drm/i915: Fix regression in 95ca9d
[safe/jmp/linux-2.6] / drivers / gpu / drm / i915 / i915_gem.c
index cc2ca55..25b3374 100644 (file)
 
 #define I915_GEM_GPU_DOMAINS   (~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT))
 
-static void
-i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
-                                 uint32_t read_domains,
-                                 uint32_t write_domain);
 static void i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj);
 static void i915_gem_object_flush_gtt_write_domain(struct drm_gem_object *obj);
 static void i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj);
@@ -52,9 +48,12 @@ static void i915_gem_object_free_page_list(struct drm_gem_object *obj);
 static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);
 static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
                                           unsigned alignment);
-static void i915_gem_object_get_fence_reg(struct drm_gem_object *obj);
+static int i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write);
 static void i915_gem_clear_fence_reg(struct drm_gem_object *obj);
 static int i915_gem_evict_something(struct drm_device *dev);
+static int i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
+                               struct drm_i915_gem_pwrite *args,
+                               struct drm_file *file_priv);
 
 int i915_gem_do_init(struct drm_device *dev, unsigned long start,
                     unsigned long end)
@@ -386,8 +385,10 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
         * pread/pwrite currently are reading and writing from the CPU
         * perspective, requiring manual detiling by the client.
         */
-       if (obj_priv->tiling_mode == I915_TILING_NONE &&
-           dev->gtt_total != 0)
+       if (obj_priv->phys_obj)
+               ret = i915_gem_phys_pwrite(dev, obj, args, file_priv);
+       else if (obj_priv->tiling_mode == I915_TILING_NONE &&
+                dev->gtt_total != 0)
                ret = i915_gem_gtt_pwrite(dev, obj, args, file_priv);
        else
                ret = i915_gem_shmem_pwrite(dev, obj, args, file_priv);
@@ -562,6 +563,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        pgoff_t page_offset;
        unsigned long pfn;
        int ret = 0;
+       bool write = !!(vmf->flags & FAULT_FLAG_WRITE);
 
        /* We don't use vmf->pgoff since that has the fake offset */
        page_offset = ((unsigned long)vmf->virtual_address - vma->vm_start) >>
@@ -580,8 +582,13 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 
        /* Need a new fence register? */
        if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
-           obj_priv->tiling_mode != I915_TILING_NONE)
-               i915_gem_object_get_fence_reg(obj);
+           obj_priv->tiling_mode != I915_TILING_NONE) {
+               ret = i915_gem_object_get_fence_reg(obj, write);
+               if (ret) {
+                       mutex_unlock(&dev->struct_mutex);
+                       return VM_FAULT_SIGBUS;
+               }
+       }
 
        pfn = ((dev->agp->base + obj_priv->gtt_offset) >> PAGE_SHIFT) +
                page_offset;
@@ -596,8 +603,6 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        case -EAGAIN:
                return VM_FAULT_OOM;
        case -EFAULT:
-       case -EBUSY:
-               DRM_ERROR("can't insert pfn??  fault or busy...\n");
                return VM_FAULT_SIGBUS;
        default:
                return VM_FAULT_NOPAGE;
@@ -673,6 +678,30 @@ out_free_list:
        return ret;
 }
 
+static void
+i915_gem_free_mmap_offset(struct drm_gem_object *obj)
+{
+       struct drm_device *dev = obj->dev;
+       struct drm_i915_gem_object *obj_priv = obj->driver_private;
+       struct drm_gem_mm *mm = dev->mm_private;
+       struct drm_map_list *list;
+
+       list = &obj->map_list;
+       drm_ht_remove_item(&mm->offset_hash, &list->hash);
+
+       if (list->file_offset_node) {
+               drm_mm_put_block(list->file_offset_node);
+               list->file_offset_node = NULL;
+       }
+
+       if (list->map) {
+               drm_free(list->map, sizeof(struct drm_map), DRM_MEM_DRIVER);
+               list->map = NULL;
+       }
+
+       obj_priv->mmap_offset = 0;
+}
+
 /**
  * i915_gem_get_gtt_alignment - return required GTT alignment for an object
  * @obj: object to check
@@ -747,8 +776,11 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 
        if (!obj_priv->mmap_offset) {
                ret = i915_gem_create_mmap_offset(obj);
-               if (ret)
+               if (ret) {
+                       drm_gem_object_unreference(obj);
+                       mutex_unlock(&dev->struct_mutex);
                        return ret;
+               }
        }
 
        args->offset = obj_priv->mmap_offset;
@@ -1206,7 +1238,7 @@ i915_gem_object_wait_rendering(struct drm_gem_object *obj)
 /**
  * Unbinds an object from the GTT aperture.
  */
-static int
+int
 i915_gem_object_unbind(struct drm_gem_object *obj)
 {
        struct drm_device *dev = obj->dev;
@@ -1440,21 +1472,26 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj_priv = obj->driver_private;
        int regnum = obj_priv->fence_reg;
+       int tile_width;
        uint32_t val;
        uint32_t pitch_val;
 
        if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
            (obj_priv->gtt_offset & (obj->size - 1))) {
-               WARN(1, "%s: object not 1M or size aligned\n", __FUNCTION__);
+               WARN(1, "%s: object 0x%08x not 1M or size (0x%zx) aligned\n",
+                    __func__, obj_priv->gtt_offset, obj->size);
                return;
        }
 
-       if (obj_priv->tiling_mode == I915_TILING_Y && (IS_I945G(dev) ||
-                                                      IS_I945GM(dev) ||
-                                                      IS_G33(dev)))
-               pitch_val = (obj_priv->stride / 128) - 1;
+       if (obj_priv->tiling_mode == I915_TILING_Y &&
+           HAS_128_BYTE_Y_TILING(dev))
+               tile_width = 128;
        else
-               pitch_val = (obj_priv->stride / 512) - 1;
+               tile_width = 512;
+
+       /* Note: pitch better be a power of two tile widths */
+       pitch_val = obj_priv->stride / tile_width;
+       pitch_val = ffs(pitch_val) - 1;
 
        val = obj_priv->gtt_offset;
        if (obj_priv->tiling_mode == I915_TILING_Y)
@@ -1478,7 +1515,8 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
 
        if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
            (obj_priv->gtt_offset & (obj->size - 1))) {
-               WARN(1, "%s: object not 1M or size aligned\n", __FUNCTION__);
+               WARN(1, "%s: object 0x%08x not 1M or size aligned\n",
+                    __func__, obj_priv->gtt_offset);
                return;
        }
 
@@ -1498,6 +1536,7 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
 /**
  * i915_gem_object_get_fence_reg - set up a fence reg for an object
  * @obj: object to map through a fence reg
+ * @write: object is about to be written
  *
  * When mapping objects through the GTT, userspace wants to be able to write
  * to them without having to worry about swizzling if the object is tiled.
@@ -1508,8 +1547,8 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
  * It then sets up the reg based on the object's properties: address, pitch
  * and tiling format.
  */
-static void
-i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
+static int
+i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write)
 {
        struct drm_device *dev = obj->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1522,12 +1561,18 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
                WARN(1, "allocating a fence for non-tiled object?\n");
                break;
        case I915_TILING_X:
-               WARN(obj_priv->stride & (512 - 1),
-                    "object is X tiled but has non-512B pitch\n");
+               if (!obj_priv->stride)
+                       return -EINVAL;
+               WARN((obj_priv->stride & (512 - 1)),
+                    "object 0x%08x is X tiled but has non-512B pitch\n",
+                    obj_priv->gtt_offset);
                break;
        case I915_TILING_Y:
-               WARN(obj_priv->stride & (128 - 1),
-                    "object is Y tiled but has non-128B pitch\n");
+               if (!obj_priv->stride)
+                       return -EINVAL;
+               WARN((obj_priv->stride & (128 - 1)),
+                    "object 0x%08x is Y tiled but has non-128B pitch\n",
+                    obj_priv->gtt_offset);
                break;
        }
 
@@ -1558,10 +1603,11 @@ try_again:
                 * objects to finish before trying again.
                 */
                if (i == dev_priv->num_fence_regs) {
-                       ret = i915_gem_object_wait_rendering(reg->obj);
+                       ret = i915_gem_object_set_to_gtt_domain(reg->obj, 0);
                        if (ret) {
-                               WARN(ret, "wait_rendering failed: %d\n", ret);
-                               return;
+                               WARN(ret != -ERESTARTSYS,
+                                    "switch to GTT domain failed: %d\n", ret);
+                               return ret;
                        }
                        goto try_again;
                }
@@ -1586,6 +1632,8 @@ try_again:
                i915_write_fence_reg(reg);
        else
                i830_write_fence_reg(reg);
+
+       return 0;
 }
 
 /**
@@ -1623,8 +1671,10 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
        struct drm_mm_node *free_space;
        int page_count, ret;
 
+       if (dev_priv->mm.suspended)
+               return -EBUSY;
        if (alignment == 0)
-               alignment = PAGE_SIZE;
+               alignment = i915_gem_get_gtt_alignment(obj);
        if (alignment & (PAGE_SIZE - 1)) {
                DRM_ERROR("Invalid object alignment requested %u\n", alignment);
                return -EINVAL;
@@ -1967,30 +2017,28 @@ i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj, int write)
  *             drm_agp_chipset_flush
  */
 static void
-i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
-                                 uint32_t read_domains,
-                                 uint32_t write_domain)
+i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj)
 {
        struct drm_device               *dev = obj->dev;
        struct drm_i915_gem_object      *obj_priv = obj->driver_private;
        uint32_t                        invalidate_domains = 0;
        uint32_t                        flush_domains = 0;
 
-       BUG_ON(read_domains & I915_GEM_DOMAIN_CPU);
-       BUG_ON(write_domain == I915_GEM_DOMAIN_CPU);
+       BUG_ON(obj->pending_read_domains & I915_GEM_DOMAIN_CPU);
+       BUG_ON(obj->pending_write_domain == I915_GEM_DOMAIN_CPU);
 
 #if WATCH_BUF
        DRM_INFO("%s: object %p read %08x -> %08x write %08x -> %08x\n",
                 __func__, obj,
-                obj->read_domains, read_domains,
-                obj->write_domain, write_domain);
+                obj->read_domains, obj->pending_read_domains,
+                obj->write_domain, obj->pending_write_domain);
 #endif
        /*
         * If the object isn't moving to a new write domain,
         * let the object stay in multiple read domains
         */
-       if (write_domain == 0)
-               read_domains |= obj->read_domains;
+       if (obj->pending_write_domain == 0)
+               obj->pending_read_domains |= obj->read_domains;
        else
                obj_priv->dirty = 1;
 
@@ -2000,15 +2048,17 @@ i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
         * any read domains which differ from the old
         * write domain
         */
-       if (obj->write_domain && obj->write_domain != read_domains) {
+       if (obj->write_domain &&
+           obj->write_domain != obj->pending_read_domains) {
                flush_domains |= obj->write_domain;
-               invalidate_domains |= read_domains & ~obj->write_domain;
+               invalidate_domains |=
+                       obj->pending_read_domains & ~obj->write_domain;
        }
        /*
         * Invalidate any read caches which may have
         * stale data. That is, any new read domains.
         */
-       invalidate_domains |= read_domains & ~obj->read_domains;
+       invalidate_domains |= obj->pending_read_domains & ~obj->read_domains;
        if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_CPU) {
 #if WATCH_BUF
                DRM_INFO("%s: CPU domain flush %08x invalidate %08x\n",
@@ -2017,9 +2067,15 @@ i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
                i915_gem_clflush_object(obj);
        }
 
-       if ((write_domain | flush_domains) != 0)
-               obj->write_domain = write_domain;
-       obj->read_domains = read_domains;
+       /* The actual obj->write_domain will be updated with
+        * pending_write_domain after we emit the accumulated flush for all
+        * of our domain changes in execbuffers (which clears objects'
+        * write_domains).  So if we have a current write domain that we
+        * aren't changing, set pending_write_domain to that.
+        */
+       if (flush_domains == 0 && obj->pending_write_domain == 0)
+               obj->pending_write_domain = obj->write_domain;
+       obj->read_domains = obj->pending_read_domains;
 
        dev->invalidate_domains |= invalidate_domains;
        dev->flush_domains |= flush_domains;
@@ -2222,6 +2278,8 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                                  (int) reloc.offset,
                                  reloc.read_domains,
                                  reloc.write_domain);
+                       drm_gem_object_unreference(target_obj);
+                       i915_gem_object_unpin(obj);
                        return -EINVAL;
                }
 
@@ -2451,13 +2509,15 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
        if (dev_priv->mm.wedged) {
                DRM_ERROR("Execbuf while wedged\n");
                mutex_unlock(&dev->struct_mutex);
-               return -EIO;
+               ret = -EIO;
+               goto pre_mutex_err;
        }
 
        if (dev_priv->mm.suspended) {
                DRM_ERROR("Execbuf while VT-switched.\n");
                mutex_unlock(&dev->struct_mutex);
-               return -EBUSY;
+               ret = -EBUSY;
+               goto pre_mutex_err;
        }
 
        /* Look up object handles */
@@ -2525,9 +2585,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
                struct drm_gem_object *obj = object_list[i];
 
                /* Compute new gpu domains and update invalidate/flush */
-               i915_gem_object_set_to_gpu_domain(obj,
-                                                 obj->pending_read_domains,
-                                                 obj->pending_write_domain);
+               i915_gem_object_set_to_gpu_domain(obj);
        }
 
        i915_verify_inactive(dev, __FILE__, __LINE__);
@@ -2546,6 +2604,12 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
                        (void)i915_add_request(dev, dev->flush_domains);
        }
 
+       for (i = 0; i < args->buffer_count; i++) {
+               struct drm_gem_object *obj = object_list[i];
+
+               obj->write_domain = obj->pending_write_domain;
+       }
+
        i915_verify_inactive(dev, __FILE__, __LINE__);
 
 #if WATCH_COHERENCY
@@ -2603,15 +2667,6 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 
        i915_verify_inactive(dev, __FILE__, __LINE__);
 
-       /* Copy the new buffer offsets back to the user's exec list. */
-       ret = copy_to_user((struct drm_i915_relocation_entry __user *)
-                          (uintptr_t) args->buffers_ptr,
-                          exec_list,
-                          sizeof(*exec_list) * args->buffer_count);
-       if (ret)
-               DRM_ERROR("failed to copy %d exec entries "
-                         "back to user (%d)\n",
-                          args->buffer_count, ret);
 err:
        for (i = 0; i < pinned; i++)
                i915_gem_object_unpin(object_list[i]);
@@ -2621,6 +2676,18 @@ err:
 
        mutex_unlock(&dev->struct_mutex);
 
+       if (!ret) {
+               /* Copy the new buffer offsets back to the user's exec list. */
+               ret = copy_to_user((struct drm_i915_relocation_entry __user *)
+                                  (uintptr_t) args->buffers_ptr,
+                                  exec_list,
+                                  sizeof(*exec_list) * args->buffer_count);
+               if (ret)
+                       DRM_ERROR("failed to copy %d exec entries "
+                                 "back to user (%d)\n",
+                                 args->buffer_count, ret);
+       }
+
 pre_mutex_err:
        drm_free(object_list, sizeof(*object_list) * args->buffer_count,
                 DRM_MEM_DRIVER);
@@ -2641,10 +2708,18 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
        if (obj_priv->gtt_space == NULL) {
                ret = i915_gem_object_bind_to_gtt(obj, alignment);
                if (ret != 0) {
-                       if (ret != -ERESTARTSYS)
+                       if (ret != -EBUSY && ret != -ERESTARTSYS)
                                DRM_ERROR("Failure to bind: %d", ret);
                        return ret;
                }
+               /*
+                * Pre-965 chips need a fence register set up in order to
+                * properly handle tiled surfaces.
+                */
+               if (!IS_I965G(dev) &&
+                   obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+                   obj_priv->tiling_mode != I915_TILING_NONE)
+                       i915_gem_object_get_fence_reg(obj, true);
        }
        obj_priv->pin_count++;
 
@@ -2716,6 +2791,7 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
        if (obj_priv->pin_filp != NULL && obj_priv->pin_filp != file_priv) {
                DRM_ERROR("Already pinned in i915_gem_pin_ioctl(): %d\n",
                          args->handle);
+               drm_gem_object_unreference(obj);
                mutex_unlock(&dev->struct_mutex);
                return -EINVAL;
        }
@@ -2796,6 +2872,13 @@ i915_gem_busy_ioctl(struct drm_device *dev, void *data,
                return -EBADF;
        }
 
+       /* Update the active list for the hardware's current position.
+        * Otherwise this only updates on a delayed timer or when irqs are
+        * actually unmasked, and our working set ends up being larger than
+        * required.
+        */
+       i915_gem_retire_requests(dev);
+
        obj_priv = obj->driver_private;
        /* Don't count being on the flushing list against the object being
         * done.  Otherwise, a buffer left on the flushing list but not getting
@@ -2848,29 +2931,17 @@ int i915_gem_init_object(struct drm_gem_object *obj)
 void i915_gem_free_object(struct drm_gem_object *obj)
 {
        struct drm_device *dev = obj->dev;
-       struct drm_gem_mm *mm = dev->mm_private;
-       struct drm_map_list *list;
-       struct drm_map *map;
        struct drm_i915_gem_object *obj_priv = obj->driver_private;
 
        while (obj_priv->pin_count > 0)
                i915_gem_object_unpin(obj);
 
-       i915_gem_object_unbind(obj);
-
-       list = &obj->map_list;
-       drm_ht_remove_item(&mm->offset_hash, &list->hash);
+       if (obj_priv->phys_obj)
+               i915_gem_detach_phys_object(dev, obj);
 
-       if (list->file_offset_node) {
-               drm_mm_put_block(list->file_offset_node);
-               list->file_offset_node = NULL;
-       }
+       i915_gem_object_unbind(obj);
 
-       map = list->map;
-       if (map) {
-               drm_free(map, sizeof(*map), DRM_MEM_DRIVER);
-               list->map = NULL;
-       }
+       i915_gem_free_mmap_offset(obj);
 
        drm_free(obj_priv->page_cpu_valid, 1, DRM_MEM_DRIVER);
        drm_free(obj->driver_private, 1, DRM_MEM_DRIVER);
@@ -2909,7 +2980,7 @@ i915_gem_evict_from_list(struct drm_device *dev, struct list_head *head)
        return 0;
 }
 
-static int
+int
 i915_gem_idle(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
@@ -3055,6 +3126,7 @@ i915_gem_init_hws(struct drm_device *dev)
        if (dev_priv->hw_status_page == NULL) {
                DRM_ERROR("Failed to map status page.\n");
                memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
+               i915_gem_object_unpin(obj);
                drm_gem_object_unreference(obj);
                return -EINVAL;
        }
@@ -3067,6 +3139,31 @@ i915_gem_init_hws(struct drm_device *dev)
        return 0;
 }
 
+static void
+i915_gem_cleanup_hws(struct drm_device *dev)
+{
+       drm_i915_private_t *dev_priv = dev->dev_private;
+       struct drm_gem_object *obj;
+       struct drm_i915_gem_object *obj_priv;
+
+       if (dev_priv->hws_obj == NULL)
+               return;
+
+       obj = dev_priv->hws_obj;
+       obj_priv = obj->driver_private;
+
+       kunmap(obj_priv->page_list[0]);
+       i915_gem_object_unpin(obj);
+       drm_gem_object_unreference(obj);
+       dev_priv->hws_obj = NULL;
+
+       memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
+       dev_priv->hw_status_page = NULL;
+
+       /* Write high address into HWS_PGA when disabling. */
+       I915_WRITE(HWS_PGA, 0x1ffff000);
+}
+
 int
 i915_gem_init_ringbuffer(struct drm_device *dev)
 {
@@ -3084,6 +3181,7 @@ i915_gem_init_ringbuffer(struct drm_device *dev)
        obj = drm_gem_object_alloc(dev, 128 * 1024);
        if (obj == NULL) {
                DRM_ERROR("Failed to allocate ringbuffer\n");
+               i915_gem_cleanup_hws(dev);
                return -ENOMEM;
        }
        obj_priv = obj->driver_private;
@@ -3091,6 +3189,7 @@ i915_gem_init_ringbuffer(struct drm_device *dev)
        ret = i915_gem_object_pin(obj, 4096);
        if (ret != 0) {
                drm_gem_object_unreference(obj);
+               i915_gem_cleanup_hws(dev);
                return ret;
        }
 
@@ -3108,7 +3207,9 @@ i915_gem_init_ringbuffer(struct drm_device *dev)
        if (ring->map.handle == NULL) {
                DRM_ERROR("Failed to map ringbuffer.\n");
                memset(&dev_priv->ring, 0, sizeof(dev_priv->ring));
+               i915_gem_object_unpin(obj);
                drm_gem_object_unreference(obj);
+               i915_gem_cleanup_hws(dev);
                return -EINVAL;
        }
        ring->ring_obj = obj;
@@ -3188,20 +3289,7 @@ i915_gem_cleanup_ringbuffer(struct drm_device *dev)
        dev_priv->ring.ring_obj = NULL;
        memset(&dev_priv->ring, 0, sizeof(dev_priv->ring));
 
-       if (dev_priv->hws_obj != NULL) {
-               struct drm_gem_object *obj = dev_priv->hws_obj;
-               struct drm_i915_gem_object *obj_priv = obj->driver_private;
-
-               kunmap(obj_priv->page_list[0]);
-               i915_gem_object_unpin(obj);
-               drm_gem_object_unreference(obj);
-               dev_priv->hws_obj = NULL;
-               memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
-               dev_priv->hw_status_page = NULL;
-
-               /* Write high address into HWS_PGA when disabling. */
-               I915_WRITE(HWS_PGA, 0x1ffff000);
-       }
+       i915_gem_cleanup_hws(dev);
 }
 
 int
@@ -3219,20 +3307,17 @@ i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
                dev_priv->mm.wedged = 0;
        }
 
+       mutex_lock(&dev->struct_mutex);
+       dev_priv->mm.suspended = 0;
+
        ret = i915_gem_init_ringbuffer(dev);
        if (ret != 0)
                return ret;
 
-       dev_priv->mm.gtt_mapping = io_mapping_create_wc(dev->agp->base,
-                                                       dev->agp->agp_info.aper_size
-                                                       * 1024 * 1024);
-
-       mutex_lock(&dev->struct_mutex);
        BUG_ON(!list_empty(&dev_priv->mm.active_list));
        BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
        BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
        BUG_ON(!list_empty(&dev_priv->mm.request_list));
-       dev_priv->mm.suspended = 0;
        mutex_unlock(&dev->struct_mutex);
 
        drm_irq_install(dev);
@@ -3244,7 +3329,6 @@ int
 i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
                       struct drm_file *file_priv)
 {
-       drm_i915_private_t *dev_priv = dev->dev_private;
        int ret;
 
        if (drm_core_check_feature(dev, DRIVER_MODESET))
@@ -3253,7 +3337,6 @@ i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
        ret = i915_gem_idle(dev);
        drm_irq_uninstall(dev);
 
-       io_mapping_free(dev_priv->mm.gtt_mapping);
        return ret;
 }
 
@@ -3262,6 +3345,9 @@ i915_gem_lastclose(struct drm_device *dev)
 {
        int ret;
 
+       if (drm_core_check_feature(dev, DRIVER_MODESET))
+               return;
+
        ret = i915_gem_idle(dev);
        if (ret)
                DRM_ERROR("failed to idle hardware: %d\n", ret);
@@ -3283,10 +3369,187 @@ i915_gem_load(struct drm_device *dev)
        /* Old X drivers will take 0-2 for front, back, depth buffers */
        dev_priv->fence_reg_start = 3;
 
-       if (IS_I965G(dev))
+       if (IS_I965G(dev) || IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                dev_priv->num_fence_regs = 16;
        else
                dev_priv->num_fence_regs = 8;
 
        i915_gem_detect_bit_6_swizzle(dev);
 }
+
+/*
+ * Create a physically contiguous memory object for this object
+ * e.g. for cursor + overlay regs
+ */
+int i915_gem_init_phys_object(struct drm_device *dev,
+                             int id, int size)
+{
+       drm_i915_private_t *dev_priv = dev->dev_private;
+       struct drm_i915_gem_phys_object *phys_obj;
+       int ret;
+
+       if (dev_priv->mm.phys_objs[id - 1] || !size)
+               return 0;
+
+       phys_obj = drm_calloc(1, sizeof(struct drm_i915_gem_phys_object), DRM_MEM_DRIVER);
+       if (!phys_obj)
+               return -ENOMEM;
+
+       phys_obj->id = id;
+
+       phys_obj->handle = drm_pci_alloc(dev, size, 0, 0xffffffff);
+       if (!phys_obj->handle) {
+               ret = -ENOMEM;
+               goto kfree_obj;
+       }
+#ifdef CONFIG_X86
+       set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
+#endif
+
+       dev_priv->mm.phys_objs[id - 1] = phys_obj;
+
+       return 0;
+kfree_obj:
+       drm_free(phys_obj, sizeof(struct drm_i915_gem_phys_object), DRM_MEM_DRIVER);
+       return ret;
+}
+
+void i915_gem_free_phys_object(struct drm_device *dev, int id)
+{
+       drm_i915_private_t *dev_priv = dev->dev_private;
+       struct drm_i915_gem_phys_object *phys_obj;
+
+       if (!dev_priv->mm.phys_objs[id - 1])
+               return;
+
+       phys_obj = dev_priv->mm.phys_objs[id - 1];
+       if (phys_obj->cur_obj) {
+               i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
+       }
+
+#ifdef CONFIG_X86
+       set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
+#endif
+       drm_pci_free(dev, phys_obj->handle);
+       kfree(phys_obj);
+       dev_priv->mm.phys_objs[id - 1] = NULL;
+}
+
+void i915_gem_free_all_phys_object(struct drm_device *dev)
+{
+       int i;
+
+       for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
+               i915_gem_free_phys_object(dev, i);
+}
+
+void i915_gem_detach_phys_object(struct drm_device *dev,
+                                struct drm_gem_object *obj)
+{
+       struct drm_i915_gem_object *obj_priv;
+       int i;
+       int ret;
+       int page_count;
+
+       obj_priv = obj->driver_private;
+       if (!obj_priv->phys_obj)
+               return;
+
+       ret = i915_gem_object_get_page_list(obj);
+       if (ret)
+               goto out;
+
+       page_count = obj->size / PAGE_SIZE;
+
+       for (i = 0; i < page_count; i++) {
+               char *dst = kmap_atomic(obj_priv->page_list[i], KM_USER0);
+               char *src = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
+
+               memcpy(dst, src, PAGE_SIZE);
+               kunmap_atomic(dst, KM_USER0);
+       }
+       drm_clflush_pages(obj_priv->page_list, page_count);
+       drm_agp_chipset_flush(dev);
+out:
+       obj_priv->phys_obj->cur_obj = NULL;
+       obj_priv->phys_obj = NULL;
+}
+
+int
+i915_gem_attach_phys_object(struct drm_device *dev,
+                           struct drm_gem_object *obj, int id)
+{
+       drm_i915_private_t *dev_priv = dev->dev_private;
+       struct drm_i915_gem_object *obj_priv;
+       int ret = 0;
+       int page_count;
+       int i;
+
+       if (id > I915_MAX_PHYS_OBJECT)
+               return -EINVAL;
+
+       obj_priv = obj->driver_private;
+
+       if (obj_priv->phys_obj) {
+               if (obj_priv->phys_obj->id == id)
+                       return 0;
+               i915_gem_detach_phys_object(dev, obj);
+       }
+
+
+       /* create a new object */
+       if (!dev_priv->mm.phys_objs[id - 1]) {
+               ret = i915_gem_init_phys_object(dev, id,
+                                               obj->size);
+               if (ret) {
+                       DRM_ERROR("failed to init phys object %d size: %zu\n", id, obj->size);
+                       goto out;
+               }
+       }
+
+       /* bind to the object */
+       obj_priv->phys_obj = dev_priv->mm.phys_objs[id - 1];
+       obj_priv->phys_obj->cur_obj = obj;
+
+       ret = i915_gem_object_get_page_list(obj);
+       if (ret) {
+               DRM_ERROR("failed to get page list\n");
+               goto out;
+       }
+
+       page_count = obj->size / PAGE_SIZE;
+
+       for (i = 0; i < page_count; i++) {
+               char *src = kmap_atomic(obj_priv->page_list[i], KM_USER0);
+               char *dst = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
+
+               memcpy(dst, src, PAGE_SIZE);
+               kunmap_atomic(src, KM_USER0);
+       }
+
+       return 0;
+out:
+       return ret;
+}
+
+static int
+i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
+                    struct drm_i915_gem_pwrite *args,
+                    struct drm_file *file_priv)
+{
+       struct drm_i915_gem_object *obj_priv = obj->driver_private;
+       void *obj_addr;
+       int ret;
+       char __user *user_data;
+
+       user_data = (char __user *) (uintptr_t) args->data_ptr;
+       obj_addr = obj_priv->phys_obj->handle->vaddr + args->offset;
+
+       DRM_ERROR("obj_addr %p, %lld\n", obj_addr, args->size);
+       ret = copy_from_user(obj_addr, user_data, args->size);
+       if (ret)
+               return -EFAULT;
+
+       drm_agp_chipset_flush(dev);
+       return 0;
+}