27 files changed, 321 insertions, 193 deletions

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index bf92d07510df..5663d2719063 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -148,7 +148,7 @@ int drm_gem_object_init(struct drm_device *dev,
                 return -ENOMEM;
 
         kref_init(&obj->refcount);
-        kref_init(&obj->handlecount);
+        atomic_set(&obj->handle_count, 0);
         obj->size = size;
 
         atomic_inc(&dev->object_count);
@@ -462,28 +462,6 @@ drm_gem_object_free(struct kref *kref)
 }
 EXPORT_SYMBOL(drm_gem_object_free);
 
-/**
- * Called after the last reference to the object has been lost.
- * Must be called without holding struct_mutex
- *
- * Frees the object
- */
-void
-drm_gem_object_free_unlocked(struct kref *kref)
-{
-        struct drm_gem_object *obj = (struct drm_gem_object *) kref;
-        struct drm_device *dev = obj->dev;
-
-        if (dev->driver->gem_free_object_unlocked != NULL)
-                dev->driver->gem_free_object_unlocked(obj);
-        else if (dev->driver->gem_free_object != NULL) {
-                mutex_lock(&dev->struct_mutex);
-                dev->driver->gem_free_object(obj);
-                mutex_unlock(&dev->struct_mutex);
-        }
-}
-EXPORT_SYMBOL(drm_gem_object_free_unlocked);
-
 static void drm_gem_object_ref_bug(struct kref *list_kref)
 {
         BUG();
@@ -496,12 +474,8 @@ static void drm_gem_object_ref_bug(struct kref *list_kref)
  * called before drm_gem_object_free or we'll be touching
  * freed memory
  */
-void
-drm_gem_object_handle_free(struct kref *kref)
+void drm_gem_object_handle_free(struct drm_gem_object *obj)
 {
-        struct drm_gem_object *obj = container_of(kref,
-                                                  struct drm_gem_object,
-                                                  handlecount);
         struct drm_device *dev = obj->dev;
 
         /* Remove any name for this object */
@@ -528,6 +502,10 @@ void drm_gem_vm_open(struct vm_area_struct *vma)
         struct drm_gem_object *obj = vma->vm_private_data;
 
         drm_gem_object_reference(obj);
+
+        mutex_lock(&obj->dev->struct_mutex);
+        drm_vm_open_locked(vma);
+        mutex_unlock(&obj->dev->struct_mutex);
 }
 EXPORT_SYMBOL(drm_gem_vm_open);
 
@@ -535,7 +513,10 @@ void drm_gem_vm_close(struct vm_area_struct *vma)
 {
         struct drm_gem_object *obj = vma->vm_private_data;
 
-        drm_gem_object_unreference_unlocked(obj);
+        mutex_lock(&obj->dev->struct_mutex);
+        drm_vm_close_locked(vma);
+        drm_gem_object_unreference(obj);
+        mutex_unlock(&obj->dev->struct_mutex);
 }
 EXPORT_SYMBOL(drm_gem_vm_close);
 
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index 2ef2c7827243..974e970ce3f8 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -255,7 +255,7 @@ int drm_gem_one_name_info(int id, void *ptr, void *data)
 
         seq_printf(m, "%6d %8zd %7d %8d\n",
                    obj->name, obj->size,
-                   atomic_read(&obj->handlecount.refcount),
+                   atomic_read(&obj->handle_count),
                    atomic_read(&obj->refcount.refcount));
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_vm.c b/drivers/gpu/drm/drm_vm.c
index fda67468e603..5df450683aab 100644
--- a/drivers/gpu/drm/drm_vm.c
+++ b/drivers/gpu/drm/drm_vm.c
@@ -433,15 +433,7 @@ static void drm_vm_open(struct vm_area_struct *vma)
         mutex_unlock(&dev->struct_mutex);
 }
 
-/**
- * \c close method for all virtual memory types.
- *
- * \param vma virtual memory area.
- *
- * Search the \p vma private data entry in drm_device::vmalist, unlink it, and
- * free it.
- */
-static void drm_vm_close(struct vm_area_struct *vma)
+void drm_vm_close_locked(struct vm_area_struct *vma)
 {
         struct drm_file *priv = vma->vm_file->private_data;
         struct drm_device *dev = priv->minor->dev;
@@ -451,7 +443,6 @@ static void drm_vm_close(struct vm_area_struct *vma)
                   vma->vm_start, vma->vm_end - vma->vm_start);
         atomic_dec(&dev->vma_count);
 
-        mutex_lock(&dev->struct_mutex);
         list_for_each_entry_safe(pt, temp, &dev->vmalist, head) {
                 if (pt->vma == vma) {
                         list_del(&pt->head);
@@ -459,6 +450,23 @@ static void drm_vm_close(struct vm_area_struct *vma)
                         break;
                 }
         }
+}
+
+/**
+ * \c close method for all virtual memory types.
+ *
+ * \param vma virtual memory area.
+ *
+ * Search the \p vma private data entry in drm_device::vmalist, unlink it, and
+ * free it.
+ */
+static void drm_vm_close(struct vm_area_struct *vma)
+{
+        struct drm_file *priv = vma->vm_file->private_data;
+        struct drm_device *dev = priv->minor->dev;
+
+        mutex_lock(&dev->struct_mutex);
+        drm_vm_close_locked(vma);
         mutex_unlock(&dev->struct_mutex);
 }
 
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 61b4caf220fa..fb07e73581e8 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -116,7 +116,7 @@ static int i810_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i810_buffer_fops = {
         .open = drm_open,
         .release = drm_release,
-        .unlocked_ioctl = drm_ioctl,
+        .unlocked_ioctl = i810_ioctl,
         .mmap = i810_mmap_buffers,
         .fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i830/i830_dma.c b/drivers/gpu/drm/i830/i830_dma.c
index 671aa18415ac..cc92c7e6236f 100644
--- a/drivers/gpu/drm/i830/i830_dma.c
+++ b/drivers/gpu/drm/i830/i830_dma.c
@@ -118,7 +118,7 @@ static int i830_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i830_buffer_fops = {
         .open = drm_open,
         .release = drm_release,
-        .unlocked_ioctl = drm_ioctl,
+        .unlocked_ioctl = i830_ioctl,
         .mmap = i830_mmap_buffers,
         .fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9d67b4853030..c74e4e8006d4 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1787,9 +1787,9 @@ unsigned long i915_chipset_val(struct drm_i915_private *dev_priv)
                 }
         }
 
-        div_u64(diff, diff1);
+        diff = div_u64(diff, diff1);
         ret = ((m * diff) + c);
-        div_u64(ret, 10);
+        ret = div_u64(ret, 10);
 
         dev_priv->last_count1 = total_count;
         dev_priv->last_time1 = now;
@@ -1858,7 +1858,7 @@ void i915_update_gfx_val(struct drm_i915_private *dev_priv)
 
         /* More magic constants... */
         diff = diff * 1181;
-        div_u64(diff, diffms * 10);
+        diff = div_u64(diff, diffms * 10);
         dev_priv->gfx_power = diff;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index bced9b25c71e..90b1d6753b9d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -136,14 +136,12 @@ i915_gem_create_ioctl(struct drm_device *dev, void *data,
                 return -ENOMEM;
 
         ret = drm_gem_handle_create(file_priv, obj, &handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(obj);
         if (ret) {
-                drm_gem_object_unreference_unlocked(obj);
                 return ret;
         }
 
-        /* Sink the floating reference from kref_init(handlecount) */
-        drm_gem_object_handle_unreference_unlocked(obj);
-
         args->handle = handle;
         return 0;
 }
@@ -471,14 +469,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
         obj_priv = to_intel_bo(obj);
 
-        /* Bounds check source.
-         *
-         * XXX: This could use review for overflow issues...
-         */
-        if (args->offset > obj->size || args->size > obj->size ||
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
-                return -EINVAL;
+        /* Bounds check source.  */
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (!access_ok(VERIFY_WRITE,
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
         }
 
         if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -490,8 +491,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                                                         file_priv);
         }
 
+err:
         drm_gem_object_unreference_unlocked(obj);
-
         return ret;
 }
 
@@ -580,8 +581,6 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
 
         user_data = (char __user *) (uintptr_t) args->data_ptr;
         remain = args->size;
-        if (!access_ok(VERIFY_READ, user_data, remain))
-                return -EFAULT;
 
 
         mutex_lock(&dev->struct_mutex);
@@ -934,14 +933,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
         obj_priv = to_intel_bo(obj);
 
-        /* Bounds check destination.
-         *
-         * XXX: This could use review for overflow issues...
-         */
-        if (args->offset > obj->size || args->size > obj->size ||
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
-                return -EINVAL;
+        /* Bounds check destination. */
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (!access_ok(VERIFY_READ,
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
         }
 
         /* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -975,8 +977,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                 DRM_INFO("pwrite failed %d\n", ret);
 #endif
 
+err:
         drm_gem_object_unreference_unlocked(obj);
-
         return ret;
 }
 
@@ -3258,6 +3260,8 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                                   (int) reloc->offset,
                                   reloc->read_domains,
                                   reloc->write_domain);
+                        drm_gem_object_unreference(target_obj);
+                        i915_gem_object_unpin(obj);
                         return -EINVAL;
                 }
                 if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index e85246ef691c..5c428fa3e0b3 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -93,7 +93,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct list_head eviction_list, unwind_list;
-        struct drm_i915_gem_object *obj_priv, *tmp_obj_priv;
+        struct drm_i915_gem_object *obj_priv;
         struct list_head *render_iter, *bsd_iter;
         int ret = 0;
 
@@ -175,39 +175,34 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
         return -ENOSPC;
 
 found:
+        /* drm_mm doesn't allow any other other operations while
+         * scanning, therefore store to be evicted objects on a
+         * temporary list. */
         INIT_LIST_HEAD(&eviction_list);
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
-                                 &unwind_list, evict_list) {
+        while (!list_empty(&unwind_list)) {
+                obj_priv = list_first_entry(&unwind_list,
+                                            struct drm_i915_gem_object,
+                                            evict_list);
                 if (drm_mm_scan_remove_block(obj_priv->gtt_space)) {
-                        /* drm_mm doesn't allow any other other operations while
-                         * scanning, therefore store to be evicted objects on a
-                         * temporary list. */
                         list_move(&obj_priv->evict_list, &eviction_list);
-                } else
-                        drm_gem_object_unreference(&obj_priv->base);
+                        continue;
+                }
+                list_del(&obj_priv->evict_list);
+                drm_gem_object_unreference(&obj_priv->base);
         }
 
         /* Unbinding will emit any required flushes */
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
-                                 &eviction_list, evict_list) {
-#if WATCH_LRU
-                DRM_INFO("%s: evicting %p\n", __func__, &obj_priv->base);
-#endif
-                ret = i915_gem_object_unbind(&obj_priv->base);
-                if (ret)
-                        return ret;
-
+        while (!list_empty(&eviction_list)) {
+                obj_priv = list_first_entry(&eviction_list,
+                                            struct drm_i915_gem_object,
+                                            evict_list);
+                if (ret == 0)
+                        ret = i915_gem_object_unbind(&obj_priv->base);
+                list_del(&obj_priv->evict_list);
                 drm_gem_object_unreference(&obj_priv->base);
         }
 
-        /* The just created free hole should be on the top of the free stack
-         * maintained by drm_mm, so this BUG_ON actually executes in O(1).
-         * Furthermore all accessed data has just recently been used, so it
-         * should be really fast, too. */
-        BUG_ON(!drm_mm_search_free(&dev_priv->mm.gtt_space, min_size,
-                                   alignment, 0));
-
-        return 0;
+        return ret;
 }
 
 int
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index b5bf51a4502d..979228594599 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1013,8 +1013,8 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
                 DRM_DEBUG_KMS("vblank wait timed out\n");
 }
 
-/**
- * intel_wait_for_vblank_off - wait for vblank after disabling a pipe
+/*
+ * intel_wait_for_pipe_off - wait for pipe to turn off
  * @dev: drm device
  * @pipe: pipe to wait for
  *
@@ -1022,25 +1022,39 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
  * spinning on the vblank interrupt status bit, since we won't actually
  * see an interrupt when the pipe is disabled.
  *
- * So this function waits for the display line value to settle (it
- * usually ends up stopping at the start of the next frame).
+ * On Gen4 and above:
+ *   wait for the pipe register state bit to turn off
+ *
+ * Otherwise:
+ *   wait for the display line value to settle (it usually
+ *   ends up stopping at the start of the next frame).
+ *  
  */
-void intel_wait_for_vblank_off(struct drm_device *dev, int pipe)
+static void intel_wait_for_pipe_off(struct drm_device *dev, int pipe)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-        unsigned long timeout = jiffies + msecs_to_jiffies(100);
-        u32 last_line;
-
-        /* Wait for the display line to settle */
-        do {
-                last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
-                mdelay(5);
-        } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
-                 time_after(timeout, jiffies));
-
-        if (time_after(jiffies, timeout))
-                DRM_DEBUG_KMS("vblank wait timed out\n");
+
+        if (INTEL_INFO(dev)->gen >= 4) {
+                int pipeconf_reg = (pipe == 0 ? PIPEACONF : PIPEBCONF);
+
+                /* Wait for the Pipe State to go off */
+                if (wait_for((I915_READ(pipeconf_reg) & I965_PIPECONF_ACTIVE) == 0,
+                             100, 0))
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
+        } else {
+                u32 last_line;
+                int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
+                unsigned long timeout = jiffies + msecs_to_jiffies(100);
+
+                /* Wait for the display line to settle */
+                do {
+                        last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+                        mdelay(5);
+                } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+                         time_after(timeout, jiffies));
+                if (time_after(jiffies, timeout))
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
+        }
 }
 
 /* Parameters have changed, update FBC info */
@@ -2328,13 +2342,13 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                         I915_READ(dspbase_reg);
                 }
 
-                /* Wait for vblank for the disable to take effect */
-                intel_wait_for_vblank_off(dev, pipe);
-
                 /* Don't disable pipe A or pipe A PLLs if needed */
                 if (pipeconf_reg == PIPEACONF &&
-                    (dev_priv->quirks & QUIRK_PIPEA_FORCE))
+                    (dev_priv->quirks & QUIRK_PIPEA_FORCE)) {
+                        /* Wait for vblank for the disable to take effect */
+                        intel_wait_for_vblank(dev, pipe);
                         goto skip_pipe_off;
+                }
 
                 /* Next, disable display pipes */
                 temp = I915_READ(pipeconf_reg);
@@ -2343,8 +2357,8 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                         I915_READ(pipeconf_reg);
                 }
 
-                /* Wait for vblank for the disable to take effect. */
-                intel_wait_for_vblank_off(dev, pipe);
+                /* Wait for the pipe to turn off */
+                intel_wait_for_pipe_off(dev, pipe);
 
                 temp = I915_READ(dpll_reg);
                 if ((temp & DPLL_VCO_ENABLE) != 0) {
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 1a51ee07de3e..9ab8708ac6ba 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1138,18 +1138,14 @@ static bool
 intel_dp_set_link_train(struct intel_dp *intel_dp,
                         uint32_t dp_reg_value,
                         uint8_t dp_train_pat,
-                        uint8_t train_set[4],
-                        bool first)
+                        uint8_t train_set[4])
 {
         struct drm_device *dev = intel_dp->base.enc.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
         int ret;
 
         I915_WRITE(intel_dp->output_reg, dp_reg_value);
         POSTING_READ(intel_dp->output_reg);
-        if (first)
-                intel_wait_for_vblank(dev, intel_crtc->pipe);
 
         intel_dp_aux_native_write_1(intel_dp,
                                     DP_TRAINING_PATTERN_SET,
@@ -1174,10 +1170,15 @@ intel_dp_link_train(struct intel_dp *intel_dp)
         uint8_t voltage;
         bool clock_recovery = false;
         bool channel_eq = false;
-        bool first = true;
         int tries;
         u32 reg;
         uint32_t DP = intel_dp->DP;
+        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
+
+        /* Enable output, wait for it to become active */
+        I915_WRITE(intel_dp->output_reg, intel_dp->DP);
+        POSTING_READ(intel_dp->output_reg);
+        intel_wait_for_vblank(dev, intel_crtc->pipe);
 
         /* Write the link configuration data */
         intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET,
@@ -1210,9 +1211,8 @@ intel_dp_link_train(struct intel_dp *intel_dp)
                         reg = DP | DP_LINK_TRAIN_PAT_1;
 
                 if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_1, train_set, first))
+                                             DP_TRAINING_PATTERN_1, train_set))
                         break;
-                first = false;
                 /* Set training pattern 1 */
 
                 udelay(100);
@@ -1266,8 +1266,7 @@ intel_dp_link_train(struct intel_dp *intel_dp)
 
                 /* channel eq pattern */
                 if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_2, train_set,
-                                             false))
+                                             DP_TRAINING_PATTERN_2, train_set))
                         break;
 
                 udelay(400);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index ad312ca6b3e5..8828b3ac6414 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -229,7 +229,6 @@ extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
                                                     struct drm_crtc *crtc);
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
-extern void intel_wait_for_vblank_off(struct drm_device *dev, int pipe);
 extern void intel_wait_for_vblank(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 7bdc96256bf5..56ad9df2ccb5 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -237,8 +237,10 @@ int intel_fbdev_destroy(struct drm_device *dev,
         drm_fb_helper_fini(&ifbdev->helper);
 
         drm_framebuffer_cleanup(&ifb->base);
-        if (ifb->obj)
+        if (ifb->obj) {
+                drm_gem_object_handle_unreference(ifb->obj);
                 drm_gem_object_unreference(ifb->obj);
+        }
 
         return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index dbd30b2e43fd..d2047713dc59 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -352,6 +352,7 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *nfbdev)
 
         if (nouveau_fb->nvbo) {
                 nouveau_bo_unmap(nouveau_fb->nvbo);
+                drm_gem_object_handle_unreference_unlocked(nouveau_fb->nvbo->gem);
                 drm_gem_object_unreference_unlocked(nouveau_fb->nvbo->gem);
                 nouveau_fb->nvbo = NULL;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index ead7b8fc53fc..19620a6709f5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -167,11 +167,9 @@ nouveau_gem_ioctl_new(struct drm_device *dev, void *data,
                 goto out;
 
         ret = drm_gem_handle_create(file_priv, nvbo->gem, &req->info.handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(nvbo->gem);
 out:
-        drm_gem_object_handle_unreference_unlocked(nvbo->gem);
-
-        if (ret)
-                drm_gem_object_unreference_unlocked(nvbo->gem);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 3ec181ff50ce..3c9964a8fbad 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -79,6 +79,7 @@ nouveau_notifier_takedown_channel(struct nouveau_channel *chan)
         mutex_lock(&dev->struct_mutex);
         nouveau_bo_unpin(chan->notifier_bo);
         mutex_unlock(&dev->struct_mutex);
+        drm_gem_object_handle_unreference_unlocked(chan->notifier_bo->gem);
         drm_gem_object_unreference_unlocked(chan->notifier_bo->gem);
         drm_mm_takedown(&chan->notifier_heap);
 }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index ddc3adea1dda..7a04959ba0ee 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3528,7 +3528,8 @@ void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
         /* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
          * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
          */
-        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
+        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
+            rdev->vram_scratch.ptr) {
                 void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
                 u32 tmp;
 
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index ebae14c4b768..68932ba7b8a4 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -317,6 +317,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                         *connector_type = DRM_MODE_CONNECTOR_DVID;
         }
 
+        /* MSI K9A2GM V2/V3 board has no HDMI or DVI */
+        if ((dev->pdev->device == 0x796e) &&
+            (dev->pdev->subsystem_vendor == 0x1462) &&
+            (dev->pdev->subsystem_device == 0x7302)) {
+                if ((supported_device == ATOM_DEVICE_DFP2_SUPPORT) ||
+                    (supported_device == ATOM_DEVICE_DFP3_SUPPORT))
+                        return false;
+        }
+
         /* a-bit f-i90hd - ciaranm on #radeonhd - this board has no DVI */
         if ((dev->pdev->device == 0x7941) &&
             (dev->pdev->subsystem_vendor == 0x147b) &&
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 127a395f70fb..b92d2f2fcbed 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -349,6 +349,8 @@ static void radeon_print_display_setup(struct drm_device *dev)
                                         DRM_INFO("    DFP4: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                 if (devices & ATOM_DEVICE_DFP5_SUPPORT)
                                         DRM_INFO("    DFP5: %s\n", encoder_names[radeon_encoder->encoder_id]);
+                                if (devices & ATOM_DEVICE_DFP6_SUPPORT)
+                                        DRM_INFO("    DFP6: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                 if (devices & ATOM_DEVICE_TV1_SUPPORT)
                                         DRM_INFO("    TV1: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                 if (devices & ATOM_DEVICE_CV_SUPPORT)
@@ -841,8 +843,9 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
 {
         struct radeon_framebuffer *radeon_fb = to_radeon_framebuffer(fb);
 
-        if (radeon_fb->obj)
+        if (radeon_fb->obj) {
                 drm_gem_object_unreference_unlocked(radeon_fb->obj);
+        }
         drm_framebuffer_cleanup(fb);
         kfree(radeon_fb);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index c74a8b20d941..9cdf6a35bc2c 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -94,8 +94,10 @@ static void radeonfb_destroy_pinned_object(struct drm_gem_object *gobj)
         ret = radeon_bo_reserve(rbo, false);
         if (likely(ret == 0)) {
                 radeon_bo_kunmap(rbo);
+                radeon_bo_unpin(rbo);
                 radeon_bo_unreserve(rbo);
         }
+        drm_gem_object_handle_unreference(gobj);
         drm_gem_object_unreference_unlocked(gobj);
 }
 
@@ -325,8 +327,6 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
 {
         struct fb_info *info;
         struct radeon_framebuffer *rfb = &rfbdev->rfb;
-        struct radeon_bo *rbo;
-        int r;
 
         if (rfbdev->helper.fbdev) {
                 info = rfbdev->helper.fbdev;
@@ -338,14 +338,8 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
         }
 
         if (rfb->obj) {
-                rbo = rfb->obj->driver_private;
-                r = radeon_bo_reserve(rbo, false);
-                if (likely(r == 0)) {
-                        radeon_bo_kunmap(rbo);
-                        radeon_bo_unpin(rbo);
-                        radeon_bo_unreserve(rbo);
-                }
-                drm_gem_object_unreference_unlocked(rfb->obj);
+                radeonfb_destroy_pinned_object(rfb->obj);
+                rfb->obj = NULL;
         }
         drm_fb_helper_fini(&rfbdev->helper);
         drm_framebuffer_cleanup(&rfb->base);
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index c578f265b24c..d1e595d91723 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -201,11 +201,11 @@ int radeon_gem_create_ioctl(struct drm_device *dev, void *data,
                 return r;
         }
         r = drm_gem_handle_create(filp, gobj, &handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(gobj);
         if (r) {
-                drm_gem_object_unreference_unlocked(gobj);
                 return r;
         }
-        drm_gem_object_handle_unreference_unlocked(gobj);
         args->handle = handle;
         return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 72ec2e2b6e97..a96ed6d9d010 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -148,13 +148,16 @@ static struct pci_device_id vmw_pci_id_list[] = {
         {0, 0, 0}
 };
 
-static char *vmw_devname = "vmwgfx";
+static int enable_fbdev;
 
 static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
 static void vmw_master_init(struct vmw_master *);
 static int vmwgfx_pm_notifier(struct notifier_block *nb, unsigned long val,
                               void *ptr);
 
+MODULE_PARM_DESC(enable_fbdev, "Enable vmwgfx fbdev");
+module_param_named(enable_fbdev, enable_fbdev, int, 0600);
+
 static void vmw_print_capabilities(uint32_t capabilities)
 {
         DRM_INFO("Capabilities:\n");
@@ -192,8 +195,6 @@ static int vmw_request_device(struct vmw_private *dev_priv)
 {
         int ret;
 
-        vmw_kms_save_vga(dev_priv);
-
         ret = vmw_fifo_init(dev_priv, &dev_priv->fifo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Unable to initialize FIFO.\n");
@@ -206,9 +207,35 @@ static int vmw_request_device(struct vmw_private *dev_priv)
 static void vmw_release_device(struct vmw_private *dev_priv)
 {
         vmw_fifo_release(dev_priv, &dev_priv->fifo);
-        vmw_kms_restore_vga(dev_priv);
 }
 
+int vmw_3d_resource_inc(struct vmw_private *dev_priv)
+{
+        int ret = 0;
+
+        mutex_lock(&dev_priv->release_mutex);
+        if (unlikely(dev_priv->num_3d_resources++ == 0)) {
+                ret = vmw_request_device(dev_priv);
+                if (unlikely(ret != 0))
+                        --dev_priv->num_3d_resources;
+        }
+        mutex_unlock(&dev_priv->release_mutex);
+        return ret;
+}
+
+
+void vmw_3d_resource_dec(struct vmw_private *dev_priv)
+{
+        int32_t n3d;
+
+        mutex_lock(&dev_priv->release_mutex);
+        if (unlikely(--dev_priv->num_3d_resources == 0))
+                vmw_release_device(dev_priv);
+        n3d = (int32_t) dev_priv->num_3d_resources;
+        mutex_unlock(&dev_priv->release_mutex);
+
+        BUG_ON(n3d < 0);
+}
 
 static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 {
@@ -228,6 +255,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         dev_priv->last_read_sequence = (uint32_t) -100;
         mutex_init(&dev_priv->hw_mutex);
         mutex_init(&dev_priv->cmdbuf_mutex);
+        mutex_init(&dev_priv->release_mutex);
         rwlock_init(&dev_priv->resource_lock);
         idr_init(&dev_priv->context_idr);
         idr_init(&dev_priv->surface_idr);
@@ -244,6 +272,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         dev_priv->vram_start = pci_resource_start(dev->pdev, 1);
         dev_priv->mmio_start = pci_resource_start(dev->pdev, 2);
 
+        dev_priv->enable_fb = enable_fbdev;
+
         mutex_lock(&dev_priv->hw_mutex);
 
         vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
@@ -343,17 +373,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 
         dev->dev_private = dev_priv;
 
-        if (!dev->devname)
-                dev->devname = vmw_devname;
-
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
-                ret = drm_irq_install(dev);
-                if (unlikely(ret != 0)) {
-                        DRM_ERROR("Failed installing irq: %d\n", ret);
-                        goto out_no_irq;
-                }
-        }
-
         ret = pci_request_regions(dev->pdev, "vmwgfx probe");
         dev_priv->stealth = (ret != 0);
         if (dev_priv->stealth) {
@@ -369,26 +388,52 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                         goto out_no_device;
                 }
         }
-        ret = vmw_request_device(dev_priv);
+        ret = vmw_kms_init(dev_priv);
         if (unlikely(ret != 0))
-                goto out_no_device;
-        vmw_kms_init(dev_priv);
+                goto out_no_kms;
         vmw_overlay_init(dev_priv);
-        vmw_fb_init(dev_priv);
+        if (dev_priv->enable_fb) {
+                ret = vmw_3d_resource_inc(dev_priv);
+                if (unlikely(ret != 0))
+                        goto out_no_fifo;
+                vmw_kms_save_vga(dev_priv);
+                vmw_fb_init(dev_priv);
+                DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ?
+                         "Detected device 3D availability.\n" :
+                         "Detected no device 3D availability.\n");
+        } else {
+                DRM_INFO("Delayed 3D detection since we're not "
+                         "running the device in SVGA mode yet.\n");
+        }
+
+        if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
+                ret = drm_irq_install(dev);
+                if (unlikely(ret != 0)) {
+                        DRM_ERROR("Failed installing irq: %d\n", ret);
+                        goto out_no_irq;
+                }
+        }
 
         dev_priv->pm_nb.notifier_call = vmwgfx_pm_notifier;
         register_pm_notifier(&dev_priv->pm_nb);
 
-        DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ? "Have 3D\n" : "No 3D\n");
-
         return 0;
 
-out_no_device:
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-                drm_irq_uninstall(dev_priv->dev);
-        if (dev->devname == vmw_devname)
-                dev->devname = NULL;
 out_no_irq:
+        if (dev_priv->enable_fb) {
+                vmw_fb_close(dev_priv);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
+out_no_fifo:
+        vmw_overlay_close(dev_priv);
+        vmw_kms_close(dev_priv);
+out_no_kms:
+        if (dev_priv->stealth)
+                pci_release_region(dev->pdev, 2);
+        else
+                pci_release_regions(dev->pdev);
+out_no_device:
         ttm_object_device_release(&dev_priv->tdev);
 out_err4:
         iounmap(dev_priv->mmio_virt);
@@ -415,19 +460,20 @@ static int vmw_driver_unload(struct drm_device *dev)
 
         unregister_pm_notifier(&dev_priv->pm_nb);
 
-        vmw_fb_close(dev_priv);
+        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
+                drm_irq_uninstall(dev_priv->dev);
+        if (dev_priv->enable_fb) {
+                vmw_fb_close(dev_priv);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
         vmw_kms_close(dev_priv);
         vmw_overlay_close(dev_priv);
-        vmw_release_device(dev_priv);
         if (dev_priv->stealth)
                 pci_release_region(dev->pdev, 2);
         else
                 pci_release_regions(dev->pdev);
 
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-                drm_irq_uninstall(dev_priv->dev);
-        if (dev->devname == vmw_devname)
-                dev->devname = NULL;
         ttm_object_device_release(&dev_priv->tdev);
         iounmap(dev_priv->mmio_virt);
         drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
@@ -500,7 +546,7 @@ static long vmw_unlocked_ioctl(struct file *filp, unsigned int cmd,
                 struct drm_ioctl_desc *ioctl =
                     &vmw_ioctls[nr - DRM_COMMAND_BASE];
 
-                if (unlikely(ioctl->cmd != cmd)) {
+                if (unlikely(ioctl->cmd_drv != cmd)) {
                         DRM_ERROR("Invalid command format, ioctl %d\n",
                                   nr - DRM_COMMAND_BASE);
                         return -EINVAL;
@@ -589,6 +635,16 @@ static int vmw_master_set(struct drm_device *dev,
         struct vmw_master *vmaster = vmw_master(file_priv->master);
         int ret = 0;
 
+        if (!dev_priv->enable_fb) {
+                ret = vmw_3d_resource_inc(dev_priv);
+                if (unlikely(ret != 0))
+                        return ret;
+                vmw_kms_save_vga(dev_priv);
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 0);
+                mutex_unlock(&dev_priv->hw_mutex);
+        }
+
         if (active) {
                 BUG_ON(active != &dev_priv->fbdev_master);
                 ret = ttm_vt_lock(&active->lock, false, vmw_fp->tfile);
@@ -617,7 +673,13 @@ static int vmw_master_set(struct drm_device *dev,
         return 0;
 
 out_no_active_lock:
-        vmw_release_device(dev_priv);
+        if (!dev_priv->enable_fb) {
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+                mutex_unlock(&dev_priv->hw_mutex);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
         return ret;
 }
 
@@ -645,11 +707,23 @@ static void vmw_master_drop(struct drm_device *dev,
 
         ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
 
+        if (!dev_priv->enable_fb) {
+                ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
+                if (unlikely(ret != 0))
+                        DRM_ERROR("Unable to clean VRAM on master drop.\n");
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+                mutex_unlock(&dev_priv->hw_mutex);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
+
         dev_priv->active_master = &dev_priv->fbdev_master;
         ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
         ttm_vt_unlock(&dev_priv->fbdev_master.lock);
 
-        vmw_fb_on(dev_priv);
+        if (dev_priv->enable_fb)
+                vmw_fb_on(dev_priv);
 }
 
 
@@ -722,6 +796,7 @@ static struct drm_driver driver = {
         .irq_postinstall = vmw_irq_postinstall,
         .irq_uninstall = vmw_irq_uninstall,
         .irq_handler = vmw_irq_handler,
+        .get_vblank_counter = vmw_get_vblank_counter,
         .reclaim_buffers_locked = NULL,
         .get_map_ofs = drm_core_get_map_ofs,
         .get_reg_ofs = drm_core_get_reg_ofs,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 429f917b60bf..58de6393f611 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -277,6 +277,7 @@ struct vmw_private {
 
         bool stealth;
         bool is_opened;
+        bool enable_fb;
 
         /**
          * Master management.
@@ -285,6 +286,9 @@ struct vmw_private {
         struct vmw_master *active_master;
         struct vmw_master fbdev_master;
         struct notifier_block pm_nb;
+
+        struct mutex release_mutex;
+        uint32_t num_3d_resources;
 };
 
 static inline struct vmw_private *vmw_priv(struct drm_device *dev)
@@ -319,6 +323,9 @@ static inline uint32_t vmw_read(struct vmw_private *dev_priv,
         return val;
 }
 
+int vmw_3d_resource_inc(struct vmw_private *dev_priv);
+void vmw_3d_resource_dec(struct vmw_private *dev_priv);
+
 /**
  * GMR utilities - vmwgfx_gmr.c
  */
@@ -511,6 +518,7 @@ void vmw_kms_write_svga(struct vmw_private *vmw_priv,
                         unsigned bbp, unsigned depth);
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
+u32 vmw_get_vblank_counter(struct drm_device *dev, int crtc);
 
 /**
  * Overlay control - vmwgfx_overlay.c
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 870967a97c15..409e172f4abf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -615,6 +615,11 @@ int vmw_dmabuf_to_start_of_vram(struct vmw_private *vmw_priv,
         if (unlikely(ret != 0))
                 goto err_unlock;
 
+        if (bo->mem.mem_type == TTM_PL_VRAM &&
+            bo->mem.mm_node->start < bo->num_pages)
+                (void) ttm_bo_validate(bo, &vmw_sys_placement, false,
+                                       false, false);
+
         ret = ttm_bo_validate(bo, &ne_placement, false, false, false);
 
         /* Could probably bug on */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index e6a1eb7ea954..0fe31766e4cf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -106,6 +106,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
         mutex_lock(&dev_priv->hw_mutex);
         dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
         dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
+        dev_priv->traces_state = vmw_read(dev_priv, SVGA_REG_TRACES);
         vmw_write(dev_priv, SVGA_REG_ENABLE, 1);
 
         min = 4;
@@ -175,6 +176,8 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
                   dev_priv->config_done_state);
         vmw_write(dev_priv, SVGA_REG_ENABLE,
                   dev_priv->enable_state);
+        vmw_write(dev_priv, SVGA_REG_TRACES,
+                  dev_priv->traces_state);
 
         mutex_unlock(&dev_priv->hw_mutex);
         vmw_fence_queue_takedown(&fifo->fence_queue);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 64d7f47df868..e882ba099f0c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -898,7 +898,19 @@ int vmw_kms_save_vga(struct vmw_private *vmw_priv)
                 save->width = vmw_read(vmw_priv, SVGA_REG_DISPLAY_WIDTH);
                 save->height = vmw_read(vmw_priv, SVGA_REG_DISPLAY_HEIGHT);
                 vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+                if (i == 0 && vmw_priv->num_displays == 1 &&
+                    save->width == 0 && save->height == 0) {
+
+                        /*
+                         * It should be fairly safe to assume that these
+                         * values are uninitialized.
+                         */
+
+                        save->width = vmw_priv->vga_width - save->pos_x;
+                        save->height = vmw_priv->vga_height - save->pos_y;
+                }
         }
+
         return 0;
 }
 
@@ -984,3 +996,8 @@ out_unlock:
         ttm_read_unlock(&vmaster->lock);
         return ret;
 }
+
+u32 vmw_get_vblank_counter(struct drm_device *dev, int crtc)
+{
+        return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 7083b1a24df3..11cb39e3accb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -27,6 +27,8 @@
 
 #include "vmwgfx_kms.h"
 
+#define VMWGFX_LDU_NUM_DU 8
+
 #define vmw_crtc_to_ldu(x) \
         container_of(x, struct vmw_legacy_display_unit, base.crtc)
 #define vmw_encoder_to_ldu(x) \
@@ -536,6 +538,10 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 
 int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+        int i;
+        int ret;
+
         if (dev_priv->ldu_priv) {
                 DRM_INFO("ldu system already on\n");
                 return -EINVAL;
@@ -553,23 +559,24 @@ int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
 
         drm_mode_create_dirty_info_property(dev_priv->dev);
 
-        vmw_ldu_init(dev_priv, 0);
-        /* for old hardware without multimon only enable one display */
         if (dev_priv->capabilities & SVGA_CAP_MULTIMON) {
-                vmw_ldu_init(dev_priv, 1);
-                vmw_ldu_init(dev_priv, 2);
-                vmw_ldu_init(dev_priv, 3);
-                vmw_ldu_init(dev_priv, 4);
-                vmw_ldu_init(dev_priv, 5);
-                vmw_ldu_init(dev_priv, 6);
-                vmw_ldu_init(dev_priv, 7);
+                for (i = 0; i < VMWGFX_LDU_NUM_DU; ++i)
+                        vmw_ldu_init(dev_priv, i);
+                ret = drm_vblank_init(dev, VMWGFX_LDU_NUM_DU);
+        } else {
+                /* for old hardware without multimon only enable one display */
+                vmw_ldu_init(dev_priv, 0);
+                ret = drm_vblank_init(dev, 1);
         }
 
-        return 0;
+        return ret;
 }
 
 int vmw_kms_close_legacy_display_system(struct vmw_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+
+        drm_vblank_cleanup(dev);
         if (!dev_priv->ldu_priv)
                 return -ENOSYS;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 5f2d5df01e5c..c8c40e9979db 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -211,6 +211,7 @@ static void vmw_hw_context_destroy(struct vmw_resource *res)
         cmd->body.cid = cpu_to_le32(res->id);
 
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        vmw_3d_resource_dec(dev_priv);
 }
 
 static int vmw_context_init(struct vmw_private *dev_priv,
@@ -247,6 +248,7 @@ static int vmw_context_init(struct vmw_private *dev_priv,
         cmd->body.cid = cpu_to_le32(res->id);
 
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        (void) vmw_3d_resource_inc(dev_priv);
         vmw_resource_activate(res, vmw_hw_context_destroy);
         return 0;
 }
@@ -406,6 +408,7 @@ static void vmw_hw_surface_destroy(struct vmw_resource *res)
         cmd->body.sid = cpu_to_le32(res->id);
 
         vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        vmw_3d_resource_dec(dev_priv);
 }
 
 void vmw_surface_res_free(struct vmw_resource *res)
@@ -473,6 +476,7 @@ int vmw_surface_init(struct vmw_private *dev_priv,
         }
 
         vmw_fifo_commit(dev_priv, submit_size);
+        (void) vmw_3d_resource_inc(dev_priv);
         vmw_resource_activate(res, vmw_hw_surface_destroy);
         return 0;
 }