add a fence command to the ring
+ *
+ * @rdev: radeon_device pointer
+ * @fence: the fence
+ *
+ */
+void radeon_vce_fence_emit(struct radeon_device *rdev,
+                           struct radeon_fence *fence)
+{
+        struct radeon_ring *ring = &rdev->ring[fence->ring];
+        uint32_t addr = rdev->fence_drv[fence->ring].gpu_addr;
+
+        radeon_ring_write(ring, VCE_CMD_FENCE);
+        radeon_ring_write(ring, addr);
+        radeon_ring_write(ring, upper_32_bits(addr));
+        radeon_ring_write(ring, fence->seq);
+        radeon_ring_write(ring, VCE_CMD_TRAP);
+        radeon_ring_write(ring, VCE_CMD_END);
+}
+
+/**
+ * radeon_vce_ring_test - test if VCE ring is working
+ *
+ * @rdev: radeon_device pointer
+ * @ring: the engine to test on
+ *
+ */
+int radeon_vce_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
+{
+        uint32_t rptr = vce_v1_0_get_rptr(rdev, ring);
+        unsigned i;
+        int r;
+
+        r = radeon_ring_lock(rdev, ring, 16);
+        if (r) {
+                DRM_ERROR("radeon: vce failed to lock ring %d (%d).\n",
+                          ring->idx, r);
+                return r;
+        }
+        radeon_ring_write(ring, VCE_CMD_END);
+        radeon_ring_unlock_commit(rdev, ring);
+
+        for (i = 0; i < rdev->usec_timeout; i++) {
+                if (vce_v1_0_get_rptr(rdev, ring) != rptr)
+                        break;
+                DRM_UDELAY(1);
+        }
+
+        if (i < rdev->usec_timeout) {
+                DRM_INFO("ring test on %d succeeded in %d usecs\n",
+                         ring->idx, i);
+        } else {
+                DRM_ERROR("radeon: ring %d test failed\n",
+                          ring->idx);
+                r = -ETIMEDOUT;
+        }
+
+        return r;
+}
+
+/**
+ * radeon_vce_ib_test - test if VCE IBs are working
+ *
+ * @rdev: radeon_device pointer
+ * @ring: the engine to test on
+ *
+ */
+int radeon_vce_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
+{
+        struct radeon_fence *fence = NULL;
+        int r;
+
+        r = radeon_vce_get_create_msg(rdev, ring->idx, 1, NULL);
+        if (r) {
+                DRM_ERROR("radeon: failed to get create msg (%d).\n", r);
+                goto error;
+        }
+
+        r = radeon_vce_get_destroy_msg(rdev, ring->idx, 1, &fence);
+        if (r) {
+                DRM_ERROR("radeon: failed to get destroy ib (%d).\n", r);
+                goto error;
+        }
+
+        r = radeon_fence_wait(fence, false);
+        if (r) {
+                DRM_ERROR("radeon: fence wait failed (%d).\n", r);
+        } else {
+                DRM_INFO("ib test on ring %d succeeded\n", ring->idx);
+        }
+error:
+        radeon_fence_unref(&fence);
+        return r;
+}
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
new file mode 100644
index 000000000000..2aae6ce49d32
--- /dev/null
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -0,0 +1,966 @@
+/*
+ * Copyright 2008 Advanced Micro Devices, Inc.
+ * Copyright 2008 Red Hat Inc.
+ * Copyright 2009 Jerome Glisse.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Dave Airlie
+ *          Alex Deucher
+ *          Jerome Glisse
+ */
+#include <drm/drmP.h>
+#include <drm/radeon_drm.h>
+#include "radeon.h"
+#include "radeon_trace.h"
+
+/*
+ * GPUVM
+ * GPUVM is similar to the legacy gart on older asics, however
+ * rather than there being a single global gart table
+ * for the entire GPU, there are multiple VM page tables active
+ * at any given time.  The VM page tables can contain a mix
+ * vram pages and system memory pages and system memory pages
+ * can be mapped as snooped (cached system pages) or unsnooped
+ * (uncached system pages).
+ * Each VM has an ID associated with it and there is a page table
+ * associated with each VMID.  When execting a command buffer,
+ * the kernel tells the the ring what VMID to use for that command
+ * buffer.  VMIDs are allocated dynamically as commands are submitted.
+ * The userspace drivers maintain their own address space and the kernel
+ * sets up their pages tables accordingly when they submit their
+ * command buffers and a VMID is assigned.
+ * Cayman/Trinity support up to 8 active VMs at any given time;
+ * SI supports 16.
+ */
+
+/**
+ * radeon_vm_num_pde - return the number of page directory entries
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Calculate the number of page directory entries (cayman+).
+ */
+static unsigned radeon_vm_num_pdes(struct radeon_device *rdev)
+{
+        return rdev->vm_manager.max_pfn >> RADEON_VM_BLOCK_SIZE;
+}
+
+/**
+ * radeon_vm_directory_size - returns the size of the page directory in bytes
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Calculate the size of the page directory in bytes (cayman+).
+ */
+static unsigned radeon_vm_directory_size(struct radeon_device *rdev)
+{
+        return RADEON_GPU_PAGE_ALIGN(radeon_vm_num_pdes(rdev) * 8);
+}
+
+/**
+ * radeon_vm_manager_init - init the vm manager
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Init the vm manager (cayman+).
+ * Returns 0 for success, error for failure.
+ */
+int radeon_vm_manager_init(struct radeon_device *rdev)
+{
+        int r;
+
+        if (!rdev->vm_manager.enabled) {
+                r = radeon_asic_vm_init(rdev);
+                if (r)
+                        return r;
+
+                rdev->vm_manager.enabled = true;
+        }
+        return 0;
+}
+
+/**
+ * radeon_vm_manager_fini - tear down the vm manager
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Tear down the VM manager (cayman+).
+ */
+void radeon_vm_manager_fini(struct radeon_device *rdev)
+{
+        int i;
+
+        if (!rdev->vm_manager.enabled)
+                return;
+
+        for (i = 0; i < RADEON_NUM_VM; ++i)
+                radeon_fence_unref(&rdev->vm_manager.active[i]);
+        radeon_asic_vm_fini(rdev);
+        rdev->vm_manager.enabled = false;
+}
+
+/**
+ * radeon_vm_get_bos - add the vm BOs to a validation list
+ *
+ * @vm: vm providing the BOs
+ * @head: head of validation list
+ *
+ * Add the page directory to the list of BOs to
+ * validate for command submission (cayman+).
+ */
+struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
+                                          struct radeon_vm *vm,
+                                          struct list_head *head)
+{
+        struct radeon_cs_reloc *list;
+        unsigned i, idx, size;
+
+        size = (radeon_vm_num_pdes(rdev) + 1) * sizeof(struct radeon_cs_reloc);
+        list = kmalloc(size, GFP_KERNEL);
+        if (!list)
+                return NULL;
+
+        /* add the vm page table to the list */
+        list[0].gobj = NULL;
+        list[0].robj = vm->page_directory;
+        list[0].domain = RADEON_GEM_DOMAIN_VRAM;
+        list[0].alt_domain = RADEON_GEM_DOMAIN_VRAM;
+        list[0].tv.bo = &vm->page_directory->tbo;
+        list[0].tiling_flags = 0;
+        list[0].handle = 0;
+        list_add(&list[0].tv.head, head);
+
+        for (i = 0, idx = 1; i <= vm->max_pde_used; i++) {
+                if (!vm->page_tables[i].bo)
+                        continue;
+
+                list[idx].gobj = NULL;
+                list[idx].robj = vm->page_tables[i].bo;
+                list[idx].domain = RADEON_GEM_DOMAIN_VRAM;
+                list[idx].alt_domain = RADEON_GEM_DOMAIN_VRAM;
+                list[idx].tv.bo = &list[idx].robj->tbo;
+                list[idx].tiling_flags = 0;
+                list[idx].handle = 0;
+                list_add(&list[idx++].tv.head, head);
+        }
+
+        return list;
+}
+
+/**
+ * radeon_vm_grab_id - allocate the next free VMID
+ *
+ * @rdev: radeon_device pointer
+ * @vm: vm to allocate id for
+ * @ring: ring we want to submit job to
+ *
+ * Allocate an id for the vm (cayman+).
+ * Returns the fence we need to sync to (if any).
+ *
+ * Global and local mutex must be locked!
+ */
+struct radeon_fence *radeon_vm_grab_id(struct radeon_device *rdev,
+                                       struct radeon_vm *vm, int ring)
+{
+        struct radeon_fence *best[RADEON_NUM_RINGS] = {};
+        unsigned choices[2] = {};
+        unsigned i;
+
+        /* check if the id is still valid */
+        if (vm->last_id_use && vm->last_id_use == rdev->vm_manager.active[vm->id])
+                return NULL;
+
+        /* we definately need to flush */
+        radeon_fence_unref(&vm->last_flush);
+
+        /* skip over VMID 0, since it is the system VM */
+        for (i = 1; i < rdev->vm_manager.nvm; ++i) {
+                struct radeon_fence *fence = rdev->vm_manager.active[i];
+
+                if (fence == NULL) {
+                        /* found a free one */
+                        vm->id = i;
+                        trace_radeon_vm_grab_id(vm->id, ring);
+                        return NULL;
+                }
+
+                if (radeon_fence_is_earlier(fence, best[fence->ring])) {
+                        best[fence->ring] = fence;
+                        choices[fence->ring == ring ? 0 : 1] = i;
+                }
+        }
+
+        for (i = 0; i < 2; ++i) {
+                if (choices[i]) {
+                        vm->id = choices[i];
+                        trace_radeon_vm_grab_id(vm->id, ring);
+                        return rdev->vm_manager.active[choices[i]];
+                }
+        }
+
+        /* should never happen */
+        BUG();
+        return NULL;
+}
+
+/**
+ * radeon_vm_flush - hardware flush the vm
+ *
+ * @rdev: radeon_device pointer
+ * @vm: vm we want to flush
+ * @ring: ring to use for flush
+ *
+ * Flush the vm (cayman+).
+ *
+ * Global and local mutex must be locked!
+ */
+void radeon_vm_flush(struct radeon_device *rdev,
+                     struct radeon_vm *vm,
+                     int ring)
+{
+        uint64_t pd_addr = radeon_bo_gpu_offset(vm->page_directory);
+
+        /* if we can't remember our last VM flush then flush now! */
+        /* XXX figure out why we have to flush all the time */
+        if (!vm->last_flush || true || pd_addr != vm->pd_gpu_addr) {
+                vm->pd_gpu_addr = pd_addr;
+                radeon_ring_vm_flush(rdev, ring, vm);
+        }
+}
+
+/**
+ * radeon_vm_fence - remember fence for vm
+ *
+ * @rdev: radeon_device pointer
+ * @vm: vm we want to fence
+ * @fence: fence to remember
+ *
+ * Fence the vm (cayman+).
+ * Set the fence used to protect page table and id.
+ *
+ * Global and local mutex must be locked!
+ */
+void radeon_vm_fence(struct radeon_device *rdev,
+                     struct radeon_vm *vm,
+                     struct radeon_fence *fence)
+{
+        radeon_fence_unref(&vm->fence);
+        vm->fence = radeon_fence_ref(fence);
+
+        radeon_fence_unref(&rdev->vm_manager.active[vm->id]);
+        rdev->vm_manager.active[vm->id] = radeon_fence_ref(fence);
+
+        radeon_fence_unref(&vm->last_id_use);
+        vm->last_id_use = radeon_fence_ref(fence);
+
+        /* we just flushed the VM, remember that */
+        if (!vm->last_flush)
+                vm->last_flush = radeon_fence_ref(fence);
+}
+
+/**
+ * radeon_vm_bo_find - find the bo_va for a specific vm & bo
+ *
+ * @vm: requested vm
+ * @bo: requested buffer object
+ *
+ * Find @bo inside the requested vm (cayman+).
+ * Search inside the @bos vm list for the requested vm
+ * Returns the found bo_va or NULL if none is found
+ *
+ * Object has to be reserved!
+ */
+struct radeon_bo_va *radeon_vm_bo_find(struct radeon_vm *vm,
+                                       struct radeon_bo *bo)
+{
+        struct radeon_bo_va *bo_va;
+
+        list_for_each_entry(bo_va, &bo->va, bo_list) {
+                if (bo_va->vm == vm) {
+                        return bo_va;
+                }
+        }
+        return NULL;
+}
+
+/**
+ * radeon_vm_bo_add - add a bo to a specific vm
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @bo: radeon buffer object
+ *
+ * Add @bo into the requested vm (cayman+).
+ * Add @bo to the list of bos associated with the vm
+ * Returns newly added bo_va or NULL for failure
+ *
+ * Object has to be reserved!
+ */
+struct radeon_bo_va *radeon_vm_bo_add(struct radeon_device *rdev,
+                                      struct radeon_vm *vm,
+                                      struct radeon_bo *bo)
+{
+        struct radeon_bo_va *bo_va;
+
+        bo_va = kzalloc(sizeof(struct radeon_bo_va), GFP_KERNEL);
+        if (bo_va == NULL) {
+                return NULL;
+        }
+        bo_va->vm = vm;
+        bo_va->bo = bo;
+        bo_va->soffset = 0;
+        bo_va->eoffset = 0;
+        bo_va->flags = 0;
+        bo_va->valid = false;
+        bo_va->ref_count = 1;
+        INIT_LIST_HEAD(&bo_va->bo_list);
+        INIT_LIST_HEAD(&bo_va->vm_list);
+
+        mutex_lock(&vm->mutex);
+        list_add(&bo_va->vm_list, &vm->va);
+        list_add_tail(&bo_va->bo_list, &bo->va);
+        mutex_unlock(&vm->mutex);
+
+        return bo_va;
+}
+
+/**
+ * radeon_vm_clear_bo - initially clear the page dir/table
+ *
+ * @rdev: radeon_device pointer
+ * @bo: bo to clear
+ */
+static int radeon_vm_clear_bo(struct radeon_device *rdev,
+                              struct radeon_bo *bo)
+{
+        struct ttm_validate_buffer tv;
+        struct ww_acquire_ctx ticket;
+        struct list_head head;
+        struct radeon_ib ib;
+        unsigned entries;
+        uint64_t addr;
+        int r;
+
+        memset(&tv, 0, sizeof(tv));
+        tv.bo = &bo->tbo;
+
+        INIT_LIST_HEAD(&head);
+        list_add(&tv.head, &head);
+
+        r = ttm_eu_reserve_buffers(&ticket, &head);
+        if (r)
+                return r;
+
+        r = ttm_bo_validate(&bo->tbo, &bo->placement, true, false);
+        if (r)
+                goto error;
+
+        addr = radeon_bo_gpu_offset(bo);
+        entries = radeon_bo_size(bo) / 8;
+
+        r = radeon_ib_get(rdev, R600_RING_TYPE_DMA_INDEX, &ib,
+                          NULL, entries * 2 + 64);
+        if (r)
+                goto error;
+
+        ib.length_dw = 0;
+
+        radeon_asic_vm_set_page(rdev, &ib, addr, 0, entries, 0, 0);
+
+        r = radeon_ib_schedule(rdev, &ib, NULL);
+        if (r)
+                goto error;
+
+        ttm_eu_fence_buffer_objects(&ticket, &head, ib.fence);
+        radeon_ib_free(rdev, &ib);
+
+        return 0;
+
+error:
+        ttm_eu_backoff_reservation(&ticket, &head);
+        return r;
+}
+
+/**
+ * radeon_vm_bo_set_addr - set bos virtual address inside a vm
+ *
+ * @rdev: radeon_device pointer
+ * @bo_va: bo_va to store the address
+ * @soffset: requested offset of the buffer in the VM address space
+ * @flags: attributes of pages (read/write/valid/etc.)
+ *
+ * Set offset of @bo_va (cayman+).
+ * Validate and set the offset requested within the vm address space.
+ * Returns 0 for success, error for failure.
+ *
+ * Object has to be reserved!
+ */
+int radeon_vm_bo_set_addr(struct radeon_device *rdev,
+                          struct radeon_bo_va *bo_va,
+                          uint64_t soffset,
+                          uint32_t flags)
+{
+        uint64_t size = radeon_bo_size(bo_va->bo);
+        uint64_t eoffset, last_offset = 0;
+        struct radeon_vm *vm = bo_va->vm;
+        struct radeon_bo_va *tmp;
+        struct list_head *head;
+        unsigned last_pfn, pt_idx;
+        int r;
+
+        if (soffset) {
+                /* make sure object fit at this offset */
+                eoffset = soffset + size;
+                if (soffset >= eoffset) {
+                        return -EINVAL;
+                }
+
+                last_pfn = eoffset / RADEON_GPU_PAGE_SIZE;
+                if (last_pfn > rdev->vm_manager.max_pfn) {
+                        dev_err(rdev->dev, "va above limit (0x%08X > 0x%08X)\n",
+                                last_pfn, rdev->vm_manager.max_pfn);
+                        return -EINVAL;
+                }
+
+        } else {
+                eoffset = last_pfn = 0;
+        }
+
+        mutex_lock(&vm->mutex);
+        head = &vm->va;
+        last_offset = 0;
+        list_for_each_entry(tmp, &vm->va, vm_list) {
+                if (bo_va == tmp) {
+                        /* skip over currently modified bo */
+                        continue;
+                }
+
+                if (soffset >= last_offset && eoffset <= tmp->soffset) {
+                        /* bo can be added before this one */
+                        break;
+                }
+                if (eoffset > tmp->soffset && soffset < tmp->eoffset) {
+                        /* bo and tmp overlap, invalid offset */
+                        dev_err(rdev->dev, "bo %p va 0x%08X conflict with (bo %p 0x%08X 0x%08X)\n",
+                                bo_va->bo, (unsigned)bo_va->soffset, tmp->bo,
+                                (unsigned)tmp->soffset, (unsigned)tmp->eoffset);
+                        mutex_unlock(&vm->mutex);
+                        return -EINVAL;
+                }
+                last_offset = tmp->eoffset;
+                head = &tmp->vm_list;
+        }
+
+        bo_va->soffset = soffset;
+        bo_va->eoffset = eoffset;
+        bo_va->flags = flags;
+        bo_va->valid = false;
+        list_move(&bo_va->vm_list, head);
+
+        soffset = (soffset / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE;
+        eoffset = (eoffset / RADEON_GPU_PAGE_SIZE) >> RADEON_VM_BLOCK_SIZE;
+
+        if (eoffset > vm->max_pde_used)
+                vm->max_pde_used = eoffset;
+
+        radeon_bo_unreserve(bo_va->bo);
+
+        /* walk over the address space and allocate the page tables */
+        for (pt_idx = soffset; pt_idx <= eoffset; ++pt_idx) {
+                struct radeon_bo *pt;
+
+                if (vm->page_tables[pt_idx].bo)
+                        continue;
+
+                /* drop mutex to allocate and clear page table */
+                mutex_unlock(&vm->mutex);
+
+                r = radeon_bo_create(rdev, RADEON_VM_PTE_COUNT * 8,
+                                     RADEON_GPU_PAGE_SIZE, false, 
+                                     RADEON_GEM_DOMAIN_VRAM, NULL, &pt);
+                if (r)
+                        return r;
+
+                r = radeon_vm_clear_bo(rdev, pt);
+                if (r) {
+                        radeon_bo_unref(&pt);
+                        radeon_bo_reserve(bo_va->bo, false);
+                        return r;
+                }
+
+                /* aquire mutex again */
+                mutex_lock(&vm->mutex);
+                if (vm->page_tables[pt_idx].bo) {
+                        /* someone else allocated the pt in the meantime */
+                        mutex_unlock(&vm->mutex);
+                        radeon_bo_unref(&pt);
+                        mutex_lock(&vm->mutex);
+                        continue;
+                }
+
+                vm->page_tables[pt_idx].addr = 0;
+                vm->page_tables[pt_idx].bo = pt;
+        }
+
+        mutex_unlock(&vm->mutex);
+        return radeon_bo_reserve(bo_va->bo, false);
+}
+
+/**
+ * radeon_vm_map_gart - get the physical address of a gart page
+ *
+ * @rdev: radeon_device pointer
+ * @addr: the unmapped addr
+ *
+ * Look up the physical address of the page that the pte resolves
+ * to (cayman+).
+ * Returns the physical address of the page.
+ */
+uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr)
+{
+        uint64_t result;
+
+        /* page table offset */
+        result = rdev->gart.pages_addr[addr >> PAGE_SHIFT];
+
+        /* in case cpu page size != gpu page size*/
+        result |= addr & (~PAGE_MASK);
+
+        return result;
+}
+
+/**
+ * radeon_vm_page_flags - translate page flags to what the hw uses
+ *
+ * @flags: flags comming from userspace
+ *
+ * Translate the flags the userspace ABI uses to hw flags.
+ */
+static uint32_t radeon_vm_page_flags(uint32_t flags)
+{
+        uint32_t hw_flags = 0;
+        hw_flags |= (flags & RADEON_VM_PAGE_VALID) ? R600_PTE_VALID : 0;
+        hw_flags |= (flags & RADEON_VM_PAGE_READABLE) ? R600_PTE_READABLE : 0;
+        hw_flags |= (flags & RADEON_VM_PAGE_WRITEABLE) ? R600_PTE_WRITEABLE : 0;
+        if (flags & RADEON_VM_PAGE_SYSTEM) {
+                hw_flags |= R600_PTE_SYSTEM;
+                hw_flags |= (flags & RADEON_VM_PAGE_SNOOPED) ? R600_PTE_SNOOPED : 0;
+        }
+        return hw_flags;
+}
+
+/**
+ * radeon_vm_update_pdes - make sure that page directory is valid
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @start: start of GPU address range
+ * @end: end of GPU address range
+ *
+ * Allocates new page tables if necessary
+ * and updates the page directory (cayman+).
+ * Returns 0 for success, error for failure.
+ *
+ * Global and local mutex must be locked!
+ */
+int radeon_vm_update_page_directory(struct radeon_device *rdev,
+                                    struct radeon_vm *vm)
+{
+        static const uint32_t incr = RADEON_VM_PTE_COUNT * 8;
+
+        uint64_t pd_addr = radeon_bo_gpu_offset(vm->page_directory);
+        uint64_t last_pde = ~0, last_pt = ~0;
+        unsigned count = 0, pt_idx, ndw;
+        struct radeon_ib ib;
+        int r;
+
+        /* padding, etc. */
+        ndw = 64;
+
+        /* assume the worst case */
+        ndw += vm->max_pde_used * 12;
+
+        /* update too big for an IB */
+        if (ndw > 0xfffff)
+                return -ENOMEM;
+
+        r = radeon_ib_get(rdev, R600_RING_TYPE_DMA_INDEX, &ib, NULL, ndw * 4);
+        if (r)
+                return r;
+        ib.length_dw = 0;
+
+        /* walk over the address space and update the page directory */
+        for (pt_idx = 0; pt_idx <= vm->max_pde_used; ++pt_idx) {
+                struct radeon_bo *bo = vm->page_tables[pt_idx].bo;
+                uint64_t pde, pt;
+
+                if (bo == NULL)
+                        continue;
+
+                pt = radeon_bo_gpu_offset(bo);
+                if (vm->page_tables[pt_idx].addr == pt)
+                        continue;
+                vm->page_tables[pt_idx].addr = pt;
+
+                pde = pd_addr + pt_idx * 8;
+                if (((last_pde + 8 * count) != pde) ||
+                    ((last_pt + incr * count) != pt)) {
+
+                        if (count) {
+                                radeon_asic_vm_set_page(rdev, &ib, last_pde,
+                                                        last_pt, count, incr,
+                                                        R600_PTE_VALID);
+                        }
+
+                        count = 1;
+                        last_pde = pde;
+                        last_pt = pt;
+                } else {
+                        ++count;
+                }
+        }
+
+        if (count)
+                radeon_asic_vm_set_page(rdev, &ib, last_pde, last_pt, count,
+                                        incr, R600_PTE_VALID);
+
+        if (ib.length_dw != 0) {
+                radeon_semaphore_sync_to(ib.semaphore, vm->last_id_use);
+                r = radeon_ib_schedule(rdev, &ib, NULL);
+                if (r) {
+                        radeon_ib_free(rdev, &ib);
+                        return r;
+                }
+                radeon_fence_unref(&vm->fence);
+                vm->fence = radeon_fence_ref(ib.fence);
+                radeon_fence_unref(&vm->last_flush);
+        }
+        radeon_ib_free(rdev, &ib);
+
+        return 0;
+}
+
+/**
+ * radeon_vm_update_ptes - make sure that page tables are valid
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @start: start of GPU address range
+ * @end: end of GPU address range
+ * @dst: destination address to map to
+ * @flags: mapping flags
+ *
+ * Update the page tables in the range @start - @end (cayman+).
+ *
+ * Global and local mutex must be locked!
+ */
+static void radeon_vm_update_ptes(struct radeon_device *rdev,
+                                  struct radeon_vm *vm,
+                                  struct radeon_ib *ib,
+                                  uint64_t start, uint64_t end,
+                                  uint64_t dst, uint32_t flags)
+{
+        static const uint64_t mask = RADEON_VM_PTE_COUNT - 1;
+
+        uint64_t last_pte = ~0, last_dst = ~0;
+        unsigned count = 0;
+        uint64_t addr;
+
+        start = start / RADEON_GPU_PAGE_SIZE;
+        end = end / RADEON_GPU_PAGE_SIZE;
+
+        /* walk over the address space and update the page tables */
+        for (addr = start; addr < end; ) {
+                uint64_t pt_idx = addr >> RADEON_VM_BLOCK_SIZE;
+                unsigned nptes;
+                uint64_t pte;
+
+                if ((addr & ~mask) == (end & ~mask))
+                        nptes = end - addr;
+                else
+                        nptes = RADEON_VM_PTE_COUNT - (addr & mask);
+
+                pte = radeon_bo_gpu_offset(vm->page_tables[pt_idx].bo);
+                pte += (addr & mask) * 8;
+
+                if ((last_pte + 8 * count) != pte) {
+
+                        if (count) {
+                                radeon_asic_vm_set_page(rdev, ib, last_pte,
+                                                        last_dst, count,
+                                                        RADEON_GPU_PAGE_SIZE,
+                                                        flags);
+                        }
+
+                        count = nptes;
+                        last_pte = pte;
+                        last_dst = dst;
+                } else {
+                        count += nptes;
+                }
+
+                addr += nptes;
+                dst += nptes * RADEON_GPU_PAGE_SIZE;
+        }
+
+        if (count) {
+                radeon_asic_vm_set_page(rdev, ib, last_pte,
+                                        last_dst, count,
+                                        RADEON_GPU_PAGE_SIZE, flags);
+        }
+}
+
+/**
+ * radeon_vm_bo_update - map a bo into the vm page table
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @bo: radeon buffer object
+ * @mem: ttm mem
+ *
+ * Fill in the page table entries for @bo (cayman+).
+ * Returns 0 for success, -EINVAL for failure.
+ *
+ * Object have to be reserved and mutex must be locked!
+ */
+int radeon_vm_bo_update(struct radeon_device *rdev,
+                        struct radeon_vm *vm,
+                        struct radeon_bo *bo,
+                        struct ttm_mem_reg *mem)
+{
+        struct radeon_ib ib;
+        struct radeon_bo_va *bo_va;
+        unsigned nptes, ndw;
+        uint64_t addr;
+        int r;
+
+        bo_va = radeon_vm_bo_find(vm, bo);
+        if (bo_va == NULL) {
+                dev_err(rdev->dev, "bo %p not in vm %p\n", bo, vm);
+                return -EINVAL;
+        }
+
+        if (!bo_va->soffset) {
+                dev_err(rdev->dev, "bo %p don't has a mapping in vm %p\n",
+                        bo, vm);
+                return -EINVAL;
+        }
+
+        if ((bo_va->valid && mem) || (!bo_va->valid && mem == NULL))
+                return 0;
+
+        bo_va->flags &= ~RADEON_VM_PAGE_VALID;
+        bo_va->flags &= ~RADEON_VM_PAGE_SYSTEM;
+        if (mem) {
+                addr = mem->start << PAGE_SHIFT;
+                if (mem->mem_type != TTM_PL_SYSTEM) {
+                        bo_va->flags |= RADEON_VM_PAGE_VALID;
+                        bo_va->valid = true;
+                }
+                if (mem->mem_type == TTM_PL_TT) {
+                        bo_va->flags |= RADEON_VM_PAGE_SYSTEM;
+                } else {
+                        addr += rdev->vm_manager.vram_base_offset;
+                }
+        } else {
+                addr = 0;
+                bo_va->valid = false;
+        }
+
+        trace_radeon_vm_bo_update(bo_va);
+
+        nptes = radeon_bo_ngpu_pages(bo);
+
+        /* padding, etc. */
+        ndw = 64;
+
+        if (RADEON_VM_BLOCK_SIZE > 11)
+                /* reserve space for one header for every 2k dwords */
+                ndw += (nptes >> 11) * 4;
+        else
+                /* reserve space for one header for
+                    every (1 << BLOCK_SIZE) entries */
+                ndw += (nptes >> RADEON_VM_BLOCK_SIZE) * 4;
+
+        /* reserve space for pte addresses */
+        ndw += nptes * 2;
+
+        /* update too big for an IB */
+        if (ndw > 0xfffff)
+                return -ENOMEM;
+
+        r = radeon_ib_get(rdev, R600_RING_TYPE_DMA_INDEX, &ib, NULL, ndw * 4);
+        if (r)
+                return r;
+        ib.length_dw = 0;
+
+        radeon_vm_update_ptes(rdev, vm, &ib, bo_va->soffset, bo_va->eoffset,
+                              addr, radeon_vm_page_flags(bo_va->flags));
+
+        radeon_semaphore_sync_to(ib.semaphore, vm->fence);
+        r = radeon_ib_schedule(rdev, &ib, NULL);
+        if (r) {
+                radeon_ib_free(rdev, &ib);
+                return r;
+        }
+        radeon_fence_unref(&vm->fence);
+        vm->fence = radeon_fence_ref(ib.fence);
+        radeon_ib_free(rdev, &ib);
+        radeon_fence_unref(&vm->last_flush);
+
+        return 0;
+}
+
+/**
+ * radeon_vm_bo_rmv - remove a bo to a specific vm
+ *
+ * @rdev: radeon_device pointer
+ * @bo_va: requested bo_va
+ *
+ * Remove @bo_va->bo from the requested vm (cayman+).
+ * Remove @bo_va->bo from the list of bos associated with the bo_va->vm and
+ * remove the ptes for @bo_va in the page table.
+ * Returns 0 for success.
+ *
+ * Object have to be reserved!
+ */
+int radeon_vm_bo_rmv(struct radeon_device *rdev,
+                     struct radeon_bo_va *bo_va)
+{
+        int r = 0;
+
+        mutex_lock(&bo_va->vm->mutex);
+        if (bo_va->soffset)
+                r = radeon_vm_bo_update(rdev, bo_va->vm, bo_va->bo, NULL);
+
+        list_del(&bo_va->vm_list);
+        mutex_unlock(&bo_va->vm->mutex);
+        list_del(&bo_va->bo_list);
+
+        kfree(bo_va);
+        return r;
+}
+
+/**
+ * radeon_vm_bo_invalidate - mark the bo as invalid
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ * @bo: radeon buffer object
+ *
+ * Mark @bo as invalid (cayman+).
+ */
+void radeon_vm_bo_invalidate(struct radeon_device *rdev,
+                             struct radeon_bo *bo)
+{
+        struct radeon_bo_va *bo_va;
+
+        list_for_each_entry(bo_va, &bo->va, bo_list) {
+                bo_va->valid = false;
+        }
+}
+
+/**
+ * radeon_vm_init - initialize a vm instance
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ *
+ * Init @vm fields (cayman+).
+ */
+int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
+{
+        unsigned pd_size, pd_entries, pts_size;
+        int r;
+
+        vm->id = 0;
+        vm->fence = NULL;
+        vm->last_flush = NULL;
+        vm->last_id_use = NULL;
+        mutex_init(&vm->mutex);
+        INIT_LIST_HEAD(&vm->va);
+
+        pd_size = radeon_vm_directory_size(rdev);
+        pd_entries = radeon_vm_num_pdes(rdev);
+
+        /* allocate page table array */
+        pts_size = pd_entries * sizeof(struct radeon_vm_pt);
+        vm->page_tables = kzalloc(pts_size, GFP_KERNEL);
+        if (vm->page_tables == NULL) {
+                DRM_ERROR("Cannot allocate memory for page table array\n");
+                return -ENOMEM;
+        }
+
+        r = radeon_bo_create(rdev, pd_size, RADEON_VM_PTB_ALIGN_SIZE, false,
+                             RADEON_GEM_DOMAIN_VRAM, NULL,
+                             &vm->page_directory);
+        if (r)
+                return r;
+
+        r = radeon_vm_clear_bo(rdev, vm->page_directory);
+        if (r) {
+                radeon_bo_unref(&vm->page_directory);
+                vm->page_directory = NULL;
+                return r;
+        }
+
+        return 0;
+}
+
+/**
+ * radeon_vm_fini - tear down a vm instance
+ *
+ * @rdev: radeon_device pointer
+ * @vm: requested vm
+ *
+ * Tear down @vm (cayman+).
+ * Unbind the VM and remove all bos from the vm bo list
+ */
+void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
+{
+        struct radeon_bo_va *bo_va, *tmp;
+        int i, r;
+
+        if (!list_empty(&vm->va)) {
+                dev_err(rdev->dev, "still active bo inside vm\n");
+        }
+        list_for_each_entry_safe(bo_va, tmp, &vm->va, vm_list) {
+                list_del_init(&bo_va->vm_list);
+                r = radeon_bo_reserve(bo_va->bo, false);
+                if (!r) {
+                        list_del_init(&bo_va->bo_list);
+                        radeon_bo_unreserve(bo_va->bo);
+                        kfree(bo_va);
+                }
+        }
+
+
+        for (i = 0; i < radeon_vm_num_pdes(rdev); i++)
+                radeon_bo_unref(&vm->page_tables[i].bo);
+        kfree(vm->page_tables);
+
+        radeon_bo_unref(&vm->page_directory);
+
+        radeon_fence_unref(&vm->fence);
+        radeon_fence_unref(&vm->last_flush);
+        radeon_fence_unref(&vm->last_id_use);
+
+        mutex_destroy(&vm->mutex);
+}
diff --git a/drivers/gpu/drm/radeon/rs780_dpm.c b/drivers/gpu/drm/radeon/rs780_dpm.c
index 8512085b0aef..02f7710de470 100644
--- a/drivers/gpu/drm/radeon/rs780_dpm.c
+++ b/drivers/gpu/drm/radeon/rs780_dpm.c
@@ -807,9 +807,6 @@ static int rs780_parse_power_table(struct radeon_device *rdev)
                                   power_info->pplib.ucNumStates, GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
 
         for (i = 0; i < power_info->pplib.ucNumStates; i++) {
                 power_state = (union pplib_power_state *)
@@ -859,6 +856,10 @@ int rs780_dpm_init(struct radeon_device *rdev)
                 return -ENOMEM;
         rdev->pm.dpm.priv = pi;
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = rs780_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/rv6xx_dpm.c b/drivers/gpu/drm/radeon/rv6xx_dpm.c
index bebf31c4d841..e7045b085715 100644
--- a/drivers/gpu/drm/radeon/rv6xx_dpm.c
+++ b/drivers/gpu/drm/radeon/rv6xx_dpm.c
@@ -1891,9 +1891,6 @@ static int rv6xx_parse_power_table(struct radeon_device *rdev)
                                   power_info->pplib.ucNumStates, GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
 
         for (i = 0; i < power_info->pplib.ucNumStates; i++) {
                 power_state = (union pplib_power_state *)
@@ -1943,6 +1940,10 @@ int rv6xx_dpm_init(struct radeon_device *rdev)
                 return -ENOMEM;
         rdev->pm.dpm.priv = pi;
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = rv6xx_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index b5f63f5e22a3..da041a43d82e 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2281,9 +2281,6 @@ int rv7xx_parse_power_table(struct radeon_device *rdev)
                                   power_info->pplib.ucNumStates, GFP_KERNEL);
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
 
         for (i = 0; i < power_info->pplib.ucNumStates; i++) {
                 power_state = (union pplib_power_state *)
@@ -2361,6 +2358,10 @@ int rv770_dpm_init(struct radeon_device *rdev)
         pi->min_vddc_in_table = 0;
         pi->max_vddc_in_table = 0;
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = rv7xx_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 9a124d0608b3..d589475fe9e6 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3434,8 +3434,6 @@ static int si_cp_resume(struct radeon_device *rdev)
 
         WREG32(CP_RB0_BASE, ring->gpu_addr >> 8);
 
-        ring->rptr = RREG32(CP_RB0_RPTR);
-
         /* ring1  - compute only */
         /* Set ring buffer size */
         ring = &rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX];
@@ -3460,8 +3458,6 @@ static int si_cp_resume(struct radeon_device *rdev)
 
         WREG32(CP_RB1_BASE, ring->gpu_addr >> 8);
 
-        ring->rptr = RREG32(CP_RB1_RPTR);
-
         /* ring2 - compute only */
         /* Set ring buffer size */
         ring = &rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX];
@@ -3486,8 +3482,6 @@ static int si_cp_resume(struct radeon_device *rdev)
 
         WREG32(CP_RB2_BASE, ring->gpu_addr >> 8);
 
-        ring->rptr = RREG32(CP_RB2_RPTR);
-
         /* start the rings */
         si_cp_start(rdev);
         rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready = true;
@@ -3872,11 +3866,9 @@ bool si_gfx_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
         if (!(reset_mask & (RADEON_RESET_GFX |
                             RADEON_RESET_COMPUTE |
                             RADEON_RESET_CP))) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force CP activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/si_dma.c b/drivers/gpu/drm/radeon/si_dma.c
index 59be2cfcbb47..cf0fdad8c278 100644
--- a/drivers/gpu/drm/radeon/si_dma.c
+++ b/drivers/gpu/drm/radeon/si_dma.c
@@ -49,11 +49,9 @@ bool si_dma_is_lockup(struct radeon_device *rdev, struct radeon_ring *ring)
                 mask = RADEON_RESET_DMA1;
 
         if (!(reset_mask & mask)) {
-                radeon_ring_lockup_update(ring);
+                radeon_ring_lockup_update(rdev, ring);
                 return false;
         }
-        /* force ring activities */
-        radeon_ring_force_activity(rdev, ring);
         return radeon_ring_test_lockup(rdev, ring);
 }
 
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 0a2f5b4bca43..9a3567bedaae 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6271,9 +6271,6 @@ static int si_parse_power_table(struct radeon_device *rdev)
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
         for (i = 0; i < state_array->ucNumEntries; i++) {
                 u8 *idx;
                 power_state = (union pplib_power_state *)power_state_offset;
@@ -6350,6 +6347,10 @@ int si_dpm_init(struct radeon_device *rdev)
         pi->min_vddc_in_table = 0;
         pi->max_vddc_in_table = 0;
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = si_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 9239a6d29128..683532f84931 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -1798,4 +1798,51 @@
 #define DMA_PACKET_CONSTANT_FILL                          0xd
 #define DMA_PACKET_NOP                                    0xf
 
+#define VCE_STATUS                                      0x20004
+#define VCE_VCPU_CNTL                                   0x20014
+#define         VCE_CLK_EN                              (1 << 0)
+#define VCE_VCPU_CACHE_OFFSET0                          0x20024
+#define VCE_VCPU_CACHE_SIZE0                            0x20028
+#define VCE_VCPU_CACHE_OFFSET1                          0x2002c
+#define VCE_VCPU_CACHE_SIZE1                            0x20030
+#define VCE_VCPU_CACHE_OFFSET2                          0x20034
+#define VCE_VCPU_CACHE_SIZE2                            0x20038
+#define VCE_SOFT_RESET                                  0x20120
+#define         VCE_ECPU_SOFT_RESET                     (1 << 0)
+#define         VCE_FME_SOFT_RESET                      (1 << 2)
+#define VCE_RB_BASE_LO2                                 0x2016c
+#define VCE_RB_BASE_HI2                                 0x20170
+#define VCE_RB_SIZE2                                    0x20174
+#define VCE_RB_RPTR2                                    0x20178
+#define VCE_RB_WPTR2                                    0x2017c
+#define VCE_RB_BASE_LO                                  0x20180
+#define VCE_RB_BASE_HI                                  0x20184
+#define VCE_RB_SIZE                                     0x20188
+#define VCE_RB_RPTR                                     0x2018c
+#define VCE_RB_WPTR                                     0x20190
+#define VCE_CLOCK_GATING_A                              0x202f8
+#define VCE_CLOCK_GATING_B                              0x202fc
+#define VCE_UENC_CLOCK_GATING                           0x205bc
+#define VCE_UENC_REG_CLOCK_GATING                       0x205c0
+#define VCE_FW_REG_STATUS                               0x20e10
+#       define VCE_FW_REG_STATUS_BUSY                   (1 << 0)
+#       define VCE_FW_REG_STATUS_PASS                   (1 << 3)
+#       define VCE_FW_REG_STATUS_DONE                   (1 << 11)
+#define VCE_LMI_FW_START_KEYSEL                         0x20e18
+#define VCE_LMI_FW_PERIODIC_CTRL                        0x20e20
+#define VCE_LMI_CTRL2                                   0x20e74
+#define VCE_LMI_CTRL                                    0x20e98
+#define VCE_LMI_VM_CTRL                                 0x20ea0
+#define VCE_LMI_SWAP_CNTL                               0x20eb4
+#define VCE_LMI_SWAP_CNTL1                              0x20eb8
+#define VCE_LMI_CACHE_CTRL                              0x20ef4
+
+#define VCE_CMD_NO_OP                                   0x00000000
+#define VCE_CMD_END                                     0x00000001
+#define VCE_CMD_IB                                      0x00000002
+#define VCE_CMD_FENCE                                   0x00000003
+#define VCE_CMD_TRAP                                    0x00000004
+#define VCE_CMD_IB_AUTO                                 0x00000005
+#define VCE_CMD_SEMAPHORE                               0x00000006
+
 #endif
diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index 8b47b3cd0357..3f0e8d7b8dbe 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1484,9 +1484,6 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
         for (i = 0; i < state_array->ucNumEntries; i++) {
                 u8 *idx;
                 power_state = (union pplib_power_state *)power_state_offset;
@@ -1772,6 +1769,10 @@ int sumo_dpm_init(struct radeon_device *rdev)
 
         sumo_construct_boot_and_acpi_state(rdev);
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = sumo_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 2da0e17eb960..2a2822c03329 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1694,9 +1694,6 @@ static int trinity_parse_power_table(struct radeon_device *rdev)
         if (!rdev->pm.dpm.ps)
                 return -ENOMEM;
         power_state_offset = (u8 *)state_array->states;
-        rdev->pm.dpm.platform_caps = le32_to_cpu(power_info->pplib.ulPlatformCaps);
-        rdev->pm.dpm.backbias_response_time = le16_to_cpu(power_info->pplib.usBackbiasTime);
-        rdev->pm.dpm.voltage_response_time = le16_to_cpu(power_info->pplib.usVoltageTime);
         for (i = 0; i < state_array->ucNumEntries; i++) {
                 u8 *idx;
                 power_state = (union pplib_power_state *)power_state_offset;
@@ -1895,6 +1892,10 @@ int trinity_dpm_init(struct radeon_device *rdev)
 
         trinity_construct_boot_state(rdev);
 
+        ret = r600_get_platform_caps(rdev);
+        if (ret)
+                return ret;
+
         ret = trinity_parse_power_table(rdev);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index d4a68af1a279..0a243f0e5d68 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -262,7 +262,7 @@ int uvd_v1_0_start(struct radeon_device *rdev)
         /* Initialize the ring buffer's read and write pointers */
         WREG32(UVD_RBC_RB_RPTR, 0x0);
 
-        ring->wptr = ring->rptr = RREG32(UVD_RBC_RB_RPTR);
+        ring->wptr = RREG32(UVD_RBC_RB_RPTR);
         WREG32(UVD_RBC_RB_WPTR, ring->wptr);
 
         /* set the ring address */
diff --git a/drivers/gpu/drm/radeon/vce_v1_0.c b/drivers/gpu/drm/radeon/vce_v1_0.c
new file mode 100644
index 000000000000..b44d9c842f7b
--- /dev/null
+++ b/drivers/gpu/drm/radeon/vce_v1_0.c
@@ -0,0 +1,187 @@
+/*
+ * Copyright 2013 Advanced Micro Devices, Inc.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * Authors: Christian König <christian.koenig@amd.com>
+ */
+
+#include <linux/firmware.h>
+#include <drm/drmP.h>
+#include "radeon.h"
+#include "radeon_asic.h"
+#include "sid.h"
+
+/**
+ * vce_v1_0_get_rptr - get read pointer
+ *
+ * @rdev: radeon_device pointer
+ * @ring: radeon_ring pointer
+ *
+ * Returns the current hardware read pointer
+ */
+uint32_t vce_v1_0_get_rptr(struct radeon_device *rdev,
+                           struct radeon_ring *ring)
+{
+        if (ring->idx == TN_RING_TYPE_VCE1_INDEX)
+                return RREG32(VCE_RB_RPTR);
+        else
+                return RREG32(VCE_RB_RPTR2);
+}
+
+/**
+ * vce_v1_0_get_wptr - get write pointer
+ *
+ * @rdev: radeon_device pointer
+ * @ring: radeon_ring pointer
+ *
+ * Returns the current hardware write pointer
+ */
+uint32_t vce_v1_0_get_wptr(struct radeon_device *rdev,
+                           struct radeon_ring *ring)
+{
+        if (ring->idx == TN_RING_TYPE_VCE1_INDEX)
+                return RREG32(VCE_RB_WPTR);
+        else
+                return RREG32(VCE_RB_WPTR2);
+}
+
+/**
+ * vce_v1_0_set_wptr - set write pointer
+ *
+ * @rdev: radeon_device pointer
+ * @ring: radeon_ring pointer
+ *
+ * Commits the write pointer to the hardware
+ */
+void vce_v1_0_set_wptr(struct radeon_device *rdev,
+                       struct radeon_ring *ring)
+{
+        if (ring->idx == TN_RING_TYPE_VCE1_INDEX)
+                WREG32(VCE_RB_WPTR, ring->wptr);
+        else
+                WREG32(VCE_RB_WPTR2, ring->wptr);
+}
+
+/**
+ * vce_v1_0_start - start VCE block
+ *
+ * @rdev: radeon_device pointer
+ *
+ * Setup and start the VCE block
+ */
+int vce_v1_0_start(struct radeon_device *rdev)
+{
+        struct radeon_ring *ring;
+        int i, j, r;
+
+        /* set BUSY flag */
+        WREG32_P(VCE_STATUS, 1, ~1);
+
+        ring = &rdev->ring[TN_RING_TYPE_VCE1_INDEX];
+        WREG32(VCE_RB_RPTR, ring->wptr);
+        WREG32(VCE_RB_WPTR, ring->wptr);
+        WREG32(VCE_RB_BASE_LO, ring->gpu_addr);
+        WREG32(VCE_RB_BASE_HI, upper_32_bits(ring->gpu_addr));
+        WREG32(VCE_RB_SIZE, ring->ring_size / 4);
+
+        ring = &rdev->ring[TN_RING_TYPE_VCE2_INDEX];
+        WREG32(VCE_RB_RPTR2, ring->wptr);
+        WREG32(VCE_RB_WPTR2, ring->wptr);
+        WREG32(VCE_RB_BASE_LO2, ring->gpu_addr);
+        WREG32(VCE_RB_BASE_HI2, upper_32_bits(ring->gpu_addr));
+        WREG32(VCE_RB_SIZE2, ring->ring_size / 4);
+
+        WREG32_P(VCE_VCPU_CNTL, VCE_CLK_EN, ~VCE_CLK_EN);
+
+        WREG32_P(VCE_SOFT_RESET,
+                 VCE_ECPU_SOFT_RESET |
+                 VCE_FME_SOFT_RESET, ~(
+                 VCE_ECPU_SOFT_RESET |
+                 VCE_FME_SOFT_RESET));
+
+        mdelay(100);
+
+        WREG32_P(VCE_SOFT_RESET, 0, ~(
+                 VCE_ECPU_SOFT_RESET |
+                 VCE_FME_SOFT_RESET));
+
+        for (i = 0; i < 10; ++i) {
+                uint32_t status;
+                for (j = 0; j < 100; ++j) {
+                        status = RREG32(VCE_STATUS);
+                        if (status & 2)
+                                break;
+                        mdelay(10);
+                }
+                r = 0;
+                if (status & 2)
+                        break;
+
+                DRM_ERROR("VCE not responding, trying to reset the ECPU!!!\n");
+                WREG32_P(VCE_SOFT_RESET, VCE_ECPU_SOFT_RESET, ~VCE_ECPU_SOFT_RESET);
+                mdelay(10);
+                WREG32_P(VCE_SOFT_RESET, 0, ~VCE_ECPU_SOFT_RESET);
+                mdelay(10);
+                r = -1;
+        }
+
+        /* clear BUSY flag */
+        WREG32_P(VCE_STATUS, 0, ~1);
+
+        if (r) {
+                DRM_ERROR("VCE not responding, giving up!!!\n");
+                return r;
+        }
+
+        return 0;
+}
+
+int vce_v1_0_init(struct radeon_device *rdev)
+{
+        struct radeon_ring *ring;
+        int r;
+
+        r = vce_v1_0_start(rdev);
+        if (r)
+                return r;
+
+        ring = &rdev->ring[TN_RING_TYPE_VCE1_INDEX];
+        ring->ready = true;
+        r = radeon_ring_test(rdev, TN_RING_TYPE_VCE1_INDEX, ring);
+        if (r) {
+                ring->ready = false;
+                return r;
+        }
+
+        ring = &rdev->ring[TN_RING_TYPE_VCE2_INDEX];
+        ring->ready = true;
+        r = radeon_ring_test(rdev, TN_RING_TYPE_VCE2_INDEX, ring);
+        if (r) {
+                ring->ready = false;
+                return r;
+        }
+
+        DRM_INFO("VCE initialized successfully.\n");
+
+        return 0;
+}
diff --git a/drivers/gpu/drm/radeon/vce_v2_0.c b/drivers/gpu/drm/radeon/vce_v2_0.c
new file mode 100644
index 000000000000..1ac7bb825a1b
--- /dev/null
+++ b/drivers/gpu/drm/radeon/vce_v2_0.c
@@ -0,0 +1,181 @@
+/*
+ * Copyright 2013 Advanced Micro Devices, Inc.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * Authors: Christian König <christian.koenig@amd.com>
+ */
+
+#include <linux/firmware.h>
+#include <drm/drmP.h>
+#include "radeon.h"
+#include "radeon_asic.h"
+#include "cikd.h"
+
+static void vce_v2_0_set_sw_cg(struct radeon_device *rdev, bool gated)
+{
+        u32 tmp;
+
+        if (gated) {
+                tmp = RREG32(VCE_CLOCK_GATING_B);
+                tmp |= 0xe70000;
+                WREG32(VCE_CLOCK_GATING_B, tmp);
+
+                tmp = RREG32(VCE_UENC_CLOCK_GATING);
+                tmp |= 0xff000000;
+                WREG32(VCE_UENC_CLOCK_GATING, tmp);
+
+                tmp = RREG32(VCE_UENC_REG_CLOCK_GATING);
+                tmp &= ~0x3fc;
+                WREG32(VCE_UENC_REG_CLOCK_GATING, tmp);
+
+                WREG32(VCE_CGTT_CLK_OVERRIDE, 0);
+    } else {
+                tmp = RREG32(VCE_CLOCK_GATING_B);
+                tmp |= 0xe7;
+                tmp &= ~0xe70000;
+                WREG32(VCE_CLOCK_GATING_B, tmp);
+
+                tmp = RREG32(VCE_UENC_CLOCK_GATING);
+                tmp |= 0x1fe000;
+                tmp &= ~0xff000000;
+                WREG32(VCE_UENC_CLOCK_GATING, tmp);
+
+                tmp = RREG32(VCE_UENC_REG_CLOCK_GATING);
+                tmp |= 0x3fc;
+                WREG32(VCE_UENC_REG_CLOCK_GATING, tmp);
+        }
+}
+
+static void vce_v2_0_set_dyn_cg(struct radeon_device *rdev, bool gated)
+{
+        u32 orig, tmp;
+
+        tmp = RREG32(VCE_CLOCK_GATING_B);
+        tmp &= ~0x00060006;
+        if (gated) {
+                tmp |= 0xe10000;
+        } else {
+                tmp |= 0xe1;
+                tmp &= ~0xe10000;
+        }
+        WREG32(VCE_CLOCK_GATING_B, tmp);
+
+        orig = tmp = RREG32(VCE_UENC_CLOCK_GATING);
+        tmp &= ~0x1fe000;
+        tmp &= ~0xff000000;
+        if (tmp != orig)
+                WREG32(VCE_UENC_CLOCK_GATING, tmp);
+
+        orig = tmp = RREG32(VCE_UENC_REG_CLOCK_GATING);
+        tmp &= ~0x3fc;
+        if (tmp != orig)
+                WREG32(VCE_UENC_REG_CLOCK_GATING, tmp);
+
+        if (gated)
+                WREG32(VCE_CGTT_CLK_OVERRIDE, 0);
+}
+
+static void vce_v2_0_disable_cg(struct radeon_device *rdev)
+{
+        WREG32(VCE_CGTT_CLK_OVERRIDE, 7);
+}
+
+void vce_v2_0_enable_mgcg(struct radeon_device *rdev, bool enable)
+{
+        bool sw_cg = false;
+
+        if (enable && (rdev->cg_flags & RADEON_CG_SUPPORT_VCE_MGCG)) {
+                if (sw_cg)
+                        vce_v2_0_set_sw_cg(rdev, true);
+                else
+                        vce_v2_0_set_dyn_cg(rdev, true);
+        } else {
+                vce_v2_0_disable_cg(rdev);
+
+                if (sw_cg)
+                        vce_v2_0_set_sw_cg(rdev, false);
+                else
+                        vce_v2_0_set_dyn_cg(rdev, false);
+        }
+}
+
+static void vce_v2_0_init_cg(struct radeon_device *rdev)
+{
+        u32 tmp;
+
+        tmp = RREG32(VCE_CLOCK_GATING_A);
+        tmp &= ~(CGC_CLK_GATE_DLY_TIMER_MASK | CGC_CLK_GATER_OFF_DLY_TIMER_MASK);
+        tmp |= (CGC_CLK_GATE_DLY_TIMER(0) | CGC_CLK_GATER_OFF_DLY_TIMER(4));
+        tmp |= CGC_UENC_WAIT_AWAKE;
+        WREG32(VCE_CLOCK_GATING_A, tmp);
+
+        tmp = RREG32(VCE_UENC_CLOCK_GATING);
+        tmp &= ~(CLOCK_ON_DELAY_MASK | CLOCK_OFF_DELAY_MASK);
+        tmp |= (CLOCK_ON_DELAY(0) | CLOCK_OFF_DELAY(4));
+        WREG32(VCE_UENC_CLOCK_GATING, tmp);
+
+        tmp = RREG32(VCE_CLOCK_GATING_B);
+        tmp |= 0x10;
+        tmp &= ~0x100000;
+        WREG32(VCE_CLOCK_GATING_B, tmp);
+}
+
+int vce_v2_0_resume(struct radeon_device *rdev)
+{
+        uint64_t addr = rdev->vce.gpu_addr;
+        uint32_t size;
+
+        WREG32_P(VCE_CLOCK_GATING_A, 0, ~(1 << 16));
+        WREG32_P(VCE_UENC_CLOCK_GATING, 0x1FF000, ~0xFF9FF000);
+        WREG32_P(VCE_UENC_REG_CLOCK_GATING, 0x3F, ~0x3F);
+        WREG32(VCE_CLOCK_GATING_B, 0xf7);
+
+        WREG32(VCE_LMI_CTRL, 0x00398000);
+        WREG32_P(VCE_LMI_CACHE_CTRL, 0x0, ~0x1);
+        WREG32(VCE_LMI_SWAP_CNTL, 0);
+        WREG32(VCE_LMI_SWAP_CNTL1, 0);
+        WREG32(VCE_LMI_VM_CTRL, 0);
+
+        size = RADEON_GPU_PAGE_ALIGN(rdev->vce_fw->size);
+        WREG32(VCE_VCPU_CACHE_OFFSET0, addr & 0x7fffffff);
+        WREG32(VCE_VCPU_CACHE_SIZE0, size);
+
+        addr += size;
+        size = RADEON_VCE_STACK_SIZE;
+        WREG32(VCE_VCPU_CACHE_OFFSET1, addr & 0x7fffffff);
+        WREG32(VCE_VCPU_CACHE_SIZE1, size);
+
+        addr += size;
+        size = RADEON_VCE_HEAP_SIZE;
+        WREG32(VCE_VCPU_CACHE_OFFSET2, addr & 0x7fffffff);
+        WREG32(VCE_VCPU_CACHE_SIZE2, size);
+
+        WREG32_P(VCE_LMI_CTRL2, 0x0, ~0x100);
+
+        WREG32_P(VCE_SYS_INT_EN, VCE_SYS_INT_TRAP_INTERRUPT_EN,
+                 ~VCE_SYS_INT_TRAP_INTERRUPT_EN);
+
+        vce_v2_0_init_cg(rdev);
+
+        return 0;
+}
diff --git a/drivers/gpu/drm/tegra/bus.c b/drivers/gpu/drm/tegra/bus.c
index e38e5967d77b..71cef5c13dc8 100644
--- a/drivers/gpu/drm/tegra/bus.c
+++ b/drivers/gpu/drm/tegra/bus.c
@@ -63,7 +63,7 @@ int drm_host1x_init(struct drm_driver *driver, struct host1x_device *device)
         return 0;
 
 err_free:
-        drm_dev_free(drm);
+        drm_dev_unref(drm);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index a06651309388..9df79ac7b8f5 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -351,9 +351,11 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 
 moved:
         if (bo->evicted) {
-                ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
-                if (ret)
-                        pr_err("Can not flush read caches\n");
+                if (bdev->driver->invalidate_caches) {
+                        ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
+                        if (ret)
+                                pr_err("Can not flush read caches\n");
+                }
                 bo->evicted = false;
         }
 
@@ -1449,6 +1451,7 @@ EXPORT_SYMBOL(ttm_bo_device_release);
 int ttm_bo_device_init(struct ttm_bo_device *bdev,
                        struct ttm_bo_global *glob,
                        struct ttm_bo_driver *driver,
+                       struct address_space *mapping,
                        uint64_t file_page_offset,
                        bool need_dma32)
 {
@@ -1470,7 +1473,7 @@ int ttm_bo_device_init(struct ttm_bo_device *bdev,
                                     0x10000000);
         INIT_DELAYED_WORK(&bdev->wq, ttm_bo_delayed_workqueue);
         INIT_LIST_HEAD(&bdev->ddestroy);
-        bdev->dev_mapping = NULL;
+        bdev->dev_mapping = mapping;
         bdev->glob = glob;
         bdev->need_dma32 = need_dma32;
         bdev->val_seq = 0;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 801231c9ae48..0ce48e5a9cb4 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -339,11 +339,13 @@ int ttm_bo_mmap(struct file *filp, struct vm_area_struct *vma,
         vma->vm_private_data = bo;
 
         /*
-         * PFNMAP is faster than MIXEDMAP due to reduced page
-         * administration. So use MIXEDMAP only if private VMA, where
-         * we need to support COW.
+         * We'd like to use VM_PFNMAP on shared mappings, where
+         * (vma->vm_flags & VM_SHARED) != 0, for performance reasons,
+         * but for some reason VM_PFNMAP + x86 PAT + write-combine is very
+         * bad for performance. Until that has been sorted out, use
+         * VM_MIXEDMAP on all mappings. See freedesktop.org bug #75719
          */
-        vma->vm_flags |= (vma->vm_flags & VM_SHARED) ? VM_PFNMAP : VM_MIXEDMAP;
+        vma->vm_flags |= VM_MIXEDMAP;
         vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
         return 0;
 out_unref:
@@ -359,7 +361,7 @@ int ttm_fbdev_mmap(struct vm_area_struct *vma, struct ttm_buffer_object *bo)
 
         vma->vm_ops = &ttm_bo_vm_ops;
         vma->vm_private_data = ttm_bo_reference(bo);
-        vma->vm_flags |= (vma->vm_flags & VM_SHARED) ? VM_PFNMAP : VM_MIXEDMAP;
+        vma->vm_flags |= VM_MIXEDMAP;
         vma->vm_flags |= VM_IO | VM_DONTEXPAND;
         return 0;
 }
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index dbadd49e4c4a..377176372da8 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -421,7 +421,7 @@ static int udl_user_framebuffer_dirty(struct drm_framebuffer *fb,
                                   clips[i].x2 - clips[i].x1,
                                   clips[i].y2 - clips[i].y1);
                 if (ret)
-                        goto unlock;
+                        break;
         }
 
         if (ufb->obj->base.import_attach) {
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index 8d67b943ac05..be4fcd0f0e0f 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -60,7 +60,7 @@ int udl_dumb_create(struct drm_file *file,
                     struct drm_device *dev,
                     struct drm_mode_create_dumb *args)
 {
-        args->pitch = args->width * ((args->bpp + 1) / 8);
+        args->pitch = args->width * DIV_ROUND_UP(args->bpp, 8);
         args->size = args->pitch * args->height;
         return udl_gem_create(file, dev,
                               args->size, &args->handle);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 0083cbf99edf..c35715f26f40 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -722,7 +722,9 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 
         ret = ttm_bo_device_init(&dev_priv->bdev,
                                  dev_priv->bo_global_ref.ref.object,
-                                 &vmw_bo_driver, VMWGFX_FILE_PAGE_OFFSET,
+                                 &vmw_bo_driver,
+                                 dev->anon_inode->i_mapping,
+                                 VMWGFX_FILE_PAGE_OFFSET,
                                  false);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Failed initializing TTM buffer object driver.\n");
@@ -969,7 +971,6 @@ static int vmw_driver_open(struct drm_device *dev, struct drm_file *file_priv)
                 goto out_no_shman;
 
         file_priv->driver_priv = vmw_fp;
-        dev_priv->bdev.dev_mapping = dev->dev_mapping;
 
         return 0;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 82468d902915..e7af580ab977 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -830,6 +830,24 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
         if (unlikely(ret != 0))
                 goto out_unlock;
 
+        /*
+         * A gb-aware client referencing a shared surface will
+         * expect a backup buffer to be present.
+         */
+        if (dev_priv->has_mob && req->shareable) {
+                uint32_t backup_handle;
+
+                ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
+                                            res->backup_size,
+                                            true,
+                                            &backup_handle,
+                                            &res->backup);
+                if (unlikely(ret != 0)) {
+                        vmw_resource_unreference(&res);
+                        goto out_unlock;
+                }
+        }
+
         tmp = vmw_resource_reference(&srf->res);
         ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
                                     req->shareable, VMW_RES_SURFACE,
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index f5ed03164d86..de17c5593d97 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -387,7 +387,7 @@ config I2C_CBUS_GPIO
 
 config I2C_CPM
         tristate "Freescale CPM1 or CPM2 (MPC8xx/826x)"
-        depends on (CPM1 || CPM2) && OF_I2C
+        depends on CPM1 || CPM2
         help
           This supports the use of the I2C interface on Freescale
           processors with CPM1 or CPM2.
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1af70145fab9..074b9c8e4cf0 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -979,12 +979,13 @@ static void issue_copy_real(struct dm_cache_migration *mg)
         int r;
         struct dm_io_region o_region, c_region;
         struct cache *cache = mg->cache;
+        sector_t cblock = from_cblock(mg->cblock);
 
         o_region.bdev = cache->origin_dev->bdev;
         o_region.count = cache->sectors_per_block;
 
         c_region.bdev = cache->cache_dev->bdev;
-        c_region.sector = from_cblock(mg->cblock) * cache->sectors_per_block;
+        c_region.sector = cblock * cache->sectors_per_block;
         c_region.count = cache->sectors_per_block;
 
         if (mg->writeback || mg->demote) {
@@ -2464,20 +2465,18 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
         bool discarded_block;
         struct dm_bio_prison_cell *cell;
         struct policy_result lookup_result;
-        struct per_bio_data *pb;
+        struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size);
 
-        if (from_oblock(block) > from_oblock(cache->origin_blocks)) {
+        if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) {
                 /*
                  * This can only occur if the io goes to a partial block at
                  * the end of the origin device.  We don't cache these.
                  * Just remap to the origin and carry on.
                  */
-                remap_to_origin_clear_discard(cache, bio, block);
+                remap_to_origin(cache, bio);
                 return DM_MAPIO_REMAPPED;
         }
 
-        pb = init_per_bio_data(bio, pb_data_size);
-
         if (bio->bi_rw & (REQ_FLUSH | REQ_FUA | REQ_DISCARD)) {
                 defer_bio(cache, bio);
                 return DM_MAPIO_SUBMITTED;
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index b9e2000969f0..95c894482fdd 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -240,7 +240,7 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
 
         nid = cpu_to_node(cpu);
         page = alloc_pages_exact_node(nid,
-                                      GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                      GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                       pg_order);
         if (page == NULL) {
                 dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d "
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index a2c47476804d..e8f133e926aa 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -730,7 +730,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
                         client_info->ntt = 0;
                 }
 
-                if (!vlan_get_tag(skb, &client_info->vlan_id))
+                if (vlan_get_tag(skb, &client_info->vlan_id))
                         client_info->vlan_id = 0;
 
                 if (!client_info->assigned) {
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index c37878432717..298c26509095 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -121,6 +121,7 @@ static struct bond_opt_value bond_resend_igmp_tbl[] = {
 static struct bond_opt_value bond_lp_interval_tbl[] = {
         { "minval",  1,       BOND_VALFLAG_MIN | BOND_VALFLAG_DEFAULT},
         { "maxval",  INT_MAX, BOND_VALFLAG_MAX},
+        { NULL,      -1,      0},
 };
 
 static struct bond_option bond_opts[] = {
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index cda25ac45b47..6c9e1c9bdeb8 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -2507,6 +2507,7 @@ bnx2_fw_sync(struct bnx2 *bp, u32 msg_data, int ack, int silent)
 
         bp->fw_wr_seq++;
         msg_data |= bp->fw_wr_seq;
+        bp->fw_last_msg = msg_data;
 
         bnx2_shmem_wr(bp, BNX2_DRV_MB, msg_data);
 
@@ -4000,8 +4001,23 @@ bnx2_setup_wol(struct bnx2 *bp)
                         wol_msg = BNX2_DRV_MSG_CODE_SUSPEND_NO_WOL;
         }
 
-        if (!(bp->flags & BNX2_FLAG_NO_WOL))
-                bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT3 | wol_msg, 1, 0);
+        if (!(bp->flags & BNX2_FLAG_NO_WOL)) {
+                u32 val;
+
+                wol_msg |= BNX2_DRV_MSG_DATA_WAIT3;
+                if (bp->fw_last_msg || BNX2_CHIP(bp) != BNX2_CHIP_5709) {
+                        bnx2_fw_sync(bp, wol_msg, 1, 0);
+                        return;
+                }
+                /* Tell firmware not to power down the PHY yet, otherwise
+                 * the chip will take a long time to respond to MMIO reads.
+                 */
+                val = bnx2_shmem_rd(bp, BNX2_PORT_FEATURE);
+                bnx2_shmem_wr(bp, BNX2_PORT_FEATURE,
+                              val | BNX2_PORT_FEATURE_ASF_ENABLED);
+                bnx2_fw_sync(bp, wol_msg, 1, 0);
+                bnx2_shmem_wr(bp, BNX2_PORT_FEATURE, val);
+        }
 
 }
 
@@ -4033,9 +4049,22 @@ bnx2_set_power_state(struct bnx2 *bp, pci_power_t state)
 
                         if (bp->wol)
                                 pci_set_power_state(bp->pdev, PCI_D3hot);
-                } else {
-                        pci_set_power_state(bp->pdev, PCI_D3hot);
+                        break;
+
+                }
+                if (!bp->fw_last_msg && BNX2_CHIP(bp) == BNX2_CHIP_5709) {
+                        u32 val;
+
+                        /* Tell firmware not to power down the PHY yet,
+                         * otherwise the other port may not respond to
+                         * MMIO reads.
+                         */
+                        val = bnx2_shmem_rd(bp, BNX2_BC_STATE_CONDITION);
+                        val &= ~BNX2_CONDITION_PM_STATE_MASK;
+                        val |= BNX2_CONDITION_PM_STATE_UNPREP;
+                        bnx2_shmem_wr(bp, BNX2_BC_STATE_CONDITION, val);
                 }
+                pci_set_power_state(bp->pdev, PCI_D3hot);
 
                 /* No more memory access after this point until
                  * device is brought back to D0.
diff --git a/drivers/net/ethernet/broadcom/bnx2.h b/drivers/net/ethernet/broadcom/bnx2.h
index f1cf2c44e7ed..e341bc366fa5 100644
--- a/drivers/net/ethernet/broadcom/bnx2.h
+++ b/drivers/net/ethernet/broadcom/bnx2.h
@@ -6900,6 +6900,7 @@ struct bnx2 {
 
         u16                     fw_wr_seq;
         u16                     fw_drv_pulse_wr_seq;
+        u32                     fw_last_msg;
 
         int                     rx_max_ring;
         int                     rx_ring_size;
@@ -7406,6 +7407,10 @@ struct bnx2_rv2p_fw_file {
 #define BNX2_CONDITION_MFW_RUN_NCSI              0x00006000
 #define BNX2_CONDITION_MFW_RUN_NONE              0x0000e000
 #define BNX2_CONDITION_MFW_RUN_MASK              0x0000e000
+#define BNX2_CONDITION_PM_STATE_MASK             0x00030000
+#define BNX2_CONDITION_PM_STATE_FULL             0x00030000
+#define BNX2_CONDITION_PM_STATE_PREP             0x00020000
+#define BNX2_CONDITION_PM_STATE_UNPREP           0x00010000
 
 #define BNX2_BC_STATE_DEBUG_CMD                 0x1dc
 #define BNX2_BC_STATE_BC_DBG_CMD_SIGNATURE       0x42440000
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 1803c3959044..354ae9792bad 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -1704,7 +1704,7 @@ bfa_flash_sem_get(void __iomem *bar)
         while (!bfa_raw_sem_get(bar)) {
                 if (--n <= 0)
                         return BFA_STATUS_BADFLASH;
-                udelay(10000);
+                mdelay(10);
         }
         return BFA_STATUS_OK;
 }
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 3190d38e16fb..d0c38e01e99f 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -632,11 +632,16 @@ static void gem_rx_refill(struct macb *bp)
                                            "Unable to allocate sk_buff\n");
                                 break;
                         }
-                        bp->rx_skbuff[entry] = skb;
 
                         /* now fill corresponding descriptor entry */
                         paddr = dma_map_single(&bp->pdev->dev, skb->data,
                                                bp->rx_buffer_size, DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&bp->pdev->dev, paddr)) {
+                                dev_kfree_skb(skb);
+                                break;
+                        }
+
+                        bp->rx_skbuff[entry] = skb;
 
                         if (entry == RX_RING_SIZE - 1)
                                 paddr |= MACB_BIT(RX_WRAP);
@@ -725,7 +730,7 @@ static int gem_rx(struct macb *bp, int budget)
                 skb_put(skb, len);
                 addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, addr));
                 dma_unmap_single(&bp->pdev->dev, addr,
-                                 len, DMA_FROM_DEVICE);
+                                 bp->rx_buffer_size, DMA_FROM_DEVICE);
 
                 skb->protocol = eth_type_trans(skb, bp->dev);
                 skb_checksum_none_assert(skb);
@@ -1036,11 +1041,15 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         entry = macb_tx_ring_wrap(bp->tx_head);
-        bp->tx_head++;
         netdev_vdbg(bp->dev, "Allocated ring entry %u\n", entry);
         mapping = dma_map_single(&bp->pdev->dev, skb->data,
                                  len, DMA_TO_DEVICE);
+        if (dma_mapping_error(&bp->pdev->dev, mapping)) {
+                kfree_skb(skb);
+                goto unlock;
+        }
 
+        bp->tx_head++;
         tx_skb = &bp->tx_skb[entry];
         tx_skb->skb = skb;
         tx_skb->mapping = mapping;
@@ -1066,6 +1075,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (CIRC_SPACE(bp->tx_head, bp->tx_tail, TX_RING_SIZE) < 1)
                 netif_stop_queue(dev);
 
+unlock:
         spin_unlock_irqrestore(&bp->lock, flags);
 
         return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 479a7cba45c0..03a351300013 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -528,13 +528,6 @@ fec_restart(struct net_device *ndev, int duplex)
         /* Clear any outstanding interrupt. */
         writel(0xffc00000, fep->hwp + FEC_IEVENT);
 
-        /* Setup multicast filter. */
-        set_multicast_list(ndev);
-#ifndef CONFIG_M5272
-        writel(0, fep->hwp + FEC_HASH_TABLE_HIGH);
-        writel(0, fep->hwp + FEC_HASH_TABLE_LOW);
-#endif
-
         /* Set maximum receive buffer size. */
         writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE);
 
@@ -655,6 +648,13 @@ fec_restart(struct net_device *ndev, int duplex)
 
         writel(rcntl, fep->hwp + FEC_R_CNTRL);
 
+        /* Setup multicast filter. */
+        set_multicast_list(ndev);
+#ifndef CONFIG_M5272
+        writel(0, fep->hwp + FEC_HASH_TABLE_HIGH);
+        writel(0, fep->hwp + FEC_HASH_TABLE_LOW);
+#endif
+
         if (id_entry->driver_data & FEC_QUIRK_ENET_MAC) {
                 /* enable ENET endian swap */
                 ecntl |= (1 << 8);
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 4be971590461..1fc8334fc181 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -522,10 +522,21 @@ retry:
         return rc;
 }
 
+static u64 ibmveth_encode_mac_addr(u8 *mac)
+{
+        int i;
+        u64 encoded = 0;
+
+        for (i = 0; i < ETH_ALEN; i++)
+                encoded = (encoded << 8) | mac[i];
+
+        return encoded;
+}
+
 static int ibmveth_open(struct net_device *netdev)
 {
         struct ibmveth_adapter *adapter = netdev_priv(netdev);
-        u64 mac_address = 0;
+        u64 mac_address;
         int rxq_entries = 1;
         unsigned long lpar_rc;
         int rc;
@@ -579,8 +590,7 @@ static int ibmveth_open(struct net_device *netdev)
         adapter->rx_queue.num_slots = rxq_entries;
         adapter->rx_queue.toggle = 1;
 
-        memcpy(&mac_address, netdev->dev_addr, netdev->addr_len);
-        mac_address = mac_address >> 16;
+        mac_address = ibmveth_encode_mac_addr(netdev->dev_addr);
 
         rxq_desc.fields.flags_len = IBMVETH_BUF_VALID |
                                         adapter->rx_queue.queue_len;
@@ -1183,8 +1193,8 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                 /* add the addresses to the filter table */
                 netdev_for_each_mc_addr(ha, netdev) {
                         /* add the multicast address to the filter table */
-                        unsigned long mcast_addr = 0;
-                        memcpy(((char *)&mcast_addr)+2, ha->addr, ETH_ALEN);
+                        u64 mcast_addr;
+                        mcast_addr = ibmveth_encode_mac_addr(ha->addr);
                         lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                                    IbmVethMcastAddFilter,
                                                    mcast_addr);
@@ -1372,9 +1382,6 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 
         netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
 
-        adapter->mac_addr = 0;
-        memcpy(&adapter->mac_addr, mac_addr_p, ETH_ALEN);
-
         netdev->irq = dev->irq;
         netdev->netdev_ops = &ibmveth_netdev_ops;
         netdev->ethtool_ops = &netdev_ethtool_ops;
@@ -1383,7 +1390,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         netdev->features |= netdev->hw_features;
 
-        memcpy(netdev->dev_addr, &adapter->mac_addr, netdev->addr_len);
+        memcpy(netdev->dev_addr, mac_addr_p, ETH_ALEN);
 
         for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
                 struct kobject *kobj = &adapter->rx_buff_pool[i].kobj;
diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h
index 451ba7949e15..1f37499d4398 100644
--- a/drivers/net/ethernet/ibm/ibmveth.h
+++ b/drivers/net/ethernet/ibm/ibmveth.h
@@ -138,7 +138,6 @@ struct ibmveth_adapter {
     struct napi_struct napi;
     struct net_device_stats stats;
     unsigned int mcastFilterSize;
-    unsigned long mac_addr;
     void * buffer_list_addr;
     void * filter_list_addr;
     dma_addr_t buffer_list_dma;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index fad45316200a..84a96f70dfb5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -742,6 +742,14 @@ static int mlx4_en_replace_mac(struct mlx4_en_priv *priv, int qpn,
                                 err = mlx4_en_uc_steer_add(priv, new_mac,
                                                            &qpn,
                                                            &entry->reg_id);
+                                if (err)
+                                        return err;
+                                if (priv->tunnel_reg_id) {
+                                        mlx4_flow_detach(priv->mdev->dev, priv->tunnel_reg_id);
+                                        priv->tunnel_reg_id = 0;
+                                }
+                                err = mlx4_en_tunnel_steer_add(priv, new_mac, qpn,
+                                                               &priv->tunnel_reg_id);
                                 return err;
                         }
                 }
@@ -1792,6 +1800,8 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
                 mc_list[5] = priv->port;
                 mlx4_multicast_detach(mdev->dev, &priv->rss_map.indir_qp,
                                       mc_list, MLX4_PROT_ETH, mclist->reg_id);
+                if (mclist->tunnel_reg_id)
+                        mlx4_flow_detach(mdev->dev, mclist->tunnel_reg_id);
         }
         mlx4_en_clear_list(dev);
         list_for_each_entry_safe(mclist, tmp, &priv->curr_list, list) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 91b69ff4b4a2..7e2995ecea6f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -129,13 +129,14 @@ static void dump_dev_cap_flags2(struct mlx4_dev *dev, u64 flags)
                 [0] = "RSS support",
                 [1] = "RSS Toeplitz Hash Function support",
                 [2] = "RSS XOR Hash Function support",
-                [3] = "Device manage flow steering support",
+                [3] = "Device managed flow steering support",
                 [4] = "Automatic MAC reassignment support",
                 [5] = "Time stamping support",
                 [6] = "VST (control vlan insertion/stripping) support",
                 [7] = "FSM (MAC anti-spoofing) support",
                 [8] = "Dynamic QP updates support",
-                [9] = "TCP/IP offloads/flow-steering for VXLAN support"
+                [9] = "Device managed flow steering IPoIB support",
+                [10] = "TCP/IP offloads/flow-steering for VXLAN support"
         };
         int i;
 
@@ -859,7 +860,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
         MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_CQ_TS_SUPPORT_OFFSET);
 
         /* For guests, disable vxlan tunneling */
-        MLX4_GET(field, outbox, QUERY_DEV_CAP_VXLAN);
+        MLX4_GET(field, outbox->buf, QUERY_DEV_CAP_VXLAN);
         field &= 0xf7;
         MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_VXLAN);
 
@@ -869,7 +870,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
         MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_BF_OFFSET);
 
         /* For guests, disable mw type 2 */
-        MLX4_GET(bmme_flags, outbox, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
+        MLX4_GET(bmme_flags, outbox->buf, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
         bmme_flags &= ~MLX4_BMME_FLAG_TYPE_2_WIN;
         MLX4_PUT(outbox->buf, bmme_flags, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
 
@@ -883,7 +884,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
         }
 
         /* turn off ipoib managed steering for guests */
-        MLX4_GET(field, outbox, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
+        MLX4_GET(field, outbox->buf, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
         field &= ~0x80;
         MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index d711158b0d4b..936c15364739 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -150,6 +150,8 @@ struct mlx4_port_config {
         struct pci_dev *pdev;
 };
 
+static atomic_t pf_loading = ATOMIC_INIT(0);
+
 int mlx4_check_port_params(struct mlx4_dev *dev,
                            enum mlx4_port_type *port_type)
 {
@@ -749,7 +751,7 @@ static void mlx4_request_modules(struct mlx4_dev *dev)
                         has_eth_port = true;
         }
 
-        if (has_ib_port)
+        if (has_ib_port || (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE))
                 request_module_nowait(IB_DRV_NAME);
         if (has_eth_port)
                 request_module_nowait(EN_DRV_NAME);
@@ -1407,6 +1409,11 @@ static int mlx4_init_slave(struct mlx4_dev *dev)
         u32 slave_read;
         u32 cmd_channel_ver;
 
+        if (atomic_read(&pf_loading)) {
+                mlx4_warn(dev, "PF is not ready. Deferring probe\n");
+                return -EPROBE_DEFER;
+        }
+
         mutex_lock(&priv->cmd.slave_cmd_mutex);
         priv->cmd.max_cmds = 1;
         mlx4_warn(dev, "Sending reset\n");
@@ -2319,7 +2326,11 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data)
 
                 if (num_vfs) {
                         mlx4_warn(dev, "Enabling SR-IOV with %d VFs\n", num_vfs);
+
+                        atomic_inc(&pf_loading);
                         err = pci_enable_sriov(pdev, num_vfs);
+                        atomic_dec(&pf_loading);
+
                         if (err) {
                                 mlx4_err(dev, "Failed to enable SR-IOV, continuing without SR-IOV (err = %d).\n",
                                          err);
@@ -2684,6 +2695,7 @@ static struct pci_driver mlx4_driver = {
         .name           = DRV_NAME,
         .id_table       = mlx4_pci_table,
         .probe          = mlx4_init_one,
+        .shutdown       = mlx4_remove_one,
         .remove         = mlx4_remove_one,
         .err_handler    = &mlx4_err_handler,
 };
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index e9779653cd4c..3ff7bc3e7a23 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -209,7 +209,7 @@ static const struct {
         [RTL_GIGA_MAC_VER_16] =
                 _R("RTL8101e",          RTL_TD_0, NULL, JUMBO_1K, true),
         [RTL_GIGA_MAC_VER_17] =
-                _R("RTL8168b/8111b",    RTL_TD_1, NULL, JUMBO_4K, false),
+                _R("RTL8168b/8111b",    RTL_TD_0, NULL, JUMBO_4K, false),
         [RTL_GIGA_MAC_VER_18] =
                 _R("RTL8168cp/8111cp",  RTL_TD_1, NULL, JUMBO_6K, false),
         [RTL_GIGA_MAC_VER_19] =
diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
index 72d282bf33a5..c553f6b5a913 100644
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -151,7 +151,7 @@ static void stmmac_clean_desc3(void *priv_ptr, struct dma_desc *p)
                                           sizeof(struct dma_desc)));
 }
 
-const struct stmmac_chain_mode_ops chain_mode_ops = {
+const struct stmmac_mode_ops chain_mode_ops = {
         .init = stmmac_init_dma_chain,
         .is_jumbo_frm = stmmac_is_jumbo_frm,
         .jumbo_frm = stmmac_jumbo_frm,
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 7834a3993946..74610f3aca9e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -419,20 +419,13 @@ struct mii_regs {
         unsigned int data;      /* MII Data */
 };
 
-struct stmmac_ring_mode_ops {
-        unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
-        unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
-        void (*refill_desc3) (void *priv, struct dma_desc *p);
-        void (*init_desc3) (struct dma_desc *p);
-        void (*clean_desc3) (void *priv, struct dma_desc *p);
-        int (*set_16kib_bfsize) (int mtu);
-};
-
-struct stmmac_chain_mode_ops {
+struct stmmac_mode_ops {
         void (*init) (void *des, dma_addr_t phy_addr, unsigned int size,
                       unsigned int extend_desc);
         unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
         unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
+        int (*set_16kib_bfsize)(int mtu);
+        void (*init_desc3)(struct dma_desc *p);
         void (*refill_desc3) (void *priv, struct dma_desc *p);
         void (*clean_desc3) (void *priv, struct dma_desc *p);
 };
@@ -441,8 +434,7 @@ struct mac_device_info {
         const struct stmmac_ops *mac;
         const struct stmmac_desc_ops *desc;
         const struct stmmac_dma_ops *dma;
-        const struct stmmac_ring_mode_ops *ring;
-        const struct stmmac_chain_mode_ops *chain;
+        const struct stmmac_mode_ops *mode;
         const struct stmmac_hwtimestamp *ptp;
         struct mii_regs mii;    /* MII register Addresses */
         struct mac_link link;
@@ -460,7 +452,7 @@ void stmmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
 void stmmac_set_mac(void __iomem *ioaddr, bool enable);
 
 void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
-extern const struct stmmac_ring_mode_ops ring_mode_ops;
-extern const struct stmmac_chain_mode_ops chain_mode_ops;
+extern const struct stmmac_mode_ops ring_mode_ops;
+extern const struct stmmac_mode_ops chain_mode_ops;
 
 #endif /* __COMMON_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index a96c7c2f5f3f..650a4be6bce5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -100,10 +100,9 @@ static void stmmac_refill_desc3(void *priv_ptr, struct dma_desc *p)
 {
         struct stmmac_priv *priv = (struct stmmac_priv *)priv_ptr;
 
-        if (unlikely(priv->plat->has_gmac))
-                /* Fill DES3 in case of RING mode */
-                if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
-                        p->des3 = p->des2 + BUF_SIZE_8KiB;
+        /* Fill DES3 in case of RING mode */
+        if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
+                p->des3 = p->des2 + BUF_SIZE_8KiB;
 }
 
 /* In ring mode we need to fill the desc3 because it is used as buffer */
@@ -126,7 +125,7 @@ static int stmmac_set_16kib_bfsize(int mtu)
         return ret;
 }
 
-const struct stmmac_ring_mode_ops ring_mode_ops = {
+const struct stmmac_mode_ops ring_mode_ops = {
         .is_jumbo_frm = stmmac_is_jumbo_frm,
         .jumbo_frm = stmmac_jumbo_frm,
         .refill_desc3 = stmmac_refill_desc3,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 078ad0ec8593..8543e1cfd55e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -92,8 +92,8 @@ static int tc = TC_DEFAULT;
 module_param(tc, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(tc, "DMA threshold control value");
 
-#define DMA_BUFFER_SIZE BUF_SIZE_4KiB
-static int buf_sz = DMA_BUFFER_SIZE;
+#define DEFAULT_BUFSIZE 1536
+static int buf_sz = DEFAULT_BUFSIZE;
 module_param(buf_sz, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(buf_sz, "DMA buffer size");
 
@@ -136,8 +136,8 @@ static void stmmac_verify_args(void)
                 dma_rxsize = DMA_RX_SIZE;
         if (unlikely(dma_txsize < 0))
                 dma_txsize = DMA_TX_SIZE;
-        if (unlikely((buf_sz < DMA_BUFFER_SIZE) || (buf_sz > BUF_SIZE_16KiB)))
-                buf_sz = DMA_BUFFER_SIZE;
+        if (unlikely((buf_sz < DEFAULT_BUFSIZE) || (buf_sz > BUF_SIZE_16KiB)))
+                buf_sz = DEFAULT_BUFSIZE;
         if (unlikely(flow_ctrl > 1))
                 flow_ctrl = FLOW_AUTO;
         else if (likely(flow_ctrl < 0))
@@ -286,10 +286,25 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
 
         /* MAC core supports the EEE feature. */
         if (priv->dma_cap.eee) {
+                int tx_lpi_timer = priv->tx_lpi_timer;
+
                 /* Check if the PHY supports EEE */
-                if (phy_init_eee(priv->phydev, 1))
+                if (phy_init_eee(priv->phydev, 1)) {
+                        /* To manage at run-time if the EEE cannot be supported
+                         * anymore (for example because the lp caps have been
+                         * changed).
+                         * In that case the driver disable own timers.
+                         */
+                        if (priv->eee_active) {
+                                pr_debug("stmmac: disable EEE\n");
+                                del_timer_sync(&priv->eee_ctrl_timer);
+                                priv->hw->mac->set_eee_timer(priv->ioaddr, 0,
+                                                             tx_lpi_timer);
+                        }
+                        priv->eee_active = 0;
                         goto out;
-
+                }
+                /* Activate the EEE and start timers */
                 if (!priv->eee_active) {
                         priv->eee_active = 1;
                         init_timer(&priv->eee_ctrl_timer);
@@ -300,13 +315,13 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
 
                         priv->hw->mac->set_eee_timer(priv->ioaddr,
                                                      STMMAC_DEFAULT_LIT_LS,
-                                                     priv->tx_lpi_timer);
+                                                     tx_lpi_timer);
                 } else
                         /* Set HW EEE according to the speed */
                         priv->hw->mac->set_eee_pls(priv->ioaddr,
                                                    priv->phydev->link);
 
-                pr_info("stmmac: Energy-Efficient Ethernet initialized\n");
+                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
 
                 ret = true;
         }
@@ -886,10 +901,10 @@ static int stmmac_set_bfsize(int mtu, int bufsize)
                 ret = BUF_SIZE_8KiB;
         else if (mtu >= BUF_SIZE_2KiB)
                 ret = BUF_SIZE_4KiB;
-        else if (mtu >= DMA_BUFFER_SIZE)
+        else if (mtu > DEFAULT_BUFSIZE)
                 ret = BUF_SIZE_2KiB;
         else
-                ret = DMA_BUFFER_SIZE;
+                ret = DEFAULT_BUFSIZE;
 
         return ret;
 }
@@ -951,9 +966,9 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
 
         p->des2 = priv->rx_skbuff_dma[i];
 
-        if ((priv->mode == STMMAC_RING_MODE) &&
+        if ((priv->hw->mode->init_desc3) &&
             (priv->dma_buf_sz == BUF_SIZE_16KiB))
-                priv->hw->ring->init_desc3(p);
+                priv->hw->mode->init_desc3(p);
 
         return 0;
 }
@@ -984,11 +999,8 @@ static int init_dma_desc_rings(struct net_device *dev)
         unsigned int bfsize = 0;
         int ret = -ENOMEM;
 
-        /* Set the max buffer size according to the DESC mode
-         * and the MTU. Note that RING mode allows 16KiB bsize.
-         */
-        if (priv->mode == STMMAC_RING_MODE)
-                bfsize = priv->hw->ring->set_16kib_bfsize(dev->mtu);
+        if (priv->hw->mode->set_16kib_bfsize)
+                bfsize = priv->hw->mode->set_16kib_bfsize(dev->mtu);
 
         if (bfsize < BUF_SIZE_16KiB)
                 bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
@@ -1029,15 +1041,15 @@ static int init_dma_desc_rings(struct net_device *dev)
         /* Setup the chained descriptor addresses */
         if (priv->mode == STMMAC_CHAIN_MODE) {
                 if (priv->extend_desc) {
-                        priv->hw->chain->init(priv->dma_erx, priv->dma_rx_phy,
-                                              rxsize, 1);
-                        priv->hw->chain->init(priv->dma_etx, priv->dma_tx_phy,
-                                              txsize, 1);
+                        priv->hw->mode->init(priv->dma_erx, priv->dma_rx_phy,
+                                             rxsize, 1);
+                        priv->hw->mode->init(priv->dma_etx, priv->dma_tx_phy,
+                                             txsize, 1);
                 } else {
-                        priv->hw->chain->init(priv->dma_rx, priv->dma_rx_phy,
-                                              rxsize, 0);
-                        priv->hw->chain->init(priv->dma_tx, priv->dma_tx_phy,
-                                              txsize, 0);
+                        priv->hw->mode->init(priv->dma_rx, priv->dma_rx_phy,
+                                             rxsize, 0);
+                        priv->hw->mode->init(priv->dma_tx, priv->dma_tx_phy,
+                                             txsize, 0);
                 }
         }
 
@@ -1288,7 +1300,7 @@ static void stmmac_tx_clean(struct stmmac_priv *priv)
                                          DMA_TO_DEVICE);
                         priv->tx_skbuff_dma[entry] = 0;
                 }
-                priv->hw->ring->clean_desc3(priv, p);
+                priv->hw->mode->clean_desc3(priv, p);
 
                 if (likely(skb != NULL)) {
                         dev_kfree_skb(skb);
@@ -1844,6 +1856,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         int nfrags = skb_shinfo(skb)->nr_frags;
         struct dma_desc *desc, *first;
         unsigned int nopaged_len = skb_headlen(skb);
+        unsigned int enh_desc = priv->plat->enh_desc;
 
         if (unlikely(stmmac_tx_avail(priv) < nfrags + 1)) {
                 if (!netif_queue_stopped(dev)) {
@@ -1871,27 +1884,19 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         first = desc;
 
         /* To program the descriptors according to the size of the frame */
-        if (priv->mode == STMMAC_RING_MODE) {
-                is_jumbo = priv->hw->ring->is_jumbo_frm(skb->len,
-                                                        priv->plat->enh_desc);
-                if (unlikely(is_jumbo))
-                        entry = priv->hw->ring->jumbo_frm(priv, skb,
-                                                          csum_insertion);
-        } else {
-                is_jumbo = priv->hw->chain->is_jumbo_frm(skb->len,
-                                                         priv->plat->enh_desc);
-                if (unlikely(is_jumbo))
-                        entry = priv->hw->chain->jumbo_frm(priv, skb,
-                                                           csum_insertion);
-        }
+        if (enh_desc)
+                is_jumbo = priv->hw->mode->is_jumbo_frm(skb->len, enh_desc);
+
         if (likely(!is_jumbo)) {
                 desc->des2 = dma_map_single(priv->device, skb->data,
                                             nopaged_len, DMA_TO_DEVICE);
                 priv->tx_skbuff_dma[entry] = desc->des2;
                 priv->hw->desc->prepare_tx_desc(desc, 1, nopaged_len,
                                                 csum_insertion, priv->mode);
-        } else
+        } else {
                 desc = first;
+                entry = priv->hw->mode->jumbo_frm(priv, skb, csum_insertion);
+        }
 
         for (i = 0; i < nfrags; i++) {
                 const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
@@ -2029,7 +2034,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
 
                         p->des2 = priv->rx_skbuff_dma[entry];
 
-                        priv->hw->ring->refill_desc3(priv, p);
+                        priv->hw->mode->refill_desc3(priv, p);
 
                         if (netif_msg_rx_status(priv))
                                 pr_debug("\trefill entry #%d\n", entry);
@@ -2633,11 +2638,11 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
 
         /* To use the chained or ring mode */
         if (chain_mode) {
-                priv->hw->chain = &chain_mode_ops;
+                priv->hw->mode = &chain_mode_ops;
                 pr_info(" Chain mode enabled\n");
                 priv->mode = STMMAC_CHAIN_MODE;
         } else {
-                priv->hw->ring = &ring_mode_ops;
+                priv->hw->mode = &ring_mode_ops;
                 pr_info(" Ring mode enabled\n");
                 priv->mode = STMMAC_RING_MODE;
         }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index c61bc72b8e90..8fb32a80f1c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -36,7 +36,7 @@ static const struct of_device_id stmmac_dt_ids[] = {
 #ifdef CONFIG_DWMAC_STI
         { .compatible = "st,stih415-dwmac", .data = &sti_gmac_data},
         { .compatible = "st,stih416-dwmac", .data = &sti_gmac_data},
-        { .compatible = "st,stih127-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stid127-dwmac", .data = &sti_gmac_data},
 #endif
         /* SoC specific glue layers should come before generic bindings */
         { .compatible = "st,spear600-gmac"},
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 7141a1937360..d6fce9750b95 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -442,6 +442,8 @@ static int netvsc_probe(struct hv_device *dev,
         if (!net)
                 return -ENOMEM;
 
+        netif_carrier_off(net);
+
         net_device_ctx = netdev_priv(net);
         net_device_ctx->device_ctx = dev;
         hv_set_drvdata(dev, net);
@@ -473,6 +475,8 @@ static int netvsc_probe(struct hv_device *dev,
                 pr_err("Unable to register netdev.\n");
                 rndis_filter_device_remove(dev);
                 free_netdev(net);
+        } else {
+                schedule_delayed_work(&net_device_ctx->dwork, 0);
         }
 
         return ret;
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 1084e5de3ceb..b54fd257652b 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -243,6 +243,22 @@ static int rndis_filter_send_request(struct rndis_device *dev,
         return ret;
 }
 
+static void rndis_set_link_state(struct rndis_device *rdev,
+                                 struct rndis_request *request)
+{
+        u32 link_status;
+        struct rndis_query_complete *query_complete;
+
+        query_complete = &request->response_msg.msg.query_complete;
+
+        if (query_complete->status == RNDIS_STATUS_SUCCESS &&
+            query_complete->info_buflen == sizeof(u32)) {
+                memcpy(&link_status, (void *)((unsigned long)query_complete +
+                       query_complete->info_buf_offset), sizeof(u32));
+                rdev->link_state = link_status != 0;
+        }
+}
+
 static void rndis_filter_receive_response(struct rndis_device *dev,
                                        struct rndis_message *resp)
 {
@@ -272,6 +288,10 @@ static void rndis_filter_receive_response(struct rndis_device *dev,
                     sizeof(struct rndis_message) + RNDIS_EXT_LEN) {
                         memcpy(&request->response_msg, resp,
                                resp->msg_len);
+                        if (request->request_msg.ndis_msg_type ==
+                            RNDIS_MSG_QUERY && request->request_msg.msg.
+                            query_req.oid == RNDIS_OID_GEN_MEDIA_CONNECT_STATUS)
+                                rndis_set_link_state(dev, request);
                 } else {
                         netdev_err(ndev,
                                 "rndis response buffer overflow "
@@ -620,7 +640,6 @@ static int rndis_filter_query_device_link_status(struct rndis_device *dev)
         ret = rndis_filter_query_device(dev,
                                       RNDIS_OID_GEN_MEDIA_CONNECT_STATUS,
                                       &link_status, &size);
-        dev->link_state = (link_status != 0) ? true : false;
 
         return ret;
 }
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index ab31544bc254..a30258aad139 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -546,12 +546,12 @@ at86rf230_xmit(struct ieee802154_dev *dev, struct sk_buff *skb)
         int rc;
         unsigned long flags;
 
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
         if  (lp->irq_busy) {
-                spin_unlock(&lp->lock);
+                spin_unlock_irqrestore(&lp->lock, flags);
                 return -EBUSY;
         }
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
 
         might_sleep();
 
@@ -725,10 +725,11 @@ static void at86rf230_irqwork_level(struct work_struct *work)
 static irqreturn_t at86rf230_isr(int irq, void *data)
 {
         struct at86rf230_local *lp = data;
+        unsigned long flags;
 
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
         lp->irq_busy = 1;
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
 
         schedule_work(&lp->irqwork);
 
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 19c9eca0ef26..76d96b9ebcdb 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -164,9 +164,9 @@ static const struct phy_setting settings[] = {
  *   of that setting.  Returns the index of the last setting if
  *   none of the others match.
  */
-static inline int phy_find_setting(int speed, int duplex)
+static inline unsigned int phy_find_setting(int speed, int duplex)
 {
-        int idx = 0;
+        unsigned int idx = 0;
 
         while (idx < ARRAY_SIZE(settings) &&
                (settings[idx].speed != speed || settings[idx].duplex != duplex))
@@ -185,7 +185,7 @@ static inline int phy_find_setting(int speed, int duplex)
  *   the mask in features.  Returns the index of the last setting
  *   if nothing else matches.
  */
-static inline int phy_find_valid(int idx, u32 features)
+static inline unsigned int phy_find_valid(unsigned int idx, u32 features)
 {
         while (idx < MAX_NUM_SETTINGS && !(settings[idx].setting & features))
                 idx++;
@@ -204,7 +204,7 @@ static inline int phy_find_valid(int idx, u32 features)
 static void phy_sanitize_settings(struct phy_device *phydev)
 {
         u32 features = phydev->supported;
-        int idx;
+        unsigned int idx;
 
         /* Sanitize settings based on PHY capabilities */
         if ((features & SUPPORTED_Autoneg) == 0)
@@ -954,7 +954,8 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
             (phydev->interface == PHY_INTERFACE_MODE_RGMII))) {
                 int eee_lp, eee_cap, eee_adv;
                 u32 lp, cap, adv;
-                int idx, status;
+                int status;
+                unsigned int idx;
 
                 /* Read phy status to properly get the right settings */
                 status = phy_read_status(phydev);
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 433f0a00c683..e2797f1e1b31 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -11,7 +11,7 @@ obj-$(CONFIG_USB_HSO)		+= hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 asix-y := asix_devices.o asix_common.o ax88172a.o
 obj-$(CONFIG_USB_NET_AX88179_178A)      += ax88179_178a.o
-obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o r815x.o
+obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SR9700)    += sr9700.o
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 42e176912c8e..bd363b27e854 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -652,6 +652,13 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+/* Samsung USB Ethernet Adapters */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, 0xa101, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d89dbe395ad2..adb12f349a61 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -449,9 +449,6 @@ enum rtl8152_flags {
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
 
-#define REALTEK_USB_DEVICE(vend, prod)  \
-        USB_DEVICE_INTERFACE_CLASS(vend, prod, USB_CLASS_VENDOR_SPEC)
-
 struct rx_desc {
         __le32 opts1;
 #define RX_LEN_MASK                     0x7fff
@@ -2739,6 +2736,12 @@ static int rtl8152_probe(struct usb_interface *intf,
         struct net_device *netdev;
         int ret;
 
+        if (udev->actconfig->desc.bConfigurationValue != 1) {
+                usb_driver_set_configuration(udev, 1);
+                return -ENODEV;
+        }
+
+        usb_reset_device(udev);
         netdev = alloc_etherdev(sizeof(struct r8152));
         if (!netdev) {
                 dev_err(&intf->dev, "Out of memory\n");
@@ -2819,9 +2822,9 @@ static void rtl8152_disconnect(struct usb_interface *intf)
 
 /* table of devices that work with this driver */
 static struct usb_device_id rtl8152_table[] = {
-        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8152)},
-        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8153)},
-        {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, PRODUCT_ID_SAMSUNG)},
+        {USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8152)},
+        {USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8153)},
+        {USB_DEVICE(VENDOR_ID_SAMSUNG, PRODUCT_ID_SAMSUNG)},
         {}
 };
 
diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
deleted file mode 100644
index f0a8791b7636..000000000000
--- a/drivers/net/usb/r815x.c
+++ /dev/null
@@ -1,248 +0,0 @@
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/mii.h>
-#include <linux/usb.h>
-#include <linux/usb/cdc.h>
-#include <linux/usb/usbnet.h>
-
-#define RTL815x_REQT_READ       0xc0
-#define RTL815x_REQT_WRITE      0x40
-#define RTL815x_REQ_GET_REGS    0x05
-#define RTL815x_REQ_SET_REGS    0x05
-
-#define MCU_TYPE_PLA            0x0100
-#define OCP_BASE                0xe86c
-#define BASE_MII                0xa400
-
-#define BYTE_EN_DWORD           0xff
-#define BYTE_EN_WORD            0x33
-#define BYTE_EN_BYTE            0x11
-
-#define R815x_PHY_ID            32
-#define REALTEK_VENDOR_ID       0x0bda
-
-
-static int pla_read_word(struct usb_device *udev, u16 index)
-{
-        int ret;
-        u8 shift = index & 2;
-        __le32 *tmp;
-
-        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
-                return -ENOMEM;
-
-        index &= ~3;
-
-        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-                              RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
-        if (ret < 0)
-                goto out2;
-
-        ret = __le32_to_cpu(*tmp);
-        ret >>= (shift * 8);
-        ret &= 0xffff;
-
-out2:
-        kfree(tmp);
-        return ret;
-}
-
-static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
-{
-        __le32 *tmp;
-        u32 mask = 0xffff;
-        u16 byen = BYTE_EN_WORD;
-        u8 shift = index & 2;
-        int ret;
-
-        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
-                return -ENOMEM;
-
-        data &= mask;
-
-        if (shift) {
-                byen <<= shift;
-                mask <<= (shift * 8);
-                data <<= (shift * 8);
-                index &= ~3;
-        }
-
-        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-                              RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
-        if (ret < 0)
-                goto out3;
-
-        data |= __le32_to_cpu(*tmp) & ~mask;
-        *tmp = __cpu_to_le32(data);
-
-        ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
-                              RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
-                              index, MCU_TYPE_PLA | byen, tmp, sizeof(*tmp),
-                              500);
-
-out3:
-        kfree(tmp);
-        return ret;
-}
-
-static int ocp_reg_read(struct usbnet *dev, u16 addr)
-{
-        u16 ocp_base, ocp_index;
-        int ret;
-
-        ocp_base = addr & 0xf000;
-        ret = pla_write_word(dev->udev, OCP_BASE, ocp_base);
-        if (ret < 0)
-                goto out;
-
-        ocp_index = (addr & 0x0fff) | 0xb000;
-        ret = pla_read_word(dev->udev, ocp_index);
-
-out:
-        return ret;
-}
-
-static int ocp_reg_write(struct usbnet *dev, u16 addr, u16 data)
-{
-        u16 ocp_base, ocp_index;
-        int ret;
-
-        ocp_base = addr & 0xf000;
-        ret = pla_write_word(dev->udev, OCP_BASE, ocp_base);
-        if (ret < 0)
-                goto out1;
-
-        ocp_index = (addr & 0x0fff) | 0xb000;
-        ret = pla_write_word(dev->udev, ocp_index, data);
-
-out1:
-        return ret;
-}
-
-static int r815x_mdio_read(struct net_device *netdev, int phy_id, int reg)
-{
-        struct usbnet *dev = netdev_priv(netdev);
-        int ret;
-
-        if (phy_id != R815x_PHY_ID)
-                return -EINVAL;
-
-        if (usb_autopm_get_interface(dev->intf) < 0)
-                return -ENODEV;
-
-        ret = ocp_reg_read(dev, BASE_MII + reg * 2);
-
-        usb_autopm_put_interface(dev->intf);
-        return ret;
-}
-
-static
-void r815x_mdio_write(struct net_device *netdev, int phy_id, int reg, int val)
-{
-        struct usbnet *dev = netdev_priv(netdev);
-
-        if (phy_id != R815x_PHY_ID)
-                return;
-
-        if (usb_autopm_get_interface(dev->intf) < 0)
-                return;
-
-        ocp_reg_write(dev, BASE_MII + reg * 2, val);
-
-        usb_autopm_put_interface(dev->intf);
-}
-
-static int r8153_bind(struct usbnet *dev, struct usb_interface *intf)
-{
-        int status;
-
-        status = usbnet_cdc_bind(dev, intf);
-        if (status < 0)
-                return status;
-
-        dev->mii.dev = dev->net;
-        dev->mii.mdio_read = r815x_mdio_read;
-        dev->mii.mdio_write = r815x_mdio_write;
-        dev->mii.phy_id_mask = 0x3f;
-        dev->mii.reg_num_mask = 0x1f;
-        dev->mii.phy_id = R815x_PHY_ID;
-        dev->mii.supports_gmii = 1;
-
-        return status;
-}
-
-static int r8152_bind(struct usbnet *dev, struct usb_interface *intf)
-{
-        int status;
-
-        status = usbnet_cdc_bind(dev, intf);
-        if (status < 0)
-                return status;
-
-        dev->mii.dev = dev->net;
-        dev->mii.mdio_read = r815x_mdio_read;
-        dev->mii.mdio_write = r815x_mdio_write;
-        dev->mii.phy_id_mask = 0x3f;
-        dev->mii.reg_num_mask = 0x1f;
-        dev->mii.phy_id = R815x_PHY_ID;
-        dev->mii.supports_gmii = 0;
-
-        return status;
-}
-
-static const struct driver_info r8152_info = {
-        .description =  "RTL8152 ECM Device",
-        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        .bind =         r8152_bind,
-        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
-        .manage_power = usbnet_manage_power,
-};
-
-static const struct driver_info r8153_info = {
-        .description =  "RTL8153 ECM Device",
-        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        .bind =         r8153_bind,
-        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
-        .manage_power = usbnet_manage_power,
-};
-
-static const struct usb_device_id products[] = {
-{
-        USB_DEVICE_AND_INTERFACE_INFO(REALTEK_VENDOR_ID, 0x8152, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &r8152_info,
-},
-
-{
-        USB_DEVICE_AND_INTERFACE_INFO(REALTEK_VENDOR_ID, 0x8153, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &r8153_info,
-},
-
-        { },            /* END */
-};
-MODULE_DEVICE_TABLE(usb, products);
-
-static struct usb_driver r815x_driver = {
-        .name =         "r815x",
-        .id_table =     products,
-        .probe =        usbnet_probe,
-        .disconnect =   usbnet_disconnect,
-        .suspend =      usbnet_suspend,
-        .resume =       usbnet_resume,
-        .reset_resume = usbnet_resume,
-        .supports_autosuspend = 1,
-        .disable_hub_initiated_lpm = 1,
-};
-
-module_usb_driver(r815x_driver);
-
-MODULE_AUTHOR("Hayes Wang");
-MODULE_DESCRIPTION("Realtek USB ECM device");
-MODULE_LICENSE("GPL");
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 3be786faaaec..0fa3b44f7342 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1762,11 +1762,20 @@ vmxnet3_netpoll(struct net_device *netdev)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
 
-        if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
-                vmxnet3_disable_all_intrs(adapter);
-
-        vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
-        vmxnet3_enable_all_intrs(adapter);
+        switch (adapter->intr.type) {
+#ifdef CONFIG_PCI_MSI
+        case VMXNET3_IT_MSIX: {
+                int i;
+                for (i = 0; i < adapter->num_rx_queues; i++)
+                        vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
+                break;
+        }
+#endif
+        case VMXNET3_IT_MSI:
+        default:
+                vmxnet3_intr(0, adapter->netdev);
+                break;
+        }
 
 }
 #endif  /* CONFIG_NET_POLL_CONTROLLER */
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 76cde6ce6551..18a895a949d4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -872,8 +872,11 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         lockdep_assert_held(&mvm->mutex);
 
-        /* Rssi update while not associated ?! */
-        if (WARN_ON_ONCE(mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT))
+        /*
+         * Rssi update while not associated - can happen since the statistics
+         * are handled asynchronously
+         */
+        if (mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT)
                 return;
 
         /* No BT - reports should be disabled */
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index f47bcbe2945a..3872ead75488 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -359,13 +359,12 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 7265 Series */
         {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x5112, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5100, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x510A, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_n_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/mwifiex/11ac.c b/drivers/net/wireless/mwifiex/11ac.c
index 5e0eec4d71c7..5d9a8084665d 100644
--- a/drivers/net/wireless/mwifiex/11ac.c
+++ b/drivers/net/wireless/mwifiex/11ac.c
@@ -189,8 +189,7 @@ int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,
                 vht_cap->header.len  =
                                 cpu_to_le16(sizeof(struct ieee80211_vht_cap));
                 memcpy((u8 *)vht_cap + sizeof(struct mwifiex_ie_types_header),
-                       (u8 *)bss_desc->bcn_vht_cap +
-                       sizeof(struct ieee_types_header),
+                       (u8 *)bss_desc->bcn_vht_cap,
                        le16_to_cpu(vht_cap->header.len));
 
                 mwifiex_fill_vht_cap_tlv(priv, vht_cap, bss_desc->bss_band);
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 6261f8c53d44..7db1a89fdd95 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -308,8 +308,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
                 ht_cap->header.len =
                                 cpu_to_le16(sizeof(struct ieee80211_ht_cap));
                 memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header),
-                       (u8 *) bss_desc->bcn_ht_cap +
-                       sizeof(struct ieee_types_header),
+                       (u8 *)bss_desc->bcn_ht_cap,
                        le16_to_cpu(ht_cap->header.len));
 
                 mwifiex_fill_cap_info(priv, radio_type, ht_cap);
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 0a8a26e10f01..668547c2de84 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -2101,12 +2101,12 @@ mwifiex_save_curr_bcn(struct mwifiex_private *priv)
                          curr_bss->ht_info_offset);
 
         if (curr_bss->bcn_vht_cap)
-                curr_bss->bcn_ht_cap = (void *)(curr_bss->beacon_buf +
-                                                curr_bss->vht_cap_offset);
+                curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
+                                                 curr_bss->vht_cap_offset);
 
         if (curr_bss->bcn_vht_oper)
-                curr_bss->bcn_ht_oper = (void *)(curr_bss->beacon_buf +
-                                                 curr_bss->vht_info_offset);
+                curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
+                                                  curr_bss->vht_info_offset);
 
         if (curr_bss->bcn_bss_co_2040)
                 curr_bss->bcn_bss_co_2040 =
diff --git a/drivers/net/wireless/ti/wl1251/rx.c b/drivers/net/wireless/ti/wl1251/rx.c
index 123c4bb50e0a..cde0eaf99714 100644
--- a/drivers/net/wireless/ti/wl1251/rx.c
+++ b/drivers/net/wireless/ti/wl1251/rx.c
@@ -180,7 +180,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
         wl1251_mem_read(wl, rx_packet_ring_addr, rx_buffer, length);
 
         /* The actual length doesn't include the target's alignment */
-        skb->len = desc->length  - PLCP_HEADER_LENGTH;
+        skb_trim(skb, desc->length - PLCP_HEADER_LENGTH);
 
         fc = (u16 *)skb->data;
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 7669d49a67e2..301cc037fda8 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -132,8 +132,7 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* If the skb is GSO then we'll also need an extra slot for the
          * metadata.
          */
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
-            skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+        if (skb_is_gso(skb))
                 min_slots_needed++;
 
         /* If the skb can't possibly fit in the remaining slots
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e5284bca2d90..438d0c09b7e6 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -240,7 +240,7 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
         struct gnttab_copy *copy_gop;
         struct xenvif_rx_meta *meta;
         unsigned long bytes;
-        int gso_type;
+        int gso_type = XEN_NETIF_GSO_TYPE_NONE;
 
         /* Data must not cross a page boundary. */
         BUG_ON(size + offset > PAGE_SIZE<<compound_order(page));
@@ -299,12 +299,12 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
                 }
 
                 /* Leave a gap for the GSO descriptor. */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
-                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
-                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
-                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
-                else
-                        gso_type = XEN_NETIF_GSO_TYPE_NONE;
+                if (skb_is_gso(skb)) {
+                        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
+                                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                        else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                }
 
                 if (*head && ((1 << gso_type) & vif->gso_mask))
                         vif->rx.req_cons++;
@@ -338,19 +338,15 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         int head = 1;
         int old_meta_prod;
         int gso_type;
-        int gso_size;
 
         old_meta_prod = npo->meta_prod;
 
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
-                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
-                gso_size = skb_shinfo(skb)->gso_size;
-        } else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
-                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
-                gso_size = skb_shinfo(skb)->gso_size;
-        } else {
-                gso_type = XEN_NETIF_GSO_TYPE_NONE;
-                gso_size = 0;
+        gso_type = XEN_NETIF_GSO_TYPE_NONE;
+        if (skb_is_gso(skb)) {
+                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
         }
 
         /* Set up a GSO prefix descriptor, if necessary */
@@ -358,7 +354,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
                 req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                 meta = npo->meta + npo->meta_prod++;
                 meta->gso_type = gso_type;
-                meta->gso_size = gso_size;
+                meta->gso_size = skb_shinfo(skb)->gso_size;
                 meta->size = 0;
                 meta->id = req->id;
         }
@@ -368,7 +364,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
 
         if ((1 << gso_type) & vif->gso_mask) {
                 meta->gso_type = gso_type;
-                meta->gso_size = gso_size;
+                meta->gso_size = skb_shinfo(skb)->gso_size;
         } else {
                 meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
                 meta->gso_size = 0;
@@ -500,8 +496,9 @@ static void xenvif_rx_action(struct xenvif *vif)
                         size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
                         max_slots_needed += DIV_ROUND_UP(size, PAGE_SIZE);
                 }
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
-                    skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                if (skb_is_gso(skb) &&
+                   (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
+                    skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
                         max_slots_needed++;
 
                 /* If the skb may not fit then bail out now */
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 00660cc502c5..38901665c770 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -162,8 +162,6 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
 
                 avail = *r;
                 pci_clip_resource_to_region(bus, &avail, region);
-                if (!resource_size(&avail))
-                        continue;
 
                 /*
                  * "min" is typically PCIBIOS_MIN_IO or PCIBIOS_MIN_MEM to
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 6b05f6134b68..fdbc294821e6 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1192,6 +1192,9 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars)
                 return err;
         pci_fixup_device(pci_fixup_enable, dev);
 
+        if (dev->msi_enabled || dev->msix_enabled)
+                return 0;
+
         pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
         if (pin) {
                 pci_read_config_word(dev, PCI_COMMAND, &cmd);
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 167f3d00c916..66977ebf13b3 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -183,9 +183,7 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
         struct resource r = {0};
         int i, flags;
 
-        if (acpi_dev_resource_memory(res, &r)
-            || acpi_dev_resource_io(res, &r)
-            || acpi_dev_resource_address_space(res, &r)
+        if (acpi_dev_resource_address_space(res, &r)
             || acpi_dev_resource_ext_address_space(res, &r)) {
                 pnp_add_resource(dev, &r);
                 return AE_OK;
@@ -217,6 +215,17 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
         }
 
         switch (res->type) {
+        case ACPI_RESOURCE_TYPE_MEMORY24:
+        case ACPI_RESOURCE_TYPE_MEMORY32:
+        case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
+                if (acpi_dev_resource_memory(res, &r))
+                        pnp_add_resource(dev, &r);
+                break;
+        case ACPI_RESOURCE_TYPE_IO:
+        case ACPI_RESOURCE_TYPE_FIXED_IO:
+                if (acpi_dev_resource_io(res, &r))
+                        pnp_add_resource(dev, &r);
+                break;
         case ACPI_RESOURCE_TYPE_DMA:
                 dma = &res->data.dma;
                 if (dma->channel_count > 0 && dma->channels[0] != (u8) -1)
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 1f375051483a..5642a9b250c2 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -325,7 +325,7 @@ static int beiscsi_eh_device_reset(struct scsi_cmnd *sc)
                 if (!abrt_task->sc || abrt_task->state == ISCSI_TASK_FREE)
                         continue;
 
-                if (abrt_task->sc->device->lun != abrt_task->sc->device->lun)
+                if (sc->device->lun != abrt_task->sc->device->lun)
                         continue;
 
                 /* Invalidate WRB Posted for this Task */
diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
index 4911310a38f5..22a9bb1abae1 100644
--- a/drivers/scsi/isci/host.h
+++ b/drivers/scsi/isci/host.h
@@ -311,9 +311,8 @@ static inline struct Scsi_Host *to_shost(struct isci_host *ihost)
 }
 
 #define for_each_isci_host(id, ihost, pdev) \
-        for (id = 0, ihost = to_pci_info(pdev)->hosts[id]; \
-             id < ARRAY_SIZE(to_pci_info(pdev)->hosts) && ihost; \
-             ihost = to_pci_info(pdev)->hosts[++id])
+        for (id = 0; id < SCI_MAX_CONTROLLERS && \
+             (ihost = to_pci_info(pdev)->hosts[id]); id++)
 
 static inline void wait_for_start(struct isci_host *ihost)
 {
diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c
index 85c77f6b802b..ac879745ef80 100644
--- a/drivers/scsi/isci/port_config.c
+++ b/drivers/scsi/isci/port_config.c
@@ -615,13 +615,6 @@ static void sci_apc_agent_link_up(struct isci_host *ihost,
                                           SCIC_SDS_APC_WAIT_LINK_UP_NOTIFICATION);
         } else {
                 /* the phy is already the part of the port */
-                u32 port_state = iport->sm.current_state_id;
-
-                /* if the PORT'S state is resetting then the link up is from
-                 * port hard reset in this case, we need to tell the port
-                 * that link up is recieved
-                 */
-                BUG_ON(port_state != SCI_PORT_RESETTING);
                 port_agent->phy_ready_mask |= 1 << phy_index;
                 sci_port_link_up(iport, iphy);
         }
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 0d30ca849e8f..5d6fda72d659 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -801,7 +801,7 @@ int isci_task_I_T_nexus_reset(struct domain_device *dev)
                 /* XXX: need to cleanup any ireqs targeting this
                  * domain_device
                  */
-                ret = TMF_RESP_FUNC_COMPLETE;
+                ret = -ENODEV;
                 goto out;
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index e1fe95ef23e1..266724b6b899 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -2996,8 +2996,7 @@ struct qla_hw_data {
                                 IS_QLA82XX(ha) || IS_QLA83XX(ha) || \
                                 IS_QLA8044(ha))
 #define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha))
-#define IS_NOPOLLING_TYPE(ha)   ((IS_QLA25XX(ha) || IS_QLA81XX(ha) || \
-                        IS_QLA83XX(ha)) && (ha)->flags.msix_enabled)
+#define IS_NOPOLLING_TYPE(ha)   (IS_QLA81XX(ha) && (ha)->flags.msix_enabled)
 #define IS_FAC_REQUIRED(ha)     (IS_QLA81XX(ha) || IS_QLA83XX(ha))
 #define IS_NOCACHE_VPD_TYPE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha))
 #define IS_ALOGIO_CAPABLE(ha)   (IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha))
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 9bc86b9e86b1..0a1dcb43d18b 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2880,6 +2880,7 @@ static int
 qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
 #define MIN_MSIX_COUNT  2
+#define ATIO_VECTOR     2
         int i, ret;
         struct msix_entry *entries;
         struct qla_msix_entry *qentry;
@@ -2936,34 +2937,47 @@ msix_failed:
         }
 
         /* Enable MSI-X vectors for the base queue */
-        for (i = 0; i < ha->msix_count; i++) {
+        for (i = 0; i < 2; i++) {
                 qentry = &ha->msix_entries[i];
-                if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) {
-                        ret = request_irq(qentry->vector,
-                                qla83xx_msix_entries[i].handler,
-                                0, qla83xx_msix_entries[i].name, rsp);
-                } else if (IS_P3P_TYPE(ha)) {
+                if (IS_P3P_TYPE(ha))
                         ret = request_irq(qentry->vector,
                                 qla82xx_msix_entries[i].handler,
                                 0, qla82xx_msix_entries[i].name, rsp);
-                } else {
+                else
                         ret = request_irq(qentry->vector,
                                 msix_entries[i].handler,
                                 0, msix_entries[i].name, rsp);
-                }
-                if (ret) {
-                        ql_log(ql_log_fatal, vha, 0x00cb,
-                            "MSI-X: unable to register handler -- %x/%d.\n",
-                            qentry->vector, ret);
-                        qla24xx_disable_msix(ha);
-                        ha->mqenable = 0;
-                        goto msix_out;
-                }
+                if (ret)
+                        goto msix_register_fail;
                 qentry->have_irq = 1;
                 qentry->rsp = rsp;
                 rsp->msix = qentry;
         }
 
+        /*
+         * If target mode is enable, also request the vector for the ATIO
+         * queue.
+         */
+        if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) {
+                qentry = &ha->msix_entries[ATIO_VECTOR];
+                ret = request_irq(qentry->vector,
+                        qla83xx_msix_entries[ATIO_VECTOR].handler,
+                        0, qla83xx_msix_entries[ATIO_VECTOR].name, rsp);
+                qentry->have_irq = 1;
+                qentry->rsp = rsp;
+                rsp->msix = qentry;
+        }
+
+msix_register_fail:
+        if (ret) {
+                ql_log(ql_log_fatal, vha, 0x00cb,
+                    "MSI-X: unable to register handler -- %x/%d.\n",
+                    qentry->vector, ret);
+                qla24xx_disable_msix(ha);
+                ha->mqenable = 0;
+                goto msix_out;
+        }
+
         /* Enable MSI-X vector for response queue update for queue 0 */
         if (IS_QLA83XX(ha)) {
                 if (ha->msixbase && ha->mqiobase &&
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 17d740427240..9969fa1ef7c4 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1419,6 +1419,9 @@ static void storvsc_device_destroy(struct scsi_device *sdevice)
 {
         struct stor_mem_pools *memp = sdevice->hostdata;
 
+        if (!memp)
+                return;
+
         mempool_destroy(memp->request_mempool);
         kmem_cache_destroy(memp->request_pool);
         kfree(memp);
diff --git a/drivers/staging/imx-drm/imx-hdmi.c b/drivers/staging/imx-drm/imx-hdmi.c
index 62ce0e86f14b..f996e082faf4 100644
--- a/drivers/staging/imx-drm/imx-hdmi.c
+++ b/drivers/staging/imx-drm/imx-hdmi.c
@@ -1883,7 +1883,6 @@ static int imx_hdmi_platform_remove(struct platform_device *pdev)
         struct drm_connector *connector = &hdmi->connector;
         struct drm_encoder *encoder = &hdmi->encoder;
 
-        drm_mode_connector_detach_encoder(connector, encoder);
         imx_drm_remove_connector(hdmi->imx_drm_connector);
         imx_drm_remove_encoder(hdmi->imx_drm_encoder);
 
diff --git a/drivers/staging/imx-drm/imx-ldb.c b/drivers/staging/imx-drm/imx-ldb.c
index 7e593296ac47..c703e986b44c 100644
--- a/drivers/staging/imx-drm/imx-ldb.c
+++ b/drivers/staging/imx-drm/imx-ldb.c
@@ -595,8 +595,6 @@ static int imx_ldb_remove(struct platform_device *pdev)
                 struct drm_connector *connector = &channel->connector;
                 struct drm_encoder *encoder = &channel->encoder;
 
-                drm_mode_connector_detach_encoder(connector, encoder);
-
                 imx_drm_remove_connector(channel->imx_drm_connector);
                 imx_drm_remove_encoder(channel->imx_drm_encoder);
         }
diff --git a/drivers/staging/imx-drm/imx-tve.c b/drivers/staging/imx-drm/imx-tve.c
index 9abc7ca8b6cf..64729fa4a3d4 100644
--- a/drivers/staging/imx-drm/imx-tve.c
+++ b/drivers/staging/imx-drm/imx-tve.c
@@ -709,8 +709,6 @@ static int imx_tve_remove(struct platform_device *pdev)
         struct drm_connector *connector = &tve->connector;
         struct drm_encoder *encoder = &tve->encoder;
 
-        drm_mode_connector_detach_encoder(connector, encoder);
-
         imx_drm_remove_connector(tve->imx_drm_connector);
         imx_drm_remove_encoder(tve->imx_drm_encoder);
 
diff --git a/drivers/staging/imx-drm/parallel-display.c b/drivers/staging/imx-drm/parallel-display.c
index 351d61dede00..823d015d2140 100644
--- a/drivers/staging/imx-drm/parallel-display.c
+++ b/drivers/staging/imx-drm/parallel-display.c
@@ -244,8 +244,6 @@ static int imx_pd_remove(struct platform_device *pdev)
         struct drm_connector *connector = &imxpd->connector;
         struct drm_encoder *encoder = &imxpd->encoder;
 
-        drm_mode_connector_detach_encoder(connector, encoder);
-
         imx_drm_remove_connector(imxpd->imx_drm_connector);
         imx_drm_remove_encoder(imxpd->imx_drm_encoder);
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index cf32f0393369..c0f3718b77a8 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -513,7 +513,7 @@ struct cifs_mnt_data {
 static inline unsigned int
 get_rfc1002_length(void *buf)
 {
-        return be32_to_cpu(*((__be32 *)buf));
+        return be32_to_cpu(*((__be32 *)buf)) & 0xffffff;
 }
 
 static inline void
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 53c15074bb36..834fce759d80 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2579,31 +2579,19 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
         struct cifsInodeInfo *cinode = CIFS_I(inode);
         struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
         ssize_t rc = -EACCES;
+        loff_t lock_pos = pos;
 
-        BUG_ON(iocb->ki_pos != pos);
-
+        if (file->f_flags & O_APPEND)
+                lock_pos = i_size_read(inode);
         /*
          * We need to hold the sem to be sure nobody modifies lock list
          * with a brlock that prevents writing.
          */
         down_read(&cinode->lock_sem);
-        if (!cifs_find_lock_conflict(cfile, pos, iov_length(iov, nr_segs),
+        if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),
                                      server->vals->exclusive_lock_type, NULL,
-                                     CIFS_WRITE_OP)) {
-                mutex_lock(&inode->i_mutex);
-                rc = __generic_file_aio_write(iocb, iov, nr_segs,
-                                               &iocb->ki_pos);
-                mutex_unlock(&inode->i_mutex);
-        }
-
-        if (rc > 0) {
-                ssize_t err;
-
-                err = generic_write_sync(file, iocb->ki_pos - rc, rc);
-                if (err < 0)
-                        rc = err;
-        }
-
+                                     CIFS_WRITE_OP))
+                rc = generic_file_aio_write(iocb, iov, nr_segs, pos);
         up_read(&cinode->lock_sem);
         return rc;
 }
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b37570952846..18cd5650a5fc 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -270,6 +270,26 @@ cifs_rqst_page_to_kvec(struct smb_rqst *rqst, unsigned int idx,
                 iov->iov_len = rqst->rq_pagesz;
 }
 
+static unsigned long
+rqst_len(struct smb_rqst *rqst)
+{
+        unsigned int i;
+        struct kvec *iov = rqst->rq_iov;
+        unsigned long buflen = 0;
+
+        /* total up iov array first */
+        for (i = 0; i < rqst->rq_nvec; i++)
+                buflen += iov[i].iov_len;
+
+        /* add in the page array if there is one */
+        if (rqst->rq_npages) {
+                buflen += rqst->rq_pagesz * (rqst->rq_npages - 1);
+                buflen += rqst->rq_tailsz;
+        }
+
+        return buflen;
+}
+
 static int
 smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 {
@@ -277,6 +297,7 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
         struct kvec *iov = rqst->rq_iov;
         int n_vec = rqst->rq_nvec;
         unsigned int smb_buf_length = get_rfc1002_length(iov[0].iov_base);
+        unsigned long send_length;
         unsigned int i;
         size_t total_len = 0, sent;
         struct socket *ssocket = server->ssocket;
@@ -285,6 +306,14 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
         if (ssocket == NULL)
                 return -ENOTSOCK;
 
+        /* sanity check send length */
+        send_length = rqst_len(rqst);
+        if (send_length != smb_buf_length + 4) {
+                WARN(1, "Send length mismatch(send_length=%lu smb_buf_length=%u)\n",
+                        send_length, smb_buf_length);
+                return -EIO;
+        }
+
         cifs_dbg(FYI, "Sending smb: smb_len=%u\n", smb_buf_length);
         dump_smb(iov[0].iov_base, iov[0].iov_len);
 
diff --git a/fs/dcache.c b/fs/dcache.c
index 265e0ce9769c..66dc62cb766d 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -3112,6 +3112,7 @@ char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
                 end = ERR_PTR(-ENAMETOOLONG);
         return end;
 }
+EXPORT_SYMBOL(simple_dname);
 
 /*
  * Write full pathname from the root of the filesystem into the buffer.
diff --git a/fs/file.c b/fs/file.c
index db25c2bdfe46..60a45e9f5323 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -683,35 +683,65 @@ EXPORT_SYMBOL(fget_raw);
  * The fput_needed flag returned by fget_light should be passed to the
  * corresponding fput_light.
  */
-struct file *__fget_light(unsigned int fd, fmode_t mask, int *fput_needed)
+static unsigned long __fget_light(unsigned int fd, fmode_t mask)
 {
         struct files_struct *files = current->files;
         struct file *file;
 
-        *fput_needed = 0;
         if (atomic_read(&files->count) == 1) {
                 file = __fcheck_files(files, fd);
-                if (file && (file->f_mode & mask))
-                        file = NULL;
+                if (!file || unlikely(file->f_mode & mask))
+                        return 0;
+                return (unsigned long)file;
         } else {
                 file = __fget(fd, mask);
-                if (file)
-                        *fput_needed = 1;
+                if (!file)
+                        return 0;
+                return FDPUT_FPUT | (unsigned long)file;
         }
-
-        return file;
 }
-struct file *fget_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget(unsigned int fd)
 {
-        return __fget_light(fd, FMODE_PATH, fput_needed);
+        return __fget_light(fd, FMODE_PATH);
 }
-EXPORT_SYMBOL(fget_light);
+EXPORT_SYMBOL(__fdget);
 
-struct file *fget_raw_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget_raw(unsigned int fd)
 {
-        return __fget_light(fd, 0, fput_needed);
+        return __fget_light(fd, 0);
+}
+
+unsigned long __fdget_pos(unsigned int fd)
+{
+        struct files_struct *files = current->files;
+        struct file *file;
+        unsigned long v;
+
+        if (atomic_read(&files->count) == 1) {
+                file = __fcheck_files(files, fd);
+                v = 0;
+        } else {
+                file = __fget(fd, 0);
+                v = FDPUT_FPUT;
+        }
+        if (!file)
+                return 0;
+
+        if (file->f_mode & FMODE_ATOMIC_POS) {
+                if (file_count(file) > 1) {
+                        v |= FDPUT_POS_UNLOCK;
+                        mutex_lock(&file->f_pos_lock);
+                }
+        }
+        return v | (unsigned long)file;
 }
 
+/*
+ * We only lock f_pos if we have threads or if the file might be
+ * shared with another process. In both cases we'll have an elevated
+ * file count (done either by fdget() or by fork()).
+ */
+
 void set_close_on_exec(unsigned int fd, int flag)
 {
         struct files_struct *files = current->files;
diff --git a/fs/file_table.c b/fs/file_table.c
index 5fff9030be34..5b24008ea4f6 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -135,6 +135,7 @@ struct file *get_empty_filp(void)
         atomic_long_set(&f->f_count, 1);
         rwlock_init(&f->f_owner.lock);
         spin_lock_init(&f->f_lock);
+        mutex_init(&f->f_pos_lock);
         eventpoll_init_file(f);
         /* f->f_version: 0 */
         return f;
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 968ce411db53..32602c667b4a 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -103,6 +103,8 @@ static int hfsplus_cat_build_record(hfsplus_cat_entry *entry,
                 folder = &entry->folder;
                 memset(folder, 0, sizeof(*folder));
                 folder->type = cpu_to_be16(HFSPLUS_FOLDER);
+                if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags))
+                        folder->flags |= cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT);
                 folder->id = cpu_to_be32(inode->i_ino);
                 HFSPLUS_I(inode)->create_date =
                         folder->create_date =
@@ -203,6 +205,36 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
         return hfs_brec_find(fd, hfs_find_rec_by_key);
 }
 
+static void hfsplus_subfolders_inc(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Increment subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 */
+                HFSPLUS_I(dir)->subfolders++;
+        }
+}
+
+static void hfsplus_subfolders_dec(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Decrement subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 *
+                 * Check for zero. Some subfolders may have been created
+                 * by an implementation ignorant of this counter.
+                 */
+                if (HFSPLUS_I(dir)->subfolders)
+                        HFSPLUS_I(dir)->subfolders--;
+        }
+}
+
 int hfsplus_create_cat(u32 cnid, struct inode *dir,
                 struct qstr *str, struct inode *inode)
 {
@@ -247,6 +279,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
                 goto err1;
 
         dir->i_size++;
+        if (S_ISDIR(inode->i_mode))
+                hfsplus_subfolders_inc(dir);
         dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
         hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
 
@@ -336,6 +370,8 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
                 goto out;
 
         dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(dir);
         dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
         hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
 
@@ -380,6 +416,7 @@ int hfsplus_rename_cat(u32 cnid,
 
         hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                                 src_fd.entrylength);
+        type = be16_to_cpu(entry.type);
 
         /* create new dir entry with the data from the old entry */
         hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name);
@@ -394,6 +431,8 @@ int hfsplus_rename_cat(u32 cnid,
         if (err)
                 goto out;
         dst_dir->i_size++;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_inc(dst_dir);
         dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC;
 
         /* finally remove the old entry */
@@ -405,6 +444,8 @@ int hfsplus_rename_cat(u32 cnid,
         if (err)
                 goto out;
         src_dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(src_dir);
         src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC;
 
         /* remove old thread entry */
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 08846425b67f..62d571eb69ba 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -242,6 +242,7 @@ struct hfsplus_inode_info {
          */
         sector_t fs_blocks;
         u8 userflags;           /* BSD user file flags */
+        u32 subfolders;         /* Subfolder count (HFSX only) */
         struct list_head open_dir_list;
         loff_t phys_size;
 
diff --git a/fs/hfsplus/hfsplus_raw.h b/fs/hfsplus/hfsplus_raw.h
index 8ffb3a8ffe75..5a126828d85e 100644
--- a/fs/hfsplus/hfsplus_raw.h
+++ b/fs/hfsplus/hfsplus_raw.h
@@ -261,7 +261,7 @@ struct hfsplus_cat_folder {
         struct DInfo user_info;
         struct DXInfo finder_info;
         __be32 text_encoding;
-        u32 reserved;
+        __be32 subfolders;      /* Subfolder count in HFSX. Reserved in HFS+. */
 } __packed;
 
 /* HFS file info (stolen from hfs.h) */
@@ -301,11 +301,13 @@ struct hfsplus_cat_file {
         struct hfsplus_fork_raw rsrc_fork;
 } __packed;
 
-/* File attribute bits */
+/* File and folder flag bits */
 #define HFSPLUS_FILE_LOCKED             0x0001
 #define HFSPLUS_FILE_THREAD_EXISTS      0x0002
 #define HFSPLUS_XATTR_EXISTS            0x0004
 #define HFSPLUS_ACL_EXISTS              0x0008
+#define HFSPLUS_HAS_FOLDER_COUNT        0x0010  /* Folder has subfolder count
+                                                 * (HFSX only) */
 
 /* HFS+ catalog thread (part of a cat_entry) */
 struct hfsplus_cat_thread {
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index fa929f325f87..a4f45bd88a63 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -375,6 +375,7 @@ struct inode *hfsplus_new_inode(struct super_block *sb, umode_t mode)
         hip->extent_state = 0;
         hip->flags = 0;
         hip->userflags = 0;
+        hip->subfolders = 0;
         memset(hip->first_extents, 0, sizeof(hfsplus_extent_rec));
         memset(hip->cached_extents, 0, sizeof(hfsplus_extent_rec));
         hip->alloc_blocks = 0;
@@ -494,6 +495,10 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
                 inode->i_ctime = hfsp_mt2ut(folder->attribute_mod_date);
                 HFSPLUS_I(inode)->create_date = folder->create_date;
                 HFSPLUS_I(inode)->fs_blocks = 0;
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        HFSPLUS_I(inode)->subfolders =
+                                be32_to_cpu(folder->subfolders);
+                }
                 inode->i_op = &hfsplus_dir_inode_operations;
                 inode->i_fop = &hfsplus_dir_operations;
         } else if (type == HFSPLUS_FILE) {
@@ -566,6 +571,10 @@ int hfsplus_cat_write_inode(struct inode *inode)
                 folder->content_mod_date = hfsp_ut2mt(inode->i_mtime);
                 folder->attribute_mod_date = hfsp_ut2mt(inode->i_ctime);
                 folder->valence = cpu_to_be32(inode->i_size - 2);
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        folder->subfolders =
+                                cpu_to_be32(HFSPLUS_I(inode)->subfolders);
+                }
                 hfs_bnode_write(fd.bnode, &entry, fd.entryoffset,
                                          sizeof(struct hfsplus_cat_folder));
         } else if (HFSPLUS_IS_RSRC(inode)) {
diff --git a/fs/namei.c b/fs/namei.c
index 385f7817bfcc..2f730ef9b4b3 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1884,7 +1884,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
 
                 nd->path = f.file->f_path;
                 if (flags & LOOKUP_RCU) {
-                        if (f.need_put)
+                        if (f.flags & FDPUT_FPUT)
                                 *fp = f.file;
                         nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
                         rcu_read_lock();
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8450262bcf2a..51632c40e896 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2393,8 +2393,8 @@ out_dio:
 
         if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
             ((file->f_flags & O_DIRECT) && !direct_io)) {
-                ret = filemap_fdatawrite_range(file->f_mapping, pos,
-                                               pos + count - 1);
+                ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
+                                               *ppos + count - 1);
                 if (ret < 0)
                         written = ret;
 
@@ -2407,8 +2407,8 @@ out_dio:
                 }
 
                 if (!ret)
-                        ret = filemap_fdatawait_range(file->f_mapping, pos,
-                                                      pos + count - 1);
+                        ret = filemap_fdatawait_range(file->f_mapping, *ppos,
+                                                      *ppos + count - 1);
         }
 
         /*
diff --git a/fs/open.c b/fs/open.c
index 4b3e1edf2fe4..b9ed8b25c108 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -705,6 +705,10 @@ static int do_dentry_open(struct file *f,
                 return 0;
         }
 
+        /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
+        if (S_ISREG(inode->i_mode))
+                f->f_mode |= FMODE_ATOMIC_POS;
+
         f->f_op = fops_get(inode->i_fop);
         if (unlikely(WARN_ON(!f->f_op))) {
                 error = -ENODEV;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 51507065263b..b9760628e1fd 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1824,6 +1824,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
         if (rc)
                 goto out_mmput;
 
+        rc = -ENOENT;
         down_read(&mm->mmap_sem);
         vma = find_exact_vma(mm, vm_start, vm_end);
         if (vma && vma->vm_file) {
diff --git a/fs/read_write.c b/fs/read_write.c
index edc5746a902a..54e19b9392dc 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -264,10 +264,22 @@ loff_t vfs_llseek(struct file *file, loff_t offset, int whence)
 }
 EXPORT_SYMBOL(vfs_llseek);
 
+static inline struct fd fdget_pos(int fd)
+{
+        return __to_fd(__fdget_pos(fd));
+}
+
+static inline void fdput_pos(struct fd f)
+{
+        if (f.flags & FDPUT_POS_UNLOCK)
+                mutex_unlock(&f.file->f_pos_lock);
+        fdput(f);
+}
+
 SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
 {
         off_t retval;
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         if (!f.file)
                 return -EBADF;
 
@@ -278,7 +290,7 @@ SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
                 if (res != (loff_t)retval)
                         retval = -EOVERFLOW;    /* LFS: should only happen on 32 bit platforms */
         }
-        fdput(f);
+        fdput_pos(f);
         return retval;
 }
 
@@ -498,7 +510,7 @@ static inline void file_pos_write(struct file *file, loff_t pos)
 
 SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret = -EBADF;
 
         if (f.file) {
@@ -506,7 +518,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
                 ret = vfs_read(f.file, buf, count, &pos);
                 if (ret >= 0)
                         file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
         }
         return ret;
 }
@@ -514,7 +526,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                 size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret = -EBADF;
 
         if (f.file) {
@@ -522,7 +534,7 @@ SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                 ret = vfs_write(f.file, buf, count, &pos);
                 if (ret >= 0)
                         file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
         }
 
         return ret;
@@ -797,7 +809,7 @@ EXPORT_SYMBOL(vfs_writev);
 SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                 unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret = -EBADF;
 
         if (f.file) {
@@ -805,7 +817,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                 ret = vfs_readv(f.file, vec, vlen, &pos);
                 if (ret >= 0)
                         file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
         }
 
         if (ret > 0)
@@ -817,7 +829,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
 SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                 unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret = -EBADF;
 
         if (f.file) {
@@ -825,7 +837,7 @@ SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                 ret = vfs_writev(f.file, vec, vlen, &pos);
                 if (ret >= 0)
                         file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
         }
 
         if (ret > 0)
@@ -968,7 +980,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
                 const struct compat_iovec __user *,vec,
                 compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret;
         loff_t pos;
 
@@ -978,7 +990,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
         ret = compat_readv(f.file, vec, vlen, &pos);
         if (ret >= 0)
                 f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
         return ret;
 }
 
@@ -1035,7 +1047,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
                 const struct compat_iovec __user *, vec,
                 compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret;
         loff_t pos;
 
@@ -1045,7 +1057,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
         ret = compat_writev(f.file, vec, vlen, &pos);
         if (ret >= 0)
                 f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
         return ret;
 }
 
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 04a7f31301f8..daac00a93126 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -43,6 +43,7 @@
 #include <asm/current.h>
 #endif                          /* __alpha__ */
 #include <linux/kernel.h>
+#include <linux/kref.h>
 #include <linux/miscdevice.h>
 #include <linux/fs.h>
 #include <linux/init.h>
@@ -1008,10 +1009,12 @@ struct drm_driver {
         struct list_head legacy_dev_list;
 };
 
-#define DRM_MINOR_UNASSIGNED 0
-#define DRM_MINOR_LEGACY 1
-#define DRM_MINOR_CONTROL 2
-#define DRM_MINOR_RENDER 3
+enum drm_minor_type {
+        DRM_MINOR_LEGACY,
+        DRM_MINOR_CONTROL,
+        DRM_MINOR_RENDER,
+        DRM_MINOR_CNT,
+};
 
 /**
  * Info file list entry. This structure represents a debugfs or proc file to
@@ -1040,7 +1043,6 @@ struct drm_info_node {
 struct drm_minor {
         int index;                      /**< Minor device number */
         int type;                       /**< Control or render */
-        dev_t device;                   /**< Device number for mknod */
         struct device *kdev;            /**< Linux device */
         struct drm_device *dev;
 
@@ -1054,21 +1056,6 @@ struct drm_minor {
         struct drm_mode_group mode_group;
 };
 
-/* mode specified on the command line */
-struct drm_cmdline_mode {
-        bool specified;
-        bool refresh_specified;
-        bool bpp_specified;
-        int xres, yres;
-        int bpp;
-        int refresh;
-        bool rb;
-        bool interlace;
-        bool cvt;
-        bool margins;
-        enum drm_connector_force force;
-};
-
 
 struct drm_pending_vblank_event {
         struct drm_pending_event base;
@@ -1098,6 +1085,19 @@ struct drm_device {
         char *devname;                  /**< For /proc/interrupts */
         int if_version;                 /**< Highest interface version set */
 
+        /** \name Lifetime Management */
+        /*@{ */
+        struct kref ref;                /**< Object ref-count */
+        struct device *dev;             /**< Device structure of bus-device */
+        struct drm_driver *driver;      /**< DRM driver managing the device */
+        void *dev_private;              /**< DRM driver private data */
+        struct drm_minor *control;              /**< Control node */
+        struct drm_minor *primary;              /**< Primary node */
+        struct drm_minor *render;               /**< Render node */
+        atomic_t unplugged;                     /**< Flag whether dev is dead */
+        struct inode *anon_inode;               /**< inode for private address-space */
+        /*@} */
+
         /** \name Locks */
         /*@{ */
         spinlock_t count_lock;          /**< For inuse, drm_device::open_count, drm_device::buf_use */
@@ -1171,7 +1171,6 @@ struct drm_device {
 
         struct drm_agp_head *agp;       /**< AGP data */
 
-        struct device *dev;             /**< Device structure */
         struct pci_dev *pdev;           /**< PCI device structure */
 #ifdef __alpha__
         struct pci_controller *hose;
@@ -1182,17 +1181,11 @@ struct drm_device {
 
         struct drm_sg_mem *sg;  /**< Scatter gather memory */
         unsigned int num_crtcs;                  /**< Number of CRTCs on this device */
-        void *dev_private;              /**< device private data */
-        struct address_space *dev_mapping;
         struct drm_sigdata sigdata;        /**< For block_all_signals */
         sigset_t sigmask;
 
-        struct drm_driver *driver;
         struct drm_local_map *agp_buffer_map;
         unsigned int agp_buffer_token;
-        struct drm_minor *control;              /**< Control node for card */
-        struct drm_minor *primary;              /**< render type primary screen head */
-        struct drm_minor *render;               /**< render node for card */
 
         struct drm_mode_config mode_config;     /**< Current mode config */
 
@@ -1203,8 +1196,6 @@ struct drm_device {
         struct drm_vma_offset_manager *vma_offset_manager;
         /*@} */
         int switch_power_state;
-
-        atomic_t unplugged; /* device has been unplugged or gone away */
 };
 
 #define DRM_SWITCH_POWER_ON 0
@@ -1411,20 +1402,6 @@ extern int drm_calc_vbltimestamp_from_scanoutpos(struct drm_device *dev,
 extern void drm_calc_timestamping_constants(struct drm_crtc *crtc,
                                             const struct drm_display_mode *mode);
 
-extern bool
-drm_mode_parse_command_line_for_connector(const char *mode_option,
-                                          struct drm_connector *connector,
-                                          struct drm_cmdline_mode *mode);
-
-extern struct drm_display_mode *
-drm_mode_create_from_cmdline_mode(struct drm_device *dev,
-                                  struct drm_cmdline_mode *cmd);
-
-extern int drm_display_mode_from_videomode(const struct videomode *vm,
-                                           struct drm_display_mode *dmode);
-extern int of_get_drm_display_mode(struct device_node *np,
-                                   struct drm_display_mode *dmode,
-                                   int index);
 
 /* Modesetting support */
 extern void drm_vblank_pre_modeset(struct drm_device *dev, int crtc);
@@ -1661,9 +1638,14 @@ static __inline__ void drm_core_dropmap(struct drm_local_map *map)
 
 struct drm_device *drm_dev_alloc(struct drm_driver *driver,
                                  struct device *parent);
-void drm_dev_free(struct drm_device *dev);
+void drm_dev_ref(struct drm_device *dev);
+void drm_dev_unref(struct drm_device *dev);
 int drm_dev_register(struct drm_device *dev, unsigned long flags);
 void drm_dev_unregister(struct drm_device *dev);
+
+struct drm_minor *drm_minor_acquire(unsigned int minor_id);
+void drm_minor_release(struct drm_minor *minor);
+
 /*@}*/
 
 /* PCI section */
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index f7646548660d..27f828c9d7f2 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -32,7 +32,6 @@
 #include <linux/fb.h>
 #include <linux/hdmi.h>
 #include <drm/drm_mode.h>
-
 #include <drm/drm_fourcc.h>
 
 struct drm_device;
@@ -65,130 +64,14 @@ struct drm_object_properties {
         uint64_t values[DRM_OBJECT_MAX_PROPERTY];
 };
 
-/*
- * Note on terminology:  here, for brevity and convenience, we refer to connector
- * control chips as 'CRTCs'.  They can control any type of connector, VGA, LVDS,
- * DVI, etc.  And 'screen' refers to the whole of the visible display, which
- * may span multiple monitors (and therefore multiple CRTC and connector
- * structures).
- */
-
-enum drm_mode_status {
-    MODE_OK     = 0,    /* Mode OK */
-    MODE_HSYNC,         /* hsync out of range */
-    MODE_VSYNC,         /* vsync out of range */
-    MODE_H_ILLEGAL,     /* mode has illegal horizontal timings */
-    MODE_V_ILLEGAL,     /* mode has illegal horizontal timings */
-    MODE_BAD_WIDTH,     /* requires an unsupported linepitch */
-    MODE_NOMODE,        /* no mode with a matching name */
-    MODE_NO_INTERLACE,  /* interlaced mode not supported */
-    MODE_NO_DBLESCAN,   /* doublescan mode not supported */
-    MODE_NO_VSCAN,      /* multiscan mode not supported */
-    MODE_MEM,           /* insufficient video memory */
-    MODE_VIRTUAL_X,     /* mode width too large for specified virtual size */
-    MODE_VIRTUAL_Y,     /* mode height too large for specified virtual size */
-    MODE_MEM_VIRT,      /* insufficient video memory given virtual size */
-    MODE_NOCLOCK,       /* no fixed clock available */
-    MODE_CLOCK_HIGH,    /* clock required is too high */
-    MODE_CLOCK_LOW,     /* clock required is too low */
-    MODE_CLOCK_RANGE,   /* clock/mode isn't in a ClockRange */
-    MODE_BAD_HVALUE,    /* horizontal timing was out of range */
-    MODE_BAD_VVALUE,    /* vertical timing was out of range */
-    MODE_BAD_VSCAN,     /* VScan value out of range */
-    MODE_HSYNC_NARROW,  /* horizontal sync too narrow */
-    MODE_HSYNC_WIDE,    /* horizontal sync too wide */
-    MODE_HBLANK_NARROW, /* horizontal blanking too narrow */
-    MODE_HBLANK_WIDE,   /* horizontal blanking too wide */
-    MODE_VSYNC_NARROW,  /* vertical sync too narrow */
-    MODE_VSYNC_WIDE,    /* vertical sync too wide */
-    MODE_VBLANK_NARROW, /* vertical blanking too narrow */
-    MODE_VBLANK_WIDE,   /* vertical blanking too wide */
-    MODE_PANEL,         /* exceeds panel dimensions */
-    MODE_INTERLACE_WIDTH, /* width too large for interlaced mode */
-    MODE_ONE_WIDTH,     /* only one width is supported */
-    MODE_ONE_HEIGHT,    /* only one height is supported */
-    MODE_ONE_SIZE,      /* only one resolution is supported */
-    MODE_NO_REDUCED,    /* monitor doesn't accept reduced blanking */
-    MODE_NO_STEREO,     /* stereo modes not supported */
-    MODE_UNVERIFIED = -3, /* mode needs to reverified */
-    MODE_BAD = -2,      /* unspecified reason */
-    MODE_ERROR  = -1    /* error condition */
-};
-
-#define DRM_MODE_TYPE_CLOCK_CRTC_C (DRM_MODE_TYPE_CLOCK_C | \
-                                    DRM_MODE_TYPE_CRTC_C)
-
-#define DRM_MODE(nm, t, c, hd, hss, hse, ht, hsk, vd, vss, vse, vt, vs, f) \
-        .name = nm, .status = 0, .type = (t), .clock = (c), \
-        .hdisplay = (hd), .hsync_start = (hss), .hsync_end = (hse), \
-        .htotal = (ht), .hskew = (hsk), .vdisplay = (vd), \
-        .vsync_start = (vss), .vsync_end = (vse), .vtotal = (vt), \
-        .vscan = (vs), .flags = (f), \
-        .base.type = DRM_MODE_OBJECT_MODE
-
-#define CRTC_INTERLACE_HALVE_V  (1 << 0) /* halve V values for interlacing */
-#define CRTC_STEREO_DOUBLE      (1 << 1) /* adjust timings for stereo modes */
-
-#define DRM_MODE_FLAG_3D_MAX    DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF
-
-struct drm_display_mode {
-        /* Header */
-        struct list_head head;
-        struct drm_mode_object base;
-
-        char name[DRM_DISPLAY_MODE_LEN];
-
-        enum drm_mode_status status;
-        unsigned int type;
-
-        /* Proposed mode values */
-        int clock;              /* in kHz */
-        int hdisplay;
-        int hsync_start;
-        int hsync_end;
-        int htotal;
-        int hskew;
-        int vdisplay;
-        int vsync_start;
-        int vsync_end;
-        int vtotal;
-        int vscan;
-        unsigned int flags;
-
-        /* Addressable image size (may be 0 for projectors, etc.) */
-        int width_mm;
-        int height_mm;
-
-        /* Actual mode we give to hw */
-        int crtc_clock;         /* in KHz */
-        int crtc_hdisplay;
-        int crtc_hblank_start;
-        int crtc_hblank_end;
-        int crtc_hsync_start;
-        int crtc_hsync_end;
-        int crtc_htotal;
-        int crtc_hskew;
-        int crtc_vdisplay;
-        int crtc_vblank_start;
-        int crtc_vblank_end;
-        int crtc_vsync_start;
-        int crtc_vsync_end;
-        int crtc_vtotal;
-
-        /* Driver private mode info */
-        int private_size;
-        int *private;
-        int private_flags;
-
-        int vrefresh;           /* in Hz */
-        int hsync;              /* in kHz */
-        enum hdmi_picture_aspect picture_aspect_ratio;
+enum drm_connector_force {
+        DRM_FORCE_UNSPECIFIED,
+        DRM_FORCE_OFF,
+        DRM_FORCE_ON,         /* force on analog part normally */
+        DRM_FORCE_ON_DIGITAL, /* for DVI-I use digital connector */
 };
 
-static inline bool drm_mode_is_stereo(const struct drm_display_mode *mode)
-{
-        return mode->flags & DRM_MODE_FLAG_3D_MASK;
-}
+#include <drm/drm_modes.h>
 
 enum drm_connector_status {
         connector_status_connected = 1,
@@ -540,13 +423,6 @@ struct drm_encoder {
         void *helper_private;
 };
 
-enum drm_connector_force {
-        DRM_FORCE_UNSPECIFIED,
-        DRM_FORCE_OFF,
-        DRM_FORCE_ON,         /* force on analog part normally */
-        DRM_FORCE_ON_DIGITAL, /* for DVI-I use digital connector */
-};
-
 /* should we poll this connector for connects and disconnects */
 /* hot plug detectable */
 #define DRM_CONNECTOR_POLL_HPD (1 << 0)
@@ -1007,34 +883,10 @@ extern struct edid *drm_get_edid(struct drm_connector *connector,
                                  struct i2c_adapter *adapter);
 extern struct edid *drm_edid_duplicate(const struct edid *edid);
 extern int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid);
-extern void drm_mode_probed_add(struct drm_connector *connector, struct drm_display_mode *mode);
-extern void drm_mode_copy(struct drm_display_mode *dst, const struct drm_display_mode *src);
-extern struct drm_display_mode *drm_mode_duplicate(struct drm_device *dev,
-                                                   const struct drm_display_mode *mode);
-extern void drm_mode_debug_printmodeline(const struct drm_display_mode *mode);
 extern void drm_mode_config_init(struct drm_device *dev);
 extern void drm_mode_config_reset(struct drm_device *dev);
 extern void drm_mode_config_cleanup(struct drm_device *dev);
-extern void drm_mode_set_name(struct drm_display_mode *mode);
-extern bool drm_mode_equal(const struct drm_display_mode *mode1, const struct drm_display_mode *mode2);
-extern bool drm_mode_equal_no_clocks_no_stereo(const struct drm_display_mode *mode1, const struct drm_display_mode *mode2);
-extern int drm_mode_width(const struct drm_display_mode *mode);
-extern int drm_mode_height(const struct drm_display_mode *mode);
-
-/* for us by fb module */
-extern struct drm_display_mode *drm_mode_create(struct drm_device *dev);
-extern void drm_mode_destroy(struct drm_device *dev, struct drm_display_mode *mode);
-extern void drm_mode_validate_size(struct drm_device *dev,
-                                   struct list_head *mode_list,
-                                   int maxX, int maxY, int maxPitch);
-extern void drm_mode_prune_invalid(struct drm_device *dev,
-                                   struct list_head *mode_list, bool verbose);
-extern void drm_mode_sort(struct list_head *mode_list);
-extern int drm_mode_hsync(const struct drm_display_mode *mode);
-extern int drm_mode_vrefresh(const struct drm_display_mode *mode);
-extern void drm_mode_set_crtcinfo(struct drm_display_mode *p,
-                                  int adjust_flags);
-extern void drm_mode_connector_list_update(struct drm_connector *connector);
+
 extern int drm_mode_connector_update_edid_property(struct drm_connector *connector,
                                                 struct edid *edid);
 extern int drm_object_property_set_value(struct drm_mode_object *obj,
@@ -1082,8 +934,6 @@ extern const char *drm_get_encoder_name(const struct drm_encoder *encoder);
 
 extern int drm_mode_connector_attach_encoder(struct drm_connector *connector,
                                              struct drm_encoder *encoder);
-extern void drm_mode_connector_detach_encoder(struct drm_connector *connector,
-                                           struct drm_encoder *encoder);
 extern int drm_mode_crtc_set_gamma_size(struct drm_crtc *crtc,
                                          int gamma_size);
 extern struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
@@ -1138,16 +988,6 @@ extern bool drm_detect_monitor_audio(struct edid *edid);
 extern bool drm_rgb_quant_range_selectable(struct edid *edid);
 extern int drm_mode_page_flip_ioctl(struct drm_device *dev,
                                     void *data, struct drm_file *file_priv);
-extern struct drm_display_mode *drm_cvt_mode(struct drm_device *dev,
-                                int hdisplay, int vdisplay, int vrefresh,
-                                bool reduced, bool interlaced, bool margins);
-extern struct drm_display_mode *drm_gtf_mode(struct drm_device *dev,
-                                int hdisplay, int vdisplay, int vrefresh,
-                                bool interlaced, int margins);
-extern struct drm_display_mode *drm_gtf_mode_complex(struct drm_device *dev,
-                                int hdisplay, int vdisplay, int vrefresh,
-                                bool interlaced, int margins, int GTF_M,
-                                int GTF_2C, int GTF_K, int GTF_2J);
 extern int drm_add_modes_noedid(struct drm_connector *connector,
                                 int hdisplay, int vdisplay);
 extern void drm_set_preferred_mode(struct drm_connector *connector,
diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
index b1388b5fe7ac..0bb34ca2ad2b 100644
--- a/include/drm/drm_crtc_helper.h
+++ b/include/drm/drm_crtc_helper.h
@@ -139,8 +139,8 @@ extern void drm_helper_connector_dpms(struct drm_connector *connector, int mode)
 
 extern void drm_helper_move_panel_connectors_to_head(struct drm_device *);
 
-extern int drm_helper_mode_fill_fb_struct(struct drm_framebuffer *fb,
-                                          struct drm_mode_fb_cmd2 *mode_cmd);
+extern void drm_helper_mode_fill_fb_struct(struct drm_framebuffer *fb,
+                                           struct drm_mode_fb_cmd2 *mode_cmd);
 
 static inline void drm_crtc_helper_add(struct drm_crtc *crtc,
                                        const struct drm_crtc_helper_funcs *funcs)
@@ -160,7 +160,7 @@ static inline void drm_connector_helper_add(struct drm_connector *connector,
         connector->helper_private = (void *)funcs;
 }
 
-extern int drm_helper_resume_force_mode(struct drm_device *dev);
+extern void drm_helper_resume_force_mode(struct drm_device *dev);
 extern void drm_kms_helper_poll_init(struct drm_device *dev);
 extern void drm_kms_helper_poll_fini(struct drm_device *dev);
 extern bool drm_helper_hpd_irq_event(struct drm_device *dev);
diff --git a/include/drm/drm_dp_helper.h b/include/drm/drm_dp_helper.h
index 73c3d1f2b20d..b4f58914bf7d 100644
--- a/include/drm/drm_dp_helper.h
+++ b/include/drm/drm_dp_helper.h
@@ -301,6 +301,7 @@
 #define DP_SET_POWER                        0x600
 # define DP_SET_POWER_D0                    0x1
 # define DP_SET_POWER_D3                    0x2
+# define DP_SET_POWER_MASK                  0x3
 
 #define DP_PSR_ERROR_STATUS                 0x2006  /* XXX 1.2? */
 # define DP_PSR_LINK_CRC_ERROR              (1 << 0)
@@ -408,4 +409,118 @@ drm_dp_enhanced_frame_cap(const u8 dpcd[DP_RECEIVER_CAP_SIZE])
                 (dpcd[DP_MAX_LANE_COUNT] & DP_ENHANCED_FRAME_CAP);
 }
 
+/*
+ * DisplayPort AUX channel
+ */
+
+/**
+ * struct drm_dp_aux_msg - DisplayPort AUX channel transaction
+ * @address: address of the (first) register to access
+ * @request: contains the type of transaction (see DP_AUX_* macros)
+ * @reply: upon completion, contains the reply type of the transaction
+ * @buffer: pointer to a transmission or reception buffer
+ * @size: size of @buffer
+ */
+struct drm_dp_aux_msg {
+        unsigned int address;
+        u8 request;
+        u8 reply;
+        void *buffer;
+        size_t size;
+};
+
+/**
+ * struct drm_dp_aux - DisplayPort AUX channel
+ * @ddc: I2C adapter that can be used for I2C-over-AUX communication
+ * @dev: pointer to struct device that is the parent for this AUX channel
+ * @transfer: transfers a message representing a single AUX transaction
+ *
+ * The .dev field should be set to a pointer to the device that implements
+ * the AUX channel.
+ *
+ * The .name field may be used to specify the name of the I2C adapter. If set to
+ * NULL, dev_name() of .dev will be used.
+ *
+ * Drivers provide a hardware-specific implementation of how transactions
+ * are executed via the .transfer() function. A pointer to a drm_dp_aux_msg
+ * structure describing the transaction is passed into this function. Upon
+ * success, the implementation should return the number of payload bytes
+ * that were transferred, or a negative error-code on failure. Helpers
+ * propagate errors from the .transfer() function, with the exception of
+ * the -EBUSY error, which causes a transaction to be retried. On a short,
+ * helpers will return -EPROTO to make it simpler to check for failure.
+ *
+ * An AUX channel can also be used to transport I2C messages to a sink. A
+ * typical application of that is to access an EDID that's present in the
+ * sink device. The .transfer() function can also be used to execute such
+ * transactions. The drm_dp_aux_register_i2c_bus() function registers an
+ * I2C adapter that can be passed to drm_probe_ddc(). Upon removal, drivers
+ * should call drm_dp_aux_unregister_i2c_bus() to remove the I2C adapter.
+ */
+struct drm_dp_aux {
+        const char *name;
+        struct i2c_adapter ddc;
+        struct device *dev;
+
+        ssize_t (*transfer)(struct drm_dp_aux *aux,
+                            struct drm_dp_aux_msg *msg);
+};
+
+ssize_t drm_dp_dpcd_read(struct drm_dp_aux *aux, unsigned int offset,
+                         void *buffer, size_t size);
+ssize_t drm_dp_dpcd_write(struct drm_dp_aux *aux, unsigned int offset,
+                          void *buffer, size_t size);
+
+/**
+ * drm_dp_dpcd_readb() - read a single byte from the DPCD
+ * @aux: DisplayPort AUX channel
+ * @offset: address of the register to read
+ * @valuep: location where the value of the register will be stored
+ *
+ * Returns the number of bytes transferred (1) on success, or a negative
+ * error code on failure.
+ */
+static inline ssize_t drm_dp_dpcd_readb(struct drm_dp_aux *aux,
+                                        unsigned int offset, u8 *valuep)
+{
+        return drm_dp_dpcd_read(aux, offset, valuep, 1);
+}
+
+/**
+ * drm_dp_dpcd_writeb() - write a single byte to the DPCD
+ * @aux: DisplayPort AUX channel
+ * @offset: address of the register to write
+ * @value: value to write to the register
+ *
+ * Returns the number of bytes transferred (1) on success, or a negative
+ * error code on failure.
+ */
+static inline ssize_t drm_dp_dpcd_writeb(struct drm_dp_aux *aux,
+                                         unsigned int offset, u8 value)
+{
+        return drm_dp_dpcd_write(aux, offset, &value, 1);
+}
+
+int drm_dp_dpcd_read_link_status(struct drm_dp_aux *aux,
+                                 u8 status[DP_LINK_STATUS_SIZE]);
+
+/*
+ * DisplayPort link
+ */
+#define DP_LINK_CAP_ENHANCED_FRAMING (1 << 0)
+
+struct drm_dp_link {
+        unsigned char revision;
+        unsigned int rate;
+        unsigned int num_lanes;
+        unsigned long capabilities;
+};
+
+int drm_dp_link_probe(struct drm_dp_aux *aux, struct drm_dp_link *link);
+int drm_dp_link_power_up(struct drm_dp_aux *aux, struct drm_dp_link *link);
+int drm_dp_link_configure(struct drm_dp_aux *aux, struct drm_dp_link *link);
+
+int drm_dp_aux_register_i2c_bus(struct drm_dp_aux *aux);
+void drm_dp_aux_unregister_i2c_bus(struct drm_dp_aux *aux);
+
 #endif /* _DRM_DP_HELPER_H_ */
diff --git a/include/drm/drm_mm.h b/include/drm/drm_mm.h
index cba67865d18f..8b6981ab3fcf 100644
--- a/include/drm/drm_mm.h
+++ b/include/drm/drm_mm.h
@@ -85,11 +85,31 @@ struct drm_mm {
                              unsigned long *start, unsigned long *end);
 };
 
+/**
+ * drm_mm_node_allocated - checks whether a node is allocated
+ * @node: drm_mm_node to check
+ *
+ * Drivers should use this helpers for proper encapusulation of drm_mm
+ * internals.
+ *
+ * Returns:
+ * True if the @node is allocated.
+ */
 static inline bool drm_mm_node_allocated(struct drm_mm_node *node)
 {
         return node->allocated;
 }
 
+/**
+ * drm_mm_initialized - checks whether an allocator is initialized
+ * @mm: drm_mm to check
+ *
+ * Drivers should use this helpers for proper encapusulation of drm_mm
+ * internals.
+ *
+ * Returns:
+ * True if the @mm is initialized.
+ */
 static inline bool drm_mm_initialized(struct drm_mm *mm)
 {
         return mm->hole_stack.next;
@@ -100,6 +120,17 @@ static inline unsigned long __drm_mm_hole_node_start(struct drm_mm_node *hole_no
         return hole_node->start + hole_node->size;
 }
 
+/**
+ * drm_mm_hole_node_start - computes the start of the hole following @node
+ * @hole_node: drm_mm_node which implicitly tracks the following hole
+ *
+ * This is useful for driver-sepific debug dumpers. Otherwise drivers should not
+ * inspect holes themselves. Drivers must check first whether a hole indeed
+ * follows by looking at node->hole_follows.
+ *
+ * Returns:
+ * Start of the subsequent hole.
+ */
 static inline unsigned long drm_mm_hole_node_start(struct drm_mm_node *hole_node)
 {
         BUG_ON(!hole_node->hole_follows);
@@ -112,18 +143,49 @@ static inline unsigned long __drm_mm_hole_node_end(struct drm_mm_node *hole_node
                           struct drm_mm_node, node_list)->start;
 }
 
+/**
+ * drm_mm_hole_node_end - computes the end of the hole following @node
+ * @hole_node: drm_mm_node which implicitly tracks the following hole
+ *
+ * This is useful for driver-sepific debug dumpers. Otherwise drivers should not
+ * inspect holes themselves. Drivers must check first whether a hole indeed
+ * follows by looking at node->hole_follows.
+ *
+ * Returns:
+ * End of the subsequent hole.
+ */
 static inline unsigned long drm_mm_hole_node_end(struct drm_mm_node *hole_node)
 {
         return __drm_mm_hole_node_end(hole_node);
 }
 
+/**
+ * drm_mm_for_each_node - iterator to walk over all allocated nodes
+ * @entry: drm_mm_node structure to assign to in each iteration step
+ * @mm: drm_mm allocator to walk
+ *
+ * This iterator walks over all nodes in the range allocator. It is implemented
+ * with list_for_each, so not save against removal of elements.
+ */
 #define drm_mm_for_each_node(entry, mm) list_for_each_entry(entry, \
                                                 &(mm)->head_node.node_list, \
                                                 node_list)
 
-/* Note that we need to unroll list_for_each_entry in order to inline
- * setting hole_start and hole_end on each iteration and keep the
- * macro sane.
+/**
+ * drm_mm_for_each_hole - iterator to walk over all holes
+ * @entry: drm_mm_node used internally to track progress
+ * @mm: drm_mm allocator to walk
+ * @hole_start: ulong variable to assign the hole start to on each iteration
+ * @hole_end: ulong variable to assign the hole end to on each iteration
+ *
+ * This iterator walks over all holes in the range allocator. It is implemented
+ * with list_for_each, so not save against removal of elements. @entry is used
+ * internally and will not reflect a real drm_mm_node for the very first hole.
+ * Hence users of this iterator may not access it.
+ *
+ * Implementation Note:
+ * We need to inline list_for_each_entry in order to be able to set hole_start
+ * and hole_end on each iteration while keeping the macro sane.
  */
 #define drm_mm_for_each_hole(entry, mm, hole_start, hole_end) \
         for (entry = list_entry((mm)->hole_stack.next, struct drm_mm_node, hole_stack); \
@@ -136,14 +198,30 @@ static inline unsigned long drm_mm_hole_node_end(struct drm_mm_node *hole_node)
 /*
  * Basic range manager support (drm_mm.c)
  */
-extern int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node);
-
-extern int drm_mm_insert_node_generic(struct drm_mm *mm,
-                                      struct drm_mm_node *node,
-                                      unsigned long size,
-                                      unsigned alignment,
-                                      unsigned long color,
-                                      enum drm_mm_search_flags flags);
+int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node);
+
+int drm_mm_insert_node_generic(struct drm_mm *mm,
+                               struct drm_mm_node *node,
+                               unsigned long size,
+                               unsigned alignment,
+                               unsigned long color,
+                               enum drm_mm_search_flags flags);
+/**
+ * drm_mm_insert_node - search for space and insert @node
+ * @mm: drm_mm to allocate from
+ * @node: preallocate node to insert
+ * @size: size of the allocation
+ * @alignment: alignment of the allocation
+ * @flags: flags to fine-tune the allocation
+ *
+ * This is a simplified version of drm_mm_insert_node_generic() with @color set
+ * to 0.
+ *
+ * The preallocated node must be cleared to 0.
+ *
+ * Returns:
+ * 0 on success, -ENOSPC if there's no suitable hole.
+ */
 static inline int drm_mm_insert_node(struct drm_mm *mm,
                                      struct drm_mm_node *node,
                                      unsigned long size,
@@ -153,14 +231,32 @@ static inline int drm_mm_insert_node(struct drm_mm *mm,
         return drm_mm_insert_node_generic(mm, node, size, alignment, 0, flags);
 }
 
-extern int drm_mm_insert_node_in_range_generic(struct drm_mm *mm,
-                                       struct drm_mm_node *node,
-                                       unsigned long size,
-                                       unsigned alignment,
-                                       unsigned long color,
-                                       unsigned long start,
-                                       unsigned long end,
-                                       enum drm_mm_search_flags flags);
+int drm_mm_insert_node_in_range_generic(struct drm_mm *mm,
+                                        struct drm_mm_node *node,
+                                        unsigned long size,
+                                        unsigned alignment,
+                                        unsigned long color,
+                                        unsigned long start,
+                                        unsigned long end,
+                                        enum drm_mm_search_flags flags);
+/**
+ * drm_mm_insert_node_in_range - ranged search for space and insert @node
+ * @mm: drm_mm to allocate from
+ * @node: preallocate node to insert
+ * @size: size of the allocation
+ * @alignment: alignment of the allocation
+ * @start: start of the allowed range for this node
+ * @end: end of the allowed range for this node
+ * @flags: flags to fine-tune the allocation
+ *
+ * This is a simplified version of drm_mm_insert_node_in_range_generic() with
+ * @color set to 0.
+ *
+ * The preallocated node must be cleared to 0.
+ *
+ * Returns:
+ * 0 on success, -ENOSPC if there's no suitable hole.
+ */
 static inline int drm_mm_insert_node_in_range(struct drm_mm *mm,
                                               struct drm_mm_node *node,
                                               unsigned long size,
@@ -173,13 +269,13 @@ static inline int drm_mm_insert_node_in_range(struct drm_mm *mm,
                                                    0, start, end, flags);
 }
 
-extern void drm_mm_remove_node(struct drm_mm_node *node);
-extern void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new);
-extern void drm_mm_init(struct drm_mm *mm,
-                        unsigned long start,
-                        unsigned long size);
-extern void drm_mm_takedown(struct drm_mm *mm);
-extern int drm_mm_clean(struct drm_mm *mm);
+void drm_mm_remove_node(struct drm_mm_node *node);
+void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new);
+void drm_mm_init(struct drm_mm *mm,
+                 unsigned long start,
+                 unsigned long size);
+void drm_mm_takedown(struct drm_mm *mm);
+bool drm_mm_clean(struct drm_mm *mm);
 
 void drm_mm_init_scan(struct drm_mm *mm,
                       unsigned long size,
@@ -191,10 +287,10 @@ void drm_mm_init_scan_with_range(struct drm_mm *mm,
                                  unsigned long color,
                                  unsigned long start,
                                  unsigned long end);
-int drm_mm_scan_add_block(struct drm_mm_node *node);
-int drm_mm_scan_remove_block(struct drm_mm_node *node);
+bool drm_mm_scan_add_block(struct drm_mm_node *node);
+bool drm_mm_scan_remove_block(struct drm_mm_node *node);
 
-extern void drm_mm_debug_table(struct drm_mm *mm, const char *prefix);
+void drm_mm_debug_table(struct drm_mm *mm, const char *prefix);
 #ifdef CONFIG_DEBUG_FS
 int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm);
 #endif
diff --git a/include/drm/drm_modes.h b/include/drm/drm_modes.h
new file mode 100644
index 000000000000..2dbbf9976669
--- /dev/null
+++ b/include/drm/drm_modes.h
@@ -0,0 +1,237 @@
+/*
+ * Copyright © 2006 Keith Packard
+ * Copyright © 2007-2008 Dave Airlie
+ * Copyright © 2007-2008 Intel Corporation
+ *   Jesse Barnes <jesse.barnes@intel.com>
+ * Copyright © 2014 Intel Corporation
+ *   Daniel Vetter <daniel.vetter@ffwll.ch>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifndef __DRM_MODES_H__
+#define __DRM_MODES_H__
+
+/*
+ * Note on terminology:  here, for brevity and convenience, we refer to connector
+ * control chips as 'CRTCs'.  They can control any type of connector, VGA, LVDS,
+ * DVI, etc.  And 'screen' refers to the whole of the visible display, which
+ * may span multiple monitors (and therefore multiple CRTC and connector
+ * structures).
+ */
+
+enum drm_mode_status {
+    MODE_OK     = 0,    /* Mode OK */
+    MODE_HSYNC,         /* hsync out of range */
+    MODE_VSYNC,         /* vsync out of range */
+    MODE_H_ILLEGAL,     /* mode has illegal horizontal timings */
+    MODE_V_ILLEGAL,     /* mode has illegal horizontal timings */
+    MODE_BAD_WIDTH,     /* requires an unsupported linepitch */
+    MODE_NOMODE,        /* no mode with a matching name */
+    MODE_NO_INTERLACE,  /* interlaced mode not supported */
+    MODE_NO_DBLESCAN,   /* doublescan mode not supported */
+    MODE_NO_VSCAN,      /* multiscan mode not supported */
+    MODE_MEM,           /* insufficient video memory */
+    MODE_VIRTUAL_X,     /* mode width too large for specified virtual size */
+    MODE_VIRTUAL_Y,     /* mode height too large for specified virtual size */
+    MODE_MEM_VIRT,      /* insufficient video memory given virtual size */
+    MODE_NOCLOCK,       /* no fixed clock available */
+    MODE_CLOCK_HIGH,    /* clock required is too high */
+    MODE_CLOCK_LOW,     /* clock required is too low */
+    MODE_CLOCK_RANGE,   /* clock/mode isn't in a ClockRange */
+    MODE_BAD_HVALUE,    /* horizontal timing was out of range */
+    MODE_BAD_VVALUE,    /* vertical timing was out of range */
+    MODE_BAD_VSCAN,     /* VScan value out of range */
+    MODE_HSYNC_NARROW,  /* horizontal sync too narrow */
+    MODE_HSYNC_WIDE,    /* horizontal sync too wide */
+    MODE_HBLANK_NARROW, /* horizontal blanking too narrow */
+    MODE_HBLANK_WIDE,   /* horizontal blanking too wide */
+    MODE_VSYNC_NARROW,  /* vertical sync too narrow */
+    MODE_VSYNC_WIDE,    /* vertical sync too wide */
+    MODE_VBLANK_NARROW, /* vertical blanking too narrow */
+    MODE_VBLANK_WIDE,   /* vertical blanking too wide */
+    MODE_PANEL,         /* exceeds panel dimensions */
+    MODE_INTERLACE_WIDTH, /* width too large for interlaced mode */
+    MODE_ONE_WIDTH,     /* only one width is supported */
+    MODE_ONE_HEIGHT,    /* only one height is supported */
+    MODE_ONE_SIZE,      /* only one resolution is supported */
+    MODE_NO_REDUCED,    /* monitor doesn't accept reduced blanking */
+    MODE_NO_STEREO,     /* stereo modes not supported */
+    MODE_UNVERIFIED = -3, /* mode needs to reverified */
+    MODE_BAD = -2,      /* unspecified reason */
+    MODE_ERROR  = -1    /* error condition */
+};
+
+#define DRM_MODE_TYPE_CLOCK_CRTC_C (DRM_MODE_TYPE_CLOCK_C | \
+                                    DRM_MODE_TYPE_CRTC_C)
+
+#define DRM_MODE(nm, t, c, hd, hss, hse, ht, hsk, vd, vss, vse, vt, vs, f) \
+        .name = nm, .status = 0, .type = (t), .clock = (c), \
+        .hdisplay = (hd), .hsync_start = (hss), .hsync_end = (hse), \
+        .htotal = (ht), .hskew = (hsk), .vdisplay = (vd), \
+        .vsync_start = (vss), .vsync_end = (vse), .vtotal = (vt), \
+        .vscan = (vs), .flags = (f), \
+        .base.type = DRM_MODE_OBJECT_MODE
+
+#define CRTC_INTERLACE_HALVE_V  (1 << 0) /* halve V values for interlacing */
+#define CRTC_STEREO_DOUBLE      (1 << 1) /* adjust timings for stereo modes */
+
+#define DRM_MODE_FLAG_3D_MAX    DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF
+
+struct drm_display_mode {
+        /* Header */
+        struct list_head head;
+        struct drm_mode_object base;
+
+        char name[DRM_DISPLAY_MODE_LEN];
+
+        enum drm_mode_status status;
+        unsigned int type;
+
+        /* Proposed mode values */
+        int clock;              /* in kHz */
+        int hdisplay;
+        int hsync_start;
+        int hsync_end;
+        int htotal;
+        int hskew;
+        int vdisplay;
+        int vsync_start;
+        int vsync_end;
+        int vtotal;
+        int vscan;
+        unsigned int flags;
+
+        /* Addressable image size (may be 0 for projectors, etc.) */
+        int width_mm;
+        int height_mm;
+
+        /* Actual mode we give to hw */
+        int crtc_clock;         /* in KHz */
+        int crtc_hdisplay;
+        int crtc_hblank_start;
+        int crtc_hblank_end;
+        int crtc_hsync_start;
+        int crtc_hsync_end;
+        int crtc_htotal;
+        int crtc_hskew;
+        int crtc_vdisplay;
+        int crtc_vblank_start;
+        int crtc_vblank_end;
+        int crtc_vsync_start;
+        int crtc_vsync_end;
+        int crtc_vtotal;
+
+        /* Driver private mode info */
+        int *private;
+        int private_flags;
+
+        int vrefresh;           /* in Hz */
+        int hsync;              /* in kHz */
+        enum hdmi_picture_aspect picture_aspect_ratio;
+};
+
+/* mode specified on the command line */
+struct drm_cmdline_mode {
+        bool specified;
+        bool refresh_specified;
+        bool bpp_specified;
+        int xres, yres;
+        int bpp;
+        int refresh;
+        bool rb;
+        bool interlace;
+        bool cvt;
+        bool margins;
+        enum drm_connector_force force;
+};
+
+/**
+ * drm_mode_is_stereo - check for stereo mode flags
+ * @mode: drm_display_mode to check
+ *
+ * Returns:
+ * True if the mode is one of the stereo modes (like side-by-side), false if
+ * not.
+ */
+static inline bool drm_mode_is_stereo(const struct drm_display_mode *mode)
+{
+        return mode->flags & DRM_MODE_FLAG_3D_MASK;
+}
+
+struct drm_connector;
+struct drm_cmdline_mode;
+
+struct drm_display_mode *drm_mode_create(struct drm_device *dev);
+void drm_mode_destroy(struct drm_device *dev, struct drm_display_mode *mode);
+void drm_mode_probed_add(struct drm_connector *connector, struct drm_display_mode *mode);
+void drm_mode_debug_printmodeline(const struct drm_display_mode *mode);
+
+struct drm_display_mode *drm_cvt_mode(struct drm_device *dev,
+                                      int hdisplay, int vdisplay, int vrefresh,
+                                      bool reduced, bool interlaced,
+                                      bool margins);
+struct drm_display_mode *drm_gtf_mode(struct drm_device *dev,
+                                      int hdisplay, int vdisplay, int vrefresh,
+                                      bool interlaced, int margins);
+struct drm_display_mode *drm_gtf_mode_complex(struct drm_device *dev,
+                                              int hdisplay, int vdisplay,
+                                              int vrefresh, bool interlaced,
+                                              int margins,
+                                              int GTF_M, int GTF_2C,
+                                              int GTF_K, int GTF_2J);
+void drm_display_mode_from_videomode(const struct videomode *vm,
+                                     struct drm_display_mode *dmode);
+int of_get_drm_display_mode(struct device_node *np,
+                            struct drm_display_mode *dmode,
+                            int index);
+
+void drm_mode_set_name(struct drm_display_mode *mode);
+int drm_mode_hsync(const struct drm_display_mode *mode);
+int drm_mode_vrefresh(const struct drm_display_mode *mode);
+
+void drm_mode_set_crtcinfo(struct drm_display_mode *p,
+                           int adjust_flags);
+void drm_mode_copy(struct drm_display_mode *dst,
+                   const struct drm_display_mode *src);
+struct drm_display_mode *drm_mode_duplicate(struct drm_device *dev,
+                                            const struct drm_display_mode *mode);
+bool drm_mode_equal(const struct drm_display_mode *mode1,
+                    const struct drm_display_mode *mode2);
+bool drm_mode_equal_no_clocks_no_stereo(const struct drm_display_mode *mode1,
+                                        const struct drm_display_mode *mode2);
+
+/* for use by the crtc helper probe functions */
+void drm_mode_validate_size(struct drm_device *dev,
+                            struct list_head *mode_list,
+                            int maxX, int maxY);
+void drm_mode_prune_invalid(struct drm_device *dev,
+                            struct list_head *mode_list, bool verbose);
+void drm_mode_sort(struct list_head *mode_list);
+void drm_mode_connector_list_update(struct drm_connector *connector);
+
+/* parsing cmdline modes */
+bool
+drm_mode_parse_command_line_for_connector(const char *mode_option,
+                                          struct drm_connector *connector,
+                                          struct drm_cmdline_mode *mode);
+struct drm_display_mode *
+drm_mode_create_from_cmdline_mode(struct drm_device *dev,
+                                  struct drm_cmdline_mode *cmd);
+
+#endif /* __DRM_MODES_H__ */
diff --git a/include/drm/drm_vma_manager.h b/include/drm/drm_vma_manager.h
index c18a593d1744..8cd402c73a5f 100644
--- a/include/drm/drm_vma_manager.h
+++ b/include/drm/drm_vma_manager.h
@@ -221,8 +221,8 @@ static inline __u64 drm_vma_node_offset_addr(struct drm_vma_offset_node *node)
  * @file_mapping: Address space to unmap @node from
  *
  * Unmap all userspace mappings for a given offset node. The mappings must be
- * associated with the @file_mapping address-space. If no offset exists or
- * the address-space is invalid, nothing is done.
+ * associated with the @file_mapping address-space. If no offset exists
+ * nothing is done.
  *
  * This call is unlocked. The caller must guarantee that drm_vma_offset_remove()
  * is not called on this node concurrently.
@@ -230,7 +230,7 @@ static inline __u64 drm_vma_node_offset_addr(struct drm_vma_offset_node *node)
 static inline void drm_vma_node_unmap(struct drm_vma_offset_node *node,
                                       struct address_space *file_mapping)
 {
-        if (file_mapping && drm_vma_node_has_offset(node))
+        if (drm_vma_node_has_offset(node))
                 unmap_mapping_range(file_mapping,
                                     drm_vma_node_offset_addr(node),
                                     drm_vma_node_size(node) << PAGE_SHIFT, 1);
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 32d34ebf0706..5d8aabe68f6c 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -747,6 +747,7 @@ extern int ttm_bo_device_release(struct ttm_bo_device *bdev);
  * @bdev: A pointer to a struct ttm_bo_device to initialize.
  * @glob: A pointer to an initialized struct ttm_bo_global.
  * @driver: A pointer to a struct ttm_bo_driver set up by the caller.
+ * @mapping: The address space to use for this bo.
  * @file_page_offset: Offset into the device address space that is available
  * for buffer data. This ensures compatibility with other users of the
  * address space.
@@ -758,6 +759,7 @@ extern int ttm_bo_device_release(struct ttm_bo_device *bdev);
 extern int ttm_bo_device_init(struct ttm_bo_device *bdev,
                               struct ttm_bo_global *glob,
                               struct ttm_bo_driver *driver,
+                              struct address_space *mapping,
                               uint64_t file_page_offset, bool need_dma32);
 
 /**
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index be85127bfed3..f27000f55a83 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -171,6 +171,11 @@ static inline int kvm_vgic_set_addr(struct kvm *kvm, unsigned long type, u64 add
         return 0;
 }
 
+static inline int kvm_vgic_addr(struct kvm *kvm, unsigned long type, u64 *addr, bool write)
+{
+        return -ENXIO;
+}
+
 static inline int kvm_vgic_init(struct kvm *kvm)
 {
         return 0;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index aa865a9a4c4f..ec1464df4c60 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -43,6 +43,7 @@ struct mq_attr;
 struct mqstat;
 struct audit_watch;
 struct audit_tree;
+struct sk_buff;
 
 struct audit_krule {
         int                     vers_ops;
@@ -463,7 +464,7 @@ extern int audit_filter_user(int type);
 extern int audit_filter_type(int type);
 extern int audit_rule_change(int type, __u32 portid, int seq,
                                 void *data, size_t datasz);
-extern int audit_list_rules_send(__u32 portid, int seq);
+extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
 
 extern u32 audit_enabled;
 #else /* CONFIG_AUDIT */
diff --git a/include/linux/file.h b/include/linux/file.h
index cbacf4faf447..4d69123377a2 100644
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -28,33 +28,36 @@ static inline void fput_light(struct file *file, int fput_needed)
 
 struct fd {
         struct file *file;
-        int need_put;
+        unsigned int flags;
 };
+#define FDPUT_FPUT       1
+#define FDPUT_POS_UNLOCK 2
 
 static inline void fdput(struct fd fd)
 {
-        if (fd.need_put)
+        if (fd.flags & FDPUT_FPUT)
                 fput(fd.file);
 }
 
 extern struct file *fget(unsigned int fd);
-extern struct file *fget_light(unsigned int fd, int *fput_needed);
+extern struct file *fget_raw(unsigned int fd);
+extern unsigned long __fdget(unsigned int fd);
+extern unsigned long __fdget_raw(unsigned int fd);
+extern unsigned long __fdget_pos(unsigned int fd);
 
-static inline struct fd fdget(unsigned int fd)
+static inline struct fd __to_fd(unsigned long v)
 {
-        int b;
-        struct file *f = fget_light(fd, &b);
-        return (struct fd){f,b};
+        return (struct fd){(struct file *)(v & ~3),v & 3};
 }
 
-extern struct file *fget_raw(unsigned int fd);
-extern struct file *fget_raw_light(unsigned int fd, int *fput_needed);
+static inline struct fd fdget(unsigned int fd)
+{
+        return __to_fd(__fdget(fd));
+}
 
 static inline struct fd fdget_raw(unsigned int fd)
 {
-        int b;
-        struct file *f = fget_raw_light(fd, &b);
-        return (struct fd){f,b};
+        return __to_fd(__fdget_raw(fd));
 }
 
 extern int f_dupfd(unsigned int from, struct file *file, unsigned flags);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 60829565e552..23b2a35d712e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -123,6 +123,9 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 /* File is opened with O_PATH; almost nothing can be done with it */
 #define FMODE_PATH              ((__force fmode_t)0x4000)
 
+/* File needs atomic accesses to f_pos */
+#define FMODE_ATOMIC_POS        ((__force fmode_t)0x8000)
+
 /* File was opened by fanotify and shouldn't generate fanotify events */
 #define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
 
@@ -780,13 +783,14 @@ struct file {
         const struct file_operations    *f_op;
 
         /*
-         * Protects f_ep_links, f_flags, f_pos vs i_size in lseek SEEK_CUR.
+         * Protects f_ep_links, f_flags.
          * Must not be taken from IRQ context.
          */
         spinlock_t              f_lock;
         atomic_long_t           f_count;
         unsigned int            f_flags;
         fmode_t                 f_mode;
+        struct mutex            f_pos_lock;
         loff_t                  f_pos;
         struct fown_struct      f_owner;
         const struct cred       *f_cred;
@@ -808,7 +812,7 @@ struct file {
 #ifdef CONFIG_DEBUG_WRITECOUNT
         unsigned long f_mnt_write_state;
 #endif
-};
+} __attribute__((aligned(4)));  /* lest something weird decides that 2 is OK */
 
 struct file_handle {
         __u32 handle_bytes;
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 0437439bc047..39b81dc7d01a 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -123,6 +123,10 @@ struct vm_area_struct;
                          __GFP_NOMEMALLOC | __GFP_NORETRY | __GFP_NOWARN | \
                          __GFP_NO_KSWAPD)
 
+/*
+ * GFP_THISNODE does not perform any reclaim, you most likely want to
+ * use __GFP_THISNODE to allocate from a given node without fallback!
+ */
 #ifdef CONFIG_NUMA
 #define GFP_THISNODE    (__GFP_THISNODE | __GFP_NOWARN | __GFP_NORETRY)
 #else
diff --git a/include/linux/hdmi.h b/include/linux/hdmi.h
index 9231be9e90a2..11c0182a153b 100644
--- a/include/linux/hdmi.h
+++ b/include/linux/hdmi.h
@@ -262,6 +262,18 @@ union hdmi_vendor_any_infoframe {
         struct hdmi_vendor_infoframe hdmi;
 };
 
+/**
+ * union hdmi_infoframe - overall union of all abstract infoframe representations
+ * @any: generic infoframe
+ * @avi: avi infoframe
+ * @spd: spd infoframe
+ * @vendor: union of all vendor infoframes
+ * @audio: audio infoframe
+ *
+ * This is used by the generic pack function. This works since all infoframes
+ * have the same header which also indicates which type of infoframe should be
+ * packed.
+ */
 union hdmi_infoframe {
         struct hdmi_any_infoframe any;
         struct hdmi_avi_infoframe avi;
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 5f2052c83154..9b61b9bf81ac 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -590,10 +590,10 @@ static inline bool zone_is_empty(struct zone *zone)
 
 /*
  * The NUMA zonelists are doubled because we need zonelists that restrict the
- * allocations to a single node for GFP_THISNODE.
+ * allocations to a single node for __GFP_THISNODE.
  *
  * [0]  : Zonelist with fallback
- * [1]  : No fallback (GFP_THISNODE)
+ * [1]  : No fallback (__GFP_THISNODE)
  */
 #define MAX_ZONELISTS 2
 
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 9260abdd67df..b5b2df60299e 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -410,7 +410,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
  *
  * %GFP_NOWAIT - Allocation will not sleep.
  *
- * %GFP_THISNODE - Allocate node-local memory only.
+ * %__GFP_THISNODE - Allocate node-local memory only.
  *
  * %GFP_DMA - Allocation suitable for DMA.
  *   Should only be used for kmalloc() caches. Otherwise, use a
diff --git a/include/net/sock.h b/include/net/sock.h
index 5c3f7c3624aa..b9586a137cad 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1488,6 +1488,11 @@ static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
  */
 #define sock_owned_by_user(sk)  ((sk)->sk_lock.owned)
 
+static inline void sock_release_ownership(struct sock *sk)
+{
+        sk->sk_lock.owned = 0;
+}
+
 /*
  * Macro so as to not evaluate some arguments when
  * lockdep is not enabled.
@@ -2186,7 +2191,6 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
 {
 #define FLAGS_TS_OR_DROPS ((1UL << SOCK_RXQ_OVFL)                       | \
                            (1UL << SOCK_RCVTSTAMP)                      | \
-                           (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)       | \
                            (1UL << SOCK_TIMESTAMPING_SOFTWARE)          | \
                            (1UL << SOCK_TIMESTAMPING_RAW_HARDWARE)      | \
                            (1UL << SOCK_TIMESTAMPING_SYS_HARDWARE))
diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h
index d9ea3a73afe2..aefa2f6afa3b 100644
--- a/include/uapi/drm/radeon_drm.h
+++ b/include/uapi/drm/radeon_drm.h
@@ -510,6 +510,7 @@ typedef struct {
 #define DRM_RADEON_GEM_GET_TILING       0x29
 #define DRM_RADEON_GEM_BUSY             0x2a
 #define DRM_RADEON_GEM_VA               0x2b
+#define DRM_RADEON_GEM_OP               0x2c
 
 #define DRM_IOCTL_RADEON_CP_INIT    DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_CP_INIT, drm_radeon_init_t)
 #define DRM_IOCTL_RADEON_CP_START   DRM_IO(  DRM_COMMAND_BASE + DRM_RADEON_CP_START)
@@ -552,6 +553,7 @@ typedef struct {
 #define DRM_IOCTL_RADEON_GEM_GET_TILING DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_GET_TILING, struct drm_radeon_gem_get_tiling)
 #define DRM_IOCTL_RADEON_GEM_BUSY       DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_BUSY, struct drm_radeon_gem_busy)
 #define DRM_IOCTL_RADEON_GEM_VA         DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_VA, struct drm_radeon_gem_va)
+#define DRM_IOCTL_RADEON_GEM_OP         DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_OP, struct drm_radeon_gem_op)
 
 typedef struct drm_radeon_init {
         enum {
@@ -884,6 +886,16 @@ struct drm_radeon_gem_pwrite {
         uint64_t data_ptr;
 };
 
+/* Sets or returns a value associated with a buffer. */
+struct drm_radeon_gem_op {
+        uint32_t        handle; /* buffer */
+        uint32_t        op;     /* RADEON_GEM_OP_* */
+        uint64_t        value;  /* input or return value */
+};
+
+#define RADEON_GEM_OP_GET_INITIAL_DOMAIN        0
+#define RADEON_GEM_OP_SET_INITIAL_DOMAIN        1
+
 #define RADEON_VA_MAP                   1
 #define RADEON_VA_UNMAP                 2
 
@@ -919,6 +931,7 @@ struct drm_radeon_gem_va {
 #define RADEON_CS_RING_COMPUTE      1
 #define RADEON_CS_RING_DMA          2
 #define RADEON_CS_RING_UVD          3
+#define RADEON_CS_RING_VCE          4
 /* The third dword of RADEON_CHUNK_ID_FLAGS is a sint32 that sets the priority */
 /* 0 = normal, + = higher priority, - = lower priority */
 
@@ -987,6 +1000,13 @@ struct drm_radeon_cs {
 #define RADEON_INFO_SI_BACKEND_ENABLED_MASK     0x19
 /* max engine clock - needed for OpenCL */
 #define RADEON_INFO_MAX_SCLK            0x1a
+/* version of VCE firmware */
+#define RADEON_INFO_VCE_FW_VERSION      0x1b
+/* version of VCE feedback */
+#define RADEON_INFO_VCE_FB_VERSION      0x1c
+#define RADEON_INFO_NUM_BYTES_MOVED     0x1d
+#define RADEON_INFO_VRAM_USAGE          0x1e
+#define RADEON_INFO_GTT_USAGE           0x1f
 
 
 struct drm_radeon_info {
diff --git a/init/main.c b/init/main.c
index eb03090cdced..9c7fd4c9249f 100644
--- a/init/main.c
+++ b/init/main.c
@@ -561,7 +561,6 @@ asmlinkage void __init start_kernel(void)
         init_timers();
         hrtimers_init();
         softirq_init();
-        acpi_early_init();
         timekeeping_init();
         time_init();
         sched_clock_postinit();
@@ -613,6 +612,7 @@ asmlinkage void __init start_kernel(void)
         calibrate_delay();
         pidmap_init();
         anon_vma_init();
+        acpi_early_init();
 #ifdef CONFIG_X86
         if (efi_enabled(EFI_RUNTIME_SERVICES))
                 efi_enter_virtual_mode();
diff --git a/ipc/msg.c b/ipc/msg.c
index 245db1140ad6..649853105a5d 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -901,6 +901,8 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgfl
                 return -EINVAL;
 
         if (msgflg & MSG_COPY) {
+                if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
+                        return -EINVAL;
                 copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
                 if (IS_ERR(copy))
                         return PTR_ERR(copy);
diff --git a/kernel/audit.c b/kernel/audit.c
index 34c5a2310fbf..3392d3e0254a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -182,7 +182,7 @@ struct audit_buffer {
 
 struct audit_reply {
         __u32 portid;
-        pid_t pid;
+        struct net *net;        
         struct sk_buff *skb;
 };
 
@@ -500,7 +500,7 @@ int audit_send_list(void *_dest)
 {
         struct audit_netlink_list *dest = _dest;
         struct sk_buff *skb;
-        struct net *net = get_net_ns_by_pid(dest->pid);
+        struct net *net = dest->net;
         struct audit_net *aunet = net_generic(net, audit_net_id);
 
         /* wait for parent to finish and send an ACK */
@@ -510,6 +510,7 @@ int audit_send_list(void *_dest)
         while ((skb = __skb_dequeue(&dest->q)) != NULL)
                 netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
 
+        put_net(net);
         kfree(dest);
 
         return 0;
@@ -543,7 +544,7 @@ out_kfree_skb:
 static int audit_send_reply_thread(void *arg)
 {
         struct audit_reply *reply = (struct audit_reply *)arg;
-        struct net *net = get_net_ns_by_pid(reply->pid);
+        struct net *net = reply->net;
         struct audit_net *aunet = net_generic(net, audit_net_id);
 
         mutex_lock(&audit_cmd_mutex);
@@ -552,12 +553,13 @@ static int audit_send_reply_thread(void *arg)
         /* Ignore failure. It'll only happen if the sender goes away,
            because our timeout is set to infinite. */
         netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
+        put_net(net);
         kfree(reply);
         return 0;
 }
 /**
  * audit_send_reply - send an audit reply message via netlink
- * @portid: netlink port to which to send reply
+ * @request_skb: skb of request we are replying to (used to target the reply)
  * @seq: sequence number
  * @type: audit message type
  * @done: done (last) flag
@@ -568,9 +570,11 @@ static int audit_send_reply_thread(void *arg)
  * Allocates an skb, builds the netlink message, and sends it to the port id.
  * No failure notifications.
  */
-static void audit_send_reply(__u32 portid, int seq, int type, int done,
+static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
                              int multi, const void *payload, int size)
 {
+        u32 portid = NETLINK_CB(request_skb).portid;
+        struct net *net = sock_net(NETLINK_CB(request_skb).sk);
         struct sk_buff *skb;
         struct task_struct *tsk;
         struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
@@ -583,8 +587,8 @@ static void audit_send_reply(__u32 portid, int seq, int type, int done,
         if (!skb)
                 goto out;
 
+        reply->net = get_net(net);
         reply->portid = portid;
-        reply->pid = task_pid_vnr(current);
         reply->skb = skb;
 
         tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
@@ -673,8 +677,7 @@ static int audit_get_feature(struct sk_buff *skb)
 
         seq = nlmsg_hdr(skb)->nlmsg_seq;
 
-        audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
-                         &af, sizeof(af));
+        audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &af, sizeof(af));
 
         return 0;
 }
@@ -794,8 +797,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 s.backlog               = skb_queue_len(&audit_skb_queue);
                 s.version               = AUDIT_VERSION_LATEST;
                 s.backlog_wait_time     = audit_backlog_wait_time;
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
-                                 &s, sizeof(s));
+                audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s));
                 break;
         }
         case AUDIT_SET: {
@@ -905,7 +907,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                            seq, data, nlmsg_len(nlh));
                 break;
         case AUDIT_LIST_RULES:
-                err = audit_list_rules_send(NETLINK_CB(skb).portid, seq);
+                err = audit_list_rules_send(skb, seq);
                 break;
         case AUDIT_TRIM:
                 audit_trim_trees();
@@ -970,8 +972,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         memcpy(sig_data->ctx, ctx, len);
                         security_release_secctx(ctx, len);
                 }
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO,
-                                0, 0, sig_data, sizeof(*sig_data) + len);
+                audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
+                                 sig_data, sizeof(*sig_data) + len);
                 kfree(sig_data);
                 break;
         case AUDIT_TTY_GET: {
@@ -983,8 +985,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 s.log_passwd = tsk->signal->audit_tty_log_passwd;
                 spin_unlock(&tsk->sighand->siglock);
 
-                audit_send_reply(NETLINK_CB(skb).portid, seq,
-                                 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
+                audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
                 break;
         }
         case AUDIT_TTY_SET: {
diff --git a/kernel/audit.h b/kernel/audit.h
index 57cc64d67718..8df132214606 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -247,7 +247,7 @@ extern void		    audit_panic(const char *message);
 
 struct audit_netlink_list {
         __u32 portid;
-        pid_t pid;
+        struct net *net;
         struct sk_buff_head q;
 };
 
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 14a78cca384e..92062fd6cc8c 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -29,6 +29,8 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/security.h>
+#include <net/net_namespace.h>
+#include <net/sock.h>
 #include "audit.h"
 
 /*
@@ -1065,11 +1067,13 @@ int audit_rule_change(int type, __u32 portid, int seq, void *data,
 
 /**
  * audit_list_rules_send - list the audit rules
- * @portid: target portid for netlink audit messages
+ * @request_skb: skb of request we are replying to (used to target the reply)
  * @seq: netlink audit message sequence (serial) number
  */
-int audit_list_rules_send(__u32 portid, int seq)
+int audit_list_rules_send(struct sk_buff *request_skb, int seq)
 {
+        u32 portid = NETLINK_CB(request_skb).portid;
+        struct net *net = sock_net(NETLINK_CB(request_skb).sk);
         struct task_struct *tsk;
         struct audit_netlink_list *dest;
         int err = 0;
@@ -1083,8 +1087,8 @@ int audit_list_rules_send(__u32 portid, int seq)
         dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
         if (!dest)
                 return -ENOMEM;
+        dest->net = get_net(net);
         dest->portid = portid;
-        dest->pid = task_pid_vnr(current);
         skb_queue_head_init(&dest->q);
 
         mutex_lock(&audit_filter_mutex);
diff --git a/kernel/profile.c b/kernel/profile.c
index 6631e1ef55ab..ebdd9c1a86b4 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -549,14 +549,14 @@ static int create_hash_tables(void)
                 struct page *page;
 
                 page = alloc_pages_exact_node(node,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                 0);
                 if (!page)
                         goto out_cleanup;
                 per_cpu(cpu_profile_hits, cpu)[1]
                                 = (struct profile_hit *)page_address(page);
                 page = alloc_pages_exact_node(node,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                 0);
                 if (!page)
                         goto out_cleanup;
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index 43c2bcc35761..b30a2924ef14 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -301,14 +301,14 @@ u64 sched_clock_cpu(int cpu)
         if (unlikely(!sched_clock_running))
                 return 0ull;
 
-        preempt_disable();
+        preempt_disable_notrace();
         scd = cpu_sdc(cpu);
 
         if (cpu != smp_processor_id())
                 clock = sched_clock_remote(scd);
         else
                 clock = sched_clock_local(scd);
-        preempt_enable();
+        preempt_enable_notrace();
 
         return clock;
 }
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 6edbef296ece..f5c6635b806c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3338,6 +3338,15 @@ recheck:
                                 return -EPERM;
                 }
 
+                 /*
+                  * Can't set/change SCHED_DEADLINE policy at all for now
+                  * (safest behavior); in the future we would like to allow
+                  * unprivileged DL tasks to increase their relative deadline
+                  * or reduce their runtime (both ways reducing utilization)
+                  */
+                if (dl_policy(policy))
+                        return -EPERM;
+
                 /*
                  * Treat SCHED_IDLE as nice 20. Only allow a switch to
                  * SCHED_NORMAL if the RLIMIT_NICE would normally permit it.
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 84571e09c907..01fbae5b97b7 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -293,7 +293,7 @@ int stop_two_cpus(unsigned int cpu1, unsigned int cpu2, cpu_stop_fn_t fn, void *
          */
         smp_call_function_single(min(cpu1, cpu2),
                                  &irq_cpu_stop_queue_work,
-                                 &call_args, 0);
+                                 &call_args, 1);
         lg_local_unlock(&stop_cpus_lock);
         preempt_enable();
 
diff --git a/mm/Kconfig b/mm/Kconfig
index 2d9f1504d75e..2888024e0b0a 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -575,5 +575,5 @@ config PGTABLE_MAPPING
           then you should select this. This causes zsmalloc to use page table
           mapping rather than copying for object mapping.
 
-          You can check speed with zsmalloc benchmark[1].
-          [1] https://github.com/spartacus06/zsmalloc
+          You can check speed with zsmalloc benchmark:
+          https://github.com/spartacus06/zsmapbench
diff --git a/mm/compaction.c b/mm/compaction.c
index b48c5259ea33..918577595ea8 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -251,7 +251,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 {
         int nr_scanned = 0, total_isolated = 0;
         struct page *cursor, *valid_page = NULL;
-        unsigned long nr_strict_required = end_pfn - blockpfn;
         unsigned long flags;
         bool locked = false;
 
@@ -264,11 +263,12 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 
                 nr_scanned++;
                 if (!pfn_valid_within(blockpfn))
-                        continue;
+                        goto isolate_fail;
+
                 if (!valid_page)
                         valid_page = page;
                 if (!PageBuddy(page))
-                        continue;
+                        goto isolate_fail;
 
                 /*
                  * The zone lock must be held to isolate freepages.
@@ -289,12 +289,10 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 
                 /* Recheck this is a buddy page under lock */
                 if (!PageBuddy(page))
-                        continue;
+                        goto isolate_fail;
 
                 /* Found a free page, break it into order-0 pages */
                 isolated = split_free_page(page);
-                if (!isolated && strict)
-                        break;
                 total_isolated += isolated;
                 for (i = 0; i < isolated; i++) {
                         list_add(&page->lru, freelist);
@@ -305,7 +303,15 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                 if (isolated) {
                         blockpfn += isolated - 1;
                         cursor += isolated - 1;
+                        continue;
                 }
+
+isolate_fail:
+                if (strict)
+                        break;
+                else
+                        continue;
+
         }
 
         trace_mm_compaction_isolate_freepages(nr_scanned, total_isolated);
@@ -315,7 +321,7 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
          * pages requested were isolated. If there were any failures, 0 is
          * returned and CMA will fail.
          */
-        if (strict && nr_strict_required > total_isolated)
+        if (strict && blockpfn < end_pfn)
                 total_isolated = 0;
 
         if (locked)
diff --git a/mm/migrate.c b/mm/migrate.c
index 482a33d89134..b494fdb9a636 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1158,7 +1158,7 @@ static struct page *new_page_node(struct page *p, unsigned long private,
                                         pm->node);
         else
                 return alloc_pages_exact_node(pm->node,
-                                GFP_HIGHUSER_MOVABLE | GFP_THISNODE, 0);
+                                GFP_HIGHUSER_MOVABLE | __GFP_THISNODE, 0);
 }
 
 /*
@@ -1544,9 +1544,9 @@ static struct page *alloc_misplaced_dst_page(struct page *page,
         struct page *newpage;
 
         newpage = alloc_pages_exact_node(nid,
-                                         (GFP_HIGHUSER_MOVABLE | GFP_THISNODE |
-                                          __GFP_NOMEMALLOC | __GFP_NORETRY |
-                                          __GFP_NOWARN) &
+                                         (GFP_HIGHUSER_MOVABLE |
+                                          __GFP_THISNODE | __GFP_NOMEMALLOC |
+                                          __GFP_NORETRY | __GFP_NOWARN) &
                                          ~GFP_IOFS, 0);
 
         return newpage;
@@ -1747,7 +1747,8 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                 goto out_dropref;
 
         new_page = alloc_pages_node(node,
-                (GFP_TRANSHUGE | GFP_THISNODE) & ~__GFP_WAIT, HPAGE_PMD_ORDER);
+                (GFP_TRANSHUGE | __GFP_THISNODE) & ~__GFP_WAIT,
+                HPAGE_PMD_ORDER);
         if (!new_page)
                 goto out_fail;
 
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index de51c48c4393..4b65aa492fb6 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -538,6 +538,9 @@ static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev
         struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
         struct net_device *real_dev = vlan->real_dev;
 
+        if (saddr == NULL)
+                saddr = dev->dev_addr;
+
         return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
 }
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index ef66365b7354..93067ecdb9a2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1127,9 +1127,10 @@ static void br_multicast_query_received(struct net_bridge *br,
                                         struct net_bridge_port *port,
                                         struct bridge_mcast_querier *querier,
                                         int saddr,
+                                        bool is_general_query,
                                         unsigned long max_delay)
 {
-        if (saddr)
+        if (saddr && is_general_query)
                 br_multicast_update_querier_timer(br, querier, max_delay);
         else if (timer_pending(&querier->timer))
                 return;
@@ -1181,8 +1182,16 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
         }
 
+        /* RFC2236+RFC3376 (IGMPv2+IGMPv3) require the multicast link layer
+         * all-systems destination addresses (224.0.0.1) for general queries
+         */
+        if (!group && iph->daddr != htonl(INADDR_ALLHOSTS_GROUP)) {
+                err = -EINVAL;
+                goto out;
+        }
+
         br_multicast_query_received(br, port, &br->ip4_querier, !!iph->saddr,
-                                    max_delay);
+                                    !group, max_delay);
 
         if (!group)
                 goto out;
@@ -1228,6 +1237,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         unsigned long max_delay;
         unsigned long now = jiffies;
         const struct in6_addr *group = NULL;
+        bool is_general_query;
         int err = 0;
 
         spin_lock(&br->multicast_lock);
@@ -1235,6 +1245,12 @@ static int br_ip6_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
+        /* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
+        if (!(ipv6_addr_type(&ip6h->saddr) & IPV6_ADDR_LINKLOCAL)) {
+                err = -EINVAL;
+                goto out;
+        }
+
         if (skb->len == sizeof(*mld)) {
                 if (!pskb_may_pull(skb, sizeof(*mld))) {
                         err = -EINVAL;
@@ -1256,8 +1272,19 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
         }
 
+        is_general_query = group && ipv6_addr_any(group);
+
+        /* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
+         * all-nodes destination address (ff02::1) for general queries
+         */
+        if (is_general_query && !ipv6_addr_is_ll_all_nodes(&ip6h->daddr)) {
+                err = -EINVAL;
+                goto out;
+        }
+
         br_multicast_query_received(br, port, &br->ip6_querier,
-                                    !ipv6_addr_any(&ip6h->saddr), max_delay);
+                                    !ipv6_addr_any(&ip6h->saddr),
+                                    is_general_query, max_delay);
 
         if (!group)
                 goto out;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5d6236d9fdce..869c7afe3b07 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2838,81 +2838,84 @@ EXPORT_SYMBOL_GPL(skb_pull_rcsum);
 
 /**
  *      skb_segment - Perform protocol segmentation on skb.
- *      @skb: buffer to segment
+ *      @head_skb: buffer to segment
  *      @features: features for the output path (see dev->features)
  *
  *      This function performs segmentation on the given skb.  It returns
  *      a pointer to the first in a list of new skbs for the segments.
  *      In case of error it returns ERR_PTR(err).
  */
-struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+struct sk_buff *skb_segment(struct sk_buff *head_skb,
+                            netdev_features_t features)
 {
         struct sk_buff *segs = NULL;
         struct sk_buff *tail = NULL;
-        struct sk_buff *fskb = skb_shinfo(skb)->frag_list;
-        skb_frag_t *skb_frag = skb_shinfo(skb)->frags;
-        unsigned int mss = skb_shinfo(skb)->gso_size;
-        unsigned int doffset = skb->data - skb_mac_header(skb);
+        struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
+        skb_frag_t *frag = skb_shinfo(head_skb)->frags;
+        unsigned int mss = skb_shinfo(head_skb)->gso_size;
+        unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
+        struct sk_buff *frag_skb = head_skb;
         unsigned int offset = doffset;
-        unsigned int tnl_hlen = skb_tnl_header_len(skb);
+        unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
         unsigned int headroom;
         unsigned int len;
         __be16 proto;
         bool csum;
         int sg = !!(features & NETIF_F_SG);
-        int nfrags = skb_shinfo(skb)->nr_frags;
+        int nfrags = skb_shinfo(head_skb)->nr_frags;
         int err = -ENOMEM;
         int i = 0;
         int pos;
 
-        proto = skb_network_protocol(skb);
+        proto = skb_network_protocol(head_skb);
         if (unlikely(!proto))
                 return ERR_PTR(-EINVAL);
 
         csum = !!can_checksum_protocol(features, proto);
-        __skb_push(skb, doffset);
-        headroom = skb_headroom(skb);
-        pos = skb_headlen(skb);
+        __skb_push(head_skb, doffset);
+        headroom = skb_headroom(head_skb);
+        pos = skb_headlen(head_skb);
 
         do {
                 struct sk_buff *nskb;
-                skb_frag_t *frag;
+                skb_frag_t *nskb_frag;
                 int hsize;
                 int size;
 
-                len = skb->len - offset;
+                len = head_skb->len - offset;
                 if (len > mss)
                         len = mss;
 
-                hsize = skb_headlen(skb) - offset;
+                hsize = skb_headlen(head_skb) - offset;
                 if (hsize < 0)
                         hsize = 0;
                 if (hsize > len || !sg)
                         hsize = len;
 
-                if (!hsize && i >= nfrags && skb_headlen(fskb) &&
-                    (skb_headlen(fskb) == len || sg)) {
-                        BUG_ON(skb_headlen(fskb) > len);
+                if (!hsize && i >= nfrags && skb_headlen(list_skb) &&
+                    (skb_headlen(list_skb) == len || sg)) {
+                        BUG_ON(skb_headlen(list_skb) > len);
 
                         i = 0;
-                        nfrags = skb_shinfo(fskb)->nr_frags;
-                        skb_frag = skb_shinfo(fskb)->frags;
-                        pos += skb_headlen(fskb);
+                        nfrags = skb_shinfo(list_skb)->nr_frags;
+                        frag = skb_shinfo(list_skb)->frags;
+                        frag_skb = list_skb;
+                        pos += skb_headlen(list_skb);
 
                         while (pos < offset + len) {
                                 BUG_ON(i >= nfrags);
 
-                                size = skb_frag_size(skb_frag);
+                                size = skb_frag_size(frag);
                                 if (pos + size > offset + len)
                                         break;
 
                                 i++;
                                 pos += size;
-                                skb_frag++;
+                                frag++;
                         }
 
-                        nskb = skb_clone(fskb, GFP_ATOMIC);
-                        fskb = fskb->next;
+                        nskb = skb_clone(list_skb, GFP_ATOMIC);
+                        list_skb = list_skb->next;
 
                         if (unlikely(!nskb))
                                 goto err;
@@ -2933,7 +2936,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         __skb_push(nskb, doffset);
                 } else {
                         nskb = __alloc_skb(hsize + doffset + headroom,
-                                           GFP_ATOMIC, skb_alloc_rx_flag(skb),
+                                           GFP_ATOMIC, skb_alloc_rx_flag(head_skb),
                                            NUMA_NO_NODE);
 
                         if (unlikely(!nskb))
@@ -2949,12 +2952,12 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         segs = nskb;
                 tail = nskb;
 
-                __copy_skb_header(nskb, skb);
-                nskb->mac_len = skb->mac_len;
+                __copy_skb_header(nskb, head_skb);
+                nskb->mac_len = head_skb->mac_len;
 
                 skb_headers_offset_update(nskb, skb_headroom(nskb) - headroom);
 
-                skb_copy_from_linear_data_offset(skb, -tnl_hlen,
+                skb_copy_from_linear_data_offset(head_skb, -tnl_hlen,
                                                  nskb->data - tnl_hlen,
                                                  doffset + tnl_hlen);
 
@@ -2963,30 +2966,32 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
 
                 if (!sg) {
                         nskb->ip_summed = CHECKSUM_NONE;
-                        nskb->csum = skb_copy_and_csum_bits(skb, offset,
+                        nskb->csum = skb_copy_and_csum_bits(head_skb, offset,
                                                             skb_put(nskb, len),
                                                             len, 0);
                         continue;
                 }
 
-                frag = skb_shinfo(nskb)->frags;
+                nskb_frag = skb_shinfo(nskb)->frags;
 
-                skb_copy_from_linear_data_offset(skb, offset,
+                skb_copy_from_linear_data_offset(head_skb, offset,
                                                  skb_put(nskb, hsize), hsize);
 
-                skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
+                skb_shinfo(nskb)->tx_flags = skb_shinfo(head_skb)->tx_flags &
+                        SKBTX_SHARED_FRAG;
 
                 while (pos < offset + len) {
                         if (i >= nfrags) {
-                                BUG_ON(skb_headlen(fskb));
+                                BUG_ON(skb_headlen(list_skb));
 
                                 i = 0;
-                                nfrags = skb_shinfo(fskb)->nr_frags;
-                                skb_frag = skb_shinfo(fskb)->frags;
+                                nfrags = skb_shinfo(list_skb)->nr_frags;
+                                frag = skb_shinfo(list_skb)->frags;
+                                frag_skb = list_skb;
 
                                 BUG_ON(!nfrags);
 
-                                fskb = fskb->next;
+                                list_skb = list_skb->next;
                         }
 
                         if (unlikely(skb_shinfo(nskb)->nr_frags >=
@@ -2997,27 +3002,30 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                                 goto err;
                         }
 
-                        *frag = *skb_frag;
-                        __skb_frag_ref(frag);
-                        size = skb_frag_size(frag);
+                        if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC)))
+                                goto err;
+
+                        *nskb_frag = *frag;
+                        __skb_frag_ref(nskb_frag);
+                        size = skb_frag_size(nskb_frag);
 
                         if (pos < offset) {
-                                frag->page_offset += offset - pos;
-                                skb_frag_size_sub(frag, offset - pos);
+                                nskb_frag->page_offset += offset - pos;
+                                skb_frag_size_sub(nskb_frag, offset - pos);
                         }
 
                         skb_shinfo(nskb)->nr_frags++;
 
                         if (pos + size <= offset + len) {
                                 i++;
-                                skb_frag++;
+                                frag++;
                                 pos += size;
                         } else {
-                                skb_frag_size_sub(frag, pos + size - (offset + len));
+                                skb_frag_size_sub(nskb_frag, pos + size - (offset + len));
                                 goto skip_fraglist;
                         }
 
-                        frag++;
+                        nskb_frag++;
                 }
 
 skip_fraglist:
@@ -3031,7 +3039,7 @@ perform_csum_check:
                                                   nskb->len - doffset, 0);
                         nskb->ip_summed = CHECKSUM_NONE;
                 }
-        } while ((offset += len) < skb->len);
+        } while ((offset += len) < head_skb->len);
 
         return segs;
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 5b6a9431b017..c0fc6bdad1e3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2357,10 +2357,13 @@ void release_sock(struct sock *sk)
         if (sk->sk_backlog.tail)
                 __release_sock(sk);
 
+        /* Warning : release_cb() might need to release sk ownership,
+         * ie call sock_release_ownership(sk) before us.
+         */
         if (sk->sk_prot->release_cb)
                 sk->sk_prot->release_cb(sk);
 
-        sk->sk_lock.owned = 0;
+        sock_release_ownership(sk);
         if (waitqueue_active(&sk->sk_lock.wq))
                 wake_up(&sk->sk_lock.wq);
         spin_unlock_bh(&sk->sk_lock.slock);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index bb075fc9a14f..3b01959bf4bb 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -208,7 +208,7 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f, bool force)
         }
 
         work = frag_mem_limit(nf) - nf->low_thresh;
-        while (work > 0) {
+        while (work > 0 || force) {
                 spin_lock(&nf->lru_lock);
 
                 if (list_empty(&nf->lru_list)) {
@@ -278,9 +278,10 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
 
         atomic_inc(&qp->refcnt);
         hlist_add_head(&qp->list, &hb->chain);
+        inet_frag_lru_add(nf, qp);
         spin_unlock(&hb->chain_lock);
         read_unlock(&f->lock);
-        inet_frag_lru_add(nf, qp);
+
         return qp;
 }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f0eb4e337ec8..17a11e65e57f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -767,6 +767,17 @@ void tcp_release_cb(struct sock *sk)
         if (flags & (1UL << TCP_TSQ_DEFERRED))
                 tcp_tsq_handler(sk);
 
+        /* Here begins the tricky part :
+         * We are called from release_sock() with :
+         * 1) BH disabled
+         * 2) sk_lock.slock spinlock held
+         * 3) socket owned by us (sk->sk_lock.owned == 1)
+         *
+         * But following code is meant to be called from BH handlers,
+         * so we should keep BH disabled, but early release socket ownership
+         */
+        sock_release_ownership(sk);
+
         if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) {
                 tcp_write_timer_handler(sk);
                 __sock_put(sk);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index fdbfeca36d63..344e972426df 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1103,8 +1103,11 @@ retry:
          * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
          * an implementation must not create a temporary address with a zero
          * Preferred Lifetime.
+         * Use age calculation as in addrconf_verify to avoid unnecessary
+         * temporary addresses being generated.
          */
-        if (tmp_prefered_lft <= regen_advance) {
+        age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
+        if (tmp_prefered_lft <= regen_advance + age) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
                 ret = -1;
diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c
index cf77f3abfd06..447a7fbd1bb6 100644
--- a/net/ipv6/exthdrs_offload.c
+++ b/net/ipv6/exthdrs_offload.c
@@ -25,11 +25,11 @@ int __init ipv6_exthdrs_offload_init(void)
         int ret;
 
         ret = inet6_add_offload(&rthdr_offload, IPPROTO_ROUTING);
-        if (!ret)
+        if (ret)
                 goto out;
 
         ret = inet6_add_offload(&dstopt_offload, IPPROTO_DSTOPTS);
-        if (!ret)
+        if (ret)
                 goto out_rt;
 
 out:
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 11dac21e6586..fba54a407bb2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1513,7 +1513,7 @@ int ip6_route_add(struct fib6_config *cfg)
         if (!table)
                 goto out;
 
-        rt = ip6_dst_alloc(net, NULL, DST_NOCOUNT, table);
+        rt = ip6_dst_alloc(net, NULL, (cfg->fc_flags & RTF_ADDRCONF) ? 0 : DST_NOCOUNT, table);
 
         if (!rt) {
                 err = -ENOMEM;
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 735d0f60c83a..85d9d94c0a3c 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -112,7 +112,6 @@ struct l2tp_net {
         spinlock_t l2tp_session_hlist_lock;
 };
 
-static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
 
 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
@@ -1863,7 +1862,7 @@ EXPORT_SYMBOL_GPL(l2tp_session_delete);
 /* We come here whenever a session's send_seq, cookie_len or
  * l2specific_len parameters are set.
  */
-static void l2tp_session_set_header_len(struct l2tp_session *session, int version)
+void l2tp_session_set_header_len(struct l2tp_session *session, int version)
 {
         if (version == L2TP_HDR_VER_2) {
                 session->hdr_len = 6;
@@ -1876,6 +1875,7 @@ static void l2tp_session_set_header_len(struct l2tp_session *session, int versio
         }
 
 }
+EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
 
 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
 {
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 1f01ba3435bc..3f93ccd6ba97 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -263,6 +263,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                       int length, int (*payload_hook)(struct sk_buff *skb));
 int l2tp_session_queue_purge(struct l2tp_session *session);
 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb);
+void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 
 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb,
                   int hdr_len);
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 4cfd722e9153..bd7387adea9e 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -578,8 +578,10 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
         if (info->attrs[L2TP_ATTR_RECV_SEQ])
                 session->recv_seq = nla_get_u8(info->attrs[L2TP_ATTR_RECV_SEQ]);
 
-        if (info->attrs[L2TP_ATTR_SEND_SEQ])
+        if (info->attrs[L2TP_ATTR_SEND_SEQ]) {
                 session->send_seq = nla_get_u8(info->attrs[L2TP_ATTR_SEND_SEQ]);
+                l2tp_session_set_header_len(session, session->tunnel->version);
+        }
 
         if (info->attrs[L2TP_ATTR_LNS_MODE])
                 session->lns_mode = nla_get_u8(info->attrs[L2TP_ATTR_LNS_MODE]);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index be5fadf34739..5990919356a5 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -254,12 +254,14 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
                 po = pppox_sk(sk);
                 ppp_input(&po->chan, skb);
         } else {
-                l2tp_info(session, PPPOL2TP_MSG_DATA, "%s: socket not bound\n",
-                          session->name);
+                l2tp_dbg(session, PPPOL2TP_MSG_DATA,
+                         "%s: recv %d byte data frame, passing to L2TP socket\n",
+                         session->name, data_len);
 
-                /* Not bound. Nothing we can do, so discard. */
-                atomic_long_inc(&session->stats.rx_errors);
-                kfree_skb(skb);
+                if (sock_queue_rcv_skb(sk, skb) < 0) {
+                        atomic_long_inc(&session->stats.rx_errors);
+                        kfree_skb(skb);
+                }
         }
 
         return;
@@ -1312,6 +1314,7 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                         po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
                                 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
                 }
+                l2tp_session_set_header_len(session, session->tunnel->version);
                 l2tp_info(session, PPPOL2TP_MSG_CONTROL,
                           "%s: set send_seq=%d\n",
                           session->name, session->send_seq);
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index f43613a97dd6..0c1ecfdf9a12 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -100,6 +100,12 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
                 }
                 max_bw = max(max_bw, width);
         }
+
+        /* use the configured bandwidth in case of monitor interface */
+        sdata = rcu_dereference(local->monitor_sdata);
+        if (sdata && rcu_access_pointer(sdata->vif.chanctx_conf) == conf)
+                max_bw = max(max_bw, conf->def.width);
+
         rcu_read_unlock();
 
         return max_bw;
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 2802f9d9279d..ad8b377b4b9f 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -36,6 +36,7 @@ static struct sk_buff *mps_qos_null_get(struct sta_info *sta)
                                       sdata->vif.addr);
         nullfunc->frame_control = fc;
         nullfunc->duration_id = 0;
+        nullfunc->seq_ctrl = 0;
         /* no address resolution for this frame -> set addr 1 immediately */
         memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
         memset(skb_put(skb, 2), 0, 2); /* append QoS control field */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a023b432143b..137a192e64bc 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1206,6 +1206,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
         memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
         memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
+        nullfunc->seq_ctrl = 0;
 
         skb->priority = tid;
         skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 1313145e3b86..a07d55e75698 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -273,11 +273,12 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 
 void qdisc_list_add(struct Qdisc *q)
 {
-        struct Qdisc *root = qdisc_dev(q)->qdisc;
+        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
+                struct Qdisc *root = qdisc_dev(q)->qdisc;
 
-        WARN_ON_ONCE(root == &noop_qdisc);
-        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS))
+                WARN_ON_ONCE(root == &noop_qdisc);
                 list_add_tail(&q->list, &root->list);
+        }
 }
 EXPORT_SYMBOL(qdisc_list_add);
 
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 08ef7a42c0e4..21e251766eb1 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -601,6 +601,7 @@ static int fq_resize(struct Qdisc *sch, u32 log)
 {
         struct fq_sched_data *q = qdisc_priv(sch);
         struct rb_root *array;
+        void *old_fq_root;
         u32 idx;
 
         if (q->fq_root && log == q->fq_trees_log)
@@ -615,13 +616,19 @@ static int fq_resize(struct Qdisc *sch, u32 log)
         for (idx = 0; idx < (1U << log); idx++)
                 array[idx] = RB_ROOT;
 
-        if (q->fq_root) {
-                fq_rehash(q, q->fq_root, q->fq_trees_log, array, log);
-                fq_free(q->fq_root);
-        }
+        sch_tree_lock(sch);
+
+        old_fq_root = q->fq_root;
+        if (old_fq_root)
+                fq_rehash(q, old_fq_root, q->fq_trees_log, array, log);
+
         q->fq_root = array;
         q->fq_trees_log = log;
 
+        sch_tree_unlock(sch);
+
+        fq_free(old_fq_root);
+
         return 0;
 }
 
@@ -697,9 +704,11 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                 q->flow_refill_delay = usecs_to_jiffies(usecs_delay);
         }
 
-        if (!err)
+        if (!err) {
+                sch_tree_unlock(sch);
                 err = fq_resize(sch, fq_log);
-
+                sch_tree_lock(sch);
+        }
         while (sch->q.qlen > sch->limit) {
                 struct sk_buff *skb = fq_dequeue(sch);
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 632090b961c3..3a1767ef3201 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1421,8 +1421,8 @@ static void sctp_chunk_destroy(struct sctp_chunk *chunk)
         BUG_ON(!list_empty(&chunk->list));
         list_del_init(&chunk->transmitted_list);
 
-        /* Free the chunk skb data and the SCTP_chunk stub itself. */
-        dev_kfree_skb(chunk->skb);
+        consume_skb(chunk->skb);
+        consume_skb(chunk->auth_chunk);
 
         SCTP_DBG_OBJCNT_DEC(chunk);
         kmem_cache_free(sctp_chunk_cachep, chunk);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index ae65b6b5973a..01e002430c85 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -760,7 +760,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
 
                 /* Make sure that we and the peer are AUTH capable */
                 if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
-                        kfree_skb(chunk->auth_chunk);
                         sctp_association_free(new_asoc);
                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 }
@@ -775,10 +774,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                 auth.transport = chunk->transport;
 
                 ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
-
-                /* We can now safely free the auth_chunk clone */
-                kfree_skb(chunk->auth_chunk);
-
                 if (ret != SCTP_IERROR_NO_ERROR) {
                         sctp_association_free(new_asoc);
                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
diff --git a/net/socket.c b/net/socket.c
index 879933aaed4c..a19ae1968d37 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -450,16 +450,17 @@ EXPORT_SYMBOL(sockfd_lookup);
 
 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
 {
-        struct file *file;
+        struct fd f = fdget(fd);
         struct socket *sock;
 
         *err = -EBADF;
-        file = fget_light(fd, fput_needed);
-        if (file) {
-                sock = sock_from_file(file, err);
-                if (sock)
+        if (f.file) {
+                sock = sock_from_file(f.file, err);
+                if (likely(sock)) {
+                        *fput_needed = f.flags;
                         return sock;
-                fput_light(file, *fput_needed);
+                }
+                fdput(f);
         }
         return NULL;
 }
@@ -1985,6 +1986,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
 {
         if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
                 return -EFAULT;
+
+        if (kmsg->msg_namelen < 0)
+                return -EINVAL;
+
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         return 0;
diff --git a/net/tipc/config.c b/net/tipc/config.c
index e74eef2e7490..e6d721692ae0 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -376,7 +376,6 @@ static void cfg_conn_msg_event(int conid, struct sockaddr_tipc *addr,
         struct tipc_cfg_msg_hdr *req_hdr;
         struct tipc_cfg_msg_hdr *rep_hdr;
         struct sk_buff *rep_buf;
-        int ret;
 
         /* Validate configuration message header (ignore invalid message) */
         req_hdr = (struct tipc_cfg_msg_hdr *)buf;
@@ -398,12 +397,8 @@ static void cfg_conn_msg_event(int conid, struct sockaddr_tipc *addr,
                 memcpy(rep_hdr, req_hdr, sizeof(*rep_hdr));
                 rep_hdr->tcm_len = htonl(rep_buf->len);
                 rep_hdr->tcm_flags &= htons(~TCM_F_REQUEST);
-
-                ret = tipc_conn_sendmsg(&cfgsrv, conid, addr, rep_buf->data,
-                                        rep_buf->len);
-                if (ret < 0)
-                        pr_err("Sending cfg reply message failed, no memory\n");
-
+                tipc_conn_sendmsg(&cfgsrv, conid, addr, rep_buf->data,
+                                  rep_buf->len);
                 kfree_skb(rep_buf);
         }
 }
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index e4bc8a296744..1fabf160501f 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -58,7 +58,6 @@ unsigned int tipc_k_signal(Handler routine, unsigned long argument)
 
         spin_lock_bh(&qitem_lock);
         if (!handler_enabled) {
-                pr_err("Signal request ignored by handler\n");
                 spin_unlock_bh(&qitem_lock);
                 return -ENOPROTOOPT;
         }
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 48302be175ce..042e8e3cabc0 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -941,17 +941,48 @@ int tipc_nametbl_init(void)
         return 0;
 }
 
+/**
+ * tipc_purge_publications - remove all publications for a given type
+ *
+ * tipc_nametbl_lock must be held when calling this function
+ */
+static void tipc_purge_publications(struct name_seq *seq)
+{
+        struct publication *publ, *safe;
+        struct sub_seq *sseq;
+        struct name_info *info;
+
+        if (!seq->sseqs) {
+                nameseq_delete_empty(seq);
+                return;
+        }
+        sseq = seq->sseqs;
+        info = sseq->info;
+        list_for_each_entry_safe(publ, safe, &info->zone_list, zone_list) {
+                tipc_nametbl_remove_publ(publ->type, publ->lower, publ->node,
+                                         publ->ref, publ->key);
+        }
+}
+
 void tipc_nametbl_stop(void)
 {
         u32 i;
+        struct name_seq *seq;
+        struct hlist_head *seq_head;
+        struct hlist_node *safe;
 
-        /* Verify name table is empty, then release it */
+        /* Verify name table is empty and purge any lingering
+         * publications, then release the name table
+         */
         write_lock_bh(&tipc_nametbl_lock);
         for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
                 if (hlist_empty(&table.types[i]))
                         continue;
-                pr_err("nametbl_stop(): orphaned hash chain detected\n");
-                break;
+                seq_head = &table.types[i];
+                hlist_for_each_entry_safe(seq, safe, seq_head, ns_list) {
+                        tipc_purge_publications(seq);
+                }
+                continue;
         }
         kfree(table.types);
         table.types = NULL;
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 373979789a73..646a930eefbf 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -87,7 +87,6 @@ static void tipc_clean_outqueues(struct tipc_conn *con);
 static void tipc_conn_kref_release(struct kref *kref)
 {
         struct tipc_conn *con = container_of(kref, struct tipc_conn, kref);
-        struct tipc_server *s = con->server;
 
         if (con->sock) {
                 tipc_sock_release_local(con->sock);
@@ -95,10 +94,6 @@ static void tipc_conn_kref_release(struct kref *kref)
         }
 
         tipc_clean_outqueues(con);
-
-        if (con->conid)
-                s->tipc_conn_shutdown(con->conid, con->usr_data);
-
         kfree(con);
 }
 
@@ -181,6 +176,9 @@ static void tipc_close_conn(struct tipc_conn *con)
         struct tipc_server *s = con->server;
 
         if (test_and_clear_bit(CF_CONNECTED, &con->flags)) {
+                if (con->conid)
+                        s->tipc_conn_shutdown(con->conid, con->usr_data);
+
                 spin_lock_bh(&s->idr_lock);
                 idr_remove(&s->conn_idr, con->conid);
                 s->idr_in_use--;
@@ -429,10 +427,12 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid,
         list_add_tail(&e->list, &con->outqueue);
         spin_unlock_bh(&con->outqueue_lock);
 
-        if (test_bit(CF_CONNECTED, &con->flags))
+        if (test_bit(CF_CONNECTED, &con->flags)) {
                 if (!queue_work(s->send_wq, &con->swork))
                         conn_put(con);
-
+        } else {
+                conn_put(con);
+        }
         return 0;
 }
 
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index a4cf274455aa..0ed0eaa62f29 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -997,7 +997,7 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long timeo)
 
         for (;;) {
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
-                if (skb_queue_empty(&sk->sk_receive_queue)) {
+                if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
                         if (sock->state == SS_DISCONNECTING) {
                                 err = -ENOTCONN;
                                 break;
@@ -1623,7 +1623,7 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
         for (;;) {
                 prepare_to_wait_exclusive(sk_sleep(sk), &wait,
                                           TASK_INTERRUPTIBLE);
-                if (skb_queue_empty(&sk->sk_receive_queue)) {
+                if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
                         release_sock(sk);
                         timeo = schedule_timeout(timeo);
                         lock_sock(sk);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 7cb0bd5b1176..11c9ae00837d 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -96,20 +96,16 @@ static void subscr_send_event(struct tipc_subscription *sub, u32 found_lower,
 {
         struct tipc_subscriber *subscriber = sub->subscriber;
         struct kvec msg_sect;
-        int ret;
 
         msg_sect.iov_base = (void *)&sub->evt;
         msg_sect.iov_len = sizeof(struct tipc_event);
-
         sub->evt.event = htohl(event, sub->swap);
         sub->evt.found_lower = htohl(found_lower, sub->swap);
         sub->evt.found_upper = htohl(found_upper, sub->swap);
         sub->evt.port.ref = htohl(port_ref, sub->swap);
         sub->evt.port.node = htohl(node, sub->swap);
-        ret = tipc_conn_sendmsg(&topsrv, subscriber->conid, NULL,
-                                msg_sect.iov_base, msg_sect.iov_len);
-        if (ret < 0)
-                pr_err("Sending subscription event failed, no memory\n");
+        tipc_conn_sendmsg(&topsrv, subscriber->conid, NULL, msg_sect.iov_base,
+                          msg_sect.iov_len);
 }
 
 /**
@@ -153,14 +149,6 @@ static void subscr_timeout(struct tipc_subscription *sub)
         /* The spin lock per subscriber is used to protect its members */
         spin_lock_bh(&subscriber->lock);
 
-        /* Validate if the connection related to the subscriber is
-         * closed (in case subscriber is terminating)
-         */
-        if (subscriber->conid == 0) {
-                spin_unlock_bh(&subscriber->lock);
-                return;
-        }
-
         /* Validate timeout (in case subscription is being cancelled) */
         if (sub->timeout == TIPC_WAIT_FOREVER) {
                 spin_unlock_bh(&subscriber->lock);
@@ -215,9 +203,6 @@ static void subscr_release(struct tipc_subscriber *subscriber)
 
         spin_lock_bh(&subscriber->lock);
 
-        /* Invalidate subscriber reference */
-        subscriber->conid = 0;
-
         /* Destroy any existing subscriptions for subscriber */
         list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
                                  subscription_list) {
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 29fc8bee9702..ce6ec6c2f4de 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -163,9 +163,8 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
 
 static inline unsigned int unix_hash_fold(__wsum n)
 {
-        unsigned int hash = (__force unsigned int)n;
+        unsigned int hash = (__force unsigned int)csum_fold(n);
 
-        hash ^= hash>>16;
         hash ^= hash>>8;
         return hash&(UNIX_HASH_SIZE-1);
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 010892b81a06..a3bf18d11609 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -788,8 +788,6 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
         default:
                 break;
         }
-
-        wdev->beacon_interval = 0;
 }
 
 static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 276e84b8a8e5..10085de886fe 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -330,7 +330,8 @@ static void write_src(void)
                                 printf("\tPTR\t_text + %#llx\n",
                                         table[i].addr - _text);
                         else
-                                printf("\tPTR\t%#llx\n", table[i].addr);
+                                printf("\tPTR\t_text - %#llx\n",
+                                        _text - table[i].addr);
                 } else {
                         printf("\tPTR\t%#llx\n", table[i].addr);
                 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 850296a1e0ff..8d0a84436674 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3616,6 +3616,19 @@ static void alc_fixup_auto_mute_via_amp(struct hda_codec *codec,
         }
 }
 
+static void alc_no_shutup(struct hda_codec *codec)
+{
+}
+
+static void alc_fixup_no_shutup(struct hda_codec *codec,
+                                const struct hda_fixup *fix, int action)
+{
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                struct alc_spec *spec = codec->spec;
+                spec->shutup = alc_no_shutup;
+        }
+}
+
 static void alc_fixup_headset_mode_alc668(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action)
 {
@@ -3844,6 +3857,7 @@ enum {
         ALC269_FIXUP_HP_GPIO_LED,
         ALC269_FIXUP_INV_DMIC,
         ALC269_FIXUP_LENOVO_DOCK,
+        ALC269_FIXUP_NO_SHUTUP,
         ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
         ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
         ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -4020,6 +4034,10 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_inv_dmic_0x12,
         },
+        [ALC269_FIXUP_NO_SHUTUP] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_no_shutup,
+        },
         [ALC269_FIXUP_LENOVO_DOCK] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -4405,6 +4423,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
         SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
         SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
index 75d0ad5d2dcb..647a72cda005 100644
--- a/sound/soc/codecs/88pm860x-codec.c
+++ b/sound/soc/codecs/88pm860x-codec.c
@@ -1328,6 +1328,9 @@ static int pm860x_probe(struct snd_soc_codec *codec)
         pm860x->codec = codec;
 
         codec->control_data = pm860x->regmap;
+        ret = snd_soc_codec_set_cache_io(codec, 0, 0, SND_SOC_REGMAP);
+        if (ret)
+                return ret;
 
         for (i = 0; i < 4; i++) {
                 ret = request_threaded_irq(pm860x->irq[i], NULL,
diff --git a/sound/soc/codecs/si476x.c b/sound/soc/codecs/si476x.c
index 52e7cb08434b..fa2b8e07f420 100644
--- a/sound/soc/codecs/si476x.c
+++ b/sound/soc/codecs/si476x.c
@@ -210,7 +210,7 @@ out:
 static int si476x_codec_probe(struct snd_soc_codec *codec)
 {
         codec->control_data = dev_get_regmap(codec->dev->parent, NULL);
-        return 0;
+        return snd_soc_codec_set_cache_io(codec, 0, 0, SND_SOC_REGMAP);
 }
 
 static struct snd_soc_dai_ops si476x_dai_ops = {
diff --git a/sound/soc/omap/n810.c b/sound/soc/omap/n810.c
index 3fde9e402710..d163e18d85d4 100644
--- a/sound/soc/omap/n810.c
+++ b/sound/soc/omap/n810.c
@@ -305,7 +305,9 @@ static int __init n810_soc_init(void)
         int err;
         struct device *dev;
 
-        if (!(machine_is_nokia_n810() || machine_is_nokia_n810_wimax()))
+        if (!of_have_populated_dt() ||
+            (!of_machine_is_compatible("nokia,n810") &&
+             !of_machine_is_compatible("nokia,n810-wimax")))
                 return -ENODEV;
 
         n810_snd_device = platform_device_alloc("soc-audio", -1);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 47e1ce771e65..28522bd03b8e 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1989,6 +1989,7 @@ int soc_dpcm_runtime_update(struct snd_soc_card *card)
 
                 paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_PLAYBACK, &list);
                 if (paths < 0) {
+                        dpcm_path_put(&list);
                         dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
                                         fe->dai_link->name,  "playback");
                         mutex_unlock(&card->mutex);
@@ -2018,6 +2019,7 @@ capture:
 
                 paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_CAPTURE, &list);
                 if (paths < 0) {
+                        dpcm_path_put(&list);
                         dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
                                         fe->dai_link->name,  "capture");
                         mutex_unlock(&card->mutex);
@@ -2082,6 +2084,7 @@ static int dpcm_fe_dai_open(struct snd_pcm_substream *fe_substream)
         fe->dpcm[stream].runtime = fe_substream->runtime;
 
         if (dpcm_path_get(fe, stream, &list) <= 0) {
+                dpcm_path_put(&list);
                 dev_dbg(fe->dev, "ASoC: %s no valid %s route\n",
                         fe->dai_link->name, stream ? "capture" : "playback");
         }
diff --git a/tools/net/Makefile b/tools/net/Makefile
index 004cd74734b6..ee577ea03ba5 100644
--- a/tools/net/Makefile
+++ b/tools/net/Makefile
@@ -12,7 +12,7 @@ YACC = bison
 
 all : bpf_jit_disasm bpf_dbg bpf_asm
 
-bpf_jit_disasm : CFLAGS = -Wall -O2
+bpf_jit_disasm : CFLAGS = -Wall -O2 -DPACKAGE='bpf_jit_disasm'
 bpf_jit_disasm : LDLIBS = -lopcodes -lbfd -ldl
 bpf_jit_disasm : bpf_jit_disasm.o
 
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 6aa6fb6f7bd9..f954c26de231 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -825,7 +825,6 @@ static size_t syscall_arg__scnprintf_signum(char *bf, size_t size, struct syscal
         P_SIGNUM(PIPE);
         P_SIGNUM(ALRM);
         P_SIGNUM(TERM);
-        P_SIGNUM(STKFLT);
         P_SIGNUM(CHLD);
         P_SIGNUM(CONT);
         P_SIGNUM(STOP);
@@ -841,6 +840,15 @@ static size_t syscall_arg__scnprintf_signum(char *bf, size_t size, struct syscal
         P_SIGNUM(IO);
         P_SIGNUM(PWR);
         P_SIGNUM(SYS);
+#ifdef SIGEMT
+        P_SIGNUM(EMT);
+#endif
+#ifdef SIGSTKFLT
+        P_SIGNUM(STKFLT);
+#endif
+#ifdef SIGSWI
+        P_SIGNUM(SWI);
+#endif
         default: break;
         }
 
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index c872991e0f65..620a1983b76b 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1213,7 +1213,7 @@ static void ip__resolve_ams(struct machine *machine, struct thread *thread,
                  */
                 thread__find_addr_location(thread, machine, m, MAP__FUNCTION,
                                 ip, &al);
-                if (al.sym)
+                if (al.map)
                         goto found;
         }
 found:
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 3e9f336740fa..516d19fb999b 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -151,15 +151,15 @@ Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
 
                 gelf_getshdr(sec, shp);
                 str = elf_strptr(elf, ep->e_shstrndx, shp->sh_name);
-                if (!strcmp(name, str)) {
+                if (str && !strcmp(name, str)) {
                         if (idx)
                                 *idx = cnt;
-                        break;
+                        return sec;
                 }
                 ++cnt;
         }
 
-        return sec;
+        return NULL;
 }
 
 #define elf_section__for_each_rel(reldata, pos, pos_mem, idx, nr_entries) \
diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
index d66418237d21..aa290c0de6f5 100644
--- a/tools/testing/selftests/ipc/msgque.c
+++ b/tools/testing/selftests/ipc/msgque.c
@@ -201,6 +201,7 @@ int main(int argc, char **argv)
 
         msgque.msq_id = msgget(msgque.key, IPC_CREAT | IPC_EXCL | 0666);
         if (msgque.msq_id == -1) {
+                err = -errno;
                 printf("Can't create queue\n");
                 goto err_out;
         }