31 files changed, 525 insertions, 61 deletions

diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index cc1148837e24..e354bc0b052a 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -9,6 +9,7 @@ menuconfig DRM
         depends on (AGP || AGP=n) && !EMULATED_CMPXCHG && MMU
         select I2C
         select I2C_ALGOBIT
+        select DMA_SHARED_BUFFER
         help
           Kernel-level support for the Direct Rendering Infrastructure (DRI)
           introduced in XFree86 4.0. If you say Y here, you need to select
diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
index a858532806ae..c20da5bda355 100644
--- a/drivers/gpu/drm/Makefile
+++ b/drivers/gpu/drm/Makefile
@@ -12,7 +12,7 @@ drm-y       :=	drm_auth.o drm_buffer.o drm_bufs.o drm_cache.o \
                 drm_platform.o drm_sysfs.o drm_hashtab.o drm_mm.o \
                 drm_crtc.o drm_modes.o drm_edid.o \
                 drm_info.o drm_debugfs.o drm_encoder_slave.o \
-                drm_trace_points.o drm_global.o
+                drm_trace_points.o drm_global.o drm_prime.o
 
 drm-$(CONFIG_COMPAT) += drm_ioc32.o
 
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 0b65fbc8a630..6116e3b75393 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -136,6 +136,10 @@ static struct drm_ioctl_desc drm_ioctls[] = {
         DRM_IOCTL_DEF(DRM_IOCTL_GEM_OPEN, drm_gem_open_ioctl, DRM_AUTH|DRM_UNLOCKED),
 
         DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETRESOURCES, drm_mode_getresources, DRM_CONTROL_ALLOW|DRM_UNLOCKED),
+
+        DRM_IOCTL_DEF(DRM_IOCTL_PRIME_HANDLE_TO_FD, drm_prime_handle_to_fd_ioctl, DRM_AUTH|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_IOCTL_PRIME_FD_TO_HANDLE, drm_prime_fd_to_handle_ioctl, DRM_AUTH|DRM_UNLOCKED),
+
         DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETPLANERESOURCES, drm_mode_getplane_res, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
         DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETCRTC, drm_mode_getcrtc, DRM_CONTROL_ALLOW|DRM_UNLOCKED),
         DRM_IOCTL_DEF(DRM_IOCTL_MODE_SETCRTC, drm_mode_setcrtc, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 7740dd26f007..a0d6e894d97c 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -559,9 +559,13 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
                 return -EINVAL;
 
         /* Need to resize the fb object !!! */
-        if (var->bits_per_pixel > fb->bits_per_pixel || var->xres > fb->width || var->yres > fb->height) {
+        if (var->bits_per_pixel > fb->bits_per_pixel ||
+            var->xres > fb->width || var->yres > fb->height ||
+            var->xres_virtual > fb->width || var->yres_virtual > fb->height) {
                 DRM_DEBUG("fb userspace requested width/height/bpp is greater than current fb "
-                          "object %dx%d-%d > %dx%d-%d\n", var->xres, var->yres, var->bits_per_pixel,
+                          "request %dx%d-%d (virtual %dx%d) > %dx%d-%d\n",
+                          var->xres, var->yres, var->bits_per_pixel,
+                          var->xres_virtual, var->yres_virtual,
                           fb->width, fb->height, fb->bits_per_pixel);
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 7348a3dab250..cdfbf27b2b3c 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -271,6 +271,9 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
         if (dev->driver->driver_features & DRIVER_GEM)
                 drm_gem_open(dev, priv);
 
+        if (drm_core_check_feature(dev, DRIVER_PRIME))
+                drm_prime_init_file_private(&priv->prime);
+
         if (dev->driver->open) {
                 ret = dev->driver->open(dev, priv);
                 if (ret < 0)
@@ -571,6 +574,10 @@ int drm_release(struct inode *inode, struct file *filp)
 
         if (dev->driver->postclose)
                 dev->driver->postclose(dev, file_priv);
+
+        if (drm_core_check_feature(dev, DRIVER_PRIME))
+                drm_prime_destroy_file_private(&file_priv->prime);
+
         kfree(file_priv);
 
         /* ========================================================
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 0ef358e53245..83114b5e3cee 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -35,6 +35,7 @@
 #include <linux/mman.h>
 #include <linux/pagemap.h>
 #include <linux/shmem_fs.h>
+#include <linux/dma-buf.h>
 #include "drmP.h"
 
 /** @file drm_gem.c
@@ -232,6 +233,10 @@ drm_gem_handle_delete(struct drm_file *filp, u32 handle)
         idr_remove(&filp->object_idr, handle);
         spin_unlock(&filp->table_lock);
 
+        if (obj->import_attach)
+                drm_prime_remove_imported_buf_handle(&filp->prime,
+                                obj->import_attach->dmabuf);
+
         if (dev->driver->gem_close_object)
                 dev->driver->gem_close_object(obj, filp);
         drm_gem_object_handle_unreference_unlocked(obj);
@@ -527,6 +532,10 @@ drm_gem_object_release_handle(int id, void *ptr, void *data)
         struct drm_gem_object *obj = ptr;
         struct drm_device *dev = obj->dev;
 
+        if (obj->import_attach)
+                drm_prime_remove_imported_buf_handle(&file_priv->prime,
+                                obj->import_attach->dmabuf);
+
         if (dev->driver->gem_close_object)
                 dev->driver->gem_close_object(obj, file_priv);
 
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
new file mode 100644
index 000000000000..1bdf2b54eaf6
--- /dev/null
+++ b/drivers/gpu/drm/drm_prime.c
@@ -0,0 +1,304 @@
+/*
+ * Copyright © 2012 Red Hat
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ * Authors:
+ *      Dave Airlie <airlied@redhat.com>
+ *      Rob Clark <rob.clark@linaro.org>
+ *
+ */
+
+#include <linux/export.h>
+#include <linux/dma-buf.h>
+#include "drmP.h"
+
+/*
+ * DMA-BUF/GEM Object references and lifetime overview:
+ *
+ * On the export the dma_buf holds a reference to the exporting GEM
+ * object. It takes this reference in handle_to_fd_ioctl, when it
+ * first calls .prime_export and stores the exporting GEM object in
+ * the dma_buf priv. This reference is released when the dma_buf
+ * object goes away in the driver .release function.
+ *
+ * On the import the importing GEM object holds a reference to the
+ * dma_buf (which in turn holds a ref to the exporting GEM object).
+ * It takes that reference in the fd_to_handle ioctl.
+ * It calls dma_buf_get, creates an attachment to it and stores the
+ * attachment in the GEM object. When this attachment is destroyed
+ * when the imported object is destroyed, we remove the attachment
+ * and drop the reference to the dma_buf.
+ *
+ * Thus the chain of references always flows in one direction
+ * (avoiding loops): importing_gem -> dmabuf -> exporting_gem
+ *
+ * Self-importing: if userspace is using PRIME as a replacement for flink
+ * then it will get a fd->handle request for a GEM object that it created.
+ * Drivers should detect this situation and return back the gem object
+ * from the dma-buf private.
+ */
+
+struct drm_prime_member {
+        struct list_head entry;
+        struct dma_buf *dma_buf;
+        uint32_t handle;
+};
+
+int drm_gem_prime_handle_to_fd(struct drm_device *dev,
+                struct drm_file *file_priv, uint32_t handle, uint32_t flags,
+                int *prime_fd)
+{
+        struct drm_gem_object *obj;
+        void *buf;
+
+        obj = drm_gem_object_lookup(dev, file_priv, handle);
+        if (!obj)
+                return -ENOENT;
+
+        mutex_lock(&file_priv->prime.lock);
+        /* re-export the original imported object */
+        if (obj->import_attach) {
+                get_dma_buf(obj->import_attach->dmabuf);
+                *prime_fd = dma_buf_fd(obj->import_attach->dmabuf, flags);
+                drm_gem_object_unreference_unlocked(obj);
+                mutex_unlock(&file_priv->prime.lock);
+                return 0;
+        }
+
+        if (obj->export_dma_buf) {
+                get_dma_buf(obj->export_dma_buf);
+                *prime_fd = dma_buf_fd(obj->export_dma_buf, flags);
+                drm_gem_object_unreference_unlocked(obj);
+        } else {
+                buf = dev->driver->gem_prime_export(dev, obj, flags);
+                if (IS_ERR(buf)) {
+                        /* normally the created dma-buf takes ownership of the ref,
+                         * but if that fails then drop the ref
+                         */
+                        drm_gem_object_unreference_unlocked(obj);
+                        mutex_unlock(&file_priv->prime.lock);
+                        return PTR_ERR(buf);
+                }
+                obj->export_dma_buf = buf;
+                *prime_fd = dma_buf_fd(buf, flags);
+        }
+        mutex_unlock(&file_priv->prime.lock);
+        return 0;
+}
+EXPORT_SYMBOL(drm_gem_prime_handle_to_fd);
+
+int drm_gem_prime_fd_to_handle(struct drm_device *dev,
+                struct drm_file *file_priv, int prime_fd, uint32_t *handle)
+{
+        struct dma_buf *dma_buf;
+        struct drm_gem_object *obj;
+        int ret;
+
+        dma_buf = dma_buf_get(prime_fd);
+        if (IS_ERR(dma_buf))
+                return PTR_ERR(dma_buf);
+
+        mutex_lock(&file_priv->prime.lock);
+
+        ret = drm_prime_lookup_imported_buf_handle(&file_priv->prime,
+                        dma_buf, handle);
+        if (!ret) {
+                ret = 0;
+                goto out_put;
+        }
+
+        /* never seen this one, need to import */
+        obj = dev->driver->gem_prime_import(dev, dma_buf);
+        if (IS_ERR(obj)) {
+                ret = PTR_ERR(obj);
+                goto out_put;
+        }
+
+        ret = drm_gem_handle_create(file_priv, obj, handle);
+        drm_gem_object_unreference_unlocked(obj);
+        if (ret)
+                goto out_put;
+
+        ret = drm_prime_add_imported_buf_handle(&file_priv->prime,
+                        dma_buf, *handle);
+        if (ret)
+                goto fail;
+
+        mutex_unlock(&file_priv->prime.lock);
+        return 0;
+
+fail:
+        /* hmm, if driver attached, we are relying on the free-object path
+         * to detach.. which seems ok..
+         */
+        drm_gem_object_handle_unreference_unlocked(obj);
+out_put:
+        dma_buf_put(dma_buf);
+        mutex_unlock(&file_priv->prime.lock);
+        return ret;
+}
+EXPORT_SYMBOL(drm_gem_prime_fd_to_handle);
+
+int drm_prime_handle_to_fd_ioctl(struct drm_device *dev, void *data,
+                                 struct drm_file *file_priv)
+{
+        struct drm_prime_handle *args = data;
+        uint32_t flags;
+
+        if (!drm_core_check_feature(dev, DRIVER_PRIME))
+                return -EINVAL;
+
+        if (!dev->driver->prime_handle_to_fd)
+                return -ENOSYS;
+
+        /* check flags are valid */
+        if (args->flags & ~DRM_CLOEXEC)
+                return -EINVAL;
+
+        /* we only want to pass DRM_CLOEXEC which is == O_CLOEXEC */
+        flags = args->flags & DRM_CLOEXEC;
+
+        return dev->driver->prime_handle_to_fd(dev, file_priv,
+                        args->handle, flags, &args->fd);
+}
+
+int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, void *data,
+                                 struct drm_file *file_priv)
+{
+        struct drm_prime_handle *args = data;
+
+        if (!drm_core_check_feature(dev, DRIVER_PRIME))
+                return -EINVAL;
+
+        if (!dev->driver->prime_fd_to_handle)
+                return -ENOSYS;
+
+        return dev->driver->prime_fd_to_handle(dev, file_priv,
+                        args->fd, &args->handle);
+}
+
+/*
+ * drm_prime_pages_to_sg
+ *
+ * this helper creates an sg table object from a set of pages
+ * the driver is responsible for mapping the pages into the
+ * importers address space
+ */
+struct sg_table *drm_prime_pages_to_sg(struct page **pages, int nr_pages)
+{
+        struct sg_table *sg = NULL;
+        struct scatterlist *iter;
+        int i;
+        int ret;
+
+        sg = kmalloc(sizeof(struct sg_table), GFP_KERNEL);
+        if (!sg)
+                goto out;
+
+        ret = sg_alloc_table(sg, nr_pages, GFP_KERNEL);
+        if (ret)
+                goto out;
+
+        for_each_sg(sg->sgl, iter, nr_pages, i)
+                sg_set_page(iter, pages[i], PAGE_SIZE, 0);
+
+        return sg;
+out:
+        kfree(sg);
+        return NULL;
+}
+EXPORT_SYMBOL(drm_prime_pages_to_sg);
+
+/* helper function to cleanup a GEM/prime object */
+void drm_prime_gem_destroy(struct drm_gem_object *obj, struct sg_table *sg)
+{
+        struct dma_buf_attachment *attach;
+        struct dma_buf *dma_buf;
+        attach = obj->import_attach;
+        if (sg)
+                dma_buf_unmap_attachment(attach, sg, DMA_BIDIRECTIONAL);
+        dma_buf = attach->dmabuf;
+        dma_buf_detach(attach->dmabuf, attach);
+        /* remove the reference */
+        dma_buf_put(dma_buf);
+}
+EXPORT_SYMBOL(drm_prime_gem_destroy);
+
+void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpriv)
+{
+        INIT_LIST_HEAD(&prime_fpriv->head);
+        mutex_init(&prime_fpriv->lock);
+}
+EXPORT_SYMBOL(drm_prime_init_file_private);
+
+void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_fpriv)
+{
+        struct drm_prime_member *member, *safe;
+        list_for_each_entry_safe(member, safe, &prime_fpriv->head, entry) {
+                list_del(&member->entry);
+                kfree(member);
+        }
+}
+EXPORT_SYMBOL(drm_prime_destroy_file_private);
+
+int drm_prime_add_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t handle)
+{
+        struct drm_prime_member *member;
+
+        member = kmalloc(sizeof(*member), GFP_KERNEL);
+        if (!member)
+                return -ENOMEM;
+
+        member->dma_buf = dma_buf;
+        member->handle = handle;
+        list_add(&member->entry, &prime_fpriv->head);
+        return 0;
+}
+EXPORT_SYMBOL(drm_prime_add_imported_buf_handle);
+
+int drm_prime_lookup_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf, uint32_t *handle)
+{
+        struct drm_prime_member *member;
+
+        list_for_each_entry(member, &prime_fpriv->head, entry) {
+                if (member->dma_buf == dma_buf) {
+                        *handle = member->handle;
+                        return 0;
+                }
+        }
+        return -ENOENT;
+}
+EXPORT_SYMBOL(drm_prime_lookup_imported_buf_handle);
+
+void drm_prime_remove_imported_buf_handle(struct drm_prime_file_private *prime_fpriv, struct dma_buf *dma_buf)
+{
+        struct drm_prime_member *member, *safe;
+
+        mutex_lock(&prime_fpriv->lock);
+        list_for_each_entry_safe(member, safe, &prime_fpriv->head, entry) {
+                if (member->dma_buf == dma_buf) {
+                        list_del(&member->entry);
+                        kfree(member);
+                }
+        }
+        mutex_unlock(&prime_fpriv->lock);
+}
+EXPORT_SYMBOL(drm_prime_remove_imported_buf_handle);
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index fdb7ccefffbd..b505b70dba05 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1502,14 +1502,6 @@ static int i915_ppgtt_info(struct seq_file *m, void *data)
         return 0;
 }
 
-static int
-i915_debugfs_common_open(struct inode *inode,
-                         struct file *filp)
-{
-        filp->private_data = inode->i_private;
-        return 0;
-}
-
 static ssize_t
 i915_wedged_read(struct file *filp,
                  char __user *ubuf,
@@ -1560,7 +1552,7 @@ i915_wedged_write(struct file *filp,
 
 static const struct file_operations i915_wedged_fops = {
         .owner = THIS_MODULE,
-        .open = i915_debugfs_common_open,
+        .open = simple_open,
         .read = i915_wedged_read,
         .write = i915_wedged_write,
         .llseek = default_llseek,
@@ -1622,7 +1614,7 @@ i915_max_freq_write(struct file *filp,
 
 static const struct file_operations i915_max_freq_fops = {
         .owner = THIS_MODULE,
-        .open = i915_debugfs_common_open,
+        .open = simple_open,
         .read = i915_max_freq_read,
         .write = i915_max_freq_write,
         .llseek = default_llseek,
@@ -1693,7 +1685,7 @@ i915_cache_sharing_write(struct file *filp,
 
 static const struct file_operations i915_cache_sharing_fops = {
         .owner = THIS_MODULE,
-        .open = i915_debugfs_common_open,
+        .open = simple_open,
         .read = i915_cache_sharing_read,
         .write = i915_cache_sharing_write,
         .llseek = default_llseek,
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9341eb8ce93b..785f67f963ef 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1183,6 +1183,21 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
         return can_switch;
 }
 
+static bool
+intel_enable_ppgtt(struct drm_device *dev)
+{
+        if (i915_enable_ppgtt >= 0)
+                return i915_enable_ppgtt;
+
+#ifdef CONFIG_INTEL_IOMMU
+        /* Disable ppgtt on SNB if VT-d is on. */
+        if (INTEL_INFO(dev)->gen == 6 && intel_iommu_gfx_mapped)
+                return false;
+#endif
+
+        return true;
+}
+
 static int i915_load_gem_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1197,7 +1212,7 @@ static int i915_load_gem_init(struct drm_device *dev)
         drm_mm_init(&dev_priv->mm.stolen, 0, prealloc_size);
 
         mutex_lock(&dev->struct_mutex);
-        if (i915_enable_ppgtt && HAS_ALIASING_PPGTT(dev)) {
+        if (intel_enable_ppgtt(dev) && HAS_ALIASING_PPGTT(dev)) {
                 /* PPGTT pdes are stolen from global gtt ptes, so shrink the
                  * aperture accordingly when using aliasing ppgtt. */
                 gtt_size -= I915_PPGTT_PD_ENTRIES*PAGE_SIZE;
@@ -1207,8 +1222,10 @@ static int i915_load_gem_init(struct drm_device *dev)
                 i915_gem_do_init(dev, 0, mappable_size, gtt_size);
 
                 ret = i915_gem_init_aliasing_ppgtt(dev);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&dev->struct_mutex);
                         return ret;
+                }
         } else {
                 /* Let GEM Manage all of the aperture.
                  *
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 1a7559b59997..dfa55e7478fb 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -66,7 +66,11 @@ MODULE_PARM_DESC(semaphores,
 int i915_enable_rc6 __read_mostly = -1;
 module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
 MODULE_PARM_DESC(i915_enable_rc6,
-                "Enable power-saving render C-state 6 (default: -1 (use per-chip default)");
+                "Enable power-saving render C-state 6. "
+                "Different stages can be selected via bitmask values "
+                "(0 = disable; 1 = enable rc6; 2 = enable deep rc6; 4 = enable deepest rc6). "
+                "For example, 3 would enable rc6 and deep rc6, and 7 would enable everything. "
+                "default: -1 (use per-chip default)");
 
 int i915_enable_fbc __read_mostly = -1;
 module_param_named(i915_enable_fbc, i915_enable_fbc, int, 0600);
@@ -103,8 +107,8 @@ MODULE_PARM_DESC(enable_hangcheck,
                 "WARNING: Disabling this can cause system wide hangs. "
                 "(default: true)");
 
-bool i915_enable_ppgtt __read_mostly = 1;
-module_param_named(i915_enable_ppgtt, i915_enable_ppgtt, bool, 0600);
+int i915_enable_ppgtt __read_mostly = -1;
+module_param_named(i915_enable_ppgtt, i915_enable_ppgtt, int, 0600);
 MODULE_PARM_DESC(i915_enable_ppgtt,
                 "Enable PPGTT (default: true)");
 
@@ -292,6 +296,7 @@ static const struct pci_device_id pciidlist[] = {		/* aka */
         INTEL_VGA_DEVICE(0x0152, &intel_ivybridge_d_info), /* GT1 desktop */
         INTEL_VGA_DEVICE(0x0162, &intel_ivybridge_d_info), /* GT2 desktop */
         INTEL_VGA_DEVICE(0x015a, &intel_ivybridge_d_info), /* GT1 server */
+        INTEL_VGA_DEVICE(0x016a, &intel_ivybridge_d_info), /* GT2 server */
         {0, 0, 0}
 };
 
@@ -533,7 +538,9 @@ static int i915_drm_thaw(struct drm_device *dev)
                 drm_irq_install(dev);
 
                 /* Resume the modeset for every activated CRTC */
+                mutex_lock(&dev->mode_config.mutex);
                 drm_helper_resume_force_mode(dev);
+                mutex_unlock(&dev->mode_config.mutex);
 
                 if (IS_IRONLAKE_M(dev))
                         ironlake_enable_rc6(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index c0f19f572004..5fabc6c31fec 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1053,6 +1053,27 @@ struct drm_i915_file_private {
 
 #include "i915_trace.h"
 
+/**
+ * RC6 is a special power stage which allows the GPU to enter an very
+ * low-voltage mode when idle, using down to 0V while at this stage.  This
+ * stage is entered automatically when the GPU is idle when RC6 support is
+ * enabled, and as soon as new workload arises GPU wakes up automatically as well.
+ *
+ * There are different RC6 modes available in Intel GPU, which differentiate
+ * among each other with the latency required to enter and leave RC6 and
+ * voltage consumed by the GPU in different states.
+ *
+ * The combination of the following flags define which states GPU is allowed
+ * to enter, while RC6 is the normal RC6 state, RC6p is the deep RC6, and
+ * RC6pp is deepest RC6. Their support by hardware varies according to the
+ * GPU, BIOS, chipset and platform. RC6 is usually the safest one and the one
+ * which brings the most power savings; deeper states save more power, but
+ * require higher latency to switch to and wake up.
+ */
+#define INTEL_RC6_ENABLE                        (1<<0)
+#define INTEL_RC6p_ENABLE                       (1<<1)
+#define INTEL_RC6pp_ENABLE                      (1<<2)
+
 extern struct drm_ioctl_desc i915_ioctls[];
 extern int i915_max_ioctl;
 extern unsigned int i915_fbpercrtc __always_unused;
@@ -1065,7 +1086,7 @@ extern int i915_vbt_sdvo_panel_type __read_mostly;
 extern int i915_enable_rc6 __read_mostly;
 extern int i915_enable_fbc __read_mostly;
 extern bool i915_enable_hangcheck __read_mostly;
-extern bool i915_enable_ppgtt __read_mostly;
+extern int i915_enable_ppgtt __read_mostly;
 
 extern int i915_suspend(struct drm_device *dev, pm_message_t state);
 extern int i915_resume(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 1f441f5c2405..4c65c639f772 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1472,16 +1472,19 @@ i915_gem_object_move_to_active(struct drm_i915_gem_object *obj,
         list_move_tail(&obj->ring_list, &ring->active_list);
 
         obj->last_rendering_seqno = seqno;
-        if (obj->fenced_gpu_access) {
-                struct drm_i915_fence_reg *reg;
-
-                BUG_ON(obj->fence_reg == I915_FENCE_REG_NONE);
 
+        if (obj->fenced_gpu_access) {
                 obj->last_fenced_seqno = seqno;
                 obj->last_fenced_ring = ring;
 
-                reg = &dev_priv->fence_regs[obj->fence_reg];
-                list_move_tail(&reg->lru_list, &dev_priv->mm.fence_list);
+                /* Bump MRU to take account of the delayed flush */
+                if (obj->fence_reg != I915_FENCE_REG_NONE) {
+                        struct drm_i915_fence_reg *reg;
+
+                        reg = &dev_priv->fence_regs[obj->fence_reg];
+                        list_move_tail(&reg->lru_list,
+                                       &dev_priv->mm.fence_list);
+                }
         }
 }
 
@@ -3754,12 +3757,32 @@ void i915_gem_init_ppgtt(struct drm_device *dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
         uint32_t pd_offset;
         struct intel_ring_buffer *ring;
+        struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt;
+        uint32_t __iomem *pd_addr;
+        uint32_t pd_entry;
         int i;
 
         if (!dev_priv->mm.aliasing_ppgtt)
                 return;
 
-        pd_offset = dev_priv->mm.aliasing_ppgtt->pd_offset;
+
+        pd_addr = dev_priv->mm.gtt->gtt + ppgtt->pd_offset/sizeof(uint32_t);
+        for (i = 0; i < ppgtt->num_pd_entries; i++) {
+                dma_addr_t pt_addr;
+
+                if (dev_priv->mm.gtt->needs_dmar)
+                        pt_addr = ppgtt->pt_dma_addr[i];
+                else
+                        pt_addr = page_to_phys(ppgtt->pt_pages[i]);
+
+                pd_entry = GEN6_PDE_ADDR_ENCODE(pt_addr);
+                pd_entry |= GEN6_PDE_VALID;
+
+                writel(pd_entry, pd_addr + i);
+        }
+        readl(pd_addr);
+
+        pd_offset = ppgtt->pd_offset;
         pd_offset /= 64; /* in cachelines, */
         pd_offset <<= 16;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 81687af00893..f51a696486cb 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -498,8 +498,8 @@ pin_and_fence_object(struct drm_i915_gem_object *obj,
                                 if (ret)
                                         goto err_unpin;
                         }
+                        obj->pending_fenced_gpu_access = true;
                 }
-                obj->pending_fenced_gpu_access = need_fence;
         }
 
         entry->offset = obj->gtt_offset;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 2eacd78bb93b..a135c61f4119 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -65,9 +65,7 @@ int i915_gem_init_aliasing_ppgtt(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct i915_hw_ppgtt *ppgtt;
-        uint32_t pd_entry;
         unsigned first_pd_entry_in_global_pt;
-        uint32_t __iomem *pd_addr;
         int i;
         int ret = -ENOMEM;
 
@@ -100,7 +98,6 @@ int i915_gem_init_aliasing_ppgtt(struct drm_device *dev)
                         goto err_pt_alloc;
         }
 
-        pd_addr = dev_priv->mm.gtt->gtt + first_pd_entry_in_global_pt;
         for (i = 0; i < ppgtt->num_pd_entries; i++) {
                 dma_addr_t pt_addr;
                 if (dev_priv->mm.gtt->needs_dmar) {
@@ -117,13 +114,7 @@ int i915_gem_init_aliasing_ppgtt(struct drm_device *dev)
                         ppgtt->pt_dma_addr[i] = pt_addr;
                 } else
                         pt_addr = page_to_phys(ppgtt->pt_pages[i]);
-
-                pd_entry = GEN6_PDE_ADDR_ENCODE(pt_addr);
-                pd_entry |= GEN6_PDE_VALID;
-
-                writel(pd_entry, pd_addr + i);
         }
-        readl(pd_addr);
 
         ppgtt->scratch_page_dma_addr = dev_priv->mm.gtt->scratch_page_dma;
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 3886cf051bac..2abf4eb94039 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2385,6 +2385,7 @@
 #define   PIPECONF_DISABLE      0
 #define   PIPECONF_DOUBLE_WIDE  (1<<30)
 #define   I965_PIPECONF_ACTIVE  (1<<30)
+#define   PIPECONF_FRAME_START_DELAY_MASK (3<<27)
 #define   PIPECONF_SINGLE_WIDE  0
 #define   PIPECONF_PIPE_UNLOCKED 0
 #define   PIPECONF_PIPE_LOCKED  (1<<25)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 8168d8f8a634..b48fc2a8410c 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -24,6 +24,7 @@
  *    Eric Anholt <eric@anholt.net>
  *
  */
+#include <linux/dmi.h>
 #include <drm/drm_dp_helper.h>
 #include "drmP.h"
 #include "drm.h"
@@ -621,6 +622,26 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
         dev_priv->edp.bpp = 18;
 }
 
+static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
+{
+        DRM_DEBUG_KMS("Falling back to manually reading VBT from "
+                      "VBIOS ROM for %s\n",
+                      id->ident);
+        return 1;
+}
+
+static const struct dmi_system_id intel_no_opregion_vbt[] = {
+        {
+                .callback = intel_no_opregion_vbt_callback,
+                .ident = "ThinkCentre A57",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "97027RG"),
+                },
+        },
+        { }
+};
+
 /**
  * intel_parse_bios - find VBT and initialize settings from the BIOS
  * @dev: DRM device
@@ -641,7 +662,7 @@ intel_parse_bios(struct drm_device *dev)
         init_vbt_defaults(dev_priv);
 
         /* XXX Should this validation be moved to intel_opregion.c? */
-        if (dev_priv->opregion.vbt) {
+        if (!dmi_check_system(intel_no_opregion_vbt) && dev_priv->opregion.vbt) {
                 struct vbt_header *vbt = dev_priv->opregion.vbt;
                 if (memcmp(vbt->signature, "$VBT", 4) == 0) {
                         DRM_DEBUG_KMS("Using VBT from OpRegion: %20s\n",
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index d514719f65e2..91b35fd1db8c 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5539,7 +5539,8 @@ void ironlake_init_pch_refclk(struct drm_device *dev)
                 if (intel_panel_use_ssc(dev_priv) && can_ssc) {
                         DRM_DEBUG_KMS("Using SSC on panel\n");
                         temp |= DREF_SSC1_ENABLE;
-                }
+                } else
+                        temp &= ~DREF_SSC1_ENABLE;
 
                 /* Get SSC going before enabling the outputs */
                 I915_WRITE(PCH_DREF_CONTROL, temp);
@@ -7580,6 +7581,12 @@ static void intel_sanitize_modesetting(struct drm_device *dev,
         struct drm_i915_private *dev_priv = dev->dev_private;
         u32 reg, val;
 
+        /* Clear any frame start delays used for debugging left by the BIOS */
+        for_each_pipe(pipe) {
+                reg = PIPECONF(pipe);
+                I915_WRITE(reg, I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+        }
+
         if (HAS_PCH_SPLIT(dev))
                 return;
 
@@ -8215,7 +8222,7 @@ void intel_init_emon(struct drm_device *dev)
         dev_priv->corr = (lcfuse & LCFUSE_HIV_MASK);
 }
 
-static bool intel_enable_rc6(struct drm_device *dev)
+static int intel_enable_rc6(struct drm_device *dev)
 {
         /*
          * Respect the kernel parameter if it is set
@@ -8233,11 +8240,11 @@ static bool intel_enable_rc6(struct drm_device *dev)
          * Disable rc6 on Sandybridge
          */
         if (INTEL_INFO(dev)->gen == 6) {
-                DRM_DEBUG_DRIVER("Sandybridge: RC6 disabled\n");
-                return 0;
+                DRM_DEBUG_DRIVER("Sandybridge: deep RC6 disabled\n");
+                return INTEL_RC6_ENABLE;
         }
-        DRM_DEBUG_DRIVER("RC6 enabled\n");
-        return 1;
+        DRM_DEBUG_DRIVER("RC6 and deep RC6 enabled\n");
+        return (INTEL_RC6_ENABLE | INTEL_RC6p_ENABLE);
 }
 
 void gen6_enable_rps(struct drm_i915_private *dev_priv)
@@ -8247,6 +8254,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
         u32 pcu_mbox, rc6_mask = 0;
         u32 gtfifodbg;
         int cur_freq, min_freq, max_freq;
+        int rc6_mode;
         int i;
 
         /* Here begins a magic sequence of register writes to enable
@@ -8284,9 +8292,20 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
         I915_WRITE(GEN6_RC6p_THRESHOLD, 100000);
         I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */
 
-        if (intel_enable_rc6(dev_priv->dev))
-                rc6_mask = GEN6_RC_CTL_RC6_ENABLE |
-                        ((IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0);
+        rc6_mode = intel_enable_rc6(dev_priv->dev);
+        if (rc6_mode & INTEL_RC6_ENABLE)
+                rc6_mask |= GEN6_RC_CTL_RC6_ENABLE;
+
+        if (rc6_mode & INTEL_RC6p_ENABLE)
+                rc6_mask |= GEN6_RC_CTL_RC6p_ENABLE;
+
+        if (rc6_mode & INTEL_RC6pp_ENABLE)
+                rc6_mask |= GEN6_RC_CTL_RC6pp_ENABLE;
+
+        DRM_INFO("Enabling RC6 states: RC6 %s, RC6p %s, RC6pp %s\n",
+                        (rc6_mode & INTEL_RC6_ENABLE) ? "on" : "off",
+                        (rc6_mode & INTEL_RC6p_ENABLE) ? "on" : "off",
+                        (rc6_mode & INTEL_RC6pp_ENABLE) ? "on" : "off");
 
         I915_WRITE(GEN6_RC_CONTROL,
                    rc6_mask |
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index c5c0973af8a1..95db2e988227 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -755,6 +755,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
                         DMI_MATCH(DMI_BOARD_NAME, "hp st5747"),
                 },
         },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "MSI Wind Box DC500",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+                        DMI_MATCH(DMI_BOARD_NAME, "MS-7469"),
+                },
+        },
 
         { }     /* terminating entry */
 };
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index fc66af6a9448..e25581a9f60f 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -626,7 +626,7 @@ gen6_ring_get_seqno(struct intel_ring_buffer *ring)
         /* Workaround to force correct ordering between irq and seqno writes on
          * ivb (and maybe also on snb) by reading from a CS register (like
          * ACTHD) before reading the status page. */
-        if (IS_GEN7(dev))
+        if (IS_GEN6(dev) || IS_GEN7(dev))
                 intel_ring_get_active_head(ring);
         return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
 }
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 7aa0450399a1..a464771a7240 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -411,6 +411,9 @@ intel_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
 
         old_obj = intel_plane->obj;
 
+        src_w = src_w >> 16;
+        src_h = src_h >> 16;
+
         /* Pipe must be running... */
         if (!(I915_READ(PIPECONF(pipe)) & PIPECONF_ENABLE))
                 return -EINVAL;
diff --git a/drivers/gpu/drm/nouveau/Kconfig b/drivers/gpu/drm/nouveau/Kconfig
index ca1639918f57..97a81260485a 100644
--- a/drivers/gpu/drm/nouveau/Kconfig
+++ b/drivers/gpu/drm/nouveau/Kconfig
@@ -13,6 +13,7 @@ config DRM_NOUVEAU
         select ACPI_VIDEO if ACPI && X86 && BACKLIGHT_CLASS_DEVICE && VIDEO_OUTPUT_CONTROL && INPUT
         select ACPI_WMI if ACPI
         select MXM_WMI if ACPI
+        select POWER_SUPPLY
         help
           Choose this option for open-source nVidia support.
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 637afe71de56..80963d05b54a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -177,14 +177,15 @@ bios_shadow_pci(struct nvbios *bios)
 
         if (!pci_enable_rom(pdev)) {
                 void __iomem *rom = pci_map_rom(pdev, &length);
-                if (rom) {
+                if (rom && length) {
                         bios->data = kmalloc(length, GFP_KERNEL);
                         if (bios->data) {
                                 memcpy_fromio(bios->data, rom, length);
                                 bios->length = length;
                         }
-                        pci_unmap_rom(pdev, rom);
                 }
+                if (rom)
+                        pci_unmap_rom(pdev, rom);
 
                 pci_disable_rom(pdev);
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_channel.c b/drivers/gpu/drm/nouveau/nouveau_channel.c
index 44e6416d4a33..846afb0bfef4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_channel.c
+++ b/drivers/gpu/drm/nouveau/nouveau_channel.c
@@ -436,11 +436,11 @@ nouveau_ioctl_fifo_alloc(struct drm_device *dev, void *data,
         }
 
         if (dev_priv->card_type < NV_C0) {
-                init->subchan[0].handle = NvSw;
-                init->subchan[0].grclass = NV_SW;
-                init->nr_subchan = 1;
-        } else {
-                init->nr_subchan = 0;
+                init->subchan[0].handle = 0x00000000;
+                init->subchan[0].grclass = 0x0000;
+                init->subchan[1].handle = NvSw;
+                init->subchan[1].grclass = NV_SW;
+                init->nr_subchan = 2;
         }
 
         /* Named memory object area */
diff --git a/drivers/gpu/drm/nouveau/nouveau_dma.h b/drivers/gpu/drm/nouveau/nouveau_dma.h
index bcf0fd9e313e..23d4edf992b7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dma.h
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.h
@@ -48,8 +48,8 @@ void nv50_dma_push(struct nouveau_channel *, struct nouveau_bo *,
 
 /* Hardcoded object assignments to subchannels (subchannel id). */
 enum {
-        NvSubSw         = 0,
-        NvSubM2MF       = 1,
+        NvSubM2MF       = 0,
+        NvSubSw         = 1,
         NvSub2D         = 2,
         NvSubCtxSurf2D  = 2,
         NvSubGdiRect    = 3,
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index a4886b36d0fa..c2a8511e855a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -642,7 +642,7 @@ nouveau_card_channel_init(struct drm_device *dev)
                 OUT_RING  (chan, chan->vram_handle);
                 OUT_RING  (chan, chan->gart_handle);
         } else
-        if (dev_priv->card_type <= NV_C0) {
+        if (dev_priv->card_type <= NV_D0) {
                 ret = nouveau_gpuobj_gr_new(chan, 0x9039, 0x9039);
                 if (ret)
                         goto error;
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index d1bd239cd9e9..5ce9bf51a8de 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1306,8 +1306,11 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
 
 int atom_asic_init(struct atom_context *ctx)
 {
+        struct radeon_device *rdev = ctx->card->dev->dev_private;
         int hwi = CU16(ctx->data_table + ATOM_DATA_FWI_PTR);
         uint32_t ps[16];
+        int ret;
+
         memset(ps, 0, 64);
 
         ps[0] = cpu_to_le32(CU32(hwi + ATOM_FWI_DEFSCLK_PTR));
@@ -1317,7 +1320,17 @@ int atom_asic_init(struct atom_context *ctx)
 
         if (!CU16(ctx->cmd_table + 4 + 2 * ATOM_CMD_INIT))
                 return 1;
-        return atom_execute_table(ctx, ATOM_CMD_INIT, ps);
+        ret = atom_execute_table(ctx, ATOM_CMD_INIT, ps);
+        if (ret)
+                return ret;
+
+        memset(ps, 0, 64);
+
+        if (rdev->family < CHIP_R600) {
+                if (CU16(ctx->cmd_table + 4 + 2 * ATOM_CMD_SPDFANCNTL))
+                        atom_execute_table(ctx, ATOM_CMD_SPDFANCNTL, ps);
+        }
+        return ret;
 }
 
 void atom_destroy(struct atom_context *ctx)
diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index 93cfe2086ba0..25fea631dad2 100644
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -44,6 +44,7 @@
 #define ATOM_CMD_SETSCLK        0x0A
 #define ATOM_CMD_SETMCLK        0x0B
 #define ATOM_CMD_SETPCLK        0x0C
+#define ATOM_CMD_SPDFANCNTL     0x39
 
 #define ATOM_DATA_FWI_PTR       0xC
 #define ATOM_DATA_IIO_PTR       0x32
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 6f70158d34e4..df6a4dbd93f8 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -241,7 +241,8 @@ int radeon_bo_pin_restricted(struct radeon_bo *bo, u32 domain, u64 max_offset,
                                 domain_start = bo->rdev->mc.vram_start;
                         else
                                 domain_start = bo->rdev->mc.gtt_start;
-                        WARN_ON_ONCE((*gpu_addr - domain_start) > max_offset);
+                        WARN_ON_ONCE(max_offset <
+                                     (radeon_bo_gpu_offset(bo) - domain_start));
                 }
 
                 return 0;
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 5340c5f3987b..53673907a6a0 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -47,7 +47,7 @@ static struct vm_operations_struct udl_gem_vm_ops = {
 static const struct file_operations udl_driver_fops = {
         .owner = THIS_MODULE,
         .open = drm_open,
-        .mmap = drm_gem_mmap,
+        .mmap = udl_drm_gem_mmap,
         .poll = drm_poll,
         .read = drm_read,
         .unlocked_ioctl = drm_ioctl,
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index 1612954a5bc4..96820d03a303 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -121,6 +121,7 @@ struct udl_gem_object *udl_gem_alloc_object(struct drm_device *dev,
 
 int udl_gem_vmap(struct udl_gem_object *obj);
 void udl_gem_vunmap(struct udl_gem_object *obj);
+int udl_drm_gem_mmap(struct file *filp, struct vm_area_struct *vma);
 int udl_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
 
 int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index 852642dc1187..92f19ef329b0 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -71,6 +71,20 @@ int udl_dumb_destroy(struct drm_file *file, struct drm_device *dev,
         return drm_gem_handle_delete(file, handle);
 }
 
+int udl_drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+        int ret;
+
+        ret = drm_gem_mmap(filp, vma);
+        if (ret)
+                return ret;
+
+        vma->vm_flags &= ~VM_PFNMAP;
+        vma->vm_flags |= VM_MIXEDMAP;
+
+        return ret;
+}
+
 int udl_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct udl_gem_object *obj = to_udl_bo(vma->vm_private_data);