21 files changed, 516 insertions, 384 deletions

diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 96177eec0a0e..eedb023af27d 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1833,7 +1833,6 @@ int i915_driver_unload(struct drm_device *dev)
                 flush_workqueue(dev_priv->wq);
 
                 mutex_lock(&dev->struct_mutex);
-                i915_gem_free_all_phys_object(dev);
                 i915_gem_cleanup_ringbuffer(dev);
                 i915_gem_context_fini(dev);
                 WARN_ON(dev_priv->mm.aliasing_ppgtt);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 108e1ec2fa4b..388c028e223c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -242,18 +242,6 @@ struct intel_ddi_plls {
 #define WATCH_LISTS     0
 #define WATCH_GTT       0
 
-#define I915_GEM_PHYS_CURSOR_0 1
-#define I915_GEM_PHYS_CURSOR_1 2
-#define I915_GEM_PHYS_OVERLAY_REGS 3
-#define I915_MAX_PHYS_OBJECT (I915_GEM_PHYS_OVERLAY_REGS)
-
-struct drm_i915_gem_phys_object {
-        int id;
-        struct page **page_list;
-        drm_dma_handle_t *handle;
-        struct drm_i915_gem_object *cur_obj;
-};
-
 struct opregion_header;
 struct opregion_acpi;
 struct opregion_swsci;
@@ -1187,9 +1175,6 @@ struct i915_gem_mm {
         /** Bit 6 swizzling required for Y tiling */
         uint32_t bit_6_swizzle_y;
 
-        /* storage for physical objects */
-        struct drm_i915_gem_phys_object *phys_objs[I915_MAX_PHYS_OBJECT];
-
         /* accounting, useful for userland debugging */
         spinlock_t object_stat_lock;
         size_t object_memory;
@@ -1769,7 +1754,7 @@ struct drm_i915_gem_object {
         struct drm_file *pin_filp;
 
         /** for phy allocated objects */
-        struct drm_i915_gem_phys_object *phys_obj;
+        drm_dma_handle_t *phys_handle;
 };
 
 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
@@ -2204,10 +2189,12 @@ void i915_gem_vma_destroy(struct i915_vma *vma);
 #define PIN_MAPPABLE 0x1
 #define PIN_NONBLOCK 0x2
 #define PIN_GLOBAL 0x4
+#define PIN_OFFSET_BIAS 0x8
+#define PIN_OFFSET_MASK (~4095)
 int __must_check i915_gem_object_pin(struct drm_i915_gem_object *obj,
                                      struct i915_address_space *vm,
                                      uint32_t alignment,
-                                     unsigned flags);
+                                     uint64_t flags);
 int __must_check i915_vma_unbind(struct i915_vma *vma);
 int i915_gem_object_put_pages(struct drm_i915_gem_object *obj);
 void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv);
@@ -2334,13 +2321,8 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
                                      u32 alignment,
                                      struct intel_ring_buffer *pipelined);
 void i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj);
-int i915_gem_attach_phys_object(struct drm_device *dev,
-                                struct drm_i915_gem_object *obj,
-                                int id,
+int i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
                                 int align);
-void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_i915_gem_object *obj);
-void i915_gem_free_all_phys_object(struct drm_device *dev);
 int i915_gem_open(struct drm_device *dev, struct drm_file *file);
 void i915_gem_release(struct drm_device *dev, struct drm_file *file);
 
@@ -2465,6 +2447,8 @@ int __must_check i915_gem_evict_something(struct drm_device *dev,
                                           int min_size,
                                           unsigned alignment,
                                           unsigned cache_level,
+                                          unsigned long start,
+                                          unsigned long end,
                                           unsigned flags);
 int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle);
 int i915_gem_evict_everything(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 2871ce75f438..3326770c9ed2 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -43,10 +43,6 @@ static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *o
 static __must_check int
 i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
                                bool readonly);
-static int i915_gem_phys_pwrite(struct drm_device *dev,
-                                struct drm_i915_gem_object *obj,
-                                struct drm_i915_gem_pwrite *args,
-                                struct drm_file *file);
 
 static void i915_gem_write_fence(struct drm_device *dev, int reg,
                                  struct drm_i915_gem_object *obj);
@@ -209,6 +205,128 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
         return 0;
 }
 
+static void i915_gem_object_detach_phys(struct drm_i915_gem_object *obj)
+{
+        drm_dma_handle_t *phys = obj->phys_handle;
+
+        if (!phys)
+                return;
+
+        if (obj->madv == I915_MADV_WILLNEED) {
+                struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
+                char *vaddr = phys->vaddr;
+                int i;
+
+                for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
+                        struct page *page = shmem_read_mapping_page(mapping, i);
+                        if (!IS_ERR(page)) {
+                                char *dst = kmap_atomic(page);
+                                memcpy(dst, vaddr, PAGE_SIZE);
+                                drm_clflush_virt_range(dst, PAGE_SIZE);
+                                kunmap_atomic(dst);
+
+                                set_page_dirty(page);
+                                mark_page_accessed(page);
+                                page_cache_release(page);
+                        }
+                        vaddr += PAGE_SIZE;
+                }
+                i915_gem_chipset_flush(obj->base.dev);
+        }
+
+#ifdef CONFIG_X86
+        set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
+#endif
+        drm_pci_free(obj->base.dev, phys);
+        obj->phys_handle = NULL;
+}
+
+int
+i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
+                            int align)
+{
+        drm_dma_handle_t *phys;
+        struct address_space *mapping;
+        char *vaddr;
+        int i;
+
+        if (obj->phys_handle) {
+                if ((unsigned long)obj->phys_handle->vaddr & (align -1))
+                        return -EBUSY;
+
+                return 0;
+        }
+
+        if (obj->madv != I915_MADV_WILLNEED)
+                return -EFAULT;
+
+        if (obj->base.filp == NULL)
+                return -EINVAL;
+
+        /* create a new object */
+        phys = drm_pci_alloc(obj->base.dev, obj->base.size, align);
+        if (!phys)
+                return -ENOMEM;
+
+        vaddr = phys->vaddr;
+#ifdef CONFIG_X86
+        set_memory_wc((unsigned long)vaddr, phys->size / PAGE_SIZE);
+#endif
+        mapping = file_inode(obj->base.filp)->i_mapping;
+        for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
+                struct page *page;
+                char *src;
+
+                page = shmem_read_mapping_page(mapping, i);
+                if (IS_ERR(page)) {
+#ifdef CONFIG_X86
+                        set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
+#endif
+                        drm_pci_free(obj->base.dev, phys);
+                        return PTR_ERR(page);
+                }
+
+                src = kmap_atomic(page);
+                memcpy(vaddr, src, PAGE_SIZE);
+                kunmap_atomic(src);
+
+                mark_page_accessed(page);
+                page_cache_release(page);
+
+                vaddr += PAGE_SIZE;
+        }
+
+        obj->phys_handle = phys;
+        return 0;
+}
+
+static int
+i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
+                     struct drm_i915_gem_pwrite *args,
+                     struct drm_file *file_priv)
+{
+        struct drm_device *dev = obj->base.dev;
+        void *vaddr = obj->phys_handle->vaddr + args->offset;
+        char __user *user_data = to_user_ptr(args->data_ptr);
+
+        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
+                unsigned long unwritten;
+
+                /* The physical object once assigned is fixed for the lifetime
+                 * of the obj, so we can safely drop the lock and continue
+                 * to access vaddr.
+                 */
+                mutex_unlock(&dev->struct_mutex);
+                unwritten = copy_from_user(vaddr, user_data, args->size);
+                mutex_lock(&dev->struct_mutex);
+                if (unwritten)
+                        return -EFAULT;
+        }
+
+        i915_gem_chipset_flush(dev);
+        return 0;
+}
+
 void *i915_gem_object_alloc(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -921,8 +1039,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
          * pread/pwrite currently are reading and writing from the CPU
          * perspective, requiring manual detiling by the client.
          */
-        if (obj->phys_obj) {
-                ret = i915_gem_phys_pwrite(dev, obj, args, file);
+        if (obj->phys_handle) {
+                ret = i915_gem_phys_pwrite(obj, args, file);
                 goto out;
         }
 
@@ -3208,12 +3326,14 @@ static struct i915_vma *
 i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
                            struct i915_address_space *vm,
                            unsigned alignment,
-                           unsigned flags)
+                           uint64_t flags)
 {
         struct drm_device *dev = obj->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         u32 size, fence_size, fence_alignment, unfenced_alignment;
-        size_t gtt_max =
+        unsigned long start =
+                flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;
+        unsigned long end =
                 flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;
         struct i915_vma *vma;
         int ret;
@@ -3242,11 +3362,11 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
         /* If the object is bigger than the entire aperture, reject it early
          * before evicting everything in a vain attempt to find space.
          */
-        if (obj->base.size > gtt_max) {
-                DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%zu\n",
+        if (obj->base.size > end) {
+                DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%lu\n",
                           obj->base.size,
                           flags & PIN_MAPPABLE ? "mappable" : "total",
-                          gtt_max);
+                          end);
                 return ERR_PTR(-E2BIG);
         }
 
@@ -3263,12 +3383,15 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
 search_free:
         ret = drm_mm_insert_node_in_range_generic(&vm->mm, &vma->node,
                                                   size, alignment,
-                                                  obj->cache_level, 0, gtt_max,
+                                                  obj->cache_level,
+                                                  start, end,
                                                   DRM_MM_SEARCH_DEFAULT,
                                                   DRM_MM_CREATE_DEFAULT);
         if (ret) {
                 ret = i915_gem_evict_something(dev, vm, size, alignment,
-                                               obj->cache_level, flags);
+                                               obj->cache_level,
+                                               start, end,
+                                               flags);
                 if (ret == 0)
                         goto search_free;
 
@@ -3828,11 +3951,30 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
         return ret;
 }
 
+static bool
+i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
+{
+        struct drm_i915_gem_object *obj = vma->obj;
+
+        if (alignment &&
+            vma->node.start & (alignment - 1))
+                return true;
+
+        if (flags & PIN_MAPPABLE && !obj->map_and_fenceable)
+                return true;
+
+        if (flags & PIN_OFFSET_BIAS &&
+            vma->node.start < (flags & PIN_OFFSET_MASK))
+                return true;
+
+        return false;
+}
+
 int
 i915_gem_object_pin(struct drm_i915_gem_object *obj,
                     struct i915_address_space *vm,
                     uint32_t alignment,
-                    unsigned flags)
+                    uint64_t flags)
 {
         struct i915_vma *vma;
         int ret;
@@ -3845,15 +3987,13 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
                 if (WARN_ON(vma->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
                         return -EBUSY;
 
-                if ((alignment &&
-                     vma->node.start & (alignment - 1)) ||
-                    (flags & PIN_MAPPABLE && !obj->map_and_fenceable)) {
+                if (i915_vma_misplaced(vma, alignment, flags)) {
                         WARN(vma->pin_count,
                              "bo is already pinned with incorrect alignment:"
                              " offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"
                              " obj->map_and_fenceable=%d\n",
                              i915_gem_obj_offset(obj, vm), alignment,
-                             flags & PIN_MAPPABLE,
+                             !!(flags & PIN_MAPPABLE),
                              obj->map_and_fenceable);
                         ret = i915_vma_unbind(vma);
                         if (ret)
@@ -4163,9 +4303,6 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
 
         trace_i915_gem_object_destroy(obj);
 
-        if (obj->phys_obj)
-                i915_gem_detach_phys_object(dev, obj);
-
         list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
                 int ret;
 
@@ -4183,6 +4320,8 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
                 }
         }
 
+        i915_gem_object_detach_phys(obj);
+
         /* Stolen objects don't hold a ref, but do hold pin count. Fix that up
          * before progressing. */
         if (obj->stolen)
@@ -4646,190 +4785,6 @@ i915_gem_load(struct drm_device *dev)
         register_shrinker(&dev_priv->mm.inactive_shrinker);
 }
 
-/*
- * Create a physically contiguous memory object for this object
- * e.g. for cursor + overlay regs
- */
-static int i915_gem_init_phys_object(struct drm_device *dev,
-                                     int id, int size, int align)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_phys_object *phys_obj;
-        int ret;
-
-        if (dev_priv->mm.phys_objs[id - 1] || !size)
-                return 0;
-
-        phys_obj = kzalloc(sizeof(*phys_obj), GFP_KERNEL);
-        if (!phys_obj)
-                return -ENOMEM;
-
-        phys_obj->id = id;
-
-        phys_obj->handle = drm_pci_alloc(dev, size, align);
-        if (!phys_obj->handle) {
-                ret = -ENOMEM;
-                goto kfree_obj;
-        }
-#ifdef CONFIG_X86
-        set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
-#endif
-
-        dev_priv->mm.phys_objs[id - 1] = phys_obj;
-
-        return 0;
-kfree_obj:
-        kfree(phys_obj);
-        return ret;
-}
-
-static void i915_gem_free_phys_object(struct drm_device *dev, int id)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_phys_object *phys_obj;
-
-        if (!dev_priv->mm.phys_objs[id - 1])
-                return;
-
-        phys_obj = dev_priv->mm.phys_objs[id - 1];
-        if (phys_obj->cur_obj) {
-                i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
-        }
-
-#ifdef CONFIG_X86
-        set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
-#endif
-        drm_pci_free(dev, phys_obj->handle);
-        kfree(phys_obj);
-        dev_priv->mm.phys_objs[id - 1] = NULL;
-}
-
-void i915_gem_free_all_phys_object(struct drm_device *dev)
-{
-        int i;
-
-        for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
-                i915_gem_free_phys_object(dev, i);
-}
-
-void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_i915_gem_object *obj)
-{
-        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        char *vaddr;
-        int i;
-        int page_count;
-
-        if (!obj->phys_obj)
-                return;
-        vaddr = obj->phys_obj->handle->vaddr;
-
-        page_count = obj->base.size / PAGE_SIZE;
-        for (i = 0; i < page_count; i++) {
-                struct page *page = shmem_read_mapping_page(mapping, i);
-                if (!IS_ERR(page)) {
-                        char *dst = kmap_atomic(page);
-                        memcpy(dst, vaddr + i*PAGE_SIZE, PAGE_SIZE);
-                        kunmap_atomic(dst);
-
-                        drm_clflush_pages(&page, 1);
-
-                        set_page_dirty(page);
-                        mark_page_accessed(page);
-                        page_cache_release(page);
-                }
-        }
-        i915_gem_chipset_flush(dev);
-
-        obj->phys_obj->cur_obj = NULL;
-        obj->phys_obj = NULL;
-}
-
-int
-i915_gem_attach_phys_object(struct drm_device *dev,
-                            struct drm_i915_gem_object *obj,
-                            int id,
-                            int align)
-{
-        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret = 0;
-        int page_count;
-        int i;
-
-        if (id > I915_MAX_PHYS_OBJECT)
-                return -EINVAL;
-
-        if (obj->phys_obj) {
-                if (obj->phys_obj->id == id)
-                        return 0;
-                i915_gem_detach_phys_object(dev, obj);
-        }
-
-        /* create a new object */
-        if (!dev_priv->mm.phys_objs[id - 1]) {
-                ret = i915_gem_init_phys_object(dev, id,
-                                                obj->base.size, align);
-                if (ret) {
-                        DRM_ERROR("failed to init phys object %d size: %zu\n",
-                                  id, obj->base.size);
-                        return ret;
-                }
-        }
-
-        /* bind to the object */
-        obj->phys_obj = dev_priv->mm.phys_objs[id - 1];
-        obj->phys_obj->cur_obj = obj;
-
-        page_count = obj->base.size / PAGE_SIZE;
-
-        for (i = 0; i < page_count; i++) {
-                struct page *page;
-                char *dst, *src;
-
-                page = shmem_read_mapping_page(mapping, i);
-                if (IS_ERR(page))
-                        return PTR_ERR(page);
-
-                src = kmap_atomic(page);
-                dst = obj->phys_obj->handle->vaddr + (i * PAGE_SIZE);
-                memcpy(dst, src, PAGE_SIZE);
-                kunmap_atomic(src);
-
-                mark_page_accessed(page);
-                page_cache_release(page);
-        }
-
-        return 0;
-}
-
-static int
-i915_gem_phys_pwrite(struct drm_device *dev,
-                     struct drm_i915_gem_object *obj,
-                     struct drm_i915_gem_pwrite *args,
-                     struct drm_file *file_priv)
-{
-        void *vaddr = obj->phys_obj->handle->vaddr + args->offset;
-        char __user *user_data = to_user_ptr(args->data_ptr);
-
-        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
-                unsigned long unwritten;
-
-                /* The physical object once assigned is fixed for the lifetime
-                 * of the obj, so we can safely drop the lock and continue
-                 * to access vaddr.
-                 */
-                mutex_unlock(&dev->struct_mutex);
-                unwritten = copy_from_user(vaddr, user_data, args->size);
-                mutex_lock(&dev->struct_mutex);
-                if (unwritten)
-                        return -EFAULT;
-        }
-
-        i915_gem_chipset_flush(dev);
-        return 0;
-}
-
 void i915_gem_release(struct drm_device *dev, struct drm_file *file)
 {
         struct drm_i915_file_private *file_priv = file->driver_priv;
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 75fca63dc8c1..bbf4b12d842e 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -68,9 +68,9 @@ mark_free(struct i915_vma *vma, struct list_head *unwind)
 int
 i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
                          int min_size, unsigned alignment, unsigned cache_level,
+                         unsigned long start, unsigned long end,
                          unsigned flags)
 {
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct list_head eviction_list, unwind_list;
         struct i915_vma *vma;
         int ret = 0;
@@ -102,11 +102,10 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
          */
 
         INIT_LIST_HEAD(&unwind_list);
-        if (flags & PIN_MAPPABLE) {
-                BUG_ON(!i915_is_ggtt(vm));
+        if (start != 0 || end != vm->total) {
                 drm_mm_init_scan_with_range(&vm->mm, min_size,
-                                            alignment, cache_level, 0,
-                                            dev_priv->gtt.mappable_end);
+                                            alignment, cache_level,
+                                            start, end);
         } else
                 drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 2c9d9cbaf653..20fef6c50267 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -35,6 +35,9 @@
 
 #define  __EXEC_OBJECT_HAS_PIN (1<<31)
 #define  __EXEC_OBJECT_HAS_FENCE (1<<30)
+#define  __EXEC_OBJECT_NEEDS_BIAS (1<<28)
+
+#define BATCH_OFFSET_BIAS (256*1024)
 
 struct eb_vmas {
         struct list_head vmas;
@@ -545,7 +548,7 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
         struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
         bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;
         bool need_fence;
-        unsigned flags;
+        uint64_t flags;
         int ret;
 
         flags = 0;
@@ -559,6 +562,8 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
 
         if (entry->flags & EXEC_OBJECT_NEEDS_GTT)
                 flags |= PIN_GLOBAL;
+        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS)
+                flags |= BATCH_OFFSET_BIAS | PIN_OFFSET_BIAS;
 
         ret = i915_gem_object_pin(obj, vma->vm, entry->alignment, flags);
         if (ret)
@@ -592,6 +597,36 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
         return 0;
 }
 
+static bool
+eb_vma_misplaced(struct i915_vma *vma, bool has_fenced_gpu_access)
+{
+        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
+        struct drm_i915_gem_object *obj = vma->obj;
+        bool need_fence, need_mappable;
+
+        need_fence =
+                has_fenced_gpu_access &&
+                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                obj->tiling_mode != I915_TILING_NONE;
+        need_mappable = need_fence || need_reloc_mappable(vma);
+
+        WARN_ON((need_mappable || need_fence) &&
+               !i915_is_ggtt(vma->vm));
+
+        if (entry->alignment &&
+            vma->node.start & (entry->alignment - 1))
+                return true;
+
+        if (need_mappable && !obj->map_and_fenceable)
+                return true;
+
+        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS &&
+            vma->node.start < BATCH_OFFSET_BIAS)
+                return true;
+
+        return false;
+}
+
 static int
 i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                             struct list_head *vmas,
@@ -653,26 +688,10 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
 
                 /* Unbind any ill-fitting objects or pin. */
                 list_for_each_entry(vma, vmas, exec_list) {
-                        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
-                        bool need_fence, need_mappable;
-
-                        obj = vma->obj;
-
                         if (!drm_mm_node_allocated(&vma->node))
                                 continue;
 
-                        need_fence =
-                                has_fenced_gpu_access &&
-                                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
-                                obj->tiling_mode != I915_TILING_NONE;
-                        need_mappable = need_fence || need_reloc_mappable(vma);
-
-                        WARN_ON((need_mappable || need_fence) &&
-                               !i915_is_ggtt(vma->vm));
-
-                        if ((entry->alignment &&
-                             vma->node.start & (entry->alignment - 1)) ||
-                            (need_mappable && !obj->map_and_fenceable))
+                        if (eb_vma_misplaced(vma, has_fenced_gpu_access))
                                 ret = i915_vma_unbind(vma);
                         else
                                 ret = i915_gem_execbuffer_reserve_vma(vma, ring, need_relocs);
@@ -773,9 +792,9 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
                  * relocations were valid.
                  */
                 for (j = 0; j < exec[i].relocation_count; j++) {
-                        if (copy_to_user(&user_relocs[j].presumed_offset,
-                                         &invalid_offset,
-                                         sizeof(invalid_offset))) {
+                        if (__copy_to_user(&user_relocs[j].presumed_offset,
+                                           &invalid_offset,
+                                           sizeof(invalid_offset))) {
                                 ret = -EFAULT;
                                 mutex_lock(&dev->struct_mutex);
                                 goto err;
@@ -999,6 +1018,25 @@ i915_reset_gen7_sol_offsets(struct drm_device *dev,
         return 0;
 }
 
+static struct drm_i915_gem_object *
+eb_get_batch(struct eb_vmas *eb)
+{
+        struct i915_vma *vma = list_entry(eb->vmas.prev, typeof(*vma), exec_list);
+
+        /*
+         * SNA is doing fancy tricks with compressing batch buffers, which leads
+         * to negative relocation deltas. Usually that works out ok since the
+         * relocate address is still positive, except when the batch is placed
+         * very low in the GTT. Ensure this doesn't happen.
+         *
+         * Note that actual hangs have only been observed on gen7, but for
+         * paranoia do it everywhere.
+         */
+        vma->exec_entry->flags |= __EXEC_OBJECT_NEEDS_BIAS;
+
+        return vma->obj;
+}
+
 static int
 i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                        struct drm_file *file,
@@ -1153,7 +1191,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                 goto err;
 
         /* take note of the batch buffer before we might reorder the lists */
-        batch_obj = list_entry(eb->vmas.prev, struct i915_vma, exec_list)->obj;
+        batch_obj = eb_get_batch(eb);
 
         /* Move the objects en-masse into the GTT, evicting if necessary. */
         need_relocs = (args->flags & I915_EXEC_NO_RELOC) == 0;
@@ -1355,18 +1393,21 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 
         ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);
         if (!ret) {
+                struct drm_i915_gem_exec_object __user *user_exec_list =
+                        to_user_ptr(args->buffers_ptr);
+
                 /* Copy the new buffer offsets back to the user's exec list. */
-                for (i = 0; i < args->buffer_count; i++)
-                        exec_list[i].offset = exec2_list[i].offset;
-                /* ... and back out to userspace */
-                ret = copy_to_user(to_user_ptr(args->buffers_ptr),
-                                   exec_list,
-                                   sizeof(*exec_list) * args->buffer_count);
-                if (ret) {
-                        ret = -EFAULT;
-                        DRM_DEBUG("failed to copy %d exec entries "
-                                  "back to user (%d)\n",
-                                  args->buffer_count, ret);
+                for (i = 0; i < args->buffer_count; i++) {
+                        ret = __copy_to_user(&user_exec_list[i].offset,
+                                             &exec2_list[i].offset,
+                                             sizeof(user_exec_list[i].offset));
+                        if (ret) {
+                                ret = -EFAULT;
+                                DRM_DEBUG("failed to copy %d exec entries "
+                                          "back to user (%d)\n",
+                                          args->buffer_count, ret);
+                                break;
+                        }
                 }
         }
 
@@ -1412,14 +1453,21 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
         ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);
         if (!ret) {
                 /* Copy the new buffer offsets back to the user's exec list. */
-                ret = copy_to_user(to_user_ptr(args->buffers_ptr),
-                                   exec2_list,
-                                   sizeof(*exec2_list) * args->buffer_count);
-                if (ret) {
-                        ret = -EFAULT;
-                        DRM_DEBUG("failed to copy %d exec entries "
-                                  "back to user (%d)\n",
-                                  args->buffer_count, ret);
+                struct drm_i915_gem_exec_object2 *user_exec_list =
+                                   to_user_ptr(args->buffers_ptr);
+                int i;
+
+                for (i = 0; i < args->buffer_count; i++) {
+                        ret = __copy_to_user(&user_exec_list[i].offset,
+                                             &exec2_list[i].offset,
+                                             sizeof(user_exec_list[i].offset));
+                        if (ret) {
+                                ret = -EFAULT;
+                                DRM_DEBUG("failed to copy %d exec entries "
+                                          "back to user\n",
+                                          args->buffer_count);
+                                break;
+                        }
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 154b0f8bb88d..5deb22864c52 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1089,7 +1089,9 @@ alloc:
         if (ret == -ENOSPC && !retried) {
                 ret = i915_gem_evict_something(dev, &dev_priv->gtt.base,
                                                GEN6_PD_SIZE, GEN6_PD_ALIGN,
-                                               I915_CACHE_NONE, 0);
+                                               I915_CACHE_NONE,
+                                               0, dev_priv->gtt.base.total,
+                                               0);
                 if (ret)
                         return ret;
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 48aa516a1ac0..5b60e25baa32 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7825,14 +7825,12 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                 addr = i915_gem_obj_ggtt_offset(obj);
         } else {
                 int align = IS_I830(dev) ? 16 * 1024 : 256;
-                ret = i915_gem_attach_phys_object(dev, obj,
-                                                  (intel_crtc->pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1,
-                                                  align);
+                ret = i915_gem_object_attach_phys(obj, align);
                 if (ret) {
                         DRM_DEBUG_KMS("failed to attach phys object\n");
                         goto fail_locked;
                 }
-                addr = obj->phys_obj->handle->busaddr;
+                addr = obj->phys_handle->busaddr;
         }
 
         if (IS_GEN2(dev))
@@ -7840,10 +7838,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 
  finish:
         if (intel_crtc->cursor_bo) {
-                if (INTEL_INFO(dev)->cursor_needs_physical) {
-                        if (intel_crtc->cursor_bo != obj)
-                                i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
-                } else
+                if (!INTEL_INFO(dev)->cursor_needs_physical)
                         i915_gem_object_unpin_from_display_plane(intel_crtc->cursor_bo);
                 drm_gem_object_unreference(&intel_crtc->cursor_bo->base);
         }
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index d8adc9104dca..129db0c7d835 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -193,7 +193,7 @@ intel_overlay_map_regs(struct intel_overlay *overlay)
         struct overlay_registers __iomem *regs;
 
         if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
-                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_obj->handle->vaddr;
+                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_handle->vaddr;
         else
                 regs = io_mapping_map_wc(dev_priv->gtt.mappable,
                                          i915_gem_obj_ggtt_offset(overlay->reg_bo));
@@ -1340,14 +1340,12 @@ void intel_setup_overlay(struct drm_device *dev)
         overlay->reg_bo = reg_bo;
 
         if (OVERLAY_NEEDS_PHYSICAL(dev)) {
-                ret = i915_gem_attach_phys_object(dev, reg_bo,
-                                                  I915_GEM_PHYS_OVERLAY_REGS,
-                                                  PAGE_SIZE);
+                ret = i915_gem_object_attach_phys(reg_bo, PAGE_SIZE);
                 if (ret) {
                         DRM_ERROR("failed to attach phys overlay regs\n");
                         goto out_free_bo;
                 }
-                overlay->flip_addr = reg_bo->phys_obj->handle->busaddr;
+                overlay->flip_addr = reg_bo->phys_handle->busaddr;
         } else {
                 ret = i915_gem_obj_ggtt_pin(reg_bo, PAGE_SIZE, PIN_MAPPABLE);
                 if (ret) {
@@ -1428,7 +1426,7 @@ intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
                 /* Cast to make sparse happy, but it's wc memory anyway, so
                  * equivalent to the wc io mapping on X86. */
                 regs = (struct overlay_registers __iomem *)
-                        overlay->reg_bo->phys_obj->handle->vaddr;
+                        overlay->reg_bo->phys_handle->vaddr;
         else
                 regs = io_mapping_map_atomic_wc(dev_priv->gtt.mappable,
                                                 i915_gem_obj_ggtt_offset(overlay->reg_bo));
@@ -1462,7 +1460,7 @@ intel_overlay_capture_error_state(struct drm_device *dev)
         error->dovsta = I915_READ(DOVSTA);
         error->isr = I915_READ(ISR);
         if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
-                error->base = (__force long)overlay->reg_bo->phys_obj->handle->vaddr;
+                error->base = (__force long)overlay->reg_bo->phys_handle->vaddr;
         else
                 error->base = i915_gem_obj_ggtt_offset(overlay->reg_bo);
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
index 7762665ad8fd..876de9ac3793 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
@@ -1009,7 +1009,7 @@ exec_clkcmp(struct nv50_disp_priv *priv, int head, int id,
         }
 
         if (outp == 8)
-                return false;
+                return conf;
 
         data = exec_lookup(priv, head, outp, ctrl, dcb, &ver, &hdr, &cnt, &len, &info1);
         if (data == 0x0000)
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/nvd0.c b/drivers/gpu/drm/nouveau/core/subdev/therm/nvd0.c
index 43fec17ea540..bbf117be572f 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/nvd0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/nvd0.c
@@ -40,6 +40,7 @@ pwm_info(struct nouveau_therm *therm, int line)
                 case 0x00: return 2;
                 case 0x19: return 1;
                 case 0x1c: return 0;
+                case 0x1e: return 2;
                 default:
                         break;
                 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 68528619834a..8149e7cf4303 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1642,6 +1642,7 @@ struct radeon_vce {
         unsigned                fb_version;
         atomic_t                handles[RADEON_MAX_VCE_HANDLES];
         struct drm_file         *filp[RADEON_MAX_VCE_HANDLES];
+        unsigned                img_size[RADEON_MAX_VCE_HANDLES];
         struct delayed_work     idle_work;
 };
 
@@ -1655,7 +1656,7 @@ int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
                                uint32_t handle, struct radeon_fence **fence);
 void radeon_vce_free_handles(struct radeon_device *rdev, struct drm_file *filp);
 void radeon_vce_note_usage(struct radeon_device *rdev);
-int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi);
+int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi, unsigned size);
 int radeon_vce_cs_parse(struct radeon_cs_parser *p);
 bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
                                struct radeon_ring *ring,
@@ -2640,7 +2641,8 @@ void r100_pll_errata_after_index(struct radeon_device *rdev);
 #define ASIC_IS_DCE8(rdev) ((rdev->family >= CHIP_BONAIRE))
 #define ASIC_IS_DCE81(rdev) ((rdev->family == CHIP_KAVERI))
 #define ASIC_IS_DCE82(rdev) ((rdev->family == CHIP_BONAIRE))
-#define ASIC_IS_DCE83(rdev) ((rdev->family == CHIP_KABINI))
+#define ASIC_IS_DCE83(rdev) ((rdev->family == CHIP_KABINI) || \
+                             (rdev->family == CHIP_MULLINS))
 
 #define ASIC_IS_LOMBOK(rdev) ((rdev->ddev->pdev->device == 0x6849) || \
                               (rdev->ddev->pdev->device == 0x6850) || \
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index b3633d9a5317..9ab30976287d 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -196,6 +196,20 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
                 }
         }
 
+        if (!found) {
+                while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
+                        dhandle = ACPI_HANDLE(&pdev->dev);
+                        if (!dhandle)
+                                continue;
+
+                        status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
+                        if (!ACPI_FAILURE(status)) {
+                                found = true;
+                                break;
+                        }
+                }
+        }
+
         if (!found)
                 return false;
 
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 2b6e0ebcc13a..41ecf8a60611 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -152,6 +152,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                         uint32_t domain = r->write_domain ?
                                 r->write_domain : r->read_domains;
 
+                        if (domain & RADEON_GEM_DOMAIN_CPU) {
+                                DRM_ERROR("RADEON_GEM_DOMAIN_CPU is not valid "
+                                          "for command submission\n");
+                                return -EINVAL;
+                        }
+
                         p->relocs[i].domain = domain;
                         if (domain == RADEON_GEM_DOMAIN_VRAM)
                                 domain |= RADEON_GEM_DOMAIN_GTT;
@@ -342,10 +348,17 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                         return -EINVAL;
 
                 /* we only support VM on some SI+ rings */
-                if ((p->rdev->asic->ring[p->ring]->cs_parse == NULL) &&
-                   ((p->cs_flags & RADEON_CS_USE_VM) == 0)) {
-                        DRM_ERROR("Ring %d requires VM!\n", p->ring);
-                        return -EINVAL;
+                if ((p->cs_flags & RADEON_CS_USE_VM) == 0) {
+                        if (p->rdev->asic->ring[p->ring]->cs_parse == NULL) {
+                                DRM_ERROR("Ring %d requires VM!\n", p->ring);
+                                return -EINVAL;
+                        }
+                } else {
+                        if (p->rdev->asic->ring[p->ring]->ib_parse == NULL) {
+                                DRM_ERROR("VM not supported on ring %d!\n",
+                                          p->ring);
+                                return -EINVAL;
+                        }
                 }
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 0e770bbf7e29..14671406212f 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1533,11 +1533,6 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
 
         radeon_restore_bios_scratch_regs(rdev);
 
-        if (fbcon) {
-                radeon_fbdev_set_suspend(rdev, 0);
-                console_unlock();
-        }
-
         /* init dig PHYs, disp eng pll */
         if (rdev->is_atom_bios) {
                 radeon_atom_encoder_init(rdev);
@@ -1562,6 +1557,12 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         }
 
         drm_kms_helper_poll_enable(dev);
+
+        if (fbcon) {
+                radeon_fbdev_set_suspend(rdev, 0);
+                console_unlock();
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 408b6ac53f0b..356b733caafe 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -862,7 +862,7 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,
                                  unsigned *fb_div, unsigned *ref_div)
 {
         /* limit reference * post divider to a maximum */
-        ref_div_max = min(128 / post_div, ref_div_max);
+        ref_div_max = max(min(100 / post_div, ref_div_max), 1u);
 
         /* get matching reference and feedback divider */
         *ref_div = min(max(DIV_ROUND_CLOSEST(den, post_div), 1u), ref_div_max);
@@ -999,7 +999,7 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
 
         /* avoid high jitter with small fractional dividers */
         if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV && (fb_div % 10)) {
-                fb_div_min = max(fb_div_min, (9 - (fb_div % 10)) * 20 + 60);
+                fb_div_min = max(fb_div_min, (9 - (fb_div % 10)) * 20 + 50);
                 if (fb_div < fb_div_min) {
                         unsigned tmp = DIV_ROUND_UP(fb_div_min, fb_div);
                         fb_div *= tmp;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 0cc47f12d995..eaaedba04675 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -577,28 +577,29 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                         return r;
                 }
 
-                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
-                if (r) {
-                        radeon_vm_fini(rdev, &fpriv->vm);
-                        kfree(fpriv);
-                        return r;
-                }
+                if (rdev->accel_working) {
+                        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                        if (r) {
+                                radeon_vm_fini(rdev, &fpriv->vm);
+                                kfree(fpriv);
+                                return r;
+                        }
 
-                /* map the ib pool buffer read only into
-                 * virtual address space */
-                bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
-                                         rdev->ring_tmp_bo.bo);
-                r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
-                                          RADEON_VM_PAGE_READABLE |
-                                          RADEON_VM_PAGE_SNOOPED);
+                        /* map the ib pool buffer read only into
+                         * virtual address space */
+                        bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
+                                                 rdev->ring_tmp_bo.bo);
+                        r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
+                                                  RADEON_VM_PAGE_READABLE |
+                                                  RADEON_VM_PAGE_SNOOPED);
 
-                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
-                if (r) {
-                        radeon_vm_fini(rdev, &fpriv->vm);
-                        kfree(fpriv);
-                        return r;
+                        radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+                        if (r) {
+                                radeon_vm_fini(rdev, &fpriv->vm);
+                                kfree(fpriv);
+                                return r;
+                        }
                 }
-
                 file_priv->driver_priv = fpriv;
         }
 
@@ -626,13 +627,15 @@ void radeon_driver_postclose_kms(struct drm_device *dev,
                 struct radeon_bo_va *bo_va;
                 int r;
 
-                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
-                if (!r) {
-                        bo_va = radeon_vm_bo_find(&fpriv->vm,
-                                                  rdev->ring_tmp_bo.bo);
-                        if (bo_va)
-                                radeon_vm_bo_rmv(rdev, bo_va);
-                        radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+                if (rdev->accel_working) {
+                        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                        if (!r) {
+                                bo_va = radeon_vm_bo_find(&fpriv->vm,
+                                                          rdev->ring_tmp_bo.bo);
+                                if (bo_va)
+                                        radeon_vm_bo_rmv(rdev, bo_va);
+                                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+                        }
                 }
 
                 radeon_vm_fini(rdev, &fpriv->vm);
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 19bec0dbfa38..4faa4d6f9bb4 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -458,7 +458,7 @@ int radeon_bo_list_validate(struct radeon_device *rdev,
                          * into account. We don't want to disallow buffer moves
                          * completely.
                          */
-                        if (current_domain != RADEON_GEM_DOMAIN_CPU &&
+                        if ((lobj->alt_domain & current_domain) != 0 &&
                             (domain & current_domain) == 0 && /* will be moved */
                             bytes_moved > bytes_moved_threshold) {
                                 /* don't move it */
@@ -699,22 +699,30 @@ int radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo)
         rbo = container_of(bo, struct radeon_bo, tbo);
         radeon_bo_check_tiling(rbo, 0, 0);
         rdev = rbo->rdev;
-        if (bo->mem.mem_type == TTM_PL_VRAM) {
-                size = bo->mem.num_pages << PAGE_SHIFT;
-                offset = bo->mem.start << PAGE_SHIFT;
-                if ((offset + size) > rdev->mc.visible_vram_size) {
-                        /* hurrah the memory is not visible ! */
-                        radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM);
-                        rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT;
-                        r = ttm_bo_validate(bo, &rbo->placement, false, false);
-                        if (unlikely(r != 0))
-                                return r;
-                        offset = bo->mem.start << PAGE_SHIFT;
-                        /* this should not happen */
-                        if ((offset + size) > rdev->mc.visible_vram_size)
-                                return -EINVAL;
-                }
+        if (bo->mem.mem_type != TTM_PL_VRAM)
+                return 0;
+
+        size = bo->mem.num_pages << PAGE_SHIFT;
+        offset = bo->mem.start << PAGE_SHIFT;
+        if ((offset + size) <= rdev->mc.visible_vram_size)
+                return 0;
+
+        /* hurrah the memory is not visible ! */
+        radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM);
+        rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT;
+        r = ttm_bo_validate(bo, &rbo->placement, false, false);
+        if (unlikely(r == -ENOMEM)) {
+                radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
+                return ttm_bo_validate(bo, &rbo->placement, false, false);
+        } else if (unlikely(r != 0)) {
+                return r;
         }
+
+        offset = bo->mem.start << PAGE_SHIFT;
+        /* this should never happen */
+        if ((offset + size) > rdev->mc.visible_vram_size)
+                return -EINVAL;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index f30b8426eee2..53d6e1bb48dc 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -361,6 +361,11 @@ static ssize_t radeon_set_pm_profile(struct device *dev,
         struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
 
+        /* Can't set profile when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
+
         mutex_lock(&rdev->pm.mutex);
         if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                 if (strncmp("default", buf, strlen("default")) == 0)
@@ -409,6 +414,13 @@ static ssize_t radeon_set_pm_method(struct device *dev,
         struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
 
+        /* Can't set method when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) {
+                count = -EINVAL;
+                goto fail;
+        }
+
         /* we don't support the legacy modes with dpm */
         if (rdev->pm.pm_method == PM_METHOD_DPM) {
                 count = -EINVAL;
@@ -446,6 +458,10 @@ static ssize_t radeon_get_dpm_state(struct device *dev,
         struct radeon_device *rdev = ddev->dev_private;
         enum radeon_pm_state_type pm = rdev->pm.dpm.user_state;
 
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return snprintf(buf, PAGE_SIZE, "off\n");
+
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         (pm == POWER_STATE_TYPE_BATTERY) ? "battery" :
                         (pm == POWER_STATE_TYPE_BALANCED) ? "balanced" : "performance");
@@ -459,6 +475,11 @@ static ssize_t radeon_set_dpm_state(struct device *dev,
         struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
 
+        /* Can't set dpm state when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
+
         mutex_lock(&rdev->pm.mutex);
         if (strncmp("battery", buf, strlen("battery")) == 0)
                 rdev->pm.dpm.user_state = POWER_STATE_TYPE_BATTERY;
@@ -485,6 +506,10 @@ static ssize_t radeon_get_dpm_forced_performance_level(struct device *dev,
         struct radeon_device *rdev = ddev->dev_private;
         enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level;
 
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return snprintf(buf, PAGE_SIZE, "off\n");
+
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         (level == RADEON_DPM_FORCED_LEVEL_AUTO) ? "auto" :
                         (level == RADEON_DPM_FORCED_LEVEL_LOW) ? "low" : "high");
@@ -500,6 +525,11 @@ static ssize_t radeon_set_dpm_forced_performance_level(struct device *dev,
         enum radeon_dpm_forced_level level;
         int ret = 0;
 
+        /* Can't force performance level when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
+
         mutex_lock(&rdev->pm.mutex);
         if (strncmp("low", buf, strlen("low")) == 0) {
                 level = RADEON_DPM_FORCED_LEVEL_LOW;
@@ -538,8 +568,14 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
                                       char *buf)
 {
         struct radeon_device *rdev = dev_get_drvdata(dev);
+        struct drm_device *ddev = rdev->ddev;
         int temp;
 
+        /* Can't get temperature when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
+
         if (rdev->asic->pm.get_temperature)
                 temp = radeon_get_temperature(rdev);
         else
@@ -1614,8 +1650,12 @@ static int radeon_debugfs_pm_info(struct seq_file *m, void *data)
         struct drm_info_node *node = (struct drm_info_node *) m->private;
         struct drm_device *dev = node->minor->dev;
         struct radeon_device *rdev = dev->dev_private;
+        struct drm_device *ddev = rdev->ddev;
 
-        if (rdev->pm.dpm_enabled) {
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) {
+                seq_printf(m, "PX asic powered off\n");
+        } else if (rdev->pm.dpm_enabled) {
                 mutex_lock(&rdev->pm.mutex);
                 if (rdev->asic->dpm.debugfs_print_current_performance_level)
                         radeon_dpm_debugfs_print_current_performance_level(rdev, m);
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index f73324c81491..3971d968af6c 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -443,13 +443,16 @@ int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
  * @p: parser context
  * @lo: address of lower dword
  * @hi: address of higher dword
+ * @size: size of checker for relocation buffer
  *
  * Patch relocation inside command stream with real buffer address
  */
-int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi)
+int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi,
+                        unsigned size)
 {
         struct radeon_cs_chunk *relocs_chunk;
-        uint64_t offset;
+        struct radeon_cs_reloc *reloc;
+        uint64_t start, end, offset;
         unsigned idx;
 
         relocs_chunk = &p->chunks[p->chunk_relocs_idx];
@@ -462,15 +465,60 @@ int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi)
                 return -EINVAL;
         }
 
-        offset += p->relocs_ptr[(idx / 4)]->gpu_offset;
+        reloc = p->relocs_ptr[(idx / 4)];
+        start = reloc->gpu_offset;
+        end = start + radeon_bo_size(reloc->robj);
+        start += offset;
 
-        p->ib.ptr[lo] = offset & 0xFFFFFFFF;
-        p->ib.ptr[hi] = offset >> 32;
+        p->ib.ptr[lo] = start & 0xFFFFFFFF;
+        p->ib.ptr[hi] = start >> 32;
+
+        if (end <= start) {
+                DRM_ERROR("invalid reloc offset %llX!\n", offset);
+                return -EINVAL;
+        }
+        if ((end - start) < size) {
+                DRM_ERROR("buffer to small (%d / %d)!\n",
+                        (unsigned)(end - start), size);
+                return -EINVAL;
+        }
 
         return 0;
 }
 
 /**
+ * radeon_vce_validate_handle - validate stream handle
+ *
+ * @p: parser context
+ * @handle: handle to validate
+ *
+ * Validates the handle and return the found session index or -EINVAL
+ * we we don't have another free session index.
+ */
+int radeon_vce_validate_handle(struct radeon_cs_parser *p, uint32_t handle)
+{
+        unsigned i;
+
+        /* validate the handle */
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+                if (atomic_read(&p->rdev->vce.handles[i]) == handle)
+                        return i;
+        }
+
+        /* handle not found try to alloc a new one */
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+                if (!atomic_cmpxchg(&p->rdev->vce.handles[i], 0, handle)) {
+                        p->rdev->vce.filp[i] = p->filp;
+                        p->rdev->vce.img_size[i] = 0;
+                        return i;
+                }
+        }
+
+        DRM_ERROR("No more free VCE handles!\n");
+        return -EINVAL;
+}
+
+/**
  * radeon_vce_cs_parse - parse and validate the command stream
  *
  * @p: parser context
@@ -478,8 +526,10 @@ int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi)
  */
 int radeon_vce_cs_parse(struct radeon_cs_parser *p)
 {
-        uint32_t handle = 0;
-        bool destroy = false;
+        int session_idx = -1;
+        bool destroyed = false;
+        uint32_t tmp, handle = 0;
+        uint32_t *size = &tmp;
         int i, r;
 
         while (p->idx < p->chunks[p->chunk_ib_idx].length_dw) {
@@ -491,13 +541,29 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
                         return -EINVAL;
                 }
 
+                if (destroyed) {
+                        DRM_ERROR("No other command allowed after destroy!\n");
+                        return -EINVAL;
+                }
+
                 switch (cmd) {
                 case 0x00000001: // session
                         handle = radeon_get_ib_value(p, p->idx + 2);
+                        session_idx = radeon_vce_validate_handle(p, handle);
+                        if (session_idx < 0)
+                                return session_idx;
+                        size = &p->rdev->vce.img_size[session_idx];
                         break;
 
                 case 0x00000002: // task info
+                        break;
+
                 case 0x01000001: // create
+                        *size = radeon_get_ib_value(p, p->idx + 8) *
+                                radeon_get_ib_value(p, p->idx + 10) *
+                                8 * 3 / 2;
+                        break;
+
                 case 0x04000001: // config extension
                 case 0x04000002: // pic control
                 case 0x04000005: // rate control
@@ -506,23 +572,39 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
                         break;
 
                 case 0x03000001: // encode
-                        r = radeon_vce_cs_reloc(p, p->idx + 10, p->idx + 9);
+                        r = radeon_vce_cs_reloc(p, p->idx + 10, p->idx + 9,
+                                                *size);
                         if (r)
                                 return r;
 
-                        r = radeon_vce_cs_reloc(p, p->idx + 12, p->idx + 11);
+                        r = radeon_vce_cs_reloc(p, p->idx + 12, p->idx + 11,
+                                                *size / 3);
                         if (r)
                                 return r;
                         break;
 
                 case 0x02000001: // destroy
-                        destroy = true;
+                        destroyed = true;
                         break;
 
                 case 0x05000001: // context buffer
+                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+                                                *size * 2);
+                        if (r)
+                                return r;
+                        break;
+
                 case 0x05000004: // video bitstream buffer
+                        tmp = radeon_get_ib_value(p, p->idx + 4);
+                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+                                                tmp);
+                        if (r)
+                                return r;
+                        break;
+
                 case 0x05000005: // feedback buffer
-                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2);
+                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+                                                4096);
                         if (r)
                                 return r;
                         break;
@@ -532,33 +614,21 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
                         return -EINVAL;
                 }
 
+                if (session_idx == -1) {
+                        DRM_ERROR("no session command at start of IB\n");
+                        return -EINVAL;
+                }
+
                 p->idx += len / 4;
         }
 
-        if (destroy) {
+        if (destroyed) {
                 /* IB contains a destroy msg, free the handle */
                 for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i)
                         atomic_cmpxchg(&p->rdev->vce.handles[i], handle, 0);
-
-                return 0;
-        }
-
-        /* create or encode, validate the handle */
-        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
-                if (atomic_read(&p->rdev->vce.handles[i]) == handle)
-                        return 0;
         }
 
-        /* handle not found try to alloc a new one */
-        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
-                if (!atomic_cmpxchg(&p->rdev->vce.handles[i], 0, handle)) {
-                        p->rdev->vce.filp[i] = p->filp;
-                        return 0;
-                }
-        }
-
-        DRM_ERROR("No more free VCE handles!\n");
-        return -EINVAL;
+        return 0;
 }
 
 /**
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index 2aae6ce49d32..1f426696de36 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -130,10 +130,10 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
                                           struct list_head *head)
 {
         struct radeon_cs_reloc *list;
-        unsigned i, idx, size;
+        unsigned i, idx;
 
-        size = (radeon_vm_num_pdes(rdev) + 1) * sizeof(struct radeon_cs_reloc);
-        list = kmalloc(size, GFP_KERNEL);
+        list = kmalloc_array(vm->max_pde_used + 1,
+                             sizeof(struct radeon_cs_reloc), GFP_KERNEL);
         if (!list)
                 return NULL;
 
@@ -595,7 +595,7 @@ int radeon_vm_update_page_directory(struct radeon_device *rdev,
         ndw = 64;
 
         /* assume the worst case */
-        ndw += vm->max_pde_used * 12;
+        ndw += vm->max_pde_used * 16;
 
         /* update too big for an IB */
         if (ndw > 0xfffff)
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 683532f84931..7321283602ce 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -107,8 +107,8 @@
 #define         SPLL_CHG_STATUS                         (1 << 1)
 #define SPLL_CNTL_MODE                                  0x618
 #define         SPLL_SW_DIR_CONTROL                     (1 << 0)
-#       define SPLL_REFCLK_SEL(x)                       ((x) << 8)
-#       define SPLL_REFCLK_SEL_MASK                     0xFF00
+#       define SPLL_REFCLK_SEL(x)                       ((x) << 26)
+#       define SPLL_REFCLK_SEL_MASK                     (3 << 26)
 
 #define CG_SPLL_SPREAD_SPECTRUM                         0x620
 #define         SSEN                                    (1 << 0)