These changes are the raw update to linux-4.4.6-rt14. Kernel sources
[kvmfornfv.git] / kernel / drivers / gpu / drm / i915 / i915_gem.c
index 596bce5..f56af0a 100644 (file)
 #include <linux/pci.h>
 #include <linux/dma-buf.h>
 
+#define RQ_BUG_ON(expr)
+
 static void i915_gem_object_flush_gtt_write_domain(struct drm_i915_gem_object *obj);
 static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *obj);
-static __must_check int
-i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
-                              bool readonly);
 static void
-i915_gem_object_retire(struct drm_i915_gem_object *obj);
-
-static void i915_gem_write_fence(struct drm_device *dev, int reg,
-                                struct drm_i915_gem_object *obj);
-static void i915_gem_object_update_fence(struct drm_i915_gem_object *obj,
-                                        struct drm_i915_fence_reg *fence,
-                                        bool enable);
+i915_gem_object_retire__write(struct drm_i915_gem_object *obj);
+static void
+i915_gem_object_retire__read(struct drm_i915_gem_object *obj, int ring);
 
 static bool cpu_cache_is_coherent(struct drm_device *dev,
                                  enum i915_cache_level level)
@@ -66,18 +61,6 @@ static bool cpu_write_needs_clflush(struct drm_i915_gem_object *obj)
        return obj->pin_display;
 }
 
-static inline void i915_gem_object_fence_lost(struct drm_i915_gem_object *obj)
-{
-       if (obj->tiling_mode)
-               i915_gem_release_mmap(obj);
-
-       /* As we do not have an associated fence register, we will force
-        * a tiling change if we ever need to acquire one.
-        */
-       obj->fence_dirty = false;
-       obj->fence_reg = I915_FENCE_REG_NONE;
-}
-
 /* some bookkeeping */
 static void i915_gem_info_add_obj(struct drm_i915_private *dev_priv,
                                  size_t size)
@@ -149,14 +132,18 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_get_aperture *args = data;
-       struct drm_i915_gem_object *obj;
+       struct i915_gtt *ggtt = &dev_priv->gtt;
+       struct i915_vma *vma;
        size_t pinned;
 
        pinned = 0;
        mutex_lock(&dev->struct_mutex);
-       list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list)
-               if (i915_gem_obj_is_pinned(obj))
-                       pinned += i915_gem_obj_ggtt_size(obj);
+       list_for_each_entry(vma, &ggtt->base.active_list, mm_list)
+               if (vma->pin_count)
+                       pinned += vma->node.size;
+       list_for_each_entry(vma, &ggtt->base.inactive_list, mm_list)
+               if (vma->pin_count)
+                       pinned += vma->node.size;
        mutex_unlock(&dev->struct_mutex);
 
        args->aper_size = dev_priv->gtt.base.total;
@@ -213,7 +200,6 @@ i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
        sg_dma_len(sg) = obj->base.size;
 
        obj->pages = st;
-       obj->has_dma_mapping = true;
        return 0;
 }
 
@@ -265,8 +251,6 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_object *obj)
 
        sg_free_table(obj->pages);
        kfree(obj->pages);
-
-       obj->has_dma_mapping = false;
 }
 
 static void
@@ -350,7 +334,7 @@ i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
        if (ret)
                return ret;
 
-       intel_fb_obj_invalidate(obj, NULL, ORIGIN_CPU);
+       intel_fb_obj_invalidate(obj, ORIGIN_CPU);
        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
                unsigned long unwritten;
 
@@ -371,20 +355,20 @@ i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
        i915_gem_chipset_flush(dev);
 
 out:
-       intel_fb_obj_flush(obj, false);
+       intel_fb_obj_flush(obj, false, ORIGIN_CPU);
        return ret;
 }
 
 void *i915_gem_object_alloc(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-       return kmem_cache_zalloc(dev_priv->slab, GFP_KERNEL);
+       return kmem_cache_zalloc(dev_priv->objects, GFP_KERNEL);
 }
 
 void i915_gem_object_free(struct drm_i915_gem_object *obj)
 {
        struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
-       kmem_cache_free(dev_priv->slab, obj);
+       kmem_cache_free(dev_priv->objects, obj);
 }
 
 static int
@@ -518,8 +502,6 @@ int i915_gem_obj_prepare_shmem_read(struct drm_i915_gem_object *obj,
                ret = i915_gem_object_wait_rendering(obj, true);
                if (ret)
                        return ret;
-
-               i915_gem_object_retire(obj);
        }
 
        ret = i915_gem_object_get_pages(obj);
@@ -806,7 +788,7 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev,
 
        offset = i915_gem_obj_ggtt_offset(obj) + args->offset;
 
-       intel_fb_obj_invalidate(obj, NULL, ORIGIN_GTT);
+       intel_fb_obj_invalidate(obj, ORIGIN_GTT);
 
        while (remain > 0) {
                /* Operation in this page
@@ -837,7 +819,7 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev,
        }
 
 out_flush:
-       intel_fb_obj_flush(obj, false);
+       intel_fb_obj_flush(obj, false, ORIGIN_GTT);
 out_unpin:
        i915_gem_object_ggtt_unpin(obj);
 out:
@@ -939,8 +921,6 @@ i915_gem_shmem_pwrite(struct drm_device *dev,
                ret = i915_gem_object_wait_rendering(obj, false);
                if (ret)
                        return ret;
-
-               i915_gem_object_retire(obj);
        }
        /* Same trick applies to invalidate partially written cachelines read
         * before writing. */
@@ -952,7 +932,7 @@ i915_gem_shmem_pwrite(struct drm_device *dev,
        if (ret)
                return ret;
 
-       intel_fb_obj_invalidate(obj, NULL, ORIGIN_CPU);
+       intel_fb_obj_invalidate(obj, ORIGIN_CPU);
 
        i915_gem_object_pin_pages(obj);
 
@@ -1025,14 +1005,16 @@ out:
                if (!needs_clflush_after &&
                    obj->base.write_domain != I915_GEM_DOMAIN_CPU) {
                        if (i915_gem_clflush_object(obj, obj->pin_display))
-                               i915_gem_chipset_flush(dev);
+                               needs_clflush_after = true;
                }
        }
 
        if (needs_clflush_after)
                i915_gem_chipset_flush(dev);
+       else
+               obj->cache_dirty = true;
 
-       intel_fb_obj_flush(obj, false);
+       intel_fb_obj_flush(obj, false, ORIGIN_CPU);
        return ret;
 }
 
@@ -1153,23 +1135,6 @@ i915_gem_check_wedge(struct i915_gpu_error *error,
        return 0;
 }
 
-/*
- * Compare arbitrary request against outstanding lazy request. Emit on match.
- */
-int
-i915_gem_check_olr(struct drm_i915_gem_request *req)
-{
-       int ret;
-
-       WARN_ON(!mutex_is_locked(&req->ring->dev->struct_mutex));
-
-       ret = 0;
-       if (req == req->ring->outstanding_lazy_request)
-               ret = i915_add_request(req->ring);
-
-       return ret;
-}
-
 static void fake_irq(unsigned long data)
 {
        wake_up_process((struct task_struct *)data);
@@ -1181,12 +1146,78 @@ static bool missed_irq(struct drm_i915_private *dev_priv,
        return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings);
 }
 
-static bool can_wait_boost(struct drm_i915_file_private *file_priv)
+static unsigned long local_clock_us(unsigned *cpu)
+{
+       unsigned long t;
+
+       /* Cheaply and approximately convert from nanoseconds to microseconds.
+        * The result and subsequent calculations are also defined in the same
+        * approximate microseconds units. The principal source of timing
+        * error here is from the simple truncation.
+        *
+        * Note that local_clock() is only defined wrt to the current CPU;
+        * the comparisons are no longer valid if we switch CPUs. Instead of
+        * blocking preemption for the entire busywait, we can detect the CPU
+        * switch and use that as indicator of system load and a reason to
+        * stop busywaiting, see busywait_stop().
+        */
+       *cpu = get_cpu();
+       t = local_clock() >> 10;
+       put_cpu();
+
+       return t;
+}
+
+static bool busywait_stop(unsigned long timeout, unsigned cpu)
 {
-       if (file_priv == NULL)
+       unsigned this_cpu;
+
+       if (time_after(local_clock_us(&this_cpu), timeout))
                return true;
 
-       return !atomic_xchg(&file_priv->rps_wait_boost, true);
+       return this_cpu != cpu;
+}
+
+static int __i915_spin_request(struct drm_i915_gem_request *req, int state)
+{
+       unsigned long timeout;
+       unsigned cpu;
+
+       /* When waiting for high frequency requests, e.g. during synchronous
+        * rendering split between the CPU and GPU, the finite amount of time
+        * required to set up the irq and wait upon it limits the response
+        * rate. By busywaiting on the request completion for a short while we
+        * can service the high frequency waits as quick as possible. However,
+        * if it is a slow request, we want to sleep as quickly as possible.
+        * The tradeoff between waiting and sleeping is roughly the time it
+        * takes to sleep on a request, on the order of a microsecond.
+        */
+
+       if (req->ring->irq_refcount)
+               return -EBUSY;
+
+       /* Only spin if we know the GPU is processing this request */
+       if (!i915_gem_request_started(req, true))
+               return -EAGAIN;
+
+       timeout = local_clock_us(&cpu) + 5;
+       while (!need_resched()) {
+               if (i915_gem_request_completed(req, true))
+                       return 0;
+
+               if (signal_pending_state(state, current))
+                       break;
+
+               if (busywait_stop(timeout, cpu))
+                       break;
+
+               cpu_relax_lowlatency();
+       }
+
+       if (i915_gem_request_completed(req, false))
+               return 0;
+
+       return -EAGAIN;
 }
 
 /**
@@ -1210,13 +1241,14 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
                        unsigned reset_counter,
                        bool interruptible,
                        s64 *timeout,
-                       struct drm_i915_file_private *file_priv)
+                       struct intel_rps_client *rps)
 {
        struct intel_engine_cs *ring = i915_gem_request_get_ring(req);
        struct drm_device *dev = ring->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        const bool irq_test_in_progress =
                ACCESS_ONCE(dev_priv->gpu_error.test_irq_rings) & intel_ring_flag(ring);
+       int state = interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE;
        DEFINE_WAIT(wait);
        unsigned long timeout_expire;
        s64 before, now;
@@ -1224,31 +1256,44 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
 
        WARN(!intel_irqs_enabled(dev_priv), "IRQs disabled");
 
+       if (list_empty(&req->list))
+               return 0;
+
        if (i915_gem_request_completed(req, true))
                return 0;
 
-       timeout_expire = timeout ?
-               jiffies + nsecs_to_jiffies_timeout((u64)*timeout) : 0;
+       timeout_expire = 0;
+       if (timeout) {
+               if (WARN_ON(*timeout < 0))
+                       return -EINVAL;
 
-       if (INTEL_INFO(dev)->gen >= 6 && ring->id == RCS && can_wait_boost(file_priv)) {
-               gen6_rps_boost(dev_priv);
-               if (file_priv)
-                       mod_delayed_work(dev_priv->wq,
-                                        &file_priv->mm.idle_work,
-                                        msecs_to_jiffies(100));
+               if (*timeout == 0)
+                       return -ETIME;
+
+               timeout_expire = jiffies + nsecs_to_jiffies_timeout(*timeout);
        }
 
-       if (!irq_test_in_progress && WARN_ON(!ring->irq_get(ring)))
-               return -ENODEV;
+       if (INTEL_INFO(dev_priv)->gen >= 6)
+               gen6_rps_boost(dev_priv, rps, req->emitted_jiffies);
 
        /* Record current time in case interrupted by signal, or wedged */
        trace_i915_gem_request_wait_begin(req);
        before = ktime_get_raw_ns();
+
+       /* Optimistic spin for the next jiffie before touching IRQs */
+       ret = __i915_spin_request(req, state);
+       if (ret == 0)
+               goto out;
+
+       if (!irq_test_in_progress && WARN_ON(!ring->irq_get(ring))) {
+               ret = -ENODEV;
+               goto out;
+       }
+
        for (;;) {
                struct timer_list timer;
 
-               prepare_to_wait(&ring->irq_queue, &wait,
-                               interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
+               prepare_to_wait(&ring->irq_queue, &wait, state);
 
                /* We need to check whether any gpu reset happened in between
                 * the caller grabbing the seqno and now ... */
@@ -1266,7 +1311,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
                        break;
                }
 
-               if (interruptible && signal_pending(current)) {
+               if (signal_pending_state(state, current)) {
                        ret = -ERESTARTSYS;
                        break;
                }
@@ -1292,14 +1337,15 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
                        destroy_timer_on_stack(&timer);
                }
        }
-       now = ktime_get_raw_ns();
-       trace_i915_gem_request_wait_end(req);
-
        if (!irq_test_in_progress)
                ring->irq_put(ring);
 
        finish_wait(&ring->irq_queue, &wait);
 
+out:
+       now = ktime_get_raw_ns();
+       trace_i915_gem_request_wait_end(req);
+
        if (timeout) {
                s64 tres = *timeout - (now - before);
 
@@ -1319,6 +1365,91 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
        return ret;
 }
 
+int i915_gem_request_add_to_client(struct drm_i915_gem_request *req,
+                                  struct drm_file *file)
+{
+       struct drm_i915_private *dev_private;
+       struct drm_i915_file_private *file_priv;
+
+       WARN_ON(!req || !file || req->file_priv);
+
+       if (!req || !file)
+               return -EINVAL;
+
+       if (req->file_priv)
+               return -EINVAL;
+
+       dev_private = req->ring->dev->dev_private;
+       file_priv = file->driver_priv;
+
+       spin_lock(&file_priv->mm.lock);
+       req->file_priv = file_priv;
+       list_add_tail(&req->client_list, &file_priv->mm.request_list);
+       spin_unlock(&file_priv->mm.lock);
+
+       req->pid = get_pid(task_pid(current));
+
+       return 0;
+}
+
+static inline void
+i915_gem_request_remove_from_client(struct drm_i915_gem_request *request)
+{
+       struct drm_i915_file_private *file_priv = request->file_priv;
+
+       if (!file_priv)
+               return;
+
+       spin_lock(&file_priv->mm.lock);
+       list_del(&request->client_list);
+       request->file_priv = NULL;
+       spin_unlock(&file_priv->mm.lock);
+
+       put_pid(request->pid);
+       request->pid = NULL;
+}
+
+static void i915_gem_request_retire(struct drm_i915_gem_request *request)
+{
+       trace_i915_gem_request_retire(request);
+
+       /* We know the GPU must have read the request to have
+        * sent us the seqno + interrupt, so use the position
+        * of tail of the request to update the last known position
+        * of the GPU head.
+        *
+        * Note this requires that we are always called in request
+        * completion order.
+        */
+       request->ringbuf->last_retired_head = request->postfix;
+
+       list_del_init(&request->list);
+       i915_gem_request_remove_from_client(request);
+
+       i915_gem_request_unreference(request);
+}
+
+static void
+__i915_gem_request_retire__upto(struct drm_i915_gem_request *req)
+{
+       struct intel_engine_cs *engine = req->ring;
+       struct drm_i915_gem_request *tmp;
+
+       lockdep_assert_held(&engine->dev->struct_mutex);
+
+       if (list_empty(&req->list))
+               return;
+
+       do {
+               tmp = list_first_entry(&engine->request_list,
+                                      typeof(*tmp), list);
+
+               i915_gem_request_retire(tmp);
+       } while (tmp != req);
+
+       WARN_ON(i915_verify_lists(engine->dev));
+}
+
 /**
  * Waits for a request to be signaled, and cleans up the
  * request and object lists appropriately for that event.
@@ -1329,7 +1460,6 @@ i915_wait_request(struct drm_i915_gem_request *req)
        struct drm_device *dev;
        struct drm_i915_private *dev_priv;
        bool interruptible;
-       unsigned reset_counter;
        int ret;
 
        BUG_ON(req == NULL);
@@ -1344,33 +1474,13 @@ i915_wait_request(struct drm_i915_gem_request *req)
        if (ret)
                return ret;
 
-       ret = i915_gem_check_olr(req);
+       ret = __i915_wait_request(req,
+                                 atomic_read(&dev_priv->gpu_error.reset_counter),
+                                 interruptible, NULL, NULL);
        if (ret)
                return ret;
 
-       reset_counter = atomic_read(&dev_priv->gpu_error.reset_counter);
-       i915_gem_request_reference(req);
-       ret = __i915_wait_request(req, reset_counter,
-                                 interruptible, NULL, NULL);
-       i915_gem_request_unreference(req);
-       return ret;
-}
-
-static int
-i915_gem_object_wait_rendering__tail(struct drm_i915_gem_object *obj)
-{
-       if (!obj->active)
-               return 0;
-
-       /* Manually manage the write flush as we may have not yet
-        * retired the buffer.
-        *
-        * Note that the last_write_req is always the earlier of
-        * the two (read/write) requests, so if we haved successfully waited,
-        * we know we have passed the last write.
-        */
-       i915_gem_request_assign(&obj->last_write_req, NULL);
-
+       __i915_gem_request_retire__upto(req);
        return 0;
 }
 
@@ -1378,22 +1488,56 @@ i915_gem_object_wait_rendering__tail(struct drm_i915_gem_object *obj)
  * Ensures that all rendering to the object has completed and the object is
  * safe to unbind from the GTT or access from the CPU.
  */
-static __must_check int
+int
 i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
                               bool readonly)
 {
-       struct drm_i915_gem_request *req;
-       int ret;
+       int ret, i;
 
-       req = readonly ? obj->last_write_req : obj->last_read_req;
-       if (!req)
+       if (!obj->active)
                return 0;
 
-       ret = i915_wait_request(req);
-       if (ret)
-               return ret;
+       if (readonly) {
+               if (obj->last_write_req != NULL) {
+                       ret = i915_wait_request(obj->last_write_req);
+                       if (ret)
+                               return ret;
+
+                       i = obj->last_write_req->ring->id;
+                       if (obj->last_read_req[i] == obj->last_write_req)
+                               i915_gem_object_retire__read(obj, i);
+                       else
+                               i915_gem_object_retire__write(obj);
+               }
+       } else {
+               for (i = 0; i < I915_NUM_RINGS; i++) {
+                       if (obj->last_read_req[i] == NULL)
+                               continue;
+
+                       ret = i915_wait_request(obj->last_read_req[i]);
+                       if (ret)
+                               return ret;
+
+                       i915_gem_object_retire__read(obj, i);
+               }
+               RQ_BUG_ON(obj->active);
+       }
+
+       return 0;
+}
+
+static void
+i915_gem_object_retire_request(struct drm_i915_gem_object *obj,
+                              struct drm_i915_gem_request *req)
+{
+       int ring = req->ring->id;
+
+       if (obj->last_read_req[ring] == req)
+               i915_gem_object_retire__read(obj, ring);
+       else if (obj->last_write_req == req)
+               i915_gem_object_retire__write(obj);
 
-       return i915_gem_object_wait_rendering__tail(obj);
+       __i915_gem_request_retire__upto(req);
 }
 
 /* A nonblocking variant of the above wait. This is a highly dangerous routine
@@ -1401,40 +1545,66 @@ i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
  */
 static __must_check int
 i915_gem_object_wait_rendering__nonblocking(struct drm_i915_gem_object *obj,
-                                           struct drm_i915_file_private *file_priv,
+                                           struct intel_rps_client *rps,
                                            bool readonly)
 {
-       struct drm_i915_gem_request *req;
        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
+       struct drm_i915_gem_request *requests[I915_NUM_RINGS];
        unsigned reset_counter;
-       int ret;
+       int ret, i, n = 0;
 
        BUG_ON(!mutex_is_locked(&dev->struct_mutex));
        BUG_ON(!dev_priv->mm.interruptible);
 
-       req = readonly ? obj->last_write_req : obj->last_read_req;
-       if (!req)
+       if (!obj->active)
                return 0;
 
        ret = i915_gem_check_wedge(&dev_priv->gpu_error, true);
        if (ret)
                return ret;
 
-       ret = i915_gem_check_olr(req);
-       if (ret)
-               return ret;
-
        reset_counter = atomic_read(&dev_priv->gpu_error.reset_counter);
-       i915_gem_request_reference(req);
+
+       if (readonly) {
+               struct drm_i915_gem_request *req;
+
+               req = obj->last_write_req;
+               if (req == NULL)
+                       return 0;
+
+               requests[n++] = i915_gem_request_reference(req);
+       } else {
+               for (i = 0; i < I915_NUM_RINGS; i++) {
+                       struct drm_i915_gem_request *req;
+
+                       req = obj->last_read_req[i];
+                       if (req == NULL)
+                               continue;
+
+                       requests[n++] = i915_gem_request_reference(req);
+               }
+       }
+
        mutex_unlock(&dev->struct_mutex);
-       ret = __i915_wait_request(req, reset_counter, true, NULL, file_priv);
+       for (i = 0; ret == 0 && i < n; i++)
+               ret = __i915_wait_request(requests[i], reset_counter, true,
+                                         NULL, rps);
        mutex_lock(&dev->struct_mutex);
-       i915_gem_request_unreference(req);
-       if (ret)
-               return ret;
 
-       return i915_gem_object_wait_rendering__tail(obj);
+       for (i = 0; i < n; i++) {
+               if (ret == 0)
+                       i915_gem_object_retire_request(obj, requests[i]);
+               i915_gem_request_unreference(requests[i]);
+       }
+
+       return ret;
+}
+
+static struct intel_rps_client *to_rps_client(struct drm_file *file)
+{
+       struct drm_i915_file_private *fpriv = file->driver_priv;
+       return &fpriv->rps;
 }
 
 /**
@@ -1479,7 +1649,7 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
         * to catch cases where we are gazumped.
         */
        ret = i915_gem_object_wait_rendering__nonblocking(obj,
-                                                         file->driver_priv,
+                                                         to_rps_client(file),
                                                          !write_domain);
        if (ret)
                goto unref;
@@ -1489,6 +1659,11 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
        else
                ret = i915_gem_object_set_to_cpu_domain(obj, write_domain != 0);
 
+       if (write_domain != 0)
+               intel_fb_obj_invalidate(obj,
+                                       write_domain == I915_GEM_DOMAIN_GTT ?
+                                       ORIGIN_GTT : ORIGIN_CPU);
+
 unref:
        drm_gem_object_unreference(&obj->base);
 unlock:
@@ -1597,8 +1772,8 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 
 /**
  * i915_gem_fault - fault a page into the GTT
- * vma: VMA in question
- * vmf: fault info
+ * @vma: VMA in question
+ * @vmf: fault info
  *
  * The fault handler is set up by drm_gem_mmap() when a object is GTT mapped
  * from userspace.  The fault handler takes care of binding the object to
@@ -1616,6 +1791,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        struct drm_i915_gem_object *obj = to_intel_bo(vma->vm_private_data);
        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
+       struct i915_ggtt_view view = i915_ggtt_view_normal;
        pgoff_t page_offset;
        unsigned long pfn;
        int ret = 0;
@@ -1648,8 +1824,23 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                goto unlock;
        }
 
-       /* Now bind it into the GTT if needed */
-       ret = i915_gem_obj_ggtt_pin(obj, 0, PIN_MAPPABLE);
+       /* Use a partial view if the object is bigger than the aperture. */
+       if (obj->base.size >= dev_priv->gtt.mappable_end &&
+           obj->tiling_mode == I915_TILING_NONE) {
+               static const unsigned int chunk_size = 256; // 1 MiB
+
+               memset(&view, 0, sizeof(view));
+               view.type = I915_GGTT_VIEW_PARTIAL;
+               view.params.partial.offset = rounddown(page_offset, chunk_size);
+               view.params.partial.size =
+                       min_t(unsigned int,
+                             chunk_size,
+                             (vma->vm_end - vma->vm_start)/PAGE_SIZE -
+                             view.params.partial.offset);
+       }
+
+       /* Now pin it into the GTT if needed */
+       ret = i915_gem_object_ggtt_pin(obj, &view, 0, PIN_MAPPABLE);
        if (ret)
                goto unlock;
 
@@ -1662,30 +1853,50 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                goto unpin;
 
        /* Finally, remap it using the new GTT offset */
-       pfn = dev_priv->gtt.mappable_base + i915_gem_obj_ggtt_offset(obj);
+       pfn = dev_priv->gtt.mappable_base +
+               i915_gem_obj_ggtt_offset_view(obj, &view);
        pfn >>= PAGE_SHIFT;
 
-       if (!obj->fault_mappable) {
-               unsigned long size = min_t(unsigned long,
-                                          vma->vm_end - vma->vm_start,
-                                          obj->base.size);
-               int i;
+       if (unlikely(view.type == I915_GGTT_VIEW_PARTIAL)) {
+               /* Overriding existing pages in partial view does not cause
+                * us any trouble as TLBs are still valid because the fault
+                * is due to userspace losing part of the mapping or never
+                * having accessed it before (at this partials' range).
+                */
+               unsigned long base = vma->vm_start +
+                                    (view.params.partial.offset << PAGE_SHIFT);
+               unsigned int i;
 
-               for (i = 0; i < size >> PAGE_SHIFT; i++) {
-                       ret = vm_insert_pfn(vma,
-                                           (unsigned long)vma->vm_start + i * PAGE_SIZE,
-                                           pfn + i);
+               for (i = 0; i < view.params.partial.size; i++) {
+                       ret = vm_insert_pfn(vma, base + i * PAGE_SIZE, pfn + i);
                        if (ret)
                                break;
                }
 
                obj->fault_mappable = true;
-       } else
-               ret = vm_insert_pfn(vma,
-                                   (unsigned long)vmf->virtual_address,
-                                   pfn + page_offset);
+       } else {
+               if (!obj->fault_mappable) {
+                       unsigned long size = min_t(unsigned long,
+                                                  vma->vm_end - vma->vm_start,
+                                                  obj->base.size);
+                       int i;
+
+                       for (i = 0; i < size >> PAGE_SHIFT; i++) {
+                               ret = vm_insert_pfn(vma,
+                                                   (unsigned long)vma->vm_start + i * PAGE_SIZE,
+                                                   pfn + i);
+                               if (ret)
+                                       break;
+                       }
+
+                       obj->fault_mappable = true;
+               } else
+                       ret = vm_insert_pfn(vma,
+                                           (unsigned long)vmf->virtual_address,
+                                           pfn + page_offset);
+       }
 unpin:
-       i915_gem_object_ggtt_unpin(obj);
+       i915_gem_object_ggtt_unpin_view(obj, &view);
 unlock:
        mutex_unlock(&dev->struct_mutex);
 out:
@@ -1864,7 +2075,6 @@ i915_gem_mmap_gtt(struct drm_file *file,
                  uint32_t handle,
                  uint64_t *offset)
 {
-       struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj;
        int ret;
 
@@ -1878,11 +2088,6 @@ i915_gem_mmap_gtt(struct drm_file *file,
                goto unlock;
        }
 
-       if (obj->base.size > dev_priv->gtt.mappable_end) {
-               ret = -E2BIG;
-               goto out;
-       }
-
        if (obj->madv != I915_MADV_WILLNEED) {
                DRM_DEBUG("Attempting to mmap a purgeable buffer\n");
                ret = -EFAULT;
@@ -1982,6 +2187,8 @@ i915_gem_object_put_pages_gtt(struct drm_i915_gem_object *obj)
                obj->base.read_domains = obj->base.write_domain = I915_GEM_DOMAIN_CPU;
        }
 
+       i915_gem_gtt_finish_object(obj);
+
        if (i915_gem_object_needs_bit17_swizzle(obj))
                i915_gem_object_save_bit_17_swizzle(obj);
 
@@ -2042,6 +2249,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
        struct sg_page_iter sg_iter;
        struct page *page;
        unsigned long last_pfn = 0;     /* suppress gcc warning */
+       int ret;
        gfp_t gfp;
 
        /* Assert that the object is not currently in any GPU domain. As it
@@ -2067,9 +2275,8 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
         * Fail silently without starting the shrinker
         */
        mapping = file_inode(obj->base.filp)->i_mapping;
-       gfp = mapping_gfp_mask(mapping);
-       gfp |= __GFP_NORETRY | __GFP_NOWARN | __GFP_NO_KSWAPD;
-       gfp &= ~(__GFP_IO | __GFP_WAIT);
+       gfp = mapping_gfp_constraint(mapping, ~(__GFP_IO | __GFP_RECLAIM));
+       gfp |= __GFP_NORETRY | __GFP_NOWARN;
        sg = st->sgl;
        st->nents = 0;
        for (i = 0; i < page_count; i++) {
@@ -2089,8 +2296,10 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                         */
                        i915_gem_shrink_all(dev_priv);
                        page = shmem_read_mapping_page(mapping, i);
-                       if (IS_ERR(page))
+                       if (IS_ERR(page)) {
+                               ret = PTR_ERR(page);
                                goto err_pages;
+                       }
                }
 #ifdef CONFIG_SWIOTLB
                if (swiotlb_nr_tbl()) {
@@ -2119,6 +2328,10 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                sg_mark_end(sg);
        obj->pages = st;
 
+       ret = i915_gem_gtt_prepare_object(obj);
+       if (ret)
+               goto err_pages;
+
        if (i915_gem_object_needs_bit17_swizzle(obj))
                i915_gem_object_do_bit_17_swizzle(obj);
 
@@ -2143,10 +2356,10 @@ err_pages:
         * space and so want to translate the error from shmemfs back to our
         * usual understanding of ENOMEM.
         */
-       if (PTR_ERR(page) == -ENOSPC)
-               return -ENOMEM;
-       else
-               return PTR_ERR(page);
+       if (ret == -ENOSPC)
+               ret = -ENOMEM;
+
+       return ret;
 }
 
 /* Ensure that the associated pages are gathered from the backing storage
@@ -2178,81 +2391,74 @@ i915_gem_object_get_pages(struct drm_i915_gem_object *obj)
                return ret;
 
        list_add_tail(&obj->global_list, &dev_priv->mm.unbound_list);
+
+       obj->get_page.sg = obj->pages->sgl;
+       obj->get_page.last = 0;
+
        return 0;
 }
 
-static void
-i915_gem_object_move_to_active(struct drm_i915_gem_object *obj,
-                              struct intel_engine_cs *ring)
+void i915_vma_move_to_active(struct i915_vma *vma,
+                            struct drm_i915_gem_request *req)
 {
-       struct drm_i915_gem_request *req;
-       struct intel_engine_cs *old_ring;
-
-       BUG_ON(ring == NULL);
-
-       req = intel_ring_get_request(ring);
-       old_ring = i915_gem_request_get_ring(obj->last_read_req);
+       struct drm_i915_gem_object *obj = vma->obj;
+       struct intel_engine_cs *ring;
 
-       if (old_ring != ring && obj->last_write_req) {
-               /* Keep the request relative to the current ring */
-               i915_gem_request_assign(&obj->last_write_req, req);
-       }
+       ring = i915_gem_request_get_ring(req);
 
        /* Add a reference if we're newly entering the active list. */
-       if (!obj->active) {
+       if (obj->active == 0)
                drm_gem_object_reference(&obj->base);
-               obj->active = 1;
-       }
+       obj->active |= intel_ring_flag(ring);
 
-       list_move_tail(&obj->ring_list, &ring->active_list);
+       list_move_tail(&obj->ring_list[ring->id], &ring->active_list);
+       i915_gem_request_assign(&obj->last_read_req[ring->id], req);
 
-       i915_gem_request_assign(&obj->last_read_req, req);
+       list_move_tail(&vma->mm_list, &vma->vm->active_list);
 }
 
-void i915_vma_move_to_active(struct i915_vma *vma,
-                            struct intel_engine_cs *ring)
+static void
+i915_gem_object_retire__write(struct drm_i915_gem_object *obj)
 {
-       list_move_tail(&vma->mm_list, &vma->vm->active_list);
-       return i915_gem_object_move_to_active(vma->obj, ring);
+       RQ_BUG_ON(obj->last_write_req == NULL);
+       RQ_BUG_ON(!(obj->active & intel_ring_flag(obj->last_write_req->ring)));
+
+       i915_gem_request_assign(&obj->last_write_req, NULL);
+       intel_fb_obj_flush(obj, true, ORIGIN_CS);
 }
 
 static void
-i915_gem_object_move_to_inactive(struct drm_i915_gem_object *obj)
+i915_gem_object_retire__read(struct drm_i915_gem_object *obj, int ring)
 {
        struct i915_vma *vma;
 
-       BUG_ON(obj->base.write_domain & ~I915_GEM_GPU_DOMAINS);
-       BUG_ON(!obj->active);
+       RQ_BUG_ON(obj->last_read_req[ring] == NULL);
+       RQ_BUG_ON(!(obj->active & (1 << ring)));
+
+       list_del_init(&obj->ring_list[ring]);
+       i915_gem_request_assign(&obj->last_read_req[ring], NULL);
+
+       if (obj->last_write_req && obj->last_write_req->ring->id == ring)
+               i915_gem_object_retire__write(obj);
+
+       obj->active &= ~(1 << ring);
+       if (obj->active)
+               return;
+
+       /* Bump our place on the bound list to keep it roughly in LRU order
+        * so that we don't steal from recently used but inactive objects
+        * (unless we are forced to ofc!)
+        */
+       list_move_tail(&obj->global_list,
+                      &to_i915(obj->base.dev)->mm.bound_list);
 
        list_for_each_entry(vma, &obj->vma_list, vma_link) {
                if (!list_empty(&vma->mm_list))
                        list_move_tail(&vma->mm_list, &vma->vm->inactive_list);
        }
 
-       intel_fb_obj_flush(obj, true);
-
-       list_del_init(&obj->ring_list);
-
-       i915_gem_request_assign(&obj->last_read_req, NULL);
-       i915_gem_request_assign(&obj->last_write_req, NULL);
-       obj->base.write_domain = 0;
-
        i915_gem_request_assign(&obj->last_fenced_req, NULL);
-
-       obj->active = 0;
        drm_gem_object_unreference(&obj->base);
-
-       WARN_ON(i915_verify_lists(dev));
-}
-
-static void
-i915_gem_object_retire(struct drm_i915_gem_object *obj)
-{
-       if (obj->last_read_req == NULL)
-               return;
-
-       if (i915_gem_request_completed(obj->last_read_req, true))
-               i915_gem_object_move_to_inactive(obj);
 }
 
 static int
@@ -2325,24 +2531,34 @@ i915_gem_get_seqno(struct drm_device *dev, u32 *seqno)
        return 0;
 }
 
-int __i915_add_request(struct intel_engine_cs *ring,
-                      struct drm_file *file,
-                      struct drm_i915_gem_object *obj)
+/*
+ * NB: This function is not allowed to fail. Doing so would mean the the
+ * request is not being tracked for completion but the work itself is
+ * going to happen on the hardware. This would be a Bad Thing(tm).
+ */
+void __i915_add_request(struct drm_i915_gem_request *request,
+                       struct drm_i915_gem_object *obj,
+                       bool flush_caches)
 {
-       struct drm_i915_private *dev_priv = ring->dev->dev_private;
-       struct drm_i915_gem_request *request;
+       struct intel_engine_cs *ring;
+       struct drm_i915_private *dev_priv;
        struct intel_ringbuffer *ringbuf;
        u32 request_start;
        int ret;
 
-       request = ring->outstanding_lazy_request;
        if (WARN_ON(request == NULL))
-               return -ENOMEM;
+               return;
 
-       if (i915.enable_execlists) {
-               ringbuf = request->ctx->engine[ring->id].ringbuf;
-       } else
-               ringbuf = ring->buffer;
+       ring = request->ring;
+       dev_priv = ring->dev->dev_private;
+       ringbuf = request->ringbuf;
+
+       /*
+        * To ensure that this call will not fail, space for its emissions
+        * should already have been reserved in the ring buffer. Let the ring
+        * know that it is time to use that space up.
+        */
+       intel_ring_reserved_space_use(ringbuf);
 
        request_start = intel_ring_get_tail(ringbuf);
        /*
@@ -2352,14 +2568,13 @@ int __i915_add_request(struct intel_engine_cs *ring,
         * is that the flush _must_ happen before the next request, no matter
         * what.
         */
-       if (i915.enable_execlists) {
-               ret = logical_ring_flush_all_caches(ringbuf, request->ctx);
-               if (ret)
-                       return ret;
-       } else {
-               ret = intel_ring_flush_all_caches(ring);
-               if (ret)
-                       return ret;
+       if (flush_caches) {
+               if (i915.enable_execlists)
+                       ret = logical_ring_flush_all_caches(request);
+               else
+                       ret = intel_ring_flush_all_caches(request);
+               /* Not allowed to fail! */
+               WARN(ret, "*_ring_flush_all_caches failed: %d!\n", ret);
        }
 
        /* Record the position of the start of the request so that
@@ -2369,17 +2584,15 @@ int __i915_add_request(struct intel_engine_cs *ring,
         */
        request->postfix = intel_ring_get_tail(ringbuf);
 
-       if (i915.enable_execlists) {
-               ret = ring->emit_request(ringbuf, request);
-               if (ret)
-                       return ret;
-       } else {
-               ret = ring->add_request(ring);
-               if (ret)
-                       return ret;
+       if (i915.enable_execlists)
+               ret = ring->emit_request(request);
+       else {
+               ret = ring->add_request(request);
 
                request->tail = intel_ring_get_tail(ringbuf);
        }
+       /* Not allowed to fail! */
+       WARN(ret, "emit|add_request failed: %d!\n", ret);
 
        request->head = request_start;
 
@@ -2391,58 +2604,22 @@ int __i915_add_request(struct intel_engine_cs *ring,
         */
        request->batch_obj = obj;
 
-       if (!i915.enable_execlists) {
-               /* Hold a reference to the current context so that we can inspect
-                * it later in case a hangcheck error event fires.
-                */
-               request->ctx = ring->last_context;
-               if (request->ctx)
-                       i915_gem_context_reference(request->ctx);
-       }
-
        request->emitted_jiffies = jiffies;
+       request->previous_seqno = ring->last_submitted_seqno;
        ring->last_submitted_seqno = request->seqno;
        list_add_tail(&request->list, &ring->request_list);
-       request->file_priv = NULL;
-
-       if (file) {
-               struct drm_i915_file_private *file_priv = file->driver_priv;
-
-               spin_lock(&file_priv->mm.lock);
-               request->file_priv = file_priv;
-               list_add_tail(&request->client_list,
-                             &file_priv->mm.request_list);
-               spin_unlock(&file_priv->mm.lock);
-
-               request->pid = get_pid(task_pid(current));
-       }
 
        trace_i915_gem_request_add(request);
-       ring->outstanding_lazy_request = NULL;
 
        i915_queue_hangcheck(ring->dev);
 
-       cancel_delayed_work_sync(&dev_priv->mm.idle_work);
        queue_delayed_work(dev_priv->wq,
                           &dev_priv->mm.retire_work,
                           round_jiffies_up_relative(HZ));
        intel_mark_busy(dev_priv->dev);
 
-       return 0;
-}
-
-static inline void
-i915_gem_request_remove_from_client(struct drm_i915_gem_request *request)
-{
-       struct drm_i915_file_private *file_priv = request->file_priv;
-
-       if (!file_priv)
-               return;
-
-       spin_lock(&file_priv->mm.lock);
-       list_del(&request->client_list);
-       request->file_priv = NULL;
-       spin_unlock(&file_priv->mm.lock);
+       /* Sanity check that the reserved size was large enough. */
+       intel_ring_reserved_space_end(ringbuf);
 }
 
 static bool i915_context_is_banned(struct drm_i915_private *dev_priv,
@@ -2490,34 +2667,97 @@ static void i915_set_reset_status(struct drm_i915_private *dev_priv,
        }
 }
 
-static void i915_gem_free_request(struct drm_i915_gem_request *request)
-{
-       list_del(&request->list);
-       i915_gem_request_remove_from_client(request);
-
-       put_pid(request->pid);
-
-       i915_gem_request_unreference(request);
-}
-
 void i915_gem_request_free(struct kref *req_ref)
 {
        struct drm_i915_gem_request *req = container_of(req_ref,
                                                 typeof(*req), ref);
        struct intel_context *ctx = req->ctx;
 
+       if (req->file_priv)
+               i915_gem_request_remove_from_client(req);
+
        if (ctx) {
                if (i915.enable_execlists) {
-                       struct intel_engine_cs *ring = req->ring;
-
-                       if (ctx != ring->default_context)
-                               intel_lr_context_unpin(ring, ctx);
+                       if (ctx != req->ring->default_context)
+                               intel_lr_context_unpin(req);
                }
 
                i915_gem_context_unreference(ctx);
        }
 
-       kfree(req);
+       kmem_cache_free(req->i915->requests, req);
+}
+
+int i915_gem_request_alloc(struct intel_engine_cs *ring,
+                          struct intel_context *ctx,
+                          struct drm_i915_gem_request **req_out)
+{
+       struct drm_i915_private *dev_priv = to_i915(ring->dev);
+       struct drm_i915_gem_request *req;
+       int ret;
+
+       if (!req_out)
+               return -EINVAL;
+
+       *req_out = NULL;
+
+       req = kmem_cache_zalloc(dev_priv->requests, GFP_KERNEL);
+       if (req == NULL)
+               return -ENOMEM;
+
+       ret = i915_gem_get_seqno(ring->dev, &req->seqno);
+       if (ret)
+               goto err;
+
+       kref_init(&req->ref);
+       req->i915 = dev_priv;
+       req->ring = ring;
+       req->ctx  = ctx;
+       i915_gem_context_reference(req->ctx);
+
+       if (i915.enable_execlists)
+               ret = intel_logical_ring_alloc_request_extras(req);
+       else
+               ret = intel_ring_alloc_request_extras(req);
+       if (ret) {
+               i915_gem_context_unreference(req->ctx);
+               goto err;
+       }
+
+       /*
+        * Reserve space in the ring buffer for all the commands required to
+        * eventually emit this request. This is to guarantee that the
+        * i915_add_request() call can't fail. Note that the reserve may need
+        * to be redone if the request is not actually submitted straight
+        * away, e.g. because a GPU scheduler has deferred it.
+        */
+       if (i915.enable_execlists)
+               ret = intel_logical_ring_reserve_space(req);
+       else
+               ret = intel_ring_reserve_space(req);
+       if (ret) {
+               /*
+                * At this point, the request is fully allocated even if not
+                * fully prepared. Thus it can be cleaned up using the proper
+                * free code.
+                */
+               i915_gem_request_cancel(req);
+               return ret;
+       }
+
+       *req_out = req;
+       return 0;
+
+err:
+       kmem_cache_free(dev_priv->requests, req);
+       return ret;
+}
+
+void i915_gem_request_cancel(struct drm_i915_gem_request *req)
+{
+       intel_ring_reserved_space_cancel(req->ringbuf);
+
+       i915_gem_request_unreference(req);
 }
 
 struct drm_i915_gem_request *
@@ -2562,9 +2802,9 @@ static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
 
                obj = list_first_entry(&ring->active_list,
                                       struct drm_i915_gem_object,
-                                      ring_list);
+                                      ring_list[ring->id]);
 
-               i915_gem_object_move_to_inactive(obj);
+               i915_gem_object_retire__read(obj, ring->id);
        }
 
        /*
@@ -2579,10 +2819,9 @@ static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
                                struct drm_i915_gem_request,
                                execlist_link);
                list_del(&submit_req->execlist_link);
-               intel_runtime_pm_put(dev_priv);
 
                if (submit_req->ctx != ring->default_context)
-                       intel_lr_context_unpin(ring, submit_req->ctx);
+                       intel_lr_context_unpin(submit_req);
 
                i915_gem_request_unreference(submit_req);
        }
@@ -2601,31 +2840,7 @@ static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
                                           struct drm_i915_gem_request,
                                           list);
 
-               i915_gem_free_request(request);
-       }
-
-       /* This may not have been flushed before the reset, so clean it now */
-       i915_gem_request_assign(&ring->outstanding_lazy_request, NULL);
-}
-
-void i915_gem_restore_fences(struct drm_device *dev)
-{
-       struct drm_i915_private *dev_priv = dev->dev_private;
-       int i;
-
-       for (i = 0; i < dev_priv->num_fence_regs; i++) {
-               struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
-
-               /*
-                * Commit delayed tiling changes if we have an object still
-                * attached to the fence, otherwise just clear the fence.
-                */
-               if (reg->obj) {
-                       i915_gem_object_update_fence(reg->obj, reg,
-                                                    reg->obj->tiling_mode);
-               } else {
-                       i915_gem_write_fence(dev, i, NULL);
-               }
+               i915_gem_request_retire(request);
        }
 }
 
@@ -2649,6 +2864,8 @@ void i915_gem_reset(struct drm_device *dev)
        i915_gem_context_reset(dev);
 
        i915_gem_restore_fences(dev);
+
+       WARN_ON(i915_verify_lists(dev));
 }
 
 /**
@@ -2657,9 +2874,6 @@ void i915_gem_reset(struct drm_device *dev)
 void
 i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
 {
-       if (list_empty(&ring->request_list))
-               return;
-
        WARN_ON(i915_verify_lists(ring->dev));
 
        /* Retire requests first as we use it above for the early return.
@@ -2677,16 +2891,7 @@ i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
                if (!i915_gem_request_completed(request, true))
                        break;
 
-               trace_i915_gem_request_retire(request);
-
-               /* We know the GPU must have read the request to have
-                * sent us the seqno + interrupt, so use the position
-                * of tail of the request to update the last known position
-                * of the GPU head.
-                */
-               request->ringbuf->last_retired_head = request->postfix;
-
-               i915_gem_free_request(request);
+               i915_gem_request_retire(request);
        }
 
        /* Move any buffers on the active list that are no longer referenced
@@ -2698,12 +2903,12 @@ i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
 
                obj = list_first_entry(&ring->active_list,
                                      struct drm_i915_gem_object,
-                                     ring_list);
+                                     ring_list[ring->id]);
 
-               if (!i915_gem_request_completed(obj->last_read_req, true))
+               if (!list_empty(&obj->last_read_req[ring->id]->list))
                        break;
 
-               i915_gem_object_move_to_inactive(obj);
+               i915_gem_object_retire__read(obj, ring->id);
        }
 
        if (unlikely(ring->trace_irq_req &&
@@ -2769,8 +2974,25 @@ i915_gem_idle_work_handler(struct work_struct *work)
 {
        struct drm_i915_private *dev_priv =
                container_of(work, typeof(*dev_priv), mm.idle_work.work);
+       struct drm_device *dev = dev_priv->dev;
+       struct intel_engine_cs *ring;
+       int i;
+
+       for_each_ring(ring, dev_priv, i)
+               if (!list_empty(&ring->request_list))
+                       return;
+
+       intel_mark_idle(dev);
 
-       intel_mark_idle(dev_priv->dev);
+       if (mutex_trylock(&dev->struct_mutex)) {
+               struct intel_engine_cs *ring;
+               int i;
+
+               for_each_ring(ring, dev_priv, i)
+                       i915_gem_batch_pool_fini(&ring->batch_pool);
+
+               mutex_unlock(&dev->struct_mutex);
+       }
 }
 
 /**
@@ -2781,17 +3003,26 @@ i915_gem_idle_work_handler(struct work_struct *work)
 static int
 i915_gem_object_flush_active(struct drm_i915_gem_object *obj)
 {
-       struct intel_engine_cs *ring;
-       int ret;
+       int i;
+
+       if (!obj->active)
+               return 0;
 
-       if (obj->active) {
-               ring = i915_gem_request_get_ring(obj->last_read_req);
+       for (i = 0; i < I915_NUM_RINGS; i++) {
+               struct drm_i915_gem_request *req;
 
-               ret = i915_gem_check_olr(obj->last_read_req);
-               if (ret)
-                       return ret;
+               req = obj->last_read_req[i];
+               if (req == NULL)
+                       continue;
 
-               i915_gem_retire_requests_ring(ring);
+               if (list_empty(&req->list))
+                       goto retire;
+
+               if (i915_gem_request_completed(req, true)) {
+                       __i915_gem_request_retire__upto(req);
+retire:
+                       i915_gem_object_retire__read(obj, i);
+               }
        }
 
        return 0;
@@ -2825,9 +3056,10 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_wait *args = data;
        struct drm_i915_gem_object *obj;
-       struct drm_i915_gem_request *req;
+       struct drm_i915_gem_request *req[I915_NUM_RINGS];
        unsigned reset_counter;
-       int ret = 0;
+       int i, n = 0;
+       int ret;
 
        if (args->flags != 0)
                return -EINVAL;
@@ -2847,11 +3079,9 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        if (ret)
                goto out;
 
-       if (!obj->active || !obj->last_read_req)
+       if (!obj->active)
                goto out;
 
-       req = obj->last_read_req;
-
        /* Do this after OLR check to make sure we make forward progress polling
         * on this IOCTL with a timeout == 0 (like busy ioctl)
         */
@@ -2862,15 +3092,23 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
 
        drm_gem_object_unreference(&obj->base);
        reset_counter = atomic_read(&dev_priv->gpu_error.reset_counter);
-       i915_gem_request_reference(req);
-       mutex_unlock(&dev->struct_mutex);
 
-       ret = __i915_wait_request(req, reset_counter, true,
-                                 args->timeout_ns > 0 ? &args->timeout_ns : NULL,
-                                 file->driver_priv);
-       mutex_lock(&dev->struct_mutex);
-       i915_gem_request_unreference(req);
+       for (i = 0; i < I915_NUM_RINGS; i++) {
+               if (obj->last_read_req[i] == NULL)
+                       continue;
+
+               req[n++] = i915_gem_request_reference(obj->last_read_req[i]);
+       }
+
        mutex_unlock(&dev->struct_mutex);
+
+       for (i = 0; i < n; i++) {
+               if (ret == 0)
+                       ret = __i915_wait_request(req[i], reset_counter, true,
+                                                 args->timeout_ns > 0 ? &args->timeout_ns : NULL,
+                                                 file->driver_priv);
+               i915_gem_request_unreference__unlocked(req[i]);
+       }
        return ret;
 
 out:
@@ -2879,57 +3117,130 @@ out:
        return ret;
 }
 
+static int
+__i915_gem_object_sync(struct drm_i915_gem_object *obj,
+                      struct intel_engine_cs *to,
+                      struct drm_i915_gem_request *from_req,
+                      struct drm_i915_gem_request **to_req)
+{
+       struct intel_engine_cs *from;
+       int ret;
+
+       from = i915_gem_request_get_ring(from_req);
+       if (to == from)
+               return 0;
+
+       if (i915_gem_request_completed(from_req, true))
+               return 0;
+
+       if (!i915_semaphore_is_enabled(obj->base.dev)) {
+               struct drm_i915_private *i915 = to_i915(obj->base.dev);
+               ret = __i915_wait_request(from_req,
+                                         atomic_read(&i915->gpu_error.reset_counter),
+                                         i915->mm.interruptible,
+                                         NULL,
+                                         &i915->rps.semaphores);
+               if (ret)
+                       return ret;
+
+               i915_gem_object_retire_request(obj, from_req);
+       } else {
+               int idx = intel_ring_sync_index(from, to);
+               u32 seqno = i915_gem_request_get_seqno(from_req);
+
+               WARN_ON(!to_req);
+
+               if (seqno <= from->semaphore.sync_seqno[idx])
+                       return 0;
+
+               if (*to_req == NULL) {
+                       ret = i915_gem_request_alloc(to, to->default_context, to_req);
+                       if (ret)
+                               return ret;
+               }
+
+               trace_i915_gem_ring_sync_to(*to_req, from, from_req);
+               ret = to->semaphore.sync_to(*to_req, from, seqno);
+               if (ret)
+                       return ret;
+
+               /* We use last_read_req because sync_to()
+                * might have just caused seqno wrap under
+                * the radar.
+                */
+               from->semaphore.sync_seqno[idx] =
+                       i915_gem_request_get_seqno(obj->last_read_req[from->id]);
+       }
+
+       return 0;
+}
+
 /**
  * i915_gem_object_sync - sync an object to a ring.
  *
  * @obj: object which may be in use on another ring.
  * @to: ring we wish to use the object on. May be NULL.
+ * @to_req: request we wish to use the object for. See below.
+ *          This will be allocated and returned if a request is
+ *          required but not passed in.
  *
  * This code is meant to abstract object synchronization with the GPU.
  * Calling with NULL implies synchronizing the object with the CPU
- * rather than a particular GPU ring.
+ * rather than a particular GPU ring. Conceptually we serialise writes
+ * between engines inside the GPU. We only allow one engine to write
+ * into a buffer at any time, but multiple readers. To ensure each has
+ * a coherent view of memory, we must:
+ *
+ * - If there is an outstanding write request to the object, the new
+ *   request must wait for it to complete (either CPU or in hw, requests
+ *   on the same ring will be naturally ordered).
+ *
+ * - If we are a write request (pending_write_domain is set), the new
+ *   request must wait for outstanding read requests to complete.
+ *
+ * For CPU synchronisation (NULL to) no request is required. For syncing with
+ * rings to_req must be non-NULL. However, a request does not have to be
+ * pre-allocated. If *to_req is NULL and sync commands will be emitted then a
+ * request will be allocated automatically and returned through *to_req. Note
+ * that it is not guaranteed that commands will be emitted (because the system
+ * might already be idle). Hence there is no need to create a request that
+ * might never have any work submitted. Note further that if a request is
+ * returned in *to_req, it is the responsibility of the caller to submit
+ * that request (after potentially adding more work to it).
  *
  * Returns 0 if successful, else propagates up the lower layer error.
  */
 int
 i915_gem_object_sync(struct drm_i915_gem_object *obj,
-                    struct intel_engine_cs *to)
+                    struct intel_engine_cs *to,
+                    struct drm_i915_gem_request **to_req)
 {
-       struct intel_engine_cs *from;
-       u32 seqno;
-       int ret, idx;
-
-       from = i915_gem_request_get_ring(obj->last_read_req);
-
-       if (from == NULL || to == from)
-               return 0;
+       const bool readonly = obj->base.pending_write_domain == 0;
+       struct drm_i915_gem_request *req[I915_NUM_RINGS];
+       int ret, i, n;
 
-       if (to == NULL || !i915_semaphore_is_enabled(obj->base.dev))
-               return i915_gem_object_wait_rendering(obj, false);
-
-       idx = intel_ring_sync_index(from, to);
-
-       seqno = i915_gem_request_get_seqno(obj->last_read_req);
-       /* Optimization: Avoid semaphore sync when we are sure we already
-        * waited for an object with higher seqno */
-       if (seqno <= from->semaphore.sync_seqno[idx])
+       if (!obj->active)
                return 0;
 
-       ret = i915_gem_check_olr(obj->last_read_req);
-       if (ret)
-               return ret;
+       if (to == NULL)
+               return i915_gem_object_wait_rendering(obj, readonly);
 
-       trace_i915_gem_ring_sync_to(from, to, obj->last_read_req);
-       ret = to->semaphore.sync_to(to, from, seqno);
-       if (!ret)
-               /* We use last_read_req because sync_to()
-                * might have just caused seqno wrap under
-                * the radar.
-                */
-               from->semaphore.sync_seqno[idx] =
-                               i915_gem_request_get_seqno(obj->last_read_req);
+       n = 0;
+       if (readonly) {
+               if (obj->last_write_req)
+                       req[n++] = obj->last_write_req;
+       } else {
+               for (i = 0; i < I915_NUM_RINGS; i++)
+                       if (obj->last_read_req[i])
+                               req[n++] = obj->last_read_req[i];
+       }
+       for (i = 0; i < n; i++) {
+               ret = __i915_gem_object_sync(obj, to, req[i], to_req);
+               if (ret)
+                       return ret;
+       }
 
-       return ret;
+       return 0;
 }
 
 static void i915_gem_object_finish_gtt(struct drm_i915_gem_object *obj)
@@ -2956,7 +3267,7 @@ static void i915_gem_object_finish_gtt(struct drm_i915_gem_object *obj)
                                            old_write_domain);
 }
 
-int i915_vma_unbind(struct i915_vma *vma)
+static int __i915_vma_unbind(struct i915_vma *vma, bool wait)
 {
        struct drm_i915_gem_object *obj = vma->obj;
        struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
@@ -2975,13 +3286,11 @@ int i915_vma_unbind(struct i915_vma *vma)
 
        BUG_ON(obj->pages == NULL);
 
-       ret = i915_gem_object_finish_gpu(obj);
-       if (ret)
-               return ret;
-       /* Continue on if we fail due to EIO, the GPU is hung so we
-        * should be safe and we need to cleanup or else we might
-        * cause memory corruption through use-after-free.
-        */
+       if (wait) {
+               ret = i915_gem_object_wait_rendering(obj, false);
+               if (ret)
+                       return ret;
+       }
 
        if (i915_is_ggtt(vma->vm) &&
            vma->ggtt_view.type == I915_GGTT_VIEW_NORMAL) {
@@ -2995,7 +3304,8 @@ int i915_vma_unbind(struct i915_vma *vma)
 
        trace_i915_vma_unbind(vma);
 
-       vma->unbind_vma(vma);
+       vma->vm->unbind_vma(vma);
+       vma->bound = 0;
 
        list_del_init(&vma->mm_list);
        if (i915_is_ggtt(vma->vm)) {
@@ -3013,14 +3323,8 @@ int i915_vma_unbind(struct i915_vma *vma)
 
        /* Since the unbound list is global, only move to that list if
         * no more VMAs exist. */
-       if (list_empty(&obj->vma_list)) {
-               /* Throw away the active reference before
-                * moving to the unbound list. */
-               i915_gem_object_retire(obj);
-
-               i915_gem_gtt_finish_object(obj);
+       if (list_empty(&obj->vma_list))
                list_move_tail(&obj->global_list, &dev_priv->mm.unbound_list);
-       }
 
        /* And finally now the object is completely decoupled from this vma,
         * we can drop its hold on the backing storage and allow it to be
@@ -3031,6 +3335,16 @@ int i915_vma_unbind(struct i915_vma *vma)
        return 0;
 }
 
+int i915_vma_unbind(struct i915_vma *vma)
+{
+       return __i915_vma_unbind(vma, true);
+}
+
+int __i915_vma_unbind_no_wait(struct i915_vma *vma)
+{
+       return __i915_vma_unbind(vma, false);
+}
+
 int i915_gpu_idle(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -3040,353 +3354,27 @@ int i915_gpu_idle(struct drm_device *dev)
        /* Flush everything onto the inactive list. */
        for_each_ring(ring, dev_priv, i) {
                if (!i915.enable_execlists) {
-                       ret = i915_switch_context(ring, ring->default_context);
+                       struct drm_i915_gem_request *req;
+
+                       ret = i915_gem_request_alloc(ring, ring->default_context, &req);
                        if (ret)
                                return ret;
-               }
-
-               ret = intel_ring_idle(ring);
-               if (ret)
-                       return ret;
-       }
-
-       return 0;
-}
 
-static void i965_write_fence_reg(struct drm_device *dev, int reg,
-                                struct drm_i915_gem_object *obj)
-{
-       struct drm_i915_private *dev_priv = dev->dev_private;
-       int fence_reg;
-       int fence_pitch_shift;
-
-       if (INTEL_INFO(dev)->gen >= 6) {
-               fence_reg = FENCE_REG_SANDYBRIDGE_0;
-               fence_pitch_shift = SANDYBRIDGE_FENCE_PITCH_SHIFT;
-       } else {
-               fence_reg = FENCE_REG_965_0;
-               fence_pitch_shift = I965_FENCE_PITCH_SHIFT;
-       }
-
-       fence_reg += reg * 8;
+                       ret = i915_switch_context(req);
+                       if (ret) {
+                               i915_gem_request_cancel(req);
+                               return ret;
+                       }
 
-       /* To w/a incoherency with non-atomic 64-bit register updates,
-        * we split the 64-bit update into two 32-bit writes. In order
-        * for a partial fence not to be evaluated between writes, we
-        * precede the update with write to turn off the fence register,
-        * and only enable the fence as the last step.
-        *
-        * For extra levels of paranoia, we make sure each step lands
-        * before applying the next step.
-        */
-       I915_WRITE(fence_reg, 0);
-       POSTING_READ(fence_reg);
-
-       if (obj) {
-               u32 size = i915_gem_obj_ggtt_size(obj);
-               uint64_t val;
-
-               /* Adjust fence size to match tiled area */
-               if (obj->tiling_mode != I915_TILING_NONE) {
-                       uint32_t row_size = obj->stride *
-                               (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
-                       size = (size / row_size) * row_size;
+                       i915_add_request_no_flush(req);
                }
 
-               val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
-                                0xfffff000) << 32;
-               val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;
-               val |= (uint64_t)((obj->stride / 128) - 1) << fence_pitch_shift;
-               if (obj->tiling_mode == I915_TILING_Y)
-                       val |= 1 << I965_FENCE_TILING_Y_SHIFT;
-               val |= I965_FENCE_REG_VALID;
-
-               I915_WRITE(fence_reg + 4, val >> 32);
-               POSTING_READ(fence_reg + 4);
-
-               I915_WRITE(fence_reg + 0, val);
-               POSTING_READ(fence_reg);
-       } else {
-               I915_WRITE(fence_reg + 4, 0);
-               POSTING_READ(fence_reg + 4);
-       }
-}
-
-static void i915_write_fence_reg(struct drm_device *dev, int reg,
-                                struct drm_i915_gem_object *obj)
-{
-       struct drm_i915_private *dev_priv = dev->dev_private;
-       u32 val;
-
-       if (obj) {
-               u32 size = i915_gem_obj_ggtt_size(obj);
-               int pitch_val;
-               int tile_width;
-
-               WARN((i915_gem_obj_ggtt_offset(obj) & ~I915_FENCE_START_MASK) ||
-                    (size & -size) != size ||
-                    (i915_gem_obj_ggtt_offset(obj) & (size - 1)),
-                    "object 0x%08lx [fenceable? %d] not 1M or pot-size (0x%08x) aligned\n",
-                    i915_gem_obj_ggtt_offset(obj), obj->map_and_fenceable, size);
-
-               if (obj->tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev))
-                       tile_width = 128;
-               else
-                       tile_width = 512;
-
-               /* Note: pitch better be a power of two tile widths */
-               pitch_val = obj->stride / tile_width;
-               pitch_val = ffs(pitch_val) - 1;
-
-               val = i915_gem_obj_ggtt_offset(obj);
-               if (obj->tiling_mode == I915_TILING_Y)
-                       val |= 1 << I830_FENCE_TILING_Y_SHIFT;
-               val |= I915_FENCE_SIZE_BITS(size);
-               val |= pitch_val << I830_FENCE_PITCH_SHIFT;
-               val |= I830_FENCE_REG_VALID;
-       } else
-               val = 0;
-
-       if (reg < 8)
-               reg = FENCE_REG_830_0 + reg * 4;
-       else
-               reg = FENCE_REG_945_8 + (reg - 8) * 4;
-
-       I915_WRITE(reg, val);
-       POSTING_READ(reg);
-}
-
-static void i830_write_fence_reg(struct drm_device *dev, int reg,
-                               struct drm_i915_gem_object *obj)
-{
-       struct drm_i915_private *dev_priv = dev->dev_private;
-       uint32_t val;
-
-       if (obj) {
-               u32 size = i915_gem_obj_ggtt_size(obj);
-               uint32_t pitch_val;
-
-               WARN((i915_gem_obj_ggtt_offset(obj) & ~I830_FENCE_START_MASK) ||
-                    (size & -size) != size ||
-                    (i915_gem_obj_ggtt_offset(obj) & (size - 1)),
-                    "object 0x%08lx not 512K or pot-size 0x%08x aligned\n",
-                    i915_gem_obj_ggtt_offset(obj), size);
-
-               pitch_val = obj->stride / 128;
-               pitch_val = ffs(pitch_val) - 1;
-
-               val = i915_gem_obj_ggtt_offset(obj);
-               if (obj->tiling_mode == I915_TILING_Y)
-                       val |= 1 << I830_FENCE_TILING_Y_SHIFT;
-               val |= I830_FENCE_SIZE_BITS(size);
-               val |= pitch_val << I830_FENCE_PITCH_SHIFT;
-               val |= I830_FENCE_REG_VALID;
-       } else
-               val = 0;
-
-       I915_WRITE(FENCE_REG_830_0 + reg * 4, val);
-       POSTING_READ(FENCE_REG_830_0 + reg * 4);
-}
-
-inline static bool i915_gem_object_needs_mb(struct drm_i915_gem_object *obj)
-{
-       return obj && obj->base.read_domains & I915_GEM_DOMAIN_GTT;
-}
-
-static void i915_gem_write_fence(struct drm_device *dev, int reg,
-                                struct drm_i915_gem_object *obj)
-{
-       struct drm_i915_private *dev_priv = dev->dev_private;
-
-       /* Ensure that all CPU reads are completed before installing a fence
-        * and all writes before removing the fence.
-        */
-       if (i915_gem_object_needs_mb(dev_priv->fence_regs[reg].obj))
-               mb();
-
-       WARN(obj && (!obj->stride || !obj->tiling_mode),
-            "bogus fence setup with stride: 0x%x, tiling mode: %i\n",
-            obj->stride, obj->tiling_mode);
-
-       if (IS_GEN2(dev))
-               i830_write_fence_reg(dev, reg, obj);
-       else if (IS_GEN3(dev))
-               i915_write_fence_reg(dev, reg, obj);
-       else if (INTEL_INFO(dev)->gen >= 4)
-               i965_write_fence_reg(dev, reg, obj);
-
-       /* And similarly be paranoid that no direct access to this region
-        * is reordered to before the fence is installed.
-        */
-       if (i915_gem_object_needs_mb(obj))
-               mb();
-}
-
-static inline int fence_number(struct drm_i915_private *dev_priv,
-                              struct drm_i915_fence_reg *fence)
-{
-       return fence - dev_priv->fence_regs;
-}
-
-static void i915_gem_object_update_fence(struct drm_i915_gem_object *obj,
-                                        struct drm_i915_fence_reg *fence,
-                                        bool enable)
-{
-       struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
-       int reg = fence_number(dev_priv, fence);
-
-       i915_gem_write_fence(obj->base.dev, reg, enable ? obj : NULL);
-
-       if (enable) {
-               obj->fence_reg = reg;
-               fence->obj = obj;
-               list_move_tail(&fence->lru_list, &dev_priv->mm.fence_list);
-       } else {
-               obj->fence_reg = I915_FENCE_REG_NONE;
-               fence->obj = NULL;
-               list_del_init(&fence->lru_list);
-       }
-       obj->fence_dirty = false;
-}
-
-static int
-i915_gem_object_wait_fence(struct drm_i915_gem_object *obj)
-{
-       if (obj->last_fenced_req) {
-               int ret = i915_wait_request(obj->last_fenced_req);
-               if (ret)
-                       return ret;
-
-               i915_gem_request_assign(&obj->last_fenced_req, NULL);
-       }
-
-       return 0;
-}
-
-int
-i915_gem_object_put_fence(struct drm_i915_gem_object *obj)
-{
-       struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
-       struct drm_i915_fence_reg *fence;
-       int ret;
-
-       ret = i915_gem_object_wait_fence(obj);
-       if (ret)
-               return ret;
-
-       if (obj->fence_reg == I915_FENCE_REG_NONE)
-               return 0;
-
-       fence = &dev_priv->fence_regs[obj->fence_reg];
-
-       if (WARN_ON(fence->pin_count))
-               return -EBUSY;
-
-       i915_gem_object_fence_lost(obj);
-       i915_gem_object_update_fence(obj, fence, false);
-
-       return 0;
-}
-
-static struct drm_i915_fence_reg *
-i915_find_fence_reg(struct drm_device *dev)
-{
-       struct drm_i915_private *dev_priv = dev->dev_private;
-       struct drm_i915_fence_reg *reg, *avail;
-       int i;
-
-       /* First try to find a free reg */
-       avail = NULL;
-       for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
-               reg = &dev_priv->fence_regs[i];
-               if (!reg->obj)
-                       return reg;
-
-               if (!reg->pin_count)
-                       avail = reg;
-       }
-
-       if (avail == NULL)
-               goto deadlock;
-
-       /* None available, try to steal one or wait for a user to finish */
-       list_for_each_entry(reg, &dev_priv->mm.fence_list, lru_list) {
-               if (reg->pin_count)
-                       continue;
-
-               return reg;
-       }
-
-deadlock:
-       /* Wait for completion of pending flips which consume fences */
-       if (intel_has_pending_fb_unpin(dev))
-               return ERR_PTR(-EAGAIN);
-
-       return ERR_PTR(-EDEADLK);
-}
-
-/**
- * i915_gem_object_get_fence - set up fencing for an object
- * @obj: object to map through a fence reg
- *
- * When mapping objects through the GTT, userspace wants to be able to write
- * to them without having to worry about swizzling if the object is tiled.
- * This function walks the fence regs looking for a free one for @obj,
- * stealing one if it can't find any.
- *
- * It then sets up the reg based on the object's properties: address, pitch
- * and tiling format.
- *
- * For an untiled surface, this removes any existing fence.
- */
-int
-i915_gem_object_get_fence(struct drm_i915_gem_object *obj)
-{
-       struct drm_device *dev = obj->base.dev;
-       struct drm_i915_private *dev_priv = dev->dev_private;
-       bool enable = obj->tiling_mode != I915_TILING_NONE;
-       struct drm_i915_fence_reg *reg;
-       int ret;
-
-       /* Have we updated the tiling parameters upon the object and so
-        * will need to serialise the write to the associated fence register?
-        */
-       if (obj->fence_dirty) {
-               ret = i915_gem_object_wait_fence(obj);
+               ret = intel_ring_idle(ring);
                if (ret)
                        return ret;
        }
 
-       /* Just update our place in the LRU if our fence is getting reused. */
-       if (obj->fence_reg != I915_FENCE_REG_NONE) {
-               reg = &dev_priv->fence_regs[obj->fence_reg];
-               if (!obj->fence_dirty) {
-                       list_move_tail(&reg->lru_list,
-                                      &dev_priv->mm.fence_list);
-                       return 0;
-               }
-       } else if (enable) {
-               if (WARN_ON(!obj->map_and_fenceable))
-                       return -EINVAL;
-
-               reg = i915_find_fence_reg(dev);
-               if (IS_ERR(reg))
-                       return PTR_ERR(reg);
-
-               if (reg->obj) {
-                       struct drm_i915_gem_object *old = reg->obj;
-
-                       ret = i915_gem_object_wait_fence(old);
-                       if (ret)
-                               return ret;
-
-                       i915_gem_object_fence_lost(old);
-               }
-       } else
-               return 0;
-
-       i915_gem_object_update_fence(obj, reg, enable);
-
+       WARN_ON(i915_verify_lists(dev));
        return 0;
 }
 
@@ -3424,7 +3412,8 @@ static bool i915_gem_valid_gtt_space(struct i915_vma *vma,
 }
 
 /**
- * Finds free space in the GTT aperture and binds the object there.
+ * Finds free space in the GTT aperture and binds the object or a view of it
+ * there.
  */
 static struct i915_vma *
 i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
@@ -3435,44 +3424,74 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
 {
        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-       u32 size, fence_size, fence_alignment, unfenced_alignment;
-       unsigned long start =
-               flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;
-       unsigned long end =
-               flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;
+       u32 fence_alignment, unfenced_alignment;
+       u32 search_flag, alloc_flag;
+       u64 start, end;
+       u64 size, fence_size;
        struct i915_vma *vma;
        int ret;
 
-       if(WARN_ON(i915_is_ggtt(vm) != !!ggtt_view))
-               return ERR_PTR(-EINVAL);
+       if (i915_is_ggtt(vm)) {
+               u32 view_size;
 
-       fence_size = i915_gem_get_gtt_size(dev,
-                                          obj->base.size,
-                                          obj->tiling_mode);
-       fence_alignment = i915_gem_get_gtt_alignment(dev,
-                                                    obj->base.size,
-                                                    obj->tiling_mode, true);
-       unfenced_alignment =
-               i915_gem_get_gtt_alignment(dev,
-                                          obj->base.size,
-                                          obj->tiling_mode, false);
+               if (WARN_ON(!ggtt_view))
+                       return ERR_PTR(-EINVAL);
+
+               view_size = i915_ggtt_view_size(obj, ggtt_view);
+
+               fence_size = i915_gem_get_gtt_size(dev,
+                                                  view_size,
+                                                  obj->tiling_mode);
+               fence_alignment = i915_gem_get_gtt_alignment(dev,
+                                                            view_size,
+                                                            obj->tiling_mode,
+                                                            true);
+               unfenced_alignment = i915_gem_get_gtt_alignment(dev,
+                                                               view_size,
+                                                               obj->tiling_mode,
+                                                               false);
+               size = flags & PIN_MAPPABLE ? fence_size : view_size;
+       } else {
+               fence_size = i915_gem_get_gtt_size(dev,
+                                                  obj->base.size,
+                                                  obj->tiling_mode);
+               fence_alignment = i915_gem_get_gtt_alignment(dev,
+                                                            obj->base.size,
+                                                            obj->tiling_mode,
+                                                            true);
+               unfenced_alignment =
+                       i915_gem_get_gtt_alignment(dev,
+                                                  obj->base.size,
+                                                  obj->tiling_mode,
+                                                  false);
+               size = flags & PIN_MAPPABLE ? fence_size : obj->base.size;
+       }
+
+       start = flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;
+       end = vm->total;
+       if (flags & PIN_MAPPABLE)
+               end = min_t(u64, end, dev_priv->gtt.mappable_end);
+       if (flags & PIN_ZONE_4G)
+               end = min_t(u64, end, (1ULL << 32));
 
        if (alignment == 0)
                alignment = flags & PIN_MAPPABLE ? fence_alignment :
                                                unfenced_alignment;
        if (flags & PIN_MAPPABLE && alignment & (fence_alignment - 1)) {
-               DRM_DEBUG("Invalid object alignment requested %u\n", alignment);
+               DRM_DEBUG("Invalid object (view type=%u) alignment requested %u\n",
+                         ggtt_view ? ggtt_view->type : 0,
+                         alignment);
                return ERR_PTR(-EINVAL);
        }
 
-       size = flags & PIN_MAPPABLE ? fence_size : obj->base.size;
-
-       /* If the object is bigger than the entire aperture, reject it early
-        * before evicting everything in a vain attempt to find space.
+       /* If binding the object/GGTT view requires more space than the entire
+        * aperture has, reject it early before evicting everything in a vain
+        * attempt to find space.
         */
-       if (obj->base.size > end) {
-               DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%lu\n",
-                         obj->base.size,
+       if (size > end) {
+               DRM_DEBUG("Attempting to bind an object (view type=%u) larger than the aperture: size=%llu > %s aperture=%llu\n",
+                         ggtt_view ? ggtt_view->type : 0,
+                         size,
                          flags & PIN_MAPPABLE ? "mappable" : "total",
                          end);
                return ERR_PTR(-E2BIG);
@@ -3490,13 +3509,21 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
        if (IS_ERR(vma))
                goto err_unpin;
 
+       if (flags & PIN_HIGH) {
+               search_flag = DRM_MM_SEARCH_BELOW;
+               alloc_flag = DRM_MM_CREATE_TOP;
+       } else {
+               search_flag = DRM_MM_SEARCH_DEFAULT;
+               alloc_flag = DRM_MM_CREATE_DEFAULT;
+       }
+
 search_free:
        ret = drm_mm_insert_node_in_range_generic(&vm->mm, &vma->node,
                                                  size, alignment,
                                                  obj->cache_level,
                                                  start, end,
-                                                 DRM_MM_SEARCH_DEFAULT,
-                                                 DRM_MM_CREATE_DEFAULT);
+                                                 search_flag,
+                                                 alloc_flag);
        if (ret) {
                ret = i915_gem_evict_something(dev, vm, size, alignment,
                                               obj->cache_level,
@@ -3512,34 +3539,16 @@ search_free:
                goto err_remove_node;
        }
 
-       ret = i915_gem_gtt_prepare_object(obj);
-       if (ret)
-               goto err_remove_node;
-
-       /*  allocate before insert / bind */
-       if (vma->vm->allocate_va_range) {
-               trace_i915_va_alloc(vma->vm, vma->node.start, vma->node.size,
-                               VM_TO_TRACE_NAME(vma->vm));
-               ret = vma->vm->allocate_va_range(vma->vm,
-                                               vma->node.start,
-                                               vma->node.size);
-               if (ret)
-                       goto err_remove_node;
-       }
-
        trace_i915_vma_bind(vma, flags);
-       ret = i915_vma_bind(vma, obj->cache_level,
-                           flags & PIN_GLOBAL ? GLOBAL_BIND : 0);
+       ret = i915_vma_bind(vma, obj->cache_level, flags);
        if (ret)
-               goto err_finish_gtt;
+               goto err_remove_node;
 
        list_move_tail(&obj->global_list, &dev_priv->mm.bound_list);
        list_add_tail(&vma->mm_list, &vm->inactive_list);
 
        return vma;
 
-err_finish_gtt:
-       i915_gem_gtt_finish_object(obj);
 err_remove_node:
        drm_mm_remove_node(&vma->node);
 err_free_vma:
@@ -3610,7 +3619,7 @@ i915_gem_object_flush_gtt_write_domain(struct drm_i915_gem_object *obj)
        old_write_domain = obj->base.write_domain;
        obj->base.write_domain = 0;
 
-       intel_fb_obj_flush(obj, false);
+       intel_fb_obj_flush(obj, false, ORIGIN_GTT);
 
        trace_i915_gem_object_change_domain(obj,
                                            obj->base.read_domains,
@@ -3632,7 +3641,7 @@ i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *obj)
        old_write_domain = obj->base.write_domain;
        obj->base.write_domain = 0;
 
-       intel_fb_obj_flush(obj, false);
+       intel_fb_obj_flush(obj, false, ORIGIN_CPU);
 
        trace_i915_gem_object_change_domain(obj,
                                            obj->base.read_domains,
@@ -3659,8 +3668,6 @@ i915_gem_object_set_to_gtt_domain(struct drm_i915_gem_object *obj, bool write)
        if (ret)
                return ret;
 
-       i915_gem_object_retire(obj);
-
        /* Flush and acquire obj->pages so that we are coherent through
         * direct access in memory with previous cached writes through
         * shmemfs and that our cache domain tracking remains valid.
@@ -3696,9 +3703,6 @@ i915_gem_object_set_to_gtt_domain(struct drm_i915_gem_object *obj, bool write)
                obj->dirty = 1;
        }
 
-       if (write)
-               intel_fb_obj_invalidate(obj, NULL, ORIGIN_GTT);
-
        trace_i915_gem_object_change_domain(obj,
                                            old_read_domains,
                                            old_write_domain);
@@ -3712,59 +3716,117 @@ i915_gem_object_set_to_gtt_domain(struct drm_i915_gem_object *obj, bool write)
        return 0;
 }
 
+/**
+ * Changes the cache-level of an object across all VMA.
+ *
+ * After this function returns, the object will be in the new cache-level
+ * across all GTT and the contents of the backing storage will be coherent,
+ * with respect to the new cache-level. In order to keep the backing storage
+ * coherent for all users, we only allow a single cache level to be set
+ * globally on the object and prevent it from being changed whilst the
+ * hardware is reading from the object. That is if the object is currently
+ * on the scanout it will be set to uncached (or equivalent display
+ * cache coherency) and all non-MOCS GPU access will also be uncached so
+ * that all direct access to the scanout remains coherent.
+ */
 int i915_gem_object_set_cache_level(struct drm_i915_gem_object *obj,
                                    enum i915_cache_level cache_level)
 {
        struct drm_device *dev = obj->base.dev;
        struct i915_vma *vma, *next;
-       int ret;
+       bool bound = false;
+       int ret = 0;
 
        if (obj->cache_level == cache_level)
-               return 0;
-
-       if (i915_gem_obj_is_pinned(obj)) {
-               DRM_DEBUG("can not change the cache level of pinned objects\n");
-               return -EBUSY;
-       }
+               goto out;
 
+       /* Inspect the list of currently bound VMA and unbind any that would
+        * be invalid given the new cache-level. This is principally to
+        * catch the issue of the CS prefetch crossing page boundaries and
+        * reading an invalid PTE on older architectures.
+        */
        list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
+               if (!drm_mm_node_allocated(&vma->node))
+                       continue;
+
+               if (vma->pin_count) {
+                       DRM_DEBUG("can not change the cache level of pinned objects\n");
+                       return -EBUSY;
+               }
+
                if (!i915_gem_valid_gtt_space(vma, cache_level)) {
                        ret = i915_vma_unbind(vma);
                        if (ret)
                                return ret;
-               }
+               } else
+                       bound = true;
        }
 
-       if (i915_gem_obj_bound_any(obj)) {
-               ret = i915_gem_object_finish_gpu(obj);
+       /* We can reuse the existing drm_mm nodes but need to change the
+        * cache-level on the PTE. We could simply unbind them all and
+        * rebind with the correct cache-level on next use. However since
+        * we already have a valid slot, dma mapping, pages etc, we may as
+        * rewrite the PTE in the belief that doing so tramples upon less
+        * state and so involves less work.
+        */
+       if (bound) {
+               /* Before we change the PTE, the GPU must not be accessing it.
+                * If we wait upon the object, we know that all the bound
+                * VMA are no longer active.
+                */
+               ret = i915_gem_object_wait_rendering(obj, false);
                if (ret)
                        return ret;
 
-               i915_gem_object_finish_gtt(obj);
-
-               /* Before SandyBridge, you could not use tiling or fence
-                * registers with snooped memory, so relinquish any fences
-                * currently pointing to our region in the aperture.
-                */
-               if (INTEL_INFO(dev)->gen < 6) {
+               if (!HAS_LLC(dev) && cache_level != I915_CACHE_NONE) {
+                       /* Access to snoopable pages through the GTT is
+                        * incoherent and on some machines causes a hard
+                        * lockup. Relinquish the CPU mmaping to force
+                        * userspace to refault in the pages and we can
+                        * then double check if the GTT mapping is still
+                        * valid for that pointer access.
+                        */
+                       i915_gem_release_mmap(obj);
+
+                       /* As we no longer need a fence for GTT access,
+                        * we can relinquish it now (and so prevent having
+                        * to steal a fence from someone else on the next
+                        * fence request). Note GPU activity would have
+                        * dropped the fence as all snoopable access is
+                        * supposed to be linear.
+                        */
                        ret = i915_gem_object_put_fence(obj);
                        if (ret)
                                return ret;
+               } else {
+                       /* We either have incoherent backing store and
+                        * so no GTT access or the architecture is fully
+                        * coherent. In such cases, existing GTT mmaps
+                        * ignore the cache bit in the PTE and we can
+                        * rewrite it without confusing the GPU or having
+                        * to force userspace to fault back in its mmaps.
+                        */
                }
 
-               list_for_each_entry(vma, &obj->vma_list, vma_link)
-                       if (drm_mm_node_allocated(&vma->node)) {
-                               ret = i915_vma_bind(vma, cache_level,
-                                                   vma->bound & GLOBAL_BIND);
-                               if (ret)
-                                       return ret;
-                       }
+               list_for_each_entry(vma, &obj->vma_list, vma_link) {
+                       if (!drm_mm_node_allocated(&vma->node))
+                               continue;
+
+                       ret = i915_vma_bind(vma, cache_level, PIN_UPDATE);
+                       if (ret)
+                               return ret;
+               }
        }
 
        list_for_each_entry(vma, &obj->vma_list, vma_link)
                vma->node.color = cache_level;
        obj->cache_level = cache_level;
 
+out:
+       /* Flush the dirty CPU caches to the backing storage so that the
+        * object is now coherent at its new cache level (with respect
+        * to the access domain).
+        */
        if (obj->cache_dirty &&
            obj->base.write_domain != I915_GEM_DOMAIN_CPU &&
            cpu_write_needs_clflush(obj)) {
@@ -3780,17 +3842,10 @@ int i915_gem_get_caching_ioctl(struct drm_device *dev, void *data,
 {
        struct drm_i915_gem_caching *args = data;
        struct drm_i915_gem_object *obj;
-       int ret;
-
-       ret = i915_mutex_lock_interruptible(dev);
-       if (ret)
-               return ret;
 
        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
-       if (&obj->base == NULL) {
-               ret = -ENOENT;
-               goto unlock;
-       }
+       if (&obj->base == NULL)
+               return -ENOENT;
 
        switch (obj->cache_level) {
        case I915_CACHE_LLC:
@@ -3807,15 +3862,14 @@ int i915_gem_get_caching_ioctl(struct drm_device *dev, void *data,
                break;
        }
 
-       drm_gem_object_unreference(&obj->base);
-unlock:
-       mutex_unlock(&dev->struct_mutex);
-       return ret;
+       drm_gem_object_unreference_unlocked(&obj->base);
+       return 0;
 }
 
 int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
                               struct drm_file *file)
 {
+       struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_caching *args = data;
        struct drm_i915_gem_object *obj;
        enum i915_cache_level level;
@@ -3826,6 +3880,15 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
                level = I915_CACHE_NONE;
                break;
        case I915_CACHING_CACHED:
+               /*
+                * Due to a HW issue on BXT A stepping, GPU stores via a
+                * snooped mapping may leave stale data in a corresponding CPU
+                * cacheline, whereas normally such cachelines would get
+                * invalidated.
+                */
+               if (IS_BROXTON(dev) && INTEL_REVID(dev) < BXT_REVID_B0)
+                       return -ENODEV;
+
                level = I915_CACHE_LLC;
                break;
        case I915_CACHING_DISPLAY:
@@ -3835,9 +3898,11 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
                return -EINVAL;
        }
 
+       intel_runtime_pm_get(dev_priv);
+
        ret = i915_mutex_lock_interruptible(dev);
        if (ret)
-               return ret;
+               goto rpm_put;
 
        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (&obj->base == NULL) {
@@ -3850,25 +3915,10 @@ int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
-       return ret;
-}
-
-static bool is_pin_display(struct drm_i915_gem_object *obj)
-{
-       struct i915_vma *vma;
-
-       vma = i915_gem_obj_to_ggtt(obj);
-       if (!vma)
-               return false;
+rpm_put:
+       intel_runtime_pm_put(dev_priv);
 
-       /* There are 2 sources that pin objects:
-        *   1. The display engine (scanouts, sprites, cursors);
-        *   2. Reservations for execbuffer;
-        *
-        * We can ignore reservations as we hold the struct_mutex and
-        * are only called outside of the reservation path.
-        */
-       return vma->pin_count;
+       return ret;
 }
 
 /*
@@ -3880,23 +3930,20 @@ int
 i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
                                     u32 alignment,
                                     struct intel_engine_cs *pipelined,
+                                    struct drm_i915_gem_request **pipelined_request,
                                     const struct i915_ggtt_view *view)
 {
        u32 old_read_domains, old_write_domain;
-       bool was_pin_display;
        int ret;
 
-       if (pipelined != i915_gem_request_get_ring(obj->last_read_req)) {
-               ret = i915_gem_object_sync(obj, pipelined);
-               if (ret)
-                       return ret;
-       }
+       ret = i915_gem_object_sync(obj, pipelined, pipelined_request);
+       if (ret)
+               return ret;
 
        /* Mark the pin_display early so that we account for the
         * display coherency whilst setting up the cache domains.
         */
-       was_pin_display = obj->pin_display;
-       obj->pin_display = true;
+       obj->pin_display++;
 
        /* The display engine is not coherent with the LLC cache on gen6.  As
         * a result, we make sure that the pinning that is about to occur is
@@ -3940,8 +3987,7 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
        return 0;
 
 err_unpin_display:
-       WARN_ON(was_pin_display != is_pin_display(obj));
-       obj->pin_display = was_pin_display;
+       obj->pin_display--;
        return ret;
 }
 
@@ -3949,26 +3995,12 @@ void
 i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj,
                                         const struct i915_ggtt_view *view)
 {
-       i915_gem_object_ggtt_unpin_view(obj, view);
-
-       obj->pin_display = is_pin_display(obj);
-}
-
-int
-i915_gem_object_finish_gpu(struct drm_i915_gem_object *obj)
-{
-       int ret;
-
-       if ((obj->base.read_domains & I915_GEM_GPU_DOMAINS) == 0)
-               return 0;
+       if (WARN_ON(obj->pin_display == 0))
+               return;
 
-       ret = i915_gem_object_wait_rendering(obj, false);
-       if (ret)
-               return ret;
+       i915_gem_object_ggtt_unpin_view(obj, view);
 
-       /* Ensure that we invalidate the GPU's caches and TLBs. */
-       obj->base.read_domains &= ~I915_GEM_GPU_DOMAINS;
-       return 0;
+       obj->pin_display--;
 }
 
 /**
@@ -3990,7 +4022,6 @@ i915_gem_object_set_to_cpu_domain(struct drm_i915_gem_object *obj, bool write)
        if (ret)
                return ret;
 
-       i915_gem_object_retire(obj);
        i915_gem_object_flush_gtt_write_domain(obj);
 
        old_write_domain = obj->base.write_domain;
@@ -4016,9 +4047,6 @@ i915_gem_object_set_to_cpu_domain(struct drm_i915_gem_object *obj, bool write)
                obj->base.write_domain = I915_GEM_DOMAIN_CPU;
        }
 
-       if (write)
-               intel_fb_obj_invalidate(obj, NULL, ORIGIN_CPU);
-
        trace_i915_gem_object_change_domain(obj,
                                            old_read_domains,
                                            old_write_domain);
@@ -4041,7 +4069,7 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_file_private *file_priv = file->driver_priv;
-       unsigned long recent_enough = jiffies - msecs_to_jiffies(20);
+       unsigned long recent_enough = jiffies - DRM_I915_THROTTLE_JIFFIES;
        struct drm_i915_gem_request *request, *target = NULL;
        unsigned reset_counter;
        int ret;
@@ -4059,6 +4087,13 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
                if (time_after_eq(request->emitted_jiffies, recent_enough))
                        break;
 
+               /*
+                * Note that the request might not have been submitted yet.
+                * In which case emitted_jiffies will be zero.
+                */
+               if (!request->emitted_jiffies)
+                       continue;
+
                target = request;
        }
        reset_counter = atomic_read(&dev_priv->gpu_error.reset_counter);
@@ -4073,9 +4108,7 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
        if (ret == 0)
                queue_delayed_work(dev_priv->wq, &dev_priv->mm.retire_work, 0);
 
-       mutex_lock(&dev->struct_mutex);
-       i915_gem_request_unreference(target);
-       mutex_unlock(&dev->struct_mutex);
+       i915_gem_request_unreference__unlocked(target);
 
        return ret;
 }
@@ -4099,6 +4132,29 @@ i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
        return false;
 }
 
+void __i915_vma_set_map_and_fenceable(struct i915_vma *vma)
+{
+       struct drm_i915_gem_object *obj = vma->obj;
+       bool mappable, fenceable;
+       u32 fence_size, fence_alignment;
+
+       fence_size = i915_gem_get_gtt_size(obj->base.dev,
+                                          obj->base.size,
+                                          obj->tiling_mode);
+       fence_alignment = i915_gem_get_gtt_alignment(obj->base.dev,
+                                                    obj->base.size,
+                                                    obj->tiling_mode,
+                                                    true);
+
+       fenceable = (vma->node.size == fence_size &&
+                    (vma->node.start & (fence_alignment - 1)) == 0);
+
+       mappable = (vma->node.start + fence_size <=
+                   to_i915(obj->base.dev)->gtt.mappable_end);
+
+       obj->map_and_fenceable = mappable && fenceable;
+}
+
 static int
 i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
                       struct i915_address_space *vm,
@@ -4134,15 +4190,13 @@ i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
                        return -EBUSY;
 
                if (i915_vma_misplaced(vma, alignment, flags)) {
-                       unsigned long offset;
-                       offset = ggtt_view ? i915_gem_obj_ggtt_offset_view(obj, ggtt_view) :
-                                            i915_gem_obj_offset(obj, vm);
                        WARN(vma->pin_count,
                             "bo is already pinned in %s with incorrect alignment:"
-                            " offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"
+                            " offset=%08x %08x, req.alignment=%x, req.map_and_fenceable=%d,"
                             " obj->map_and_fenceable=%d\n",
                             ggtt_view ? "ggtt" : "ppgtt",
-                            offset,
+                            upper_32_bits(vma->node.start),
+                            lower_32_bits(vma->node.start),
                             alignment,
                             !!(flags & PIN_MAPPABLE),
                             obj->map_and_fenceable);
@@ -4156,49 +4210,23 @@ i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
 
        bound = vma ? vma->bound : 0;
        if (vma == NULL || !drm_mm_node_allocated(&vma->node)) {
-               /* In true PPGTT, bind has possibly changed PDEs, which
-                * means we must do a context switch before the GPU can
-                * accurately read some of the VMAs.
-                */
                vma = i915_gem_object_bind_to_vm(obj, vm, ggtt_view, alignment,
                                                 flags);
                if (IS_ERR(vma))
                        return PTR_ERR(vma);
-       }
-
-       if (flags & PIN_GLOBAL && !(vma->bound & GLOBAL_BIND)) {
-               ret = i915_vma_bind(vma, obj->cache_level, GLOBAL_BIND);
+       } else {
+               ret = i915_vma_bind(vma, obj->cache_level, flags);
                if (ret)
                        return ret;
        }
 
-       if ((bound ^ vma->bound) & GLOBAL_BIND) {
-               bool mappable, fenceable;
-               u32 fence_size, fence_alignment;
-
-               fence_size = i915_gem_get_gtt_size(obj->base.dev,
-                                                  obj->base.size,
-                                                  obj->tiling_mode);
-               fence_alignment = i915_gem_get_gtt_alignment(obj->base.dev,
-                                                            obj->base.size,
-                                                            obj->tiling_mode,
-                                                            true);
-
-               fenceable = (vma->node.size == fence_size &&
-                            (vma->node.start & (fence_alignment - 1)) == 0);
-
-               mappable = (vma->node.start + fence_size <=
-                           dev_priv->gtt.mappable_end);
-
-               obj->map_and_fenceable = mappable && fenceable;
+       if (ggtt_view && ggtt_view->type == I915_GGTT_VIEW_NORMAL &&
+           (bound ^ vma->bound) & GLOBAL_BIND) {
+               __i915_vma_set_map_and_fenceable(vma);
+               WARN_ON(flags & PIN_MAPPABLE && !obj->map_and_fenceable);
        }
 
-       WARN_ON(flags & PIN_MAPPABLE && !obj->map_and_fenceable);
-
        vma->pin_count++;
-       if (flags & PIN_MAPPABLE)
-               obj->pin_mappable |= true;
-
        return 0;
 }
 
@@ -4236,34 +4264,7 @@ i915_gem_object_ggtt_unpin_view(struct drm_i915_gem_object *obj,
        WARN_ON(vma->pin_count == 0);
        WARN_ON(!i915_gem_obj_ggtt_bound_view(obj, view));
 
-       if (--vma->pin_count == 0 && view->type == I915_GGTT_VIEW_NORMAL)
-               obj->pin_mappable = false;
-}
-
-bool
-i915_gem_object_pin_fence(struct drm_i915_gem_object *obj)
-{
-       if (obj->fence_reg != I915_FENCE_REG_NONE) {
-               struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
-               struct i915_vma *ggtt_vma = i915_gem_obj_to_ggtt(obj);
-
-               WARN_ON(!ggtt_vma ||
-                       dev_priv->fence_regs[obj->fence_reg].pin_count >
-                       ggtt_vma->pin_count);
-               dev_priv->fence_regs[obj->fence_reg].pin_count++;
-               return true;
-       } else
-               return false;
-}
-
-void
-i915_gem_object_unpin_fence(struct drm_i915_gem_object *obj)
-{
-       if (obj->fence_reg != I915_FENCE_REG_NONE) {
-               struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
-               WARN_ON(dev_priv->fence_regs[obj->fence_reg].pin_count <= 0);
-               dev_priv->fence_regs[obj->fence_reg].pin_count--;
-       }
+       --vma->pin_count;
 }
 
 int
@@ -4290,15 +4291,15 @@ i915_gem_busy_ioctl(struct drm_device *dev, void *data,
         * necessary flushes here.
         */
        ret = i915_gem_object_flush_active(obj);
+       if (ret)
+               goto unref;
 
-       args->busy = obj->active;
-       if (obj->last_read_req) {
-               struct intel_engine_cs *ring;
-               BUILD_BUG_ON(I915_NUM_RINGS > 16);
-               ring = i915_gem_request_get_ring(obj->last_read_req);
-               args->busy |= intel_ring_flag(ring) << 16;
-       }
+       BUILD_BUG_ON(I915_NUM_RINGS > 16);
+       args->busy = obj->active << 16;
+       if (obj->last_write_req)
+               args->busy |= obj->last_write_req->ring->id;
 
+unref:
        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
@@ -4372,11 +4373,14 @@ unlock:
 void i915_gem_object_init(struct drm_i915_gem_object *obj,
                          const struct drm_i915_gem_object_ops *ops)
 {
+       int i;
+
        INIT_LIST_HEAD(&obj->global_list);
-       INIT_LIST_HEAD(&obj->ring_list);
+       for (i = 0; i < I915_NUM_RINGS; i++)
+               INIT_LIST_HEAD(&obj->ring_list[i]);
        INIT_LIST_HEAD(&obj->obj_exec_link);
        INIT_LIST_HEAD(&obj->vma_list);
-       INIT_LIST_HEAD(&obj->batch_pool_list);
+       INIT_LIST_HEAD(&obj->batch_pool_link);
 
        obj->ops = ops;
 
@@ -4578,7 +4582,7 @@ void i915_gem_vma_destroy(struct i915_vma *vma)
 
        list_del(&vma->vma_link);
 
-       kfree(vma);
+       kmem_cache_free(to_i915(vma->obj->base.dev)->vmas, vma);
 }
 
 static void
@@ -4624,8 +4628,9 @@ err:
        return ret;
 }
 
-int i915_gem_l3_remap(struct intel_engine_cs *ring, int slice)
+int i915_gem_l3_remap(struct drm_i915_gem_request *req, int slice)
 {
+       struct intel_engine_cs *ring = req->ring;
        struct drm_device *dev = ring->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 reg_base = GEN7_L3LOG_BASE + (slice * 0x200);
@@ -4635,7 +4640,7 @@ int i915_gem_l3_remap(struct intel_engine_cs *ring, int slice)
        if (!HAS_L3_DPF(dev) || !remap_info)
                return 0;
 
-       ret = intel_ring_begin(ring, GEN7_L3LOG_SIZE / 4 * 3);
+       ret = intel_ring_begin(req, GEN7_L3LOG_SIZE / 4 * 3);
        if (ret)
                return ret;
 
@@ -4680,22 +4685,6 @@ void i915_gem_init_swizzling(struct drm_device *dev)
                BUG();
 }
 
-static bool
-intel_enable_blt(struct drm_device *dev)
-{
-       if (!HAS_BLT(dev))
-               return false;
-
-       /* The blitter was dysfunctional on early prototypes */
-       if (IS_GEN6(dev) && dev->pdev->revision < 8) {
-               DRM_INFO("BLT not supported on this pre-production hardware;"
-                        " graphics performance will be degraded.\n");
-               return false;
-       }
-
-       return true;
-}
-
 static void init_unused_ring(struct drm_device *dev, u32 base)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -4738,7 +4727,7 @@ int i915_gem_init_rings(struct drm_device *dev)
                        goto cleanup_render_ring;
        }
 
-       if (intel_enable_blt(dev)) {
+       if (HAS_BLT(dev)) {
                ret = intel_init_blt_ring_buffer(dev);
                if (ret)
                        goto cleanup_bsd_ring;
@@ -4756,14 +4745,8 @@ int i915_gem_init_rings(struct drm_device *dev)
                        goto cleanup_vebox_ring;
        }
 
-       ret = i915_gem_set_seqno(dev, ((u32)~0 - 0x1000));
-       if (ret)
-               goto cleanup_bsd2_ring;
-
        return 0;
 
-cleanup_bsd2_ring:
-       intel_cleanup_ring_buffer(&dev_priv->ring[VCS2]);
 cleanup_vebox_ring:
        intel_cleanup_ring_buffer(&dev_priv->ring[VECS]);
 cleanup_blt_ring:
@@ -4781,7 +4764,7 @@ i915_gem_init_hw(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_engine_cs *ring;
-       int ret, i;
+       int ret, i, j;
 
        if (INTEL_INFO(dev)->gen < 6 && !intel_enable_gtt())
                return -EIO;
@@ -4818,27 +4801,82 @@ i915_gem_init_hw(struct drm_device *dev)
         */
        init_unused_rings(dev);
 
+       BUG_ON(!dev_priv->ring[RCS].default_context);
+
+       ret = i915_ppgtt_init_hw(dev);
+       if (ret) {
+               DRM_ERROR("PPGTT enable HW failed %d\n", ret);
+               goto out;
+       }
+
+       /* Need to do basic initialisation of all rings first: */
        for_each_ring(ring, dev_priv, i) {
                ret = ring->init_hw(ring);
                if (ret)
                        goto out;
        }
 
-       for (i = 0; i < NUM_L3_SLICES(dev); i++)
-               i915_gem_l3_remap(&dev_priv->ring[RCS], i);
-
-       ret = i915_ppgtt_init_hw(dev);
-       if (ret && ret != -EIO) {
-               DRM_ERROR("PPGTT enable failed %d\n", ret);
-               i915_gem_cleanup_ringbuffer(dev);
+       /* We can't enable contexts until all firmware is loaded */
+       if (HAS_GUC_UCODE(dev)) {
+               ret = intel_guc_ucode_load(dev);
+               if (ret) {
+                       /*
+                        * If we got an error and GuC submission is enabled, map
+                        * the error to -EIO so the GPU will be declared wedged.
+                        * OTOH, if we didn't intend to use the GuC anyway, just
+                        * discard the error and carry on.
+                        */
+                       DRM_ERROR("Failed to initialize GuC, error %d%s\n", ret,
+                                 i915.enable_guc_submission ? "" :
+                                 " (ignored)");
+                       ret = i915.enable_guc_submission ? -EIO : 0;
+                       if (ret)
+                               goto out;
+               }
        }
 
-       ret = i915_gem_context_enable(dev_priv);
-       if (ret && ret != -EIO) {
-               DRM_ERROR("Context enable failed %d\n", ret);
-               i915_gem_cleanup_ringbuffer(dev);
-
+       /*
+        * Increment the next seqno by 0x100 so we have a visible break
+        * on re-initialisation
+        */
+       ret = i915_gem_set_seqno(dev, dev_priv->next_seqno+0x100);
+       if (ret)
                goto out;
+
+       /* Now it is safe to go back round and do everything else: */
+       for_each_ring(ring, dev_priv, i) {
+               struct drm_i915_gem_request *req;
+
+               WARN_ON(!ring->default_context);
+
+               ret = i915_gem_request_alloc(ring, ring->default_context, &req);
+               if (ret) {
+                       i915_gem_cleanup_ringbuffer(dev);
+                       goto out;
+               }
+
+               if (ring->id == RCS) {
+                       for (j = 0; j < NUM_L3_SLICES(dev); j++)
+                               i915_gem_l3_remap(req, j);
+               }
+
+               ret = i915_ppgtt_init_ring(req);
+               if (ret && ret != -EIO) {
+                       DRM_ERROR("PPGTT enable ring #%d failed %d\n", i, ret);
+                       i915_gem_request_cancel(req);
+                       i915_gem_cleanup_ringbuffer(dev);
+                       goto out;
+               }
+
+               ret = i915_gem_context_enable(req);
+               if (ret && ret != -EIO) {
+                       DRM_ERROR("Context enable ring #%d failed %d\n", i, ret);
+                       i915_gem_request_cancel(req);
+                       i915_gem_cleanup_ringbuffer(dev);
+                       goto out;
+               }
+
+               i915_add_request_no_flush(req);
        }
 
 out:
@@ -4865,12 +4903,12 @@ int i915_gem_init(struct drm_device *dev)
        }
 
        if (!i915.enable_execlists) {
-               dev_priv->gt.do_execbuf = i915_gem_ringbuffer_submission;
+               dev_priv->gt.execbuf_submit = i915_gem_ringbuffer_submission;
                dev_priv->gt.init_rings = i915_gem_init_rings;
                dev_priv->gt.cleanup_ring = intel_cleanup_ring_buffer;
                dev_priv->gt.stop_ring = intel_stop_ring_buffer;
        } else {
-               dev_priv->gt.do_execbuf = intel_execlists_submission;
+               dev_priv->gt.execbuf_submit = intel_execlists_submission;
                dev_priv->gt.init_rings = intel_logical_rings_init;
                dev_priv->gt.cleanup_ring = intel_logical_ring_cleanup;
                dev_priv->gt.stop_ring = intel_logical_ring_stop;
@@ -4905,7 +4943,7 @@ int i915_gem_init(struct drm_device *dev)
                 * for all other failure, such as an allocation failure, bail.
                 */
                DRM_ERROR("Failed to initialize GPU, declaring it wedged\n");
-               atomic_set_mask(I915_WEDGED, &dev_priv->gpu_error.reset_counter);
+               atomic_or(I915_WEDGED, &dev_priv->gpu_error.reset_counter);
                ret = 0;
        }
 
@@ -4925,6 +4963,14 @@ i915_gem_cleanup_ringbuffer(struct drm_device *dev)
 
        for_each_ring(ring, dev_priv, i)
                dev_priv->gt.cleanup_ring(ring);
+
+    if (i915.enable_execlists)
+            /*
+             * Neither the BIOS, ourselves or any other kernel
+             * expects the system to be in execlists mode on startup,
+             * so we need to reset the GPU back to legacy mode.
+             */
+            intel_gpu_reset(dev);
 }
 
 static void
@@ -4934,33 +4980,29 @@ init_ring_lists(struct intel_engine_cs *ring)
        INIT_LIST_HEAD(&ring->request_list);
 }
 
-void i915_init_vm(struct drm_i915_private *dev_priv,
-                 struct i915_address_space *vm)
-{
-       if (!i915_is_ggtt(vm))
-               drm_mm_init(&vm->mm, vm->start, vm->total);
-       vm->dev = dev_priv->dev;
-       INIT_LIST_HEAD(&vm->active_list);
-       INIT_LIST_HEAD(&vm->inactive_list);
-       INIT_LIST_HEAD(&vm->global_link);
-       list_add_tail(&vm->global_link, &dev_priv->vm_list);
-}
-
 void
 i915_gem_load(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        int i;
 
-       dev_priv->slab =
+       dev_priv->objects =
                kmem_cache_create("i915_gem_object",
                                  sizeof(struct drm_i915_gem_object), 0,
                                  SLAB_HWCACHE_ALIGN,
                                  NULL);
+       dev_priv->vmas =
+               kmem_cache_create("i915_gem_vma",
+                                 sizeof(struct i915_vma), 0,
+                                 SLAB_HWCACHE_ALIGN,
+                                 NULL);
+       dev_priv->requests =
+               kmem_cache_create("i915_gem_request",
+                                 sizeof(struct drm_i915_gem_request), 0,
+                                 SLAB_HWCACHE_ALIGN,
+                                 NULL);
 
        INIT_LIST_HEAD(&dev_priv->vm_list);
-       i915_init_vm(dev_priv, &dev_priv->gtt.base);
-
        INIT_LIST_HEAD(&dev_priv->context_list);
        INIT_LIST_HEAD(&dev_priv->mm.unbound_list);
        INIT_LIST_HEAD(&dev_priv->mm.bound_list);
@@ -4988,6 +5030,14 @@ i915_gem_load(struct drm_device *dev)
                dev_priv->num_fence_regs =
                                I915_READ(vgtif_reg(avail_rs.fence_num));
 
+       /*
+        * Set initial sequence number for requests.
+        * Using this number allows the wraparound to happen early,
+        * catching any obvious problems.
+        */
+       dev_priv->next_seqno = ((u32)~0 - 0x1100);
+       dev_priv->last_seqno = ((u32)~0 - 0x1101);
+
        /* Initialize fence registers to zero */
        INIT_LIST_HEAD(&dev_priv->mm.fence_list);
        i915_gem_restore_fences(dev);
@@ -4999,8 +5049,6 @@ i915_gem_load(struct drm_device *dev)
 
        i915_gem_shrinker_init(dev_priv);
 
-       i915_gem_batch_pool_init(dev, &dev_priv->mm.batch_pool);
-
        mutex_init(&dev_priv->fb_tracking.lock);
 }
 
@@ -5008,8 +5056,6 @@ void i915_gem_release(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_i915_file_private *file_priv = file->driver_priv;
 
-       cancel_delayed_work_sync(&file_priv->mm.idle_work);
-
        /* Clean up our request list when the client is going away, so that
         * later retire_requests won't dereference our soon-to-be-gone
         * file_priv.
@@ -5025,15 +5071,12 @@ void i915_gem_release(struct drm_device *dev, struct drm_file *file)
                request->file_priv = NULL;
        }
        spin_unlock(&file_priv->mm.lock);
-}
-
-static void
-i915_gem_file_idle_work_handler(struct work_struct *work)
-{
-       struct drm_i915_file_private *file_priv =
-               container_of(work, typeof(*file_priv), mm.idle_work.work);
 
-       atomic_set(&file_priv->rps_wait_boost, false);
+       if (!list_empty(&file_priv->rps.link)) {
+               spin_lock(&to_i915(dev)->rps.client_lock);
+               list_del(&file_priv->rps.link);
+               spin_unlock(&to_i915(dev)->rps.client_lock);
+       }
 }
 
 int i915_gem_open(struct drm_device *dev, struct drm_file *file)
@@ -5050,11 +5093,10 @@ int i915_gem_open(struct drm_device *dev, struct drm_file *file)
        file->driver_priv = file_priv;
        file_priv->dev_priv = dev->dev_private;
        file_priv->file = file;
+       INIT_LIST_HEAD(&file_priv->rps.link);
 
        spin_lock_init(&file_priv->mm.lock);
        INIT_LIST_HEAD(&file_priv->mm.request_list);
-       INIT_DELAYED_WORK(&file_priv->mm.idle_work,
-                         i915_gem_file_idle_work_handler);
 
        ret = i915_gem_context_open(dev, file);
        if (ret)
@@ -5065,9 +5107,9 @@ int i915_gem_open(struct drm_device *dev, struct drm_file *file)
 
 /**
  * i915_gem_track_fb - update frontbuffer tracking
- * old: current GEM buffer for the frontbuffer slots
- * new: new GEM buffer for the frontbuffer slots
- * frontbuffer_bits: bitmask of frontbuffer slots
+ * @old: current GEM buffer for the frontbuffer slots
+ * @new: new GEM buffer for the frontbuffer slots
+ * @frontbuffer_bits: bitmask of frontbuffer slots
  *
  * This updates the frontbuffer tracking bits @frontbuffer_bits by clearing them
  * from @old and setting them in @new. Both @old and @new can be NULL.
@@ -5090,9 +5132,8 @@ void i915_gem_track_fb(struct drm_i915_gem_object *old,
 }
 
 /* All the new VM stuff */
-unsigned long
-i915_gem_obj_offset(struct drm_i915_gem_object *o,
-                   struct i915_address_space *vm)
+u64 i915_gem_obj_offset(struct drm_i915_gem_object *o,
+                       struct i915_address_space *vm)
 {
        struct drm_i915_private *dev_priv = o->base.dev->dev_private;
        struct i915_vma *vma;
@@ -5112,9 +5153,8 @@ i915_gem_obj_offset(struct drm_i915_gem_object *o,
        return -1;
 }
 
-unsigned long
-i915_gem_obj_ggtt_offset_view(struct drm_i915_gem_object *o,
-                             const struct i915_ggtt_view *view)
+u64 i915_gem_obj_ggtt_offset_view(struct drm_i915_gem_object *o,
+                                 const struct i915_ggtt_view *view)
 {
        struct i915_address_space *ggtt = i915_obj_to_ggtt(o);
        struct i915_vma *vma;
@@ -5124,7 +5164,7 @@ i915_gem_obj_ggtt_offset_view(struct drm_i915_gem_object *o,
                    i915_ggtt_view_equal(&vma->ggtt_view, view))
                        return vma->node.start;
 
-       WARN(1, "global vma for this object not found.\n");
+       WARN(1, "global vma for this object not found. (view=%u)\n", view->type);
        return -1;
 }
 
@@ -5193,13 +5233,49 @@ unsigned long i915_gem_obj_size(struct drm_i915_gem_object *o,
 bool i915_gem_obj_is_pinned(struct drm_i915_gem_object *obj)
 {
        struct i915_vma *vma;
-       list_for_each_entry(vma, &obj->vma_list, vma_link) {
-               if (i915_is_ggtt(vma->vm) &&
-                   vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
-                       continue;
+       list_for_each_entry(vma, &obj->vma_list, vma_link)
                if (vma->pin_count > 0)
                        return true;
-       }
+
        return false;
 }
 
+/* Allocate a new GEM object and fill it with the supplied data */
+struct drm_i915_gem_object *
+i915_gem_object_create_from_data(struct drm_device *dev,
+                                const void *data, size_t size)
+{
+       struct drm_i915_gem_object *obj;
+       struct sg_table *sg;
+       size_t bytes;
+       int ret;
+
+       obj = i915_gem_alloc_object(dev, round_up(size, PAGE_SIZE));
+       if (IS_ERR_OR_NULL(obj))
+               return obj;
+
+       ret = i915_gem_object_set_to_cpu_domain(obj, true);
+       if (ret)
+               goto fail;
+
+       ret = i915_gem_object_get_pages(obj);
+       if (ret)
+               goto fail;
+
+       i915_gem_object_pin_pages(obj);
+       sg = obj->pages;
+       bytes = sg_copy_from_buffer(sg->sgl, sg->nents, (void *)data, size);
+       i915_gem_object_unpin_pages(obj);
+
+       if (WARN_ON(bytes != size)) {
+               DRM_ERROR("Incomplete copy, wrote %zu of %zu", bytes, size);
+               ret = -EFAULT;
+               goto fail;
+       }
+
+       return obj;
+
+fail:
+       drm_gem_object_unreference(&obj->base);
+       return ERR_PTR(ret);
+}