generic-poky/meta-moblin/packages/linux/linux-moblin-2.6.28+2.6.29-rc2/psb-driver.patch

Index: linux-2.6.28/include/drm/drm.h
===================================================================
--- linux-2.6.28.orig/include/drm/drm.h	2009-02-25 15:37:00.000000000 +0000
+++ linux-2.6.28/include/drm/drm.h	2009-02-25 15:37:02.000000000 +0000
@@ -174,6 +174,7 @@
 	_DRM_SCATTER_GATHER = 4,  /**< Scatter/gather memory for PCI DMA */
 	_DRM_CONSISTENT = 5,	  /**< Consistent memory for PCI DMA */
 	_DRM_GEM = 6,		  /**< GEM object */
+	_DRM_TTM = 7,
 };
 
 /**
@@ -601,6 +602,271 @@
 
 #include "drm_mode.h"
 
+#define DRM_FENCE_FLAG_EMIT                0x00000001
+#define DRM_FENCE_FLAG_SHAREABLE           0x00000002
+#define DRM_FENCE_FLAG_WAIT_LAZY           0x00000004
+#define DRM_FENCE_FLAG_WAIT_IGNORE_SIGNALS 0x00000008
+#define DRM_FENCE_FLAG_NO_USER             0x00000010
+
+/* Reserved for driver use */
+#define DRM_FENCE_MASK_DRIVER              0xFF000000
+
+#define DRM_FENCE_TYPE_EXE                 0x00000001
+
+struct drm_fence_arg {
+	unsigned int handle;
+	unsigned int fence_class;
+	unsigned int type;
+	unsigned int flags;
+	unsigned int signaled;
+	unsigned int error;
+	unsigned int sequence;
+	unsigned int pad64;
+	uint64_t expand_pad[2]; /*Future expansion */
+};
+
+/* Buffer permissions, referring to how the GPU uses the buffers.
+ * these translate to fence types used for the buffers.
+ * Typically a texture buffer is read, A destination buffer is write and
+ *  a command (batch-) buffer is exe. Can be or-ed together.
+ */
+
+#define DRM_BO_FLAG_READ        (1ULL << 0)
+#define DRM_BO_FLAG_WRITE       (1ULL << 1)
+#define DRM_BO_FLAG_EXE         (1ULL << 2)
+
+/*
+ * Status flags. Can be read to determine the actual state of a buffer.
+ * Can also be set in the buffer mask before validation.
+ */
+
+/*
+ * Mask: Never evict this buffer. Not even with force. This type of buffer is only
+ * available to root and must be manually removed before buffer manager shutdown
+ * or lock.
+ * Flags: Acknowledge
+ */
+#define DRM_BO_FLAG_NO_EVICT    (1ULL << 4)
+
+/*
+ * Mask: Require that the buffer is placed in mappable memory when validated.
+ *       If not set the buffer may or may not be in mappable memory when validated.
+ * Flags: If set, the buffer is in mappable memory.
+ */
+#define DRM_BO_FLAG_MAPPABLE    (1ULL << 5)
+
+/* Mask: The buffer should be shareable with other processes.
+ * Flags: The buffer is shareable with other processes.
+ */
+#define DRM_BO_FLAG_SHAREABLE   (1ULL << 6)
+
+/* Mask: If set, place the buffer in cache-coherent memory if available.
+ *       If clear, never place the buffer in cache coherent memory if validated.
+ * Flags: The buffer is currently in cache-coherent memory.
+ */
+#define DRM_BO_FLAG_CACHED      (1ULL << 7)
+
+/* Mask: Make sure that every time this buffer is validated,
+ *       it ends up on the same location provided that the memory mask is the same.
+ *       The buffer will also not be evicted when claiming space for
+ *       other buffers. Basically a pinned buffer but it may be thrown out as
+ *       part of buffer manager shutdown or locking.
+ * Flags: Acknowledge.
+ */
+#define DRM_BO_FLAG_NO_MOVE     (1ULL << 8)
+
+/* Mask: Make sure the buffer is in cached memory when mapped
+ * Flags: Acknowledge.
+ * Buffers allocated with this flag should not be used for suballocators
+ * This type may have issues on CPUs with over-aggressive caching
+ * http://marc.info/?l=linux-kernel&m=102376926732464&w=2
+ */
+#define DRM_BO_FLAG_CACHED_MAPPED    (1ULL << 19)
+
+
+/* Mask: Force DRM_BO_FLAG_CACHED flag strictly also if it is set.
+ * Flags: Acknowledge.
+ */
+#define DRM_BO_FLAG_FORCE_CACHING  (1ULL << 13)
+
+/*
+ * Mask: Force DRM_BO_FLAG_MAPPABLE flag strictly also if it is clear.
+ * Flags: Acknowledge.
+ */
+#define DRM_BO_FLAG_FORCE_MAPPABLE (1ULL << 14)
+#define DRM_BO_FLAG_TILE           (1ULL << 15)
+
+/*
+ * Memory type flags that can be or'ed together in the mask, but only
+ * one appears in flags.
+ */
+
+/* System memory */
+#define DRM_BO_FLAG_MEM_LOCAL  (1ULL << 24)
+/* Translation table memory */
+#define DRM_BO_FLAG_MEM_TT     (1ULL << 25)
+/* Vram memory */
+#define DRM_BO_FLAG_MEM_VRAM   (1ULL << 26)
+/* Up to the driver to define. */
+#define DRM_BO_FLAG_MEM_PRIV0  (1ULL << 27)
+#define DRM_BO_FLAG_MEM_PRIV1  (1ULL << 28)
+#define DRM_BO_FLAG_MEM_PRIV2  (1ULL << 29)
+#define DRM_BO_FLAG_MEM_PRIV3  (1ULL << 30)
+#define DRM_BO_FLAG_MEM_PRIV4  (1ULL << 31)
+/* We can add more of these now with a 64-bit flag type */
+
+/* Memory flag mask */
+#define DRM_BO_MASK_MEM         0x00000000FF000000ULL
+#define DRM_BO_MASK_MEMTYPE     0x00000000FF0800A0ULL
+
+/* Driver-private flags */
+#define DRM_BO_MASK_DRIVER      0xFFFF000000000000ULL
+
+/* Don't block on validate and map */
+#define DRM_BO_HINT_DONT_BLOCK  0x00000002
+/* Don't place this buffer on the unfenced list.*/
+#define DRM_BO_HINT_DONT_FENCE  0x00000004
+#define DRM_BO_HINT_WAIT_LAZY   0x00000008
+#define DRM_BO_HINT_PRESUMED_OFFSET 0x00000010
+
+#define DRM_BO_INIT_MAGIC 0xfe769812
+#define DRM_BO_INIT_MAJOR 1
+#define DRM_BO_INIT_MINOR 0
+#define DRM_BO_INIT_PATCH 0
+
+
+struct drm_bo_info_req {
+	uint64_t mask;
+	uint64_t flags;
+	unsigned int handle;
+	unsigned int hint;
+	unsigned int fence_class;
+	unsigned int desired_tile_stride;
+	unsigned int tile_info;
+	unsigned int pad64;
+        uint64_t presumed_offset;
+};
+
+struct drm_bo_create_req {
+	uint64_t mask;
+	uint64_t size;
+	uint64_t buffer_start;
+	unsigned int hint;
+	unsigned int page_alignment;
+};
+
+
+/*
+ * Reply flags
+ */
+
+#define DRM_BO_REP_BUSY 0x00000001
+
+struct drm_bo_info_rep {
+	uint64_t flags;
+	uint64_t mask;
+	uint64_t size;
+	uint64_t offset;
+	uint64_t arg_handle;
+	uint64_t buffer_start;
+	unsigned int handle;
+	unsigned int fence_flags;
+	unsigned int rep_flags;
+	unsigned int page_alignment;
+	unsigned int desired_tile_stride;
+	unsigned int hw_tile_stride;
+	unsigned int tile_info;
+	unsigned int pad64;
+	uint64_t expand_pad[4]; /*Future expansion */
+};
+
+struct drm_bo_arg_rep {
+	struct drm_bo_info_rep bo_info;
+	int ret;
+	unsigned int pad64;
+};
+
+struct drm_bo_create_arg {
+	union {
+		struct drm_bo_create_req req;
+		struct drm_bo_info_rep rep;
+	} d;
+};
+
+struct drm_bo_handle_arg {
+	unsigned int handle;
+};
+
+struct drm_bo_reference_info_arg {
+	union {
+		struct drm_bo_handle_arg req;
+		struct drm_bo_info_rep rep;
+	} d;
+};
+
+struct drm_bo_map_wait_idle_arg {
+	union {
+		struct drm_bo_info_req req;
+		struct drm_bo_info_rep rep;
+	} d;
+};
+
+struct drm_bo_op_req {
+	enum {
+		drm_bo_validate,
+		drm_bo_fence,
+		drm_bo_ref_fence,
+	} op;
+	unsigned int arg_handle;
+	struct drm_bo_info_req bo_req;
+};
+
+
+struct drm_bo_op_arg {
+	uint64_t next;
+	union {
+		struct drm_bo_op_req req;
+		struct drm_bo_arg_rep rep;
+	} d;
+	int handled;
+	unsigned int pad64;
+};
+
+
+#define DRM_BO_MEM_LOCAL 0
+#define DRM_BO_MEM_TT 1
+#define DRM_BO_MEM_VRAM 2
+#define DRM_BO_MEM_PRIV0 3
+#define DRM_BO_MEM_PRIV1 4
+#define DRM_BO_MEM_PRIV2 5
+#define DRM_BO_MEM_PRIV3 6
+#define DRM_BO_MEM_PRIV4 7
+
+#define DRM_BO_MEM_TYPES 8 /* For now. */
+
+#define DRM_BO_LOCK_UNLOCK_BM       (1 << 0)
+#define DRM_BO_LOCK_IGNORE_NO_EVICT (1 << 1)
+
+struct drm_bo_version_arg {
+	uint32_t major;
+	uint32_t minor;
+	uint32_t patchlevel;
+};
+
+struct drm_mm_type_arg {
+	unsigned int mem_type;
+	unsigned int lock_flags;
+};
+
+struct drm_mm_init_arg {
+	unsigned int magic;
+	unsigned int major;
+	unsigned int minor;
+	unsigned int mem_type;
+	uint64_t p_offset;
+	uint64_t p_size;
+};
+
 #define DRM_IOCTL_BASE			'd'
 #define DRM_IO(nr)			_IO(DRM_IOCTL_BASE,nr)
 #define DRM_IOR(nr,type)		_IOR(DRM_IOCTL_BASE,nr,type)
@@ -688,6 +954,39 @@
 #define DRM_IOCTL_MODE_ADDFB		DRM_IOWR(0xAE, struct drm_mode_fb_cmd)
 #define DRM_IOCTL_MODE_RMFB		DRM_IOWR(0xAF, unsigned int)
 
+#define DRM_IOCTL_MM_INIT               DRM_IOWR(0xc0, struct drm_mm_init_arg)
+#define DRM_IOCTL_MM_TAKEDOWN           DRM_IOWR(0xc1, struct drm_mm_type_arg)
+#define DRM_IOCTL_MM_LOCK               DRM_IOWR(0xc2, struct drm_mm_type_arg)
+#define DRM_IOCTL_MM_UNLOCK             DRM_IOWR(0xc3, struct drm_mm_type_arg)
+
+#define DRM_IOCTL_FENCE_CREATE          DRM_IOWR(0xc4, struct drm_fence_arg)
+#define DRM_IOCTL_FENCE_REFERENCE       DRM_IOWR(0xc6, struct drm_fence_arg)
+#define DRM_IOCTL_FENCE_UNREFERENCE     DRM_IOWR(0xc7, struct drm_fence_arg)
+#define DRM_IOCTL_FENCE_SIGNALED        DRM_IOWR(0xc8, struct drm_fence_arg)
+#define DRM_IOCTL_FENCE_FLUSH           DRM_IOWR(0xc9, struct drm_fence_arg)
+#define DRM_IOCTL_FENCE_WAIT            DRM_IOWR(0xca, struct drm_fence_arg)
+#define DRM_IOCTL_FENCE_EMIT            DRM_IOWR(0xcb, struct drm_fence_arg)
+#define DRM_IOCTL_FENCE_BUFFERS         DRM_IOWR(0xcc, struct drm_fence_arg)
+
+#define DRM_IOCTL_BO_CREATE             DRM_IOWR(0xcd, struct drm_bo_create_arg)
+#define DRM_IOCTL_BO_MAP                DRM_IOWR(0xcf, struct drm_bo_map_wait_idle_arg)
+#define DRM_IOCTL_BO_UNMAP              DRM_IOWR(0xd0, struct drm_bo_handle_arg)
+#define DRM_IOCTL_BO_REFERENCE          DRM_IOWR(0xd1, struct drm_bo_reference_info_arg)
+#define DRM_IOCTL_BO_UNREFERENCE        DRM_IOWR(0xd2, struct drm_bo_handle_arg)
+#define DRM_IOCTL_BO_SETSTATUS          DRM_IOWR(0xd3, struct drm_bo_map_wait_idle_arg)
+#define DRM_IOCTL_BO_INFO               DRM_IOWR(0xd4, struct drm_bo_reference_info_arg)
+#define DRM_IOCTL_BO_WAIT_IDLE          DRM_IOWR(0xd5, struct drm_bo_map_wait_idle_arg)
+#define DRM_IOCTL_BO_VERSION          DRM_IOR(0xd6, struct drm_bo_version_arg)
+
+
+#define DRM_IOCTL_MODE_GETRESOURCES     DRM_IOWR(0xA0, struct drm_mode_card_res)
+#define DRM_IOCTL_MODE_GETCRTC          DRM_IOWR(0xA1, struct drm_mode_crtc)
+#define DRM_IOCTL_MODE_GETOUTPUT        DRM_IOWR(0xA2, struct drm_mode_get_output)
+
+#define DRM_IOCTL_MODE_ADDMODE         DRM_IOWR(0xA7, struct drm_mode_modeinfo)
+#define DRM_IOCTL_MODE_RMMODE          DRM_IOWR(0xA8, unsigned int)
+/*@}*/
+
 /**
  * Device specific ioctls should only be in their respective headers
  * The device specific ioctl range is from 0x40 to 0x99.
@@ -742,6 +1041,11 @@
 typedef struct drm_agp_info drm_agp_info_t;
 typedef struct drm_scatter_gather drm_scatter_gather_t;
 typedef struct drm_set_version drm_set_version_t;
+
+typedef struct drm_fence_arg drm_fence_arg_t;
+typedef struct drm_mm_type_arg drm_mm_type_arg_t;
+typedef struct drm_mm_init_arg drm_mm_init_arg_t;
+typedef enum drm_bo_type drm_bo_type_t;
 #endif
 
 #endif
Index: linux-2.6.28/include/drm/drmP.h
===================================================================
--- linux-2.6.28.orig/include/drm/drmP.h	2009-02-25 15:37:00.000000000 +0000
+++ linux-2.6.28/include/drm/drmP.h	2009-02-25 15:37:02.000000000 +0000
@@ -57,6 +57,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
 #include <linux/cdev.h>
+#include <linux/i2c.h>
 #include <linux/mutex.h>
 #if defined(__alpha__) || defined(__powerpc__)
 #include <asm/pgtable.h>	/* For pte_wrprotect */
@@ -147,9 +148,24 @@
 #define DRM_MEM_CTXLIST   21
 #define DRM_MEM_MM        22
 #define DRM_MEM_HASHTAB   23
+#define DRM_MEM_OBJECTS   24
+#define DRM_MEM_FENCE     25
+#define DRM_MEM_TTM       26
+#define DRM_MEM_BUFOBJ    27
 
 #define DRM_MAX_CTXBITMAP (PAGE_SIZE * 8)
 #define DRM_MAP_HASH_OFFSET 0x10000000
+#define DRM_MAP_HASH_ORDER 12
+#define DRM_OBJECT_HASH_ORDER 12
+#define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFFUL >> PAGE_SHIFT) + 1)
+#define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFFUL >> PAGE_SHIFT) * 16)
+/*
+ * This should be small enough to allow the use of kmalloc for hash tables
+ * instead of vmalloc.
+ */
+
+#define DRM_FILE_HASH_ORDER 8
+#define DRM_MM_INIT_MAX_PAGES 256
 
 /*@}*/
 
@@ -378,6 +394,14 @@
 	struct drm_freelist freelist;
 };
 
+
+enum drm_ref_type {
+	_DRM_REF_USE = 0,
+	_DRM_REF_TYPE1,
+	_DRM_NO_REF_TYPES
+};
+
+
 /** File private data */
 struct drm_file {
 	int authenticated;
@@ -387,6 +411,7 @@
 	unsigned long ioctl_count;
 	struct list_head lhead;
 	struct drm_minor *minor;
+	int remove_auth_on_close;
 	unsigned long lock_count;
 
 	/** Mapping of mm object handles to object pointers. */
@@ -394,6 +419,16 @@
 	/** Lock for synchronization of access to object_idr. */
 	spinlock_t table_lock;
 
+	/*
+	 * The user object hash table is global and resides in the
+	 * drm_device structure. We protect the lists and hash tables with the
+	 * device struct_mutex. A bit coarse-grained but probably the best
+	 * option.
+	 */
+
+	struct list_head refd_objects;
+
+	struct drm_open_hash refd_object_hash[_DRM_NO_REF_TYPES];
 	struct file *filp;
 	void *driver_priv;
 
@@ -659,6 +694,10 @@
 	void *driver_priv; /**< Private structure for driver to use */
 };
 
+#include "drm_objects.h"
+#include "drm_edid.h"
+#include "drm_crtc.h"
+
 /**
  * DRM driver structure. This structure represent the common code for
  * a family of cards. There will one drm_device for each card present
@@ -766,6 +805,13 @@
 	int (*proc_init)(struct drm_minor *minor);
 	void (*proc_cleanup)(struct drm_minor *minor);
 
+	/* FB routines, if present */
+	int (*fb_probe)(struct drm_device *dev, struct drm_crtc *crtc);
+	int (*fb_remove)(struct drm_device *dev, struct drm_crtc *crtc);
+
+	struct drm_fence_driver *fence_driver;
+	struct drm_bo_driver *bo_driver;
+
 	/**
 	 * Driver-specific constructor for drm_gem_objects, to set up
 	 * obj->driver_private.
@@ -821,8 +867,11 @@
  */
 struct drm_device {
 	struct list_head driver_item;	/**< list of devices per driver */
+	//char *unique;			/**< Unique identifier: e.g., busid */
+	//int unique_len;			/**< Length of unique field */
 	char *devname;			/**< For /proc/interrupts */
 	int if_version;			/**< Highest interface version set */
+	//int blocked;			/**< Blocked due to VC switch? */
 
 	/** \name Locks */
 	/*@{ */
@@ -847,12 +896,18 @@
 	/*@} */
 
 	struct list_head filelist;
+	struct drm_open_hash magiclist;	/**< magic hash table */
+	struct list_head magicfree;
 
 	/** \name Memory management */
 	/*@{ */
 	struct list_head maplist;	/**< Linked list of regions */
 	int map_count;			/**< Number of mappable regions */
 	struct drm_open_hash map_hash;	/**< User token hash table for maps */
+	struct drm_mm offset_manager;        /**< User token manager */
+	struct drm_open_hash object_hash;    /**< User token hash table for objects */
+	struct address_space *dev_mapping;  /**< For unmap_mapping_range() */
+	struct page *ttm_dummy_page;
 
 	/** \name Context handle management */
 	/*@{ */
@@ -864,6 +919,7 @@
 
 	struct list_head vmalist;	/**< List of vmas (for debugging) */
 
+	struct drm_lock_data lock;	/**< Information on hardware lock */
 	/*@} */
 
 	/** \name DMA queues (contexts) */
@@ -936,7 +992,6 @@
 	int num_crtcs;                  /**< Number of CRTCs on this device */
 	void *dev_private;		/**< device private data */
 	void *mm_private;
-	struct address_space *dev_mapping;
 	struct drm_sigdata sigdata;	   /**< For block_all_signals */
 	sigset_t sigmask;
 
@@ -945,6 +1000,8 @@
 	unsigned int agp_buffer_token;
 	struct drm_minor *control;		/**< Control node for card */
 	struct drm_minor *primary;		/**< render type primary screen head */
+	struct drm_fence_manager fm;
+	struct drm_buffer_manager bm;
 
 	/** \name Drawable information */
 	/*@{ */
@@ -976,6 +1033,27 @@
 	return dev->pdev->irq;
 }
 
+#if __OS_HAS_AGP
+struct drm_agp_ttm_backend {
+	struct drm_ttm_backend backend;
+	DRM_AGP_MEM *mem;
+	struct agp_bridge_data *bridge;
+	int populated;
+};
+#endif
+
+typedef struct ati_pcigart_ttm_backend {
+	struct drm_ttm_backend backend;
+	int populated;
+	void (*gart_flush_fn)(struct drm_device *dev);
+	struct drm_ati_pcigart_info *gart_info;
+	unsigned long offset;
+	struct page **pages;
+	int num_pages;
+	int bound;
+	struct drm_device *dev;
+} ati_pcigart_ttm_backend_t;
+
 static __inline__ int drm_core_check_feature(struct drm_device *dev,
 					     int feature)
 {
@@ -1042,6 +1120,9 @@
 				/* Driver support (drm_drv.h) */
 extern int drm_init(struct drm_driver *driver);
 extern void drm_exit(struct drm_driver *driver);
+extern void drm_cleanup_pci(struct pci_dev *pdev);
+extern void drm_vbl_send_signals(struct drm_device *dev, int crtc);
+extern struct drm_ttm_backend *drm_agp_init_ttm(struct drm_device *dev);
 extern int drm_ioctl(struct inode *inode, struct file *filp,
 		     unsigned int cmd, unsigned long arg);
 extern long drm_compat_ioctl(struct file *filp,
Index: linux-2.6.28/include/drm/drm_pciids.h
===================================================================
--- linux-2.6.28.orig/include/drm/drm_pciids.h	2008-12-24 23:26:37.000000000 +0000
+++ linux-2.6.28/include/drm/drm_pciids.h	2009-02-25 15:37:02.000000000 +0000
@@ -419,3 +419,9 @@
 	{0x8086, 0x2e12, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
 	{0x8086, 0x2e22, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
 	{0, 0, 0}
+
+#define psb_PCI_IDS \
+	{0x8086, 0x8108, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PSB_8108}, \
+	{0x8086, 0x8109, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PSB_8109}, \
+	{0, 0, 0}
+
Index: linux-2.6.28/drivers/gpu/drm/Makefile
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/Makefile	2009-02-25 15:36:50.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/Makefile	2009-02-25 15:55:10.000000000 +0000
@@ -10,6 +10,8 @@
 		drm_lock.o drm_memory.o drm_proc.o drm_stub.o drm_vm.o \
 		drm_agpsupport.o drm_scatter.o ati_pcigart.o drm_pci.o \
 		drm_sysfs.o drm_hashtab.o drm_sman.o drm_mm.o \
+		drm_fence.o drm_object.o drm_ttm.o drm_bo.o \
+		drm_bo_lock.o drm_bo_move.o drm_regman.o \
 		drm_crtc.o drm_crtc_helper.o drm_modes.o drm_edid.o
 
 drm-$(CONFIG_COMPAT) += drm_ioc32.o
@@ -21,7 +23,8 @@
 obj-$(CONFIG_DRM_MGA)	+= mga/
 obj-$(CONFIG_DRM_I810)	+= i810/
 obj-$(CONFIG_DRM_I830)	+= i830/
-obj-$(CONFIG_DRM_I915)  += i915/
+obj-$(CONFIG_DRM_INTEL_COMMON)  += i915/
+obj-$(CONFIG_DRM_PSB)	+= psb/
 obj-$(CONFIG_DRM_SIS)   += sis/
 obj-$(CONFIG_DRM_SAVAGE)+= savage/
 obj-$(CONFIG_DRM_VIA)	+=via/
Index: linux-2.6.28/drivers/gpu/drm/drm_agpsupport.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/drm_agpsupport.c	2008-12-24 23:26:37.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_agpsupport.c	2009-02-25 15:37:02.000000000 +0000
@@ -502,4 +502,156 @@
 }
 EXPORT_SYMBOL(drm_agp_chipset_flush);
 
+/*
+ * AGP ttm backend interface.
+ */
+
+#ifndef AGP_USER_TYPES
+#define AGP_USER_TYPES (1 << 16)
+#define AGP_USER_MEMORY (AGP_USER_TYPES)
+#define AGP_USER_CACHED_MEMORY (AGP_USER_TYPES + 1)
+#endif
+#define AGP_REQUIRED_MAJOR 0
+#define AGP_REQUIRED_MINOR 102
+
+static int drm_agp_needs_unbind_cache_adjust(struct drm_ttm_backend *backend)
+{
+	return ((backend->flags & DRM_BE_FLAG_BOUND_CACHED) ? 0 : 1);
+}
+
+
+static int drm_agp_populate(struct drm_ttm_backend *backend,
+			    unsigned long num_pages, struct page **pages)
+{
+	struct drm_agp_ttm_backend *agp_be =
+		container_of(backend, struct drm_agp_ttm_backend, backend);
+	struct page **cur_page, **last_page = pages + num_pages;
+	DRM_AGP_MEM *mem;
+
+	DRM_DEBUG("drm_agp_populate_ttm\n");
+	mem = drm_agp_allocate_memory(agp_be->bridge, num_pages, AGP_USER_MEMORY);
+	if (!mem)
+		return -ENOMEM;
+
+	DRM_DEBUG("Current page count is %ld\n", (long) mem->page_count);
+	mem->page_count = 0;
+	for (cur_page = pages; cur_page < last_page; ++cur_page)
+		mem->memory[mem->page_count++] = phys_to_gart(page_to_phys(*cur_page));
+	agp_be->mem = mem;
+	return 0;
+}
+
+static int drm_agp_bind_ttm(struct drm_ttm_backend *backend,
+			    struct drm_bo_mem_reg *bo_mem)
+{
+	struct drm_agp_ttm_backend *agp_be =
+		container_of(backend, struct drm_agp_ttm_backend, backend);
+	DRM_AGP_MEM *mem = agp_be->mem;
+	int ret;
+	int snooped = (bo_mem->flags & DRM_BO_FLAG_CACHED) && !(bo_mem->flags & DRM_BO_FLAG_CACHED_MAPPED);
+
+	DRM_DEBUG("drm_agp_bind_ttm\n");
+	mem->is_flushed = 1;
+	mem->type = AGP_USER_MEMORY;
+	/* CACHED MAPPED implies not snooped memory */
+	if (snooped)
+		mem->type = AGP_USER_CACHED_MEMORY;
+
+	ret = drm_agp_bind_memory(mem, bo_mem->mm_node->start);
+	if (ret)
+		DRM_ERROR("AGP Bind memory failed\n");
+
+	DRM_FLAG_MASKED(backend->flags, (bo_mem->flags & DRM_BO_FLAG_CACHED) ?
+			DRM_BE_FLAG_BOUND_CACHED : 0,
+			DRM_BE_FLAG_BOUND_CACHED);
+	return ret;
+}
+
+static int drm_agp_unbind_ttm(struct drm_ttm_backend *backend)
+{
+	struct drm_agp_ttm_backend *agp_be =
+		container_of(backend, struct drm_agp_ttm_backend, backend);
+
+	DRM_DEBUG("drm_agp_unbind_ttm\n");
+	if (agp_be->mem->is_bound)
+		return drm_agp_unbind_memory(agp_be->mem);
+	else
+		return 0;
+}
+
+static void drm_agp_clear_ttm(struct drm_ttm_backend *backend)
+{
+	struct drm_agp_ttm_backend *agp_be =
+		container_of(backend, struct drm_agp_ttm_backend, backend);
+	DRM_AGP_MEM *mem = agp_be->mem;
+
+	DRM_DEBUG("drm_agp_clear_ttm\n");
+	if (mem) {
+		backend->func->unbind(backend);
+		agp_free_memory(mem);
+	}
+	agp_be->mem = NULL;
+}
+
+static void drm_agp_destroy_ttm(struct drm_ttm_backend *backend)
+{
+	struct drm_agp_ttm_backend *agp_be;
+
+	if (backend) {
+		DRM_DEBUG("drm_agp_destroy_ttm\n");
+		agp_be = container_of(backend, struct drm_agp_ttm_backend, backend);
+		if (agp_be && agp_be->mem)
+			backend->func->clear(backend);
+	}
+}
+
+static struct drm_ttm_backend_func agp_ttm_backend = {
+	.needs_ub_cache_adjust = drm_agp_needs_unbind_cache_adjust,
+	.populate = drm_agp_populate,
+	.clear = drm_agp_clear_ttm,
+	.bind = drm_agp_bind_ttm,
+	.unbind = drm_agp_unbind_ttm,
+	.destroy =  drm_agp_destroy_ttm,
+};
+
+struct drm_ttm_backend *drm_agp_init_ttm(struct drm_device *dev)
+{
+
+	struct drm_agp_ttm_backend *agp_be;
+	struct agp_kern_info *info;
+
+	if (!dev->agp) {
+		DRM_ERROR("AGP is not initialized.\n");
+		return NULL;
+	}
+	info = &dev->agp->agp_info;
+
+	if (info->version.major != AGP_REQUIRED_MAJOR ||
+	    info->version.minor < AGP_REQUIRED_MINOR) {
+		DRM_ERROR("Wrong agpgart version %d.%d\n"
+			  "\tYou need at least version %d.%d.\n",
+			  info->version.major,
+			  info->version.minor,
+			  AGP_REQUIRED_MAJOR,
+			  AGP_REQUIRED_MINOR);
+		return NULL;
+	}
+
+
+	agp_be = drm_calloc(1, sizeof(*agp_be), DRM_MEM_TTM);
+	if (!agp_be)
+		return NULL;
+
+	agp_be->mem = NULL;
+
+	agp_be->bridge = dev->agp->bridge;
+	agp_be->populated = 0;
+	agp_be->backend.func = &agp_ttm_backend;
+	agp_be->backend.dev = dev;
+
+	return &agp_be->backend;
+}
+EXPORT_SYMBOL(drm_agp_init_ttm);
+
+
 #endif /* __OS_HAS_AGP */
Index: linux-2.6.28/drivers/gpu/drm/drm_bo.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_bo.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,2660 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstr<74>m <thomas-at-tungstengraphics-dot-com>
+ */
+
+#include "drmP.h"
+
+/*
+ * Locking may look a bit complicated but isn't really:
+ *
+ * The buffer usage atomic_t needs to be protected by dev->struct_mutex
+ * when there is a chance that it can be zero before or after the operation.
+ *
+ * dev->struct_mutex also protects all lists and list heads,
+ * Hash tables and hash heads.
+ *
+ * bo->mutex protects the buffer object itself excluding the usage field.
+ * bo->mutex does also protect the buffer list heads, so to manipulate those,
+ * we need both the bo->mutex and the dev->struct_mutex.
+ *
+ * Locking order is bo->mutex, dev->struct_mutex. Therefore list traversal
+ * is a bit complicated. When dev->struct_mutex is released to grab bo->mutex,
+ * the list traversal will, in general, need to be restarted.
+ *
+ */
+
+static void drm_bo_destroy_locked(struct drm_buffer_object *bo);
+static int drm_bo_setup_vm_locked(struct drm_buffer_object *bo);
+static void drm_bo_takedown_vm_locked(struct drm_buffer_object *bo);
+static void drm_bo_unmap_virtual(struct drm_buffer_object *bo);
+
+static inline uint64_t drm_bo_type_flags(unsigned type)
+{
+	return (1ULL << (24 + type));
+}
+
+/*
+ * bo locked. dev->struct_mutex locked.
+ */
+
+void drm_bo_add_to_pinned_lru(struct drm_buffer_object *bo)
+{
+	struct drm_mem_type_manager *man;
+
+	DRM_ASSERT_LOCKED(&bo->dev->struct_mutex);
+	DRM_ASSERT_LOCKED(&bo->mutex);
+
+	man = &bo->dev->bm.man[bo->pinned_mem_type];
+	list_add_tail(&bo->pinned_lru, &man->pinned);
+}
+
+void drm_bo_add_to_lru(struct drm_buffer_object *bo)
+{
+	struct drm_mem_type_manager *man;
+
+	DRM_ASSERT_LOCKED(&bo->dev->struct_mutex);
+
+	if (!(bo->mem.mask & (DRM_BO_FLAG_NO_MOVE | DRM_BO_FLAG_NO_EVICT))
+	    || bo->mem.mem_type != bo->pinned_mem_type) {
+		man = &bo->dev->bm.man[bo->mem.mem_type];
+		list_add_tail(&bo->lru, &man->lru);
+	} else {
+		INIT_LIST_HEAD(&bo->lru);
+	}
+}
+
+static int drm_bo_vm_pre_move(struct drm_buffer_object *bo, int old_is_pci)
+{
+#ifdef DRM_ODD_MM_COMPAT
+	int ret;
+
+	if (!bo->map_list.map)
+		return 0;
+
+	ret = drm_bo_lock_kmm(bo);
+	if (ret)
+		return ret;
+	drm_bo_unmap_virtual(bo);
+	if (old_is_pci)
+		drm_bo_finish_unmap(bo);
+#else
+	if (!bo->map_list.map)
+		return 0;
+
+	drm_bo_unmap_virtual(bo);
+#endif
+	return 0;
+}
+
+static void drm_bo_vm_post_move(struct drm_buffer_object *bo)
+{
+#ifdef DRM_ODD_MM_COMPAT
+	int ret;
+
+	if (!bo->map_list.map)
+		return;
+
+	ret = drm_bo_remap_bound(bo);
+	if (ret) {
+		DRM_ERROR("Failed to remap a bound buffer object.\n"
+			  "\tThis might cause a sigbus later.\n");
+	}
+	drm_bo_unlock_kmm(bo);
+#endif
+}
+
+/*
+ * Call bo->mutex locked.
+ */
+
+static int drm_bo_add_ttm(struct drm_buffer_object *bo)
+{
+	struct drm_device *dev = bo->dev;
+	int ret = 0;
+
+	DRM_ASSERT_LOCKED(&bo->mutex);
+	bo->ttm = NULL;
+
+	switch (bo->type) {
+	case drm_bo_type_dc:
+	case drm_bo_type_kernel:
+		bo->ttm = drm_ttm_init(dev, bo->num_pages << PAGE_SHIFT);
+		if (!bo->ttm)
+			ret = -ENOMEM;
+		break;
+	case drm_bo_type_user:
+		bo->ttm = drm_ttm_init(dev, bo->num_pages << PAGE_SHIFT);
+		if (!bo->ttm)
+			ret = -ENOMEM;
+
+		ret = drm_ttm_set_user(bo->ttm, current,
+				       bo->mem.mask & DRM_BO_FLAG_WRITE,
+				       bo->buffer_start,
+				       bo->num_pages,
+				       dev->bm.dummy_read_page);
+		if (ret)
+			return ret;
+
+		break;
+	default:
+		DRM_ERROR("Illegal buffer object type\n");
+		ret = -EINVAL;
+		break;
+	}
+
+	return ret;
+}
+
+static int drm_bo_handle_move_mem(struct drm_buffer_object *bo,
+				  struct drm_bo_mem_reg *mem,
+				  int evict, int no_wait)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_buffer_manager *bm = &dev->bm;
+	int old_is_pci = drm_mem_reg_is_pci(dev, &bo->mem);
+	int new_is_pci = drm_mem_reg_is_pci(dev, mem);
+	struct drm_mem_type_manager *old_man = &bm->man[bo->mem.mem_type];
+	struct drm_mem_type_manager *new_man = &bm->man[mem->mem_type];
+	int ret = 0;
+
+	if (old_is_pci || new_is_pci ||
+	    ((mem->flags ^ bo->mem.flags) & DRM_BO_FLAG_CACHED))
+		ret = drm_bo_vm_pre_move(bo, old_is_pci);
+	if (ret)
+		return ret;
+
+	/*
+	 * Create and bind a ttm if required.
+	 */
+
+	if (!(new_man->flags & _DRM_FLAG_MEMTYPE_FIXED) && (bo->ttm == NULL)) {
+		ret = drm_bo_add_ttm(bo);
+		if (ret)
+			goto out_err;
+
+		if (mem->mem_type != DRM_BO_MEM_LOCAL) {
+			ret = drm_bind_ttm(bo->ttm, mem);
+			if (ret)
+				goto out_err;
+		}
+
+		if (bo->mem.mem_type == DRM_BO_MEM_LOCAL) {
+
+			struct drm_bo_mem_reg *old_mem = &bo->mem;
+			uint64_t save_flags = old_mem->flags;
+			uint64_t save_mask = old_mem->mask;
+
+			*old_mem = *mem;
+			mem->mm_node = NULL;
+			old_mem->mask = save_mask;
+			DRM_FLAG_MASKED(save_flags, mem->flags,
+					DRM_BO_MASK_MEMTYPE);
+			goto moved;
+		}
+
+	}
+
+	if (!(old_man->flags & _DRM_FLAG_MEMTYPE_FIXED) &&
+		   !(new_man->flags & _DRM_FLAG_MEMTYPE_FIXED)) {
+
+		ret = drm_bo_move_ttm(bo, evict, no_wait, mem);
+
+	} else if (dev->driver->bo_driver->move) {
+		ret = dev->driver->bo_driver->move(bo, evict, no_wait, mem);
+
+	} else {
+
+		ret = drm_bo_move_memcpy(bo, evict, no_wait, mem);
+
+	}
+
+	if (ret)
+		goto out_err;
+
+moved:
+	if (old_is_pci || new_is_pci)
+		drm_bo_vm_post_move(bo);
+
+	if (bo->priv_flags & _DRM_BO_FLAG_EVICTED) {
+		ret =
+		    dev->driver->bo_driver->invalidate_caches(dev,
+							      bo->mem.flags);
+		if (ret)
+			DRM_ERROR("Can not flush read caches\n");
+	}
+
+	DRM_FLAG_MASKED(bo->priv_flags,
+			(evict) ? _DRM_BO_FLAG_EVICTED : 0,
+			_DRM_BO_FLAG_EVICTED);
+
+	if (bo->mem.mm_node)
+		bo->offset = (bo->mem.mm_node->start << PAGE_SHIFT) +
+			bm->man[bo->mem.mem_type].gpu_offset;
+
+
+	return 0;
+
+out_err:
+	if (old_is_pci || new_is_pci)
+		drm_bo_vm_post_move(bo);
+
+	new_man = &bm->man[bo->mem.mem_type];
+	if ((new_man->flags & _DRM_FLAG_MEMTYPE_FIXED) && bo->ttm) {
+		drm_ttm_unbind(bo->ttm);
+		drm_destroy_ttm(bo->ttm);
+		bo->ttm = NULL;
+	}
+
+	return ret;
+}
+
+/*
+ * Call bo->mutex locked.
+ * Wait until the buffer is idle.
+ */
+
+int drm_bo_wait(struct drm_buffer_object *bo, int lazy, int ignore_signals,
+		int no_wait)
+{
+	int ret;
+
+	DRM_ASSERT_LOCKED(&bo->mutex);
+
+	if (bo->fence) {
+		if (drm_fence_object_signaled(bo->fence, bo->fence_type)) {
+			drm_fence_usage_deref_unlocked(&bo->fence);
+			return 0;
+		}
+		if (no_wait)
+			return -EBUSY;
+
+		ret = drm_fence_object_wait(bo->fence, lazy, ignore_signals,
+					  bo->fence_type);
+		if (ret)
+			return ret;
+
+		drm_fence_usage_deref_unlocked(&bo->fence);
+	}
+	return 0;
+}
+EXPORT_SYMBOL(drm_bo_wait);
+
+static int drm_bo_expire_fence(struct drm_buffer_object *bo, int allow_errors)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_buffer_manager *bm = &dev->bm;
+
+	if (bo->fence) {
+		if (bm->nice_mode) {
+			unsigned long _end = jiffies + 3 * DRM_HZ;
+			int ret;
+			do {
+				ret = drm_bo_wait(bo, 0, 1, 0);
+				if (ret && allow_errors)
+					return ret;
+
+			} while (ret && !time_after_eq(jiffies, _end));
+
+			if (bo->fence) {
+				bm->nice_mode = 0;
+				DRM_ERROR("Detected GPU lockup or "
+					  "fence driver was taken down. "
+					  "Evicting buffer.\n");
+			}
+		}
+		if (bo->fence)
+			drm_fence_usage_deref_unlocked(&bo->fence);
+	}
+	return 0;
+}
+
+/*
+ * Call dev->struct_mutex locked.
+ * Attempts to remove all private references to a buffer by expiring its
+ * fence object and removing from lru lists and memory managers.
+ */
+
+static void drm_bo_cleanup_refs(struct drm_buffer_object *bo, int remove_all)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_buffer_manager *bm = &dev->bm;
+
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+
+	atomic_inc(&bo->usage);
+	mutex_unlock(&dev->struct_mutex);
+	mutex_lock(&bo->mutex);
+
+	DRM_FLAG_MASKED(bo->priv_flags, 0, _DRM_BO_FLAG_UNFENCED);
+
+	if (bo->fence && drm_fence_object_signaled(bo->fence,
+						   bo->fence_type))
+		drm_fence_usage_deref_unlocked(&bo->fence);
+
+	if (bo->fence && remove_all)
+		(void)drm_bo_expire_fence(bo, 0);
+
+	mutex_lock(&dev->struct_mutex);
+
+	if (!atomic_dec_and_test(&bo->usage))
+		goto out;
+
+	if (!bo->fence) {
+		list_del_init(&bo->lru);
+		if (bo->mem.mm_node) {
+			drm_mm_put_block(bo->mem.mm_node);
+			if (bo->pinned_node == bo->mem.mm_node)
+				bo->pinned_node = NULL;
+			bo->mem.mm_node = NULL;
+		}
+		list_del_init(&bo->pinned_lru);
+		if (bo->pinned_node) {
+			drm_mm_put_block(bo->pinned_node);
+			bo->pinned_node = NULL;
+		}
+		list_del_init(&bo->ddestroy);
+		mutex_unlock(&bo->mutex);
+		drm_bo_destroy_locked(bo);
+		return;
+	}
+
+	if (list_empty(&bo->ddestroy)) {
+		drm_fence_object_flush(bo->fence, bo->fence_type);
+		list_add_tail(&bo->ddestroy, &bm->ddestroy);
+		schedule_delayed_work(&bm->wq,
+				      ((DRM_HZ / 100) < 1) ? 1 : DRM_HZ / 100);
+	}
+
+out:
+	mutex_unlock(&bo->mutex);
+	return;
+}
+
+static void drm_bo_unreserve_size(unsigned long size)
+{
+	//drm_free_memctl(size);
+}
+
+/*
+ * Verify that refcount is 0 and that there are no internal references
+ * to the buffer object. Then destroy it.
+ */
+
+static void drm_bo_destroy_locked(struct drm_buffer_object *bo)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_buffer_manager *bm = &dev->bm;
+	unsigned long reserved_size;
+
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+
+	if (list_empty(&bo->lru) && bo->mem.mm_node == NULL &&
+	    list_empty(&bo->pinned_lru) && bo->pinned_node == NULL &&
+	    list_empty(&bo->ddestroy) && atomic_read(&bo->usage) == 0) {
+		if (bo->fence != NULL) {
+			DRM_ERROR("Fence was non-zero.\n");
+			drm_bo_cleanup_refs(bo, 0);
+			return;
+		}
+
+#ifdef DRM_ODD_MM_COMPAT
+		BUG_ON(!list_empty(&bo->vma_list));
+		BUG_ON(!list_empty(&bo->p_mm_list));
+#endif
+
+		if (bo->ttm) {
+			drm_ttm_unbind(bo->ttm);
+			drm_destroy_ttm(bo->ttm);
+			bo->ttm = NULL;
+		}
+
+		atomic_dec(&bm->count);
+
+		reserved_size = bo->reserved_size;
+
+		drm_free(bo, sizeof(*bo), DRM_MEM_BUFOBJ);
+		drm_bo_unreserve_size(reserved_size);
+
+		return;
+	}
+
+	/*
+	 * Some stuff is still trying to reference the buffer object.
+	 * Get rid of those references.
+	 */
+
+	drm_bo_cleanup_refs(bo, 0);
+
+	return;
+}
+
+/*
+ * Call dev->struct_mutex locked.
+ */
+
+static void drm_bo_delayed_delete(struct drm_device *dev, int remove_all)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+
+	struct drm_buffer_object *entry, *nentry;
+	struct list_head *list, *next;
+
+	list_for_each_safe(list, next, &bm->ddestroy) {
+		entry = list_entry(list, struct drm_buffer_object, ddestroy);
+
+		nentry = NULL;
+		if (next != &bm->ddestroy) {
+			nentry = list_entry(next, struct drm_buffer_object,
+					    ddestroy);
+			atomic_inc(&nentry->usage);
+		}
+
+		drm_bo_cleanup_refs(entry, remove_all);
+
+		if (nentry)
+			atomic_dec(&nentry->usage);
+	}
+}
+
+static void drm_bo_delayed_workqueue(struct work_struct *work)
+{
+	struct drm_buffer_manager *bm =
+	    container_of(work, struct drm_buffer_manager, wq.work);
+	struct drm_device *dev = container_of(bm, struct drm_device, bm);
+
+	DRM_DEBUG("Delayed delete Worker\n");
+
+	mutex_lock(&dev->struct_mutex);
+	if (!bm->initialized) {
+		mutex_unlock(&dev->struct_mutex);
+		return;
+	}
+	drm_bo_delayed_delete(dev, 0);
+	if (bm->initialized && !list_empty(&bm->ddestroy)) {
+		schedule_delayed_work(&bm->wq,
+				      ((DRM_HZ / 100) < 1) ? 1 : DRM_HZ / 100);
+	}
+	mutex_unlock(&dev->struct_mutex);
+}
+
+void drm_bo_usage_deref_locked(struct drm_buffer_object **bo)
+{
+	struct drm_buffer_object *tmp_bo = *bo;
+	bo = NULL;
+
+	DRM_ASSERT_LOCKED(&tmp_bo->dev->struct_mutex);
+
+	if (atomic_dec_and_test(&tmp_bo->usage))
+		drm_bo_destroy_locked(tmp_bo);
+}
+EXPORT_SYMBOL(drm_bo_usage_deref_locked);
+
+static void drm_bo_base_deref_locked(struct drm_file *file_priv,
+				     struct drm_user_object *uo)
+{
+	struct drm_buffer_object *bo =
+	    drm_user_object_entry(uo, struct drm_buffer_object, base);
+
+	DRM_ASSERT_LOCKED(&bo->dev->struct_mutex);
+
+	drm_bo_takedown_vm_locked(bo);
+	drm_bo_usage_deref_locked(&bo);
+}
+
+void drm_bo_usage_deref_unlocked(struct drm_buffer_object **bo)
+{
+	struct drm_buffer_object *tmp_bo = *bo;
+	struct drm_device *dev = tmp_bo->dev;
+
+	*bo = NULL;
+	if (atomic_dec_and_test(&tmp_bo->usage)) {
+		mutex_lock(&dev->struct_mutex);
+		if (atomic_read(&tmp_bo->usage) == 0)
+			drm_bo_destroy_locked(tmp_bo);
+		mutex_unlock(&dev->struct_mutex);
+	}
+}
+EXPORT_SYMBOL(drm_bo_usage_deref_unlocked);
+
+void drm_putback_buffer_objects(struct drm_device *dev)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct list_head *list = &bm->unfenced;
+	struct drm_buffer_object *entry, *next;
+
+	mutex_lock(&dev->struct_mutex);
+	list_for_each_entry_safe(entry, next, list, lru) {
+		atomic_inc(&entry->usage);
+		mutex_unlock(&dev->struct_mutex);
+
+		mutex_lock(&entry->mutex);
+		BUG_ON(!(entry->priv_flags & _DRM_BO_FLAG_UNFENCED));
+		mutex_lock(&dev->struct_mutex);
+
+		list_del_init(&entry->lru);
+		DRM_FLAG_MASKED(entry->priv_flags, 0, _DRM_BO_FLAG_UNFENCED);
+		wake_up_all(&entry->event_queue);
+
+		/*
+		 * FIXME: Might want to put back on head of list
+		 * instead of tail here.
+		 */
+
+		drm_bo_add_to_lru(entry);
+		mutex_unlock(&entry->mutex);
+		drm_bo_usage_deref_locked(&entry);
+	}
+	mutex_unlock(&dev->struct_mutex);
+}
+EXPORT_SYMBOL(drm_putback_buffer_objects);
+
+
+/*
+ * Note. The caller has to register (if applicable)
+ * and deregister fence object usage.
+ */
+
+int drm_fence_buffer_objects(struct drm_device *dev,
+			     struct list_head *list,
+			     uint32_t fence_flags,
+			     struct drm_fence_object *fence,
+			     struct drm_fence_object **used_fence)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_buffer_object *entry;
+	uint32_t fence_type = 0;
+	uint32_t fence_class = ~0;
+	int count = 0;
+	int ret = 0;
+	struct list_head *l;
+
+	mutex_lock(&dev->struct_mutex);
+
+	if (!list)
+		list = &bm->unfenced;
+
+	if (fence)
+		fence_class = fence->fence_class;
+
+	list_for_each_entry(entry, list, lru) {
+		BUG_ON(!(entry->priv_flags & _DRM_BO_FLAG_UNFENCED));
+		fence_type |= entry->new_fence_type;
+		if (fence_class == ~0)
+			fence_class = entry->new_fence_class;
+		else if (entry->new_fence_class != fence_class) {
+			DRM_ERROR("Unmatching fence classes on unfenced list: "
+				  "%d and %d.\n",
+				  fence_class,
+				  entry->new_fence_class);
+			ret = -EINVAL;
+			goto out;
+		}
+		count++;
+	}
+
+	if (!count) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	if (fence) {
+		if ((fence_type & fence->type) != fence_type ||
+		    (fence->fence_class != fence_class)) {
+			DRM_ERROR("Given fence doesn't match buffers "
+				  "on unfenced list.\n");
+			ret = -EINVAL;
+			goto out;
+		}
+	} else {
+		mutex_unlock(&dev->struct_mutex);
+		ret = drm_fence_object_create(dev, fence_class, fence_type,
+					      fence_flags | DRM_FENCE_FLAG_EMIT,
+					      &fence);
+		mutex_lock(&dev->struct_mutex);
+		if (ret)
+			goto out;
+	}
+
+	count = 0;
+	l = list->next;
+	while (l != list) {
+		prefetch(l->next);
+		entry = list_entry(l, struct drm_buffer_object, lru);
+		atomic_inc(&entry->usage);
+		mutex_unlock(&dev->struct_mutex);
+		mutex_lock(&entry->mutex);
+		mutex_lock(&dev->struct_mutex);
+		list_del_init(l);
+		if (entry->priv_flags & _DRM_BO_FLAG_UNFENCED) {
+			count++;
+			if (entry->fence)
+				drm_fence_usage_deref_locked(&entry->fence);
+			entry->fence = drm_fence_reference_locked(fence);
+			entry->fence_class = entry->new_fence_class;
+			entry->fence_type = entry->new_fence_type;
+			DRM_FLAG_MASKED(entry->priv_flags, 0,
+					_DRM_BO_FLAG_UNFENCED);
+			wake_up_all(&entry->event_queue);
+			drm_bo_add_to_lru(entry);
+		}
+		mutex_unlock(&entry->mutex);
+		drm_bo_usage_deref_locked(&entry);
+		l = list->next;
+	}
+	DRM_DEBUG("Fenced %d buffers\n", count);
+out:
+	mutex_unlock(&dev->struct_mutex);
+	*used_fence = fence;
+	return ret;
+}
+EXPORT_SYMBOL(drm_fence_buffer_objects);
+
+/*
+ * bo->mutex locked
+ */
+
+static int drm_bo_evict(struct drm_buffer_object *bo, unsigned mem_type,
+			int no_wait)
+{
+	int ret = 0;
+	struct drm_device *dev = bo->dev;
+	struct drm_bo_mem_reg evict_mem;
+
+	/*
+	 * Someone might have modified the buffer before we took the
+	 * buffer mutex.
+	 */
+
+	if (bo->priv_flags & _DRM_BO_FLAG_UNFENCED)
+		goto out;
+	if (bo->mem.mem_type != mem_type)
+		goto out;
+
+	ret = drm_bo_wait(bo, 0, 0, no_wait);
+
+	if (ret && ret != -EAGAIN) {
+		DRM_ERROR("Failed to expire fence before "
+			  "buffer eviction.\n");
+		goto out;
+	}
+
+	evict_mem = bo->mem;
+	evict_mem.mm_node = NULL;
+
+	evict_mem = bo->mem;
+	evict_mem.mask = dev->driver->bo_driver->evict_mask(bo);
+	ret = drm_bo_mem_space(bo, &evict_mem, no_wait);
+
+	if (ret) {
+		if (ret != -EAGAIN)
+			DRM_ERROR("Failed to find memory space for "
+				  "buffer 0x%p eviction.\n", bo);
+		goto out;
+	}
+
+	ret = drm_bo_handle_move_mem(bo, &evict_mem, 1, no_wait);
+
+	if (ret) {
+		if (ret != -EAGAIN)
+			DRM_ERROR("Buffer eviction failed\n");
+		goto out;
+	}
+
+	mutex_lock(&dev->struct_mutex);
+	if (evict_mem.mm_node) {
+		if (evict_mem.mm_node != bo->pinned_node)
+			drm_mm_put_block(evict_mem.mm_node);
+		evict_mem.mm_node = NULL;
+	}
+	list_del(&bo->lru);
+	drm_bo_add_to_lru(bo);
+	mutex_unlock(&dev->struct_mutex);
+
+	DRM_FLAG_MASKED(bo->priv_flags, _DRM_BO_FLAG_EVICTED,
+			_DRM_BO_FLAG_EVICTED);
+
+out:
+	return ret;
+}
+
+/**
+ * Repeatedly evict memory from the LRU for @mem_type until we create enough
+ * space, or we've evicted everything and there isn't enough space.
+ */
+static int drm_bo_mem_force_space(struct drm_device *dev,
+				  struct drm_bo_mem_reg *mem,
+				  uint32_t mem_type, int no_wait)
+{
+	struct drm_mm_node *node;
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_buffer_object *entry;
+	struct drm_mem_type_manager *man = &bm->man[mem_type];
+	struct list_head *lru;
+	unsigned long num_pages = mem->num_pages;
+	int ret;
+
+	mutex_lock(&dev->struct_mutex);
+	do {
+		node = drm_mm_search_free(&man->manager, num_pages,
+					  mem->page_alignment, 1);
+		if (node)
+			break;
+
+		lru = &man->lru;
+		if (lru->next == lru)
+			break;
+
+		entry = list_entry(lru->next, struct drm_buffer_object, lru);
+		atomic_inc(&entry->usage);
+		mutex_unlock(&dev->struct_mutex);
+		mutex_lock(&entry->mutex);
+		BUG_ON(entry->mem.flags & (DRM_BO_FLAG_NO_MOVE | DRM_BO_FLAG_NO_EVICT));
+
+		ret = drm_bo_evict(entry, mem_type, no_wait);
+		mutex_unlock(&entry->mutex);
+		drm_bo_usage_deref_unlocked(&entry);
+		if (ret)
+			return ret;
+		mutex_lock(&dev->struct_mutex);
+	} while (1);
+
+	if (!node) {
+		mutex_unlock(&dev->struct_mutex);
+		return -ENOMEM;
+	}
+
+	node = drm_mm_get_block(node, num_pages, mem->page_alignment);
+	if (!node) {
+		mutex_unlock(&dev->struct_mutex);
+		return -ENOMEM;
+	}
+
+	mutex_unlock(&dev->struct_mutex);
+	mem->mm_node = node;
+	mem->mem_type = mem_type;
+	return 0;
+}
+
+static int drm_bo_mt_compatible(struct drm_mem_type_manager *man,
+				int disallow_fixed,
+				uint32_t mem_type,
+				uint64_t mask, uint32_t *res_mask)
+{
+	uint64_t cur_flags = drm_bo_type_flags(mem_type);
+	uint64_t flag_diff;
+
+	if ((man->flags & _DRM_FLAG_MEMTYPE_FIXED) && disallow_fixed)
+		return 0;
+	if (man->flags & _DRM_FLAG_MEMTYPE_CACHED)
+		cur_flags |= DRM_BO_FLAG_CACHED;
+	if (man->flags & _DRM_FLAG_MEMTYPE_MAPPABLE)
+		cur_flags |= DRM_BO_FLAG_MAPPABLE;
+	if (man->flags & _DRM_FLAG_MEMTYPE_CSELECT)
+		DRM_FLAG_MASKED(cur_flags, mask, DRM_BO_FLAG_CACHED);
+
+	if ((cur_flags & mask & DRM_BO_MASK_MEM) == 0)
+		return 0;
+
+	if (mem_type == DRM_BO_MEM_LOCAL) {
+		*res_mask = cur_flags;
+		return 1;
+	}
+
+	flag_diff = (mask ^ cur_flags);
+	if (flag_diff & DRM_BO_FLAG_CACHED_MAPPED)
+		cur_flags |= DRM_BO_FLAG_CACHED_MAPPED;
+
+	if ((flag_diff & DRM_BO_FLAG_CACHED) &&
+	    (!(mask & DRM_BO_FLAG_CACHED) ||
+	     (mask & DRM_BO_FLAG_FORCE_CACHING)))
+		return 0;
+
+	if ((flag_diff & DRM_BO_FLAG_MAPPABLE) &&
+	    ((mask & DRM_BO_FLAG_MAPPABLE) ||
+	     (mask & DRM_BO_FLAG_FORCE_MAPPABLE)))
+		return 0;
+
+	*res_mask = cur_flags;
+	return 1;
+}
+
+/**
+ * Creates space for memory region @mem according to its type.
+ *
+ * This function first searches for free space in compatible memory types in
+ * the priority order defined by the driver.  If free space isn't found, then
+ * drm_bo_mem_force_space is attempted in priority order to evict and find
+ * space.
+ */
+int drm_bo_mem_space(struct drm_buffer_object *bo,
+		     struct drm_bo_mem_reg *mem, int no_wait)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_mem_type_manager *man;
+
+	uint32_t num_prios = dev->driver->bo_driver->num_mem_type_prio;
+	const uint32_t *prios = dev->driver->bo_driver->mem_type_prio;
+	uint32_t i;
+	uint32_t mem_type = DRM_BO_MEM_LOCAL;
+	uint32_t cur_flags;
+	int type_found = 0;
+	int type_ok = 0;
+	int has_eagain = 0;
+	struct drm_mm_node *node = NULL;
+	int ret;
+
+	mem->mm_node = NULL;
+	for (i = 0; i < num_prios; ++i) {
+		mem_type = prios[i];
+		man = &bm->man[mem_type];
+
+		type_ok = drm_bo_mt_compatible(man,
+					       bo->type == drm_bo_type_user,
+					       mem_type, mem->mask,
+					       &cur_flags);
+
+		if (!type_ok)
+			continue;
+
+		if (mem_type == DRM_BO_MEM_LOCAL)
+			break;
+
+		if ((mem_type == bo->pinned_mem_type) &&
+		    (bo->pinned_node != NULL)) {
+			node = bo->pinned_node;
+			break;
+		}
+
+		mutex_lock(&dev->struct_mutex);
+		if (man->has_type && man->use_type) {
+			type_found = 1;
+			node = drm_mm_search_free(&man->manager, mem->num_pages,
+						  mem->page_alignment, 1);
+			if (node)
+				node = drm_mm_get_block(node, mem->num_pages,
+							mem->page_alignment);
+		}
+		mutex_unlock(&dev->struct_mutex);
+		if (node)
+			break;
+	}
+
+	if ((type_ok && (mem_type == DRM_BO_MEM_LOCAL)) || node) {
+		mem->mm_node = node;
+		mem->mem_type = mem_type;
+		mem->flags = cur_flags;
+		return 0;
+	}
+
+	if (!type_found)
+		return -EINVAL;
+
+	num_prios = dev->driver->bo_driver->num_mem_busy_prio;
+	prios = dev->driver->bo_driver->mem_busy_prio;
+
+	for (i = 0; i < num_prios; ++i) {
+		mem_type = prios[i];
+		man = &bm->man[mem_type];
+
+		if (!man->has_type)
+			continue;
+
+		if (!drm_bo_mt_compatible(man,
+					  bo->type == drm_bo_type_user,
+					  mem_type,
+					  mem->mask,
+					  &cur_flags))
+			continue;
+
+		ret = drm_bo_mem_force_space(dev, mem, mem_type, no_wait);
+
+		if (ret == 0 && mem->mm_node) {
+			mem->flags = cur_flags;
+			return 0;
+		}
+
+		if (ret == -EAGAIN)
+			has_eagain = 1;
+	}
+
+	ret = (has_eagain) ? -EAGAIN : -ENOMEM;
+	return ret;
+}
+EXPORT_SYMBOL(drm_bo_mem_space);
+
+static int drm_bo_new_mask(struct drm_buffer_object *bo,
+			   uint64_t new_flags, uint64_t used_mask)
+{
+	uint32_t new_props;
+
+	if (bo->type == drm_bo_type_user &&
+	    ((new_flags & (DRM_BO_FLAG_CACHED | DRM_BO_FLAG_FORCE_CACHING)) !=
+	     (DRM_BO_FLAG_CACHED | DRM_BO_FLAG_FORCE_CACHING))) {
+		DRM_ERROR("User buffers require cache-coherent memory.\n");
+		return -EINVAL;
+	}
+
+	if ((used_mask & DRM_BO_FLAG_NO_EVICT) && !DRM_SUSER(DRM_CURPROC)) {
+		DRM_ERROR("DRM_BO_FLAG_NO_EVICT is only available to priviliged processes.\n");
+		return -EPERM;
+	}
+
+	if (likely(used_mask & DRM_BO_MASK_MEM) &&
+	    (bo->mem.flags & DRM_BO_FLAG_NO_EVICT) &&
+	    !DRM_SUSER(DRM_CURPROC)) {
+		if (likely(bo->mem.flags & new_flags & used_mask &
+			   DRM_BO_MASK_MEM))
+			new_flags = (new_flags & ~DRM_BO_MASK_MEM) |
+				(bo->mem.flags & DRM_BO_MASK_MEM);
+		else {
+			DRM_ERROR("Incompatible memory type specification "
+				  "for NO_EVICT buffer.\n");
+			return -EPERM;
+		}
+	}
+
+	if ((new_flags & DRM_BO_FLAG_NO_MOVE)) {
+		DRM_ERROR("DRM_BO_FLAG_NO_MOVE is not properly implemented yet.\n");
+		return -EPERM;
+	}
+
+	new_props = new_flags & (DRM_BO_FLAG_EXE | DRM_BO_FLAG_WRITE |
+				 DRM_BO_FLAG_READ);
+
+	if (!new_props) {
+		DRM_ERROR("Invalid buffer object rwx properties\n");
+		return -EINVAL;
+	}
+
+	bo->mem.mask = new_flags;
+	return 0;
+}
+
+/*
+ * Call dev->struct_mutex locked.
+ */
+
+struct drm_buffer_object *drm_lookup_buffer_object(struct drm_file *file_priv,
+					      uint32_t handle, int check_owner)
+{
+	struct drm_user_object *uo;
+	struct drm_buffer_object *bo;
+
+	uo = drm_lookup_user_object(file_priv, handle);
+
+	if (!uo || (uo->type != drm_buffer_type)) {
+		DRM_ERROR("Could not find buffer object 0x%08x\n", handle);
+		return NULL;
+	}
+
+	if (check_owner && file_priv != uo->owner) {
+		if (!drm_lookup_ref_object(file_priv, uo, _DRM_REF_USE))
+			return NULL;
+	}
+
+	bo = drm_user_object_entry(uo, struct drm_buffer_object, base);
+	atomic_inc(&bo->usage);
+	return bo;
+}
+EXPORT_SYMBOL(drm_lookup_buffer_object);
+
+/*
+ * Call bo->mutex locked.
+ * Returns 1 if the buffer is currently rendered to or from. 0 otherwise.
+ * Doesn't do any fence flushing as opposed to the drm_bo_busy function.
+ */
+
+static int drm_bo_quick_busy(struct drm_buffer_object *bo)
+{
+	struct drm_fence_object *fence = bo->fence;
+
+	BUG_ON(bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
+	if (fence) {
+		if (drm_fence_object_signaled(fence, bo->fence_type)) {
+			drm_fence_usage_deref_unlocked(&bo->fence);
+			return 0;
+		}
+		return 1;
+	}
+	return 0;
+}
+
+/*
+ * Call bo->mutex locked.
+ * Returns 1 if the buffer is currently rendered to or from. 0 otherwise.
+ */
+
+static int drm_bo_busy(struct drm_buffer_object *bo)
+{
+	struct drm_fence_object *fence = bo->fence;
+
+	BUG_ON(bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
+	if (fence) {
+		if (drm_fence_object_signaled(fence, bo->fence_type)) {
+			drm_fence_usage_deref_unlocked(&bo->fence);
+			return 0;
+		}
+		drm_fence_object_flush(fence, DRM_FENCE_TYPE_EXE);
+		if (drm_fence_object_signaled(fence, bo->fence_type)) {
+			drm_fence_usage_deref_unlocked(&bo->fence);
+			return 0;
+		}
+		return 1;
+	}
+	return 0;
+}
+
+static int drm_bo_evict_cached(struct drm_buffer_object *bo)
+{
+	int ret = 0;
+
+	BUG_ON(bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
+	if (bo->mem.mm_node)
+		ret = drm_bo_evict(bo, DRM_BO_MEM_TT, 1);
+	return ret;
+}
+
+/*
+ * Wait until a buffer is unmapped.
+ */
+
+static int drm_bo_wait_unmapped(struct drm_buffer_object *bo, int no_wait)
+{
+	int ret = 0;
+
+	if ((atomic_read(&bo->mapped) >= 0) && no_wait)
+		return -EBUSY;
+
+	DRM_WAIT_ON(ret, bo->event_queue, 3 * DRM_HZ,
+		    atomic_read(&bo->mapped) == -1);
+
+	if (ret == -EINTR)
+		ret = -EAGAIN;
+
+	return ret;
+}
+
+static int drm_bo_check_unfenced(struct drm_buffer_object *bo)
+{
+	int ret;
+
+	mutex_lock(&bo->mutex);
+	ret = (bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
+	mutex_unlock(&bo->mutex);
+	return ret;
+}
+
+/*
+ * Wait until a buffer, scheduled to be fenced moves off the unfenced list.
+ * Until then, we cannot really do anything with it except delete it.
+ */
+
+static int drm_bo_wait_unfenced(struct drm_buffer_object *bo, int no_wait,
+				int eagain_if_wait)
+{
+	int ret = (bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
+
+	if (ret && no_wait)
+		return -EBUSY;
+	else if (!ret)
+		return 0;
+
+	ret = 0;
+	mutex_unlock(&bo->mutex);
+	DRM_WAIT_ON(ret, bo->event_queue, 3 * DRM_HZ,
+		    !drm_bo_check_unfenced(bo));
+	mutex_lock(&bo->mutex);
+	if (ret == -EINTR)
+		return -EAGAIN;
+	ret = (bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
+	if (ret) {
+		DRM_ERROR("Timeout waiting for buffer to become fenced\n");
+		return -EBUSY;
+	}
+	if (eagain_if_wait)
+		return -EAGAIN;
+
+	return 0;
+}
+
+/*
+ * Fill in the ioctl reply argument with buffer info.
+ * Bo locked.
+ */
+
+void drm_bo_fill_rep_arg(struct drm_buffer_object *bo,
+			 struct drm_bo_info_rep *rep)
+{
+	if (!rep)
+		return;
+
+	rep->handle = bo->base.hash.key;
+	rep->flags = bo->mem.flags;
+	rep->size = bo->num_pages * PAGE_SIZE;
+	rep->offset = bo->offset;
+
+	if (bo->type == drm_bo_type_dc)
+		rep->arg_handle = bo->map_list.user_token;
+	else
+		rep->arg_handle = 0;
+
+	rep->mask = bo->mem.mask;
+	rep->buffer_start = bo->buffer_start;
+	rep->fence_flags = bo->fence_type;
+	rep->rep_flags = 0;
+	rep->page_alignment = bo->mem.page_alignment;
+
+	if ((bo->priv_flags & _DRM_BO_FLAG_UNFENCED) || drm_bo_quick_busy(bo)) {
+		DRM_FLAG_MASKED(rep->rep_flags, DRM_BO_REP_BUSY,
+				DRM_BO_REP_BUSY);
+	}
+}
+EXPORT_SYMBOL(drm_bo_fill_rep_arg);
+
+/*
+ * Wait for buffer idle and register that we've mapped the buffer.
+ * Mapping is registered as a drm_ref_object with type _DRM_REF_TYPE1,
+ * so that if the client dies, the mapping is automatically
+ * unregistered.
+ */
+
+static int drm_buffer_object_map(struct drm_file *file_priv, uint32_t handle,
+				 uint32_t map_flags, unsigned hint,
+				 struct drm_bo_info_rep *rep)
+{
+	struct drm_buffer_object *bo;
+	struct drm_device *dev = file_priv->minor->dev;
+	int ret = 0;
+	int no_wait = hint & DRM_BO_HINT_DONT_BLOCK;
+
+	mutex_lock(&dev->struct_mutex);
+	bo = drm_lookup_buffer_object(file_priv, handle, 1);
+	mutex_unlock(&dev->struct_mutex);
+
+	if (!bo)
+		return -EINVAL;
+
+	mutex_lock(&bo->mutex);
+	ret = drm_bo_wait_unfenced(bo, no_wait, 0);
+	if (ret)
+		goto out;
+
+	/*
+	 * If this returns true, we are currently unmapped.
+	 * We need to do this test, because unmapping can
+	 * be done without the bo->mutex held.
+	 */
+
+	while (1) {
+		if (atomic_inc_and_test(&bo->mapped)) {
+			if (no_wait && drm_bo_busy(bo)) {
+				atomic_dec(&bo->mapped);
+				ret = -EBUSY;
+				goto out;
+			}
+			ret = drm_bo_wait(bo, 0, 0, no_wait);
+			if (ret) {
+				atomic_dec(&bo->mapped);
+				goto out;
+			}
+
+			if (bo->mem.flags & DRM_BO_FLAG_CACHED_MAPPED)
+				drm_bo_evict_cached(bo);
+
+			break;
+		} else if (bo->mem.flags & DRM_BO_FLAG_CACHED_MAPPED) {
+
+			/*
+			 * We are already mapped with different flags.
+			 * need to wait for unmap.
+			 */
+
+			ret = drm_bo_wait_unmapped(bo, no_wait);
+			if (ret)
+				goto out;
+
+			continue;
+		}
+		break;
+	}
+
+	mutex_lock(&dev->struct_mutex);
+	ret = drm_add_ref_object(file_priv, &bo->base, _DRM_REF_TYPE1);
+	mutex_unlock(&dev->struct_mutex);
+	if (ret) {
+		if (atomic_add_negative(-1, &bo->mapped))
+			wake_up_all(&bo->event_queue);
+
+	} else
+		drm_bo_fill_rep_arg(bo, rep);
+out:
+	mutex_unlock(&bo->mutex);
+	drm_bo_usage_deref_unlocked(&bo);
+	return ret;
+}
+
+static int drm_buffer_object_unmap(struct drm_file *file_priv, uint32_t handle)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_buffer_object *bo;
+	struct drm_ref_object *ro;
+	int ret = 0;
+
+	mutex_lock(&dev->struct_mutex);
+
+	bo = drm_lookup_buffer_object(file_priv, handle, 1);
+	if (!bo) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	ro = drm_lookup_ref_object(file_priv, &bo->base, _DRM_REF_TYPE1);
+	if (!ro) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	drm_remove_ref_object(file_priv, ro);
+	drm_bo_usage_deref_locked(&bo);
+out:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
+/*
+ * Call struct-sem locked.
+ */
+
+static void drm_buffer_user_object_unmap(struct drm_file *file_priv,
+					 struct drm_user_object *uo,
+					 enum drm_ref_type action)
+{
+	struct drm_buffer_object *bo =
+	    drm_user_object_entry(uo, struct drm_buffer_object, base);
+
+	/*
+	 * We DON'T want to take the bo->lock here, because we want to
+	 * hold it when we wait for unmapped buffer.
+	 */
+
+	BUG_ON(action != _DRM_REF_TYPE1);
+
+	if (atomic_add_negative(-1, &bo->mapped))
+		wake_up_all(&bo->event_queue);
+}
+
+/*
+ * bo->mutex locked.
+ * Note that new_mem_flags are NOT transferred to the bo->mem.mask.
+ */
+
+int drm_bo_move_buffer(struct drm_buffer_object *bo, uint64_t new_mem_flags,
+		       int no_wait, int move_unfenced)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_buffer_manager *bm = &dev->bm;
+	int ret = 0;
+	struct drm_bo_mem_reg mem;
+	/*
+	 * Flush outstanding fences.
+	 */
+
+	drm_bo_busy(bo);
+
+	/*
+	 * Wait for outstanding fences.
+	 */
+
+	ret = drm_bo_wait(bo, 0, 0, no_wait);
+	if (ret)
+		return ret;
+
+	mem.num_pages = bo->num_pages;
+	mem.size = mem.num_pages << PAGE_SHIFT;
+	mem.mask = new_mem_flags;
+	mem.page_alignment = bo->mem.page_alignment;
+
+	mutex_lock(&bm->evict_mutex);
+	mutex_lock(&dev->struct_mutex);
+	list_del_init(&bo->lru);
+	mutex_unlock(&dev->struct_mutex);
+
+	/*
+	 * Determine where to move the buffer.
+	 */
+	ret = drm_bo_mem_space(bo, &mem, no_wait);
+	if (ret)
+		goto out_unlock;
+
+	ret = drm_bo_handle_move_mem(bo, &mem, 0, no_wait);
+
+out_unlock:
+	mutex_lock(&dev->struct_mutex);
+	if (ret || !move_unfenced) {
+		if (mem.mm_node) {
+			if (mem.mm_node != bo->pinned_node)
+				drm_mm_put_block(mem.mm_node);
+			mem.mm_node = NULL;
+		}
+		drm_bo_add_to_lru(bo);
+		if (bo->priv_flags & _DRM_BO_FLAG_UNFENCED) {
+			wake_up_all(&bo->event_queue);
+			DRM_FLAG_MASKED(bo->priv_flags, 0,
+					_DRM_BO_FLAG_UNFENCED);
+		}
+	} else {
+		list_add_tail(&bo->lru, &bm->unfenced);
+		DRM_FLAG_MASKED(bo->priv_flags, _DRM_BO_FLAG_UNFENCED,
+				_DRM_BO_FLAG_UNFENCED);
+	}
+	mutex_unlock(&dev->struct_mutex);
+	mutex_unlock(&bm->evict_mutex);
+	return ret;
+}
+
+static int drm_bo_mem_compat(struct drm_bo_mem_reg *mem)
+{
+	uint32_t flag_diff = (mem->mask ^ mem->flags);
+
+	if ((mem->mask & mem->flags & DRM_BO_MASK_MEM) == 0)
+		return 0;
+	if ((flag_diff & DRM_BO_FLAG_CACHED) &&
+	    (/* !(mem->mask & DRM_BO_FLAG_CACHED) ||*/
+	     (mem->mask & DRM_BO_FLAG_FORCE_CACHING)))
+		return 0;
+
+	if ((flag_diff & DRM_BO_FLAG_MAPPABLE) &&
+	    ((mem->mask & DRM_BO_FLAG_MAPPABLE) ||
+	     (mem->mask & DRM_BO_FLAG_FORCE_MAPPABLE)))
+		return 0;
+	return 1;
+}
+
+/*
+ * bo locked.
+ */
+
+static int drm_buffer_object_validate(struct drm_buffer_object *bo,
+				      uint32_t fence_class,
+				      int move_unfenced, int no_wait)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_bo_driver *driver = dev->driver->bo_driver;
+	uint32_t ftype;
+	int ret;
+
+	DRM_DEBUG("New flags 0x%016llx, Old flags 0x%016llx\n",
+		  (unsigned long long) bo->mem.mask,
+		  (unsigned long long) bo->mem.flags);
+
+	ret = driver->fence_type(bo, &fence_class, &ftype);
+
+	if (ret) {
+		DRM_ERROR("Driver did not support given buffer permissions\n");
+		return ret;
+	}
+
+	/*
+	 * We're switching command submission mechanism,
+	 * or cannot simply rely on the hardware serializing for us.
+	 *
+	 * Insert a driver-dependant barrier or wait for buffer idle.
+	 */
+
+	if ((fence_class != bo->fence_class) ||
+	    ((ftype ^ bo->fence_type) & bo->fence_type)) {
+
+		ret = -EINVAL;
+		if (driver->command_stream_barrier) {
+			ret = driver->command_stream_barrier(bo,
+							     fence_class,
+							     ftype,
+							     no_wait);
+		}
+		if (ret)
+			ret = drm_bo_wait(bo, 0, 0, no_wait);
+
+		if (ret)
+			return ret;
+
+	}
+
+	bo->new_fence_class = fence_class;
+	bo->new_fence_type = ftype;
+
+	ret = drm_bo_wait_unmapped(bo, no_wait);
+	if (ret) {
+		DRM_ERROR("Timed out waiting for buffer unmap.\n");
+		return ret;
+	}
+
+	/*
+	 * Check whether we need to move buffer.
+	 */
+
+	if (!drm_bo_mem_compat(&bo->mem)) {
+		ret = drm_bo_move_buffer(bo, bo->mem.mask, no_wait,
+					 move_unfenced);
+		if (ret) {
+			if (ret != -EAGAIN)
+				DRM_ERROR("Failed moving buffer.\n");
+			if (ret == -ENOMEM)
+				DRM_ERROR("Out of aperture space.\n");
+			return ret;
+		}
+	}
+
+	/*
+	 * Pinned buffers.
+	 */
+
+	if (bo->mem.mask & (DRM_BO_FLAG_NO_EVICT | DRM_BO_FLAG_NO_MOVE)) {
+		bo->pinned_mem_type = bo->mem.mem_type;
+		mutex_lock(&dev->struct_mutex);
+		list_del_init(&bo->pinned_lru);
+		drm_bo_add_to_pinned_lru(bo);
+
+		if (bo->pinned_node != bo->mem.mm_node) {
+			if (bo->pinned_node != NULL)
+				drm_mm_put_block(bo->pinned_node);
+			bo->pinned_node = bo->mem.mm_node;
+		}
+
+		mutex_unlock(&dev->struct_mutex);
+
+	} else if (bo->pinned_node != NULL) {
+
+		mutex_lock(&dev->struct_mutex);
+
+		if (bo->pinned_node != bo->mem.mm_node)
+			drm_mm_put_block(bo->pinned_node);
+
+		list_del_init(&bo->pinned_lru);
+		bo->pinned_node = NULL;
+		mutex_unlock(&dev->struct_mutex);
+
+	}
+
+	/*
+	 * We might need to add a TTM.
+	 */
+
+	if (bo->mem.mem_type == DRM_BO_MEM_LOCAL && bo->ttm == NULL) {
+		ret = drm_bo_add_ttm(bo);
+		if (ret)
+			return ret;
+	}
+	DRM_FLAG_MASKED(bo->mem.flags, bo->mem.mask, ~DRM_BO_MASK_MEMTYPE);
+
+	/*
+	 * Finally, adjust lru to be sure.
+	 */
+
+	mutex_lock(&dev->struct_mutex);
+	list_del(&bo->lru);
+	if (move_unfenced) {
+		list_add_tail(&bo->lru, &bm->unfenced);
+		DRM_FLAG_MASKED(bo->priv_flags, _DRM_BO_FLAG_UNFENCED,
+				_DRM_BO_FLAG_UNFENCED);
+	} else {
+		drm_bo_add_to_lru(bo);
+		if (bo->priv_flags & _DRM_BO_FLAG_UNFENCED) {
+			wake_up_all(&bo->event_queue);
+			DRM_FLAG_MASKED(bo->priv_flags, 0,
+					_DRM_BO_FLAG_UNFENCED);
+		}
+	}
+	mutex_unlock(&dev->struct_mutex);
+
+	return 0;
+}
+
+int drm_bo_do_validate(struct drm_buffer_object *bo,
+		       uint64_t flags, uint64_t mask, uint32_t hint,
+		       uint32_t fence_class,
+		       int no_wait,
+		       struct drm_bo_info_rep *rep)
+{
+	int ret;
+
+	mutex_lock(&bo->mutex);
+	ret = drm_bo_wait_unfenced(bo, no_wait, 0);
+
+	if (ret)
+		goto out;
+
+	DRM_FLAG_MASKED(flags, bo->mem.mask, ~mask);
+	ret = drm_bo_new_mask(bo, flags, mask);
+	if (ret)
+		goto out;
+
+	ret = drm_buffer_object_validate(bo,
+					 fence_class,
+					 !(hint & DRM_BO_HINT_DONT_FENCE),
+					 no_wait);
+out:
+	if (rep)
+		drm_bo_fill_rep_arg(bo, rep);
+
+	mutex_unlock(&bo->mutex);
+	return ret;
+}
+EXPORT_SYMBOL(drm_bo_do_validate);
+
+
+int drm_bo_handle_validate(struct drm_file *file_priv, uint32_t handle,
+			   uint32_t fence_class,
+			   uint64_t flags, uint64_t mask,
+			   uint32_t hint,
+			   int use_old_fence_class,
+			   struct drm_bo_info_rep *rep,
+			   struct drm_buffer_object **bo_rep)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_buffer_object *bo;
+	int ret;
+	int no_wait = hint & DRM_BO_HINT_DONT_BLOCK;
+
+	mutex_lock(&dev->struct_mutex);
+	bo = drm_lookup_buffer_object(file_priv, handle, 1);
+	mutex_unlock(&dev->struct_mutex);
+
+	if (!bo)
+		return -EINVAL;
+
+	if (use_old_fence_class)
+		fence_class = bo->fence_class;
+
+	/*
+	 * Only allow creator to change shared buffer mask.
+	 */
+
+	if (bo->base.owner != file_priv)
+		mask &= ~(DRM_BO_FLAG_NO_EVICT | DRM_BO_FLAG_NO_MOVE);
+
+
+	ret = drm_bo_do_validate(bo, flags, mask, hint, fence_class,
+				 no_wait, rep);
+
+	if (!ret && bo_rep)
+		*bo_rep = bo;
+	else
+		drm_bo_usage_deref_unlocked(&bo);
+
+	return ret;
+}
+EXPORT_SYMBOL(drm_bo_handle_validate);
+
+static int drm_bo_handle_info(struct drm_file *file_priv, uint32_t handle,
+			      struct drm_bo_info_rep *rep)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_buffer_object *bo;
+
+	mutex_lock(&dev->struct_mutex);
+	bo = drm_lookup_buffer_object(file_priv, handle, 1);
+	mutex_unlock(&dev->struct_mutex);
+
+	if (!bo)
+		return -EINVAL;
+
+	mutex_lock(&bo->mutex);
+	if (!(bo->priv_flags & _DRM_BO_FLAG_UNFENCED))
+		(void)drm_bo_busy(bo);
+	drm_bo_fill_rep_arg(bo, rep);
+	mutex_unlock(&bo->mutex);
+	drm_bo_usage_deref_unlocked(&bo);
+	return 0;
+}
+
+static int drm_bo_handle_wait(struct drm_file *file_priv, uint32_t handle,
+			      uint32_t hint,
+			      struct drm_bo_info_rep *rep)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_buffer_object *bo;
+	int no_wait = hint & DRM_BO_HINT_DONT_BLOCK;
+	int ret;
+
+	mutex_lock(&dev->struct_mutex);
+	bo = drm_lookup_buffer_object(file_priv, handle, 1);
+	mutex_unlock(&dev->struct_mutex);
+
+	if (!bo)
+		return -EINVAL;
+
+	mutex_lock(&bo->mutex);
+	ret = drm_bo_wait_unfenced(bo, no_wait, 0);
+	if (ret)
+		goto out;
+	ret = drm_bo_wait(bo, hint & DRM_BO_HINT_WAIT_LAZY, 0, no_wait);
+	if (ret)
+		goto out;
+
+	drm_bo_fill_rep_arg(bo, rep);
+
+out:
+	mutex_unlock(&bo->mutex);
+	drm_bo_usage_deref_unlocked(&bo);
+	return ret;
+}
+
+static inline size_t drm_size_align(size_t size)
+{
+	size_t tmpSize = 4;
+	if (size > PAGE_SIZE)
+		return PAGE_ALIGN(size);
+	while (tmpSize < size)
+		tmpSize <<= 1;
+
+	return (size_t) tmpSize;
+}
+
+static int drm_bo_reserve_size(struct drm_device *dev,
+			       int user_bo,
+			       unsigned long num_pages,
+			       unsigned long *size)
+{
+	struct drm_bo_driver *driver = dev->driver->bo_driver;
+
+	*size = drm_size_align(sizeof(struct drm_buffer_object)) +
+		/* Always account for a TTM, even for fixed memory types */
+		drm_ttm_size(dev, num_pages, user_bo) +
+		/* user space mapping structure */
+		drm_size_align(sizeof(drm_local_map_t)) +
+		/* file offset space, aperture space, pinned space */
+		3*drm_size_align(sizeof(struct drm_mm_node *)) +
+		/* ttm backend */
+		driver->backend_size(dev, num_pages);
+
+	// FIXME - ENOMEM?
+	return 0;
+}
+
+int drm_buffer_object_create(struct drm_device *dev,
+			     unsigned long size,
+			     enum drm_bo_type type,
+			     uint64_t mask,
+			     uint32_t hint,
+			     uint32_t page_alignment,
+			     unsigned long buffer_start,
+			     struct drm_buffer_object **buf_obj)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_buffer_object *bo;
+	int ret = 0;
+	unsigned long num_pages;
+	unsigned long reserved_size;
+
+	size += buffer_start & ~PAGE_MASK;
+	num_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	if (num_pages == 0) {
+		DRM_ERROR("Illegal buffer object size.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_bo_reserve_size(dev, type == drm_bo_type_user,
+				  num_pages, &reserved_size);
+
+	if (ret) {
+		DRM_DEBUG("Failed reserving space for buffer object.\n");
+		return ret;
+	}
+
+	bo = drm_calloc(1, sizeof(*bo), DRM_MEM_BUFOBJ);
+
+	if (!bo) {
+		drm_bo_unreserve_size(num_pages);
+		return -ENOMEM;
+	}
+
+	mutex_init(&bo->mutex);
+	mutex_lock(&bo->mutex);
+
+	bo->reserved_size = reserved_size;
+	atomic_set(&bo->usage, 1);
+	atomic_set(&bo->mapped, -1);
+	DRM_INIT_WAITQUEUE(&bo->event_queue);
+	INIT_LIST_HEAD(&bo->lru);
+	INIT_LIST_HEAD(&bo->pinned_lru);
+	INIT_LIST_HEAD(&bo->ddestroy);
+#ifdef DRM_ODD_MM_COMPAT
+	INIT_LIST_HEAD(&bo->p_mm_list);
+	INIT_LIST_HEAD(&bo->vma_list);
+#endif
+	bo->dev = dev;
+	bo->type = type;
+	bo->num_pages = num_pages;
+	bo->mem.mem_type = DRM_BO_MEM_LOCAL;
+	bo->mem.num_pages = bo->num_pages;
+	bo->mem.mm_node = NULL;
+	bo->mem.page_alignment = page_alignment;
+	bo->buffer_start = buffer_start & PAGE_MASK;
+	bo->priv_flags = 0;
+	bo->mem.flags = DRM_BO_FLAG_MEM_LOCAL | DRM_BO_FLAG_CACHED |
+		DRM_BO_FLAG_MAPPABLE;
+	bo->mem.mask = DRM_BO_FLAG_MEM_LOCAL | DRM_BO_FLAG_CACHED |
+		DRM_BO_FLAG_MAPPABLE;
+	atomic_inc(&bm->count);
+	ret = drm_bo_new_mask(bo, mask, mask);
+	if (ret)
+		goto out_err;
+
+	if (bo->type == drm_bo_type_dc) {
+		mutex_lock(&dev->struct_mutex);
+		ret = drm_bo_setup_vm_locked(bo);
+		mutex_unlock(&dev->struct_mutex);
+		if (ret)
+			goto out_err;
+	}
+
+	ret = drm_buffer_object_validate(bo, 0, 0, hint & DRM_BO_HINT_DONT_BLOCK);
+	if (ret)
+		goto out_err;
+
+	mutex_unlock(&bo->mutex);
+	*buf_obj = bo;
+	return 0;
+
+out_err:
+	mutex_unlock(&bo->mutex);
+
+	drm_bo_usage_deref_unlocked(&bo);
+	return ret;
+}
+EXPORT_SYMBOL(drm_buffer_object_create);
+
+
+static int drm_bo_add_user_object(struct drm_file *file_priv,
+				  struct drm_buffer_object *bo, int shareable)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	int ret;
+
+	mutex_lock(&dev->struct_mutex);
+	ret = drm_add_user_object(file_priv, &bo->base, shareable);
+	if (ret)
+		goto out;
+
+	bo->base.remove = drm_bo_base_deref_locked;
+	bo->base.type = drm_buffer_type;
+	bo->base.ref_struct_locked = NULL;
+	bo->base.unref = drm_buffer_user_object_unmap;
+
+out:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
+int drm_bo_create_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_bo_create_arg *arg = data;
+	struct drm_bo_create_req *req = &arg->d.req;
+	struct drm_bo_info_rep *rep = &arg->d.rep;
+	struct drm_buffer_object *entry;
+	enum drm_bo_type bo_type;
+	int ret = 0;
+
+	DRM_DEBUG("drm_bo_create_ioctl: %dkb, %dkb align\n",
+	    (int)(req->size / 1024), req->page_alignment * 4);
+
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized.\n");
+		return -EINVAL;
+	}
+
+	bo_type = (req->buffer_start) ? drm_bo_type_user : drm_bo_type_dc;
+
+	if (bo_type == drm_bo_type_user)
+		req->mask &= ~DRM_BO_FLAG_SHAREABLE;
+
+	ret = drm_buffer_object_create(file_priv->minor->dev,
+				       req->size, bo_type, req->mask,
+				       req->hint, req->page_alignment,
+				       req->buffer_start, &entry);
+	if (ret)
+		goto out;
+
+	ret = drm_bo_add_user_object(file_priv, entry,
+				     req->mask & DRM_BO_FLAG_SHAREABLE);
+	if (ret) {
+		drm_bo_usage_deref_unlocked(&entry);
+		goto out;
+	}
+
+	mutex_lock(&entry->mutex);
+	drm_bo_fill_rep_arg(entry, rep);
+	mutex_unlock(&entry->mutex);
+
+out:
+	return ret;
+}
+
+int drm_bo_setstatus_ioctl(struct drm_device *dev,
+			   void *data, struct drm_file *file_priv)
+{
+	struct drm_bo_map_wait_idle_arg *arg = data;
+	struct drm_bo_info_req *req = &arg->d.req;
+	struct drm_bo_info_rep *rep = &arg->d.rep;
+	int ret;
+
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_bo_read_lock(&dev->bm.bm_lock);
+	if (ret)
+		return ret;
+
+	ret = drm_bo_handle_validate(file_priv, req->handle, req->fence_class,
+				     req->flags,
+				     req->mask,
+				     req->hint | DRM_BO_HINT_DONT_FENCE,
+				     1,
+				     rep, NULL);
+
+	(void) drm_bo_read_unlock(&dev->bm.bm_lock);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int drm_bo_map_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_bo_map_wait_idle_arg *arg = data;
+	struct drm_bo_info_req *req = &arg->d.req;
+	struct drm_bo_info_rep *rep = &arg->d.rep;
+	int ret;
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_buffer_object_map(file_priv, req->handle, req->mask,
+				    req->hint, rep);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int drm_bo_unmap_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_bo_handle_arg *arg = data;
+	int ret;
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_buffer_object_unmap(file_priv, arg->handle);
+	return ret;
+}
+
+
+int drm_bo_reference_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_bo_reference_info_arg *arg = data;
+	struct drm_bo_handle_arg *req = &arg->d.req;
+	struct drm_bo_info_rep *rep = &arg->d.rep;
+	struct drm_user_object *uo;
+	int ret;
+
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_user_object_ref(file_priv, req->handle,
+				  drm_buffer_type, &uo);
+	if (ret)
+		return ret;
+
+	ret = drm_bo_handle_info(file_priv, req->handle, rep);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int drm_bo_unreference_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_bo_handle_arg *arg = data;
+	int ret = 0;
+
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_user_object_unref(file_priv, arg->handle, drm_buffer_type);
+	return ret;
+}
+
+int drm_bo_info_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_bo_reference_info_arg *arg = data;
+	struct drm_bo_handle_arg *req = &arg->d.req;
+	struct drm_bo_info_rep *rep = &arg->d.rep;
+	int ret;
+
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_bo_handle_info(file_priv, req->handle, rep);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int drm_bo_wait_idle_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_bo_map_wait_idle_arg *arg = data;
+	struct drm_bo_info_req *req = &arg->d.req;
+	struct drm_bo_info_rep *rep = &arg->d.rep;
+	int ret;
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_bo_handle_wait(file_priv, req->handle,
+				 req->hint, rep);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int drm_bo_leave_list(struct drm_buffer_object *bo,
+			     uint32_t mem_type,
+			     int free_pinned,
+			     int allow_errors)
+{
+	struct drm_device *dev = bo->dev;
+	int ret = 0;
+
+	mutex_lock(&bo->mutex);
+
+	ret = drm_bo_expire_fence(bo, allow_errors);
+	if (ret)
+		goto out;
+
+	if (free_pinned) {
+		DRM_FLAG_MASKED(bo->mem.flags, 0, DRM_BO_FLAG_NO_MOVE);
+		mutex_lock(&dev->struct_mutex);
+		list_del_init(&bo->pinned_lru);
+		if (bo->pinned_node == bo->mem.mm_node)
+			bo->pinned_node = NULL;
+		if (bo->pinned_node != NULL) {
+			drm_mm_put_block(bo->pinned_node);
+			bo->pinned_node = NULL;
+		}
+		mutex_unlock(&dev->struct_mutex);
+	}
+
+	if (bo->mem.flags & DRM_BO_FLAG_NO_EVICT) {
+		DRM_ERROR("A DRM_BO_NO_EVICT buffer present at "
+			  "cleanup. Removing flag and evicting.\n");
+		bo->mem.flags &= ~DRM_BO_FLAG_NO_EVICT;
+		bo->mem.mask &= ~DRM_BO_FLAG_NO_EVICT;
+	}
+
+	if (bo->mem.mem_type == mem_type)
+		ret = drm_bo_evict(bo, mem_type, 0);
+
+	if (ret) {
+		if (allow_errors) {
+			goto out;
+		} else {
+			ret = 0;
+			DRM_ERROR("Cleanup eviction failed\n");
+		}
+	}
+
+out:
+	mutex_unlock(&bo->mutex);
+	return ret;
+}
+
+
+static struct drm_buffer_object *drm_bo_entry(struct list_head *list,
+					 int pinned_list)
+{
+	if (pinned_list)
+		return list_entry(list, struct drm_buffer_object, pinned_lru);
+	else
+		return list_entry(list, struct drm_buffer_object, lru);
+}
+
+/*
+ * dev->struct_mutex locked.
+ */
+
+static int drm_bo_force_list_clean(struct drm_device *dev,
+				   struct list_head *head,
+				   unsigned mem_type,
+				   int free_pinned,
+				   int allow_errors,
+				   int pinned_list)
+{
+	struct list_head *list, *next, *prev;
+	struct drm_buffer_object *entry, *nentry;
+	int ret;
+	int do_restart;
+
+	/*
+	 * The list traversal is a bit odd here, because an item may
+	 * disappear from the list when we release the struct_mutex or
+	 * when we decrease the usage count. Also we're not guaranteed
+	 * to drain pinned lists, so we can't always restart.
+	 */
+
+restart:
+	nentry = NULL;
+	list_for_each_safe(list, next, head) {
+		prev = list->prev;
+
+		entry = (nentry != NULL) ? nentry: drm_bo_entry(list, pinned_list);
+		atomic_inc(&entry->usage);
+		if (nentry) {
+			atomic_dec(&nentry->usage);
+			nentry = NULL;
+		}
+
+		/*
+		 * Protect the next item from destruction, so we can check
+		 * its list pointers later on.
+		 */
+
+		if (next != head) {
+			nentry = drm_bo_entry(next, pinned_list);
+			atomic_inc(&nentry->usage);
+		}
+		mutex_unlock(&dev->struct_mutex);
+
+		ret = drm_bo_leave_list(entry, mem_type, free_pinned,
+					allow_errors);
+		mutex_lock(&dev->struct_mutex);
+
+		drm_bo_usage_deref_locked(&entry);
+		if (ret)
+			return ret;
+
+		/*
+		 * Has the next item disappeared from the list?
+		 */
+
+		do_restart = ((next->prev != list) && (next->prev != prev));
+
+		if (nentry != NULL && do_restart)
+			drm_bo_usage_deref_locked(&nentry);
+
+		if (do_restart)
+			goto restart;
+	}
+	return 0;
+}
+
+int drm_bo_clean_mm(struct drm_device *dev, unsigned mem_type)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_mem_type_manager *man = &bm->man[mem_type];
+	int ret = -EINVAL;
+
+	if (mem_type >= DRM_BO_MEM_TYPES) {
+		DRM_ERROR("Illegal memory type %d\n", mem_type);
+		return ret;
+	}
+
+	if (!man->has_type) {
+		DRM_ERROR("Trying to take down uninitialized "
+			  "memory manager type %u\n", mem_type);
+		return ret;
+	}
+	man->use_type = 0;
+	man->has_type = 0;
+
+	ret = 0;
+	if (mem_type > 0) {
+		BUG_ON(!list_empty(&bm->unfenced));
+		drm_bo_force_list_clean(dev, &man->lru, mem_type, 1, 0, 0);
+		drm_bo_force_list_clean(dev, &man->pinned, mem_type, 1, 0, 1);
+
+		if (drm_mm_clean(&man->manager)) {
+			drm_mm_takedown(&man->manager);
+		} else {
+			ret = -EBUSY;
+		}
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL(drm_bo_clean_mm);
+
+/**
+ *Evict all buffers of a particular mem_type, but leave memory manager
+ *regions for NO_MOVE buffers intact. New buffers cannot be added at this
+ *point since we have the hardware lock.
+ */
+
+static int drm_bo_lock_mm(struct drm_device *dev, unsigned mem_type)
+{
+	int ret;
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_mem_type_manager *man = &bm->man[mem_type];
+
+	if (mem_type == 0 || mem_type >= DRM_BO_MEM_TYPES) {
+		DRM_ERROR("Illegal memory manager memory type %u.\n", mem_type);
+		return -EINVAL;
+	}
+
+	if (!man->has_type) {
+		DRM_ERROR("Memory type %u has not been initialized.\n",
+			  mem_type);
+		return 0;
+	}
+
+	ret = drm_bo_force_list_clean(dev, &man->lru, mem_type, 0, 1, 0);
+	if (ret)
+		return ret;
+	ret = drm_bo_force_list_clean(dev, &man->pinned, mem_type, 0, 1, 1);
+
+	return ret;
+}
+
+int drm_bo_init_mm(struct drm_device *dev,
+		   unsigned type,
+		   unsigned long p_offset, unsigned long p_size)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	int ret = -EINVAL;
+	struct drm_mem_type_manager *man;
+
+	if (type >= DRM_BO_MEM_TYPES) {
+		DRM_ERROR("Illegal memory type %d\n", type);
+		return ret;
+	}
+
+	man = &bm->man[type];
+	if (man->has_type) {
+		DRM_ERROR("Memory manager already initialized for type %d\n",
+			  type);
+		return ret;
+	}
+
+	ret = dev->driver->bo_driver->init_mem_type(dev, type, man);
+	if (ret)
+		return ret;
+
+	ret = 0;
+	if (type != DRM_BO_MEM_LOCAL) {
+		if (!p_size) {
+			DRM_ERROR("Zero size memory manager type %d\n", type);
+			return ret;
+		}
+		ret = drm_mm_init(&man->manager, p_offset, p_size);
+		if (ret)
+			return ret;
+	}
+	man->has_type = 1;
+	man->use_type = 1;
+
+	INIT_LIST_HEAD(&man->lru);
+	INIT_LIST_HEAD(&man->pinned);
+
+	return 0;
+}
+EXPORT_SYMBOL(drm_bo_init_mm);
+
+/*
+ * This function is intended to be called on drm driver unload.
+ * If you decide to call it from lastclose, you must protect the call
+ * from a potentially racing drm_bo_driver_init in firstopen.
+ * (This may happen on X server restart).
+ */
+
+int drm_bo_driver_finish(struct drm_device *dev)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	int ret = 0;
+	unsigned i = DRM_BO_MEM_TYPES;
+	struct drm_mem_type_manager *man;
+
+	mutex_lock(&dev->struct_mutex);
+
+	if (!bm->initialized)
+		goto out;
+	bm->initialized = 0;
+
+	while (i--) {
+		man = &bm->man[i];
+		if (man->has_type) {
+			man->use_type = 0;
+			if ((i != DRM_BO_MEM_LOCAL) && drm_bo_clean_mm(dev, i)) {
+				ret = -EBUSY;
+				DRM_ERROR("DRM memory manager type %d "
+					  "is not clean.\n", i);
+			}
+			man->has_type = 0;
+		}
+	}
+	mutex_unlock(&dev->struct_mutex);
+
+	if (!cancel_delayed_work(&bm->wq))
+		flush_scheduled_work();
+
+	mutex_lock(&dev->struct_mutex);
+	drm_bo_delayed_delete(dev, 1);
+	if (list_empty(&bm->ddestroy))
+		DRM_DEBUG("Delayed destroy list was clean\n");
+
+	if (list_empty(&bm->man[0].lru))
+		DRM_DEBUG("Swap list was clean\n");
+
+	if (list_empty(&bm->man[0].pinned))
+		DRM_DEBUG("NO_MOVE list was clean\n");
+
+	if (list_empty(&bm->unfenced))
+		DRM_DEBUG("Unfenced list was clean\n");
+
+	__free_page(bm->dummy_read_page);
+
+out:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+EXPORT_SYMBOL(drm_bo_driver_finish);
+
+/*
+ * This function is intended to be called on drm driver load.
+ * If you decide to call it from firstopen, you must protect the call
+ * from a potentially racing drm_bo_driver_finish in lastclose.
+ * (This may happen on X server restart).
+ */
+
+int drm_bo_driver_init(struct drm_device *dev)
+{
+	struct drm_bo_driver *driver = dev->driver->bo_driver;
+	struct drm_buffer_manager *bm = &dev->bm;
+	int ret = -EINVAL;
+
+	bm->dummy_read_page = NULL;
+	drm_bo_init_lock(&bm->bm_lock);
+	mutex_lock(&dev->struct_mutex);
+	if (!driver)
+		goto out_unlock;
+
+	bm->dummy_read_page = alloc_page(__GFP_ZERO | GFP_DMA32);
+	if (!bm->dummy_read_page) {
+		ret = -ENOMEM;
+		goto out_unlock;
+	}
+
+
+	/*
+	 * Initialize the system memory buffer type.
+	 * Other types need to be driver / IOCTL initialized.
+	 */
+	ret = drm_bo_init_mm(dev, DRM_BO_MEM_LOCAL, 0, 0);
+	if (ret)
+		goto out_unlock;
+
+	INIT_DELAYED_WORK(&bm->wq, drm_bo_delayed_workqueue);
+
+	bm->initialized = 1;
+	bm->nice_mode = 1;
+	atomic_set(&bm->count, 0);
+	bm->cur_pages = 0;
+	INIT_LIST_HEAD(&bm->unfenced);
+	INIT_LIST_HEAD(&bm->ddestroy);
+out_unlock:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+EXPORT_SYMBOL(drm_bo_driver_init);
+
+int drm_mm_init_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_mm_init_arg *arg = data;
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_bo_driver *driver = dev->driver->bo_driver;
+	int ret;
+
+	if (!driver) {
+		DRM_ERROR("Buffer objects are not supported by this driver\n");
+		return -EINVAL;
+	}
+
+	ret = drm_bo_write_lock(&bm->bm_lock, file_priv);
+	if (ret)
+		return ret;
+
+	ret = -EINVAL;
+	if (arg->magic != DRM_BO_INIT_MAGIC) {
+		DRM_ERROR("You are using an old libdrm that is not compatible with\n"
+			  "\tthe kernel DRM module. Please upgrade your libdrm.\n");
+		return -EINVAL;
+	}
+	if (arg->major != DRM_BO_INIT_MAJOR) {
+		DRM_ERROR("libdrm and kernel DRM buffer object interface major\n"
+			  "\tversion don't match. Got %d, expected %d.\n",
+			  arg->major, DRM_BO_INIT_MAJOR);
+		return -EINVAL;
+	}
+
+	mutex_lock(&dev->struct_mutex);
+	if (!bm->initialized) {
+		DRM_ERROR("DRM memory manager was not initialized.\n");
+		goto out;
+	}
+	if (arg->mem_type == 0) {
+		DRM_ERROR("System memory buffers already initialized.\n");
+		goto out;
+	}
+	ret = drm_bo_init_mm(dev, arg->mem_type,
+			     arg->p_offset, arg->p_size);
+
+out:
+	mutex_unlock(&dev->struct_mutex);
+	(void) drm_bo_write_unlock(&bm->bm_lock, file_priv);
+
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int drm_mm_takedown_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_mm_type_arg *arg = data;
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_bo_driver *driver = dev->driver->bo_driver;
+	int ret;
+
+	if (!driver) {
+		DRM_ERROR("Buffer objects are not supported by this driver\n");
+		return -EINVAL;
+	}
+
+	ret = drm_bo_write_lock(&bm->bm_lock, file_priv);
+	if (ret)
+		return ret;
+
+	mutex_lock(&dev->struct_mutex);
+	ret = -EINVAL;
+	if (!bm->initialized) {
+		DRM_ERROR("DRM memory manager was not initialized\n");
+		goto out;
+	}
+	if (arg->mem_type == 0) {
+		DRM_ERROR("No takedown for System memory buffers.\n");
+		goto out;
+	}
+	ret = 0;
+	if (drm_bo_clean_mm(dev, arg->mem_type)) {
+		DRM_ERROR("Memory manager type %d not clean. "
+			  "Delaying takedown\n", arg->mem_type);
+	}
+out:
+	mutex_unlock(&dev->struct_mutex);
+	(void) drm_bo_write_unlock(&bm->bm_lock, file_priv);
+
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int drm_mm_lock_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	struct drm_mm_type_arg *arg = data;
+	struct drm_bo_driver *driver = dev->driver->bo_driver;
+	int ret;
+
+	if (!driver) {
+		DRM_ERROR("Buffer objects are not supported by this driver\n");
+		return -EINVAL;
+	}
+
+	if (arg->lock_flags & DRM_BO_LOCK_IGNORE_NO_EVICT) {
+		DRM_ERROR("Lock flag DRM_BO_LOCK_IGNORE_NO_EVICT not supported yet.\n");
+		return -EINVAL;
+	}
+
+	if (arg->lock_flags & DRM_BO_LOCK_UNLOCK_BM) {
+		ret = drm_bo_write_lock(&dev->bm.bm_lock, file_priv);
+		if (ret)
+			return ret;
+	}
+
+	mutex_lock(&dev->struct_mutex);
+	ret = drm_bo_lock_mm(dev, arg->mem_type);
+	mutex_unlock(&dev->struct_mutex);
+	if (ret) {
+		(void) drm_bo_write_unlock(&dev->bm.bm_lock, file_priv);
+		return ret;
+	}
+
+	return 0;
+}
+
+int drm_mm_unlock_ioctl(struct drm_device *dev,
+			void *data,
+			struct drm_file *file_priv)
+{
+	struct drm_mm_type_arg *arg = data;
+	struct drm_bo_driver *driver = dev->driver->bo_driver;
+	int ret;
+
+	if (!driver) {
+		DRM_ERROR("Buffer objects are not supported by this driver\n");
+		return -EINVAL;
+	}
+
+	if (arg->lock_flags & DRM_BO_LOCK_UNLOCK_BM) {
+		ret = drm_bo_write_unlock(&dev->bm.bm_lock, file_priv);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+/*
+ * buffer object vm functions.
+ */
+
+int drm_mem_reg_is_pci(struct drm_device *dev, struct drm_bo_mem_reg *mem)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_mem_type_manager *man = &bm->man[mem->mem_type];
+
+	if (!(man->flags & _DRM_FLAG_MEMTYPE_FIXED)) {
+		if (mem->mem_type == DRM_BO_MEM_LOCAL)
+			return 0;
+
+		if (man->flags & _DRM_FLAG_MEMTYPE_CMA)
+			return 0;
+
+		if (mem->flags & DRM_BO_FLAG_CACHED)
+			return 0;
+	}
+	return 1;
+}
+EXPORT_SYMBOL(drm_mem_reg_is_pci);
+
+/**
+ * \c Get the PCI offset for the buffer object memory.
+ *
+ * \param bo The buffer object.
+ * \param bus_base On return the base of the PCI region
+ * \param bus_offset On return the byte offset into the PCI region
+ * \param bus_size On return the byte size of the buffer object or zero if
+ *     the buffer object memory is not accessible through a PCI region.
+ * \return Failure indication.
+ *
+ * Returns -EINVAL if the buffer object is currently not mappable.
+ * Otherwise returns zero.
+ */
+
+int drm_bo_pci_offset(struct drm_device *dev,
+		      struct drm_bo_mem_reg *mem,
+		      unsigned long *bus_base,
+		      unsigned long *bus_offset, unsigned long *bus_size)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_mem_type_manager *man = &bm->man[mem->mem_type];
+
+	*bus_size = 0;
+	if (!(man->flags & _DRM_FLAG_MEMTYPE_MAPPABLE))
+		return -EINVAL;
+
+	if (drm_mem_reg_is_pci(dev, mem)) {
+		*bus_offset = mem->mm_node->start << PAGE_SHIFT;
+		*bus_size = mem->num_pages << PAGE_SHIFT;
+		*bus_base = man->io_offset;
+	}
+
+	return 0;
+}
+
+/**
+ * \c Kill all user-space virtual mappings of this buffer object.
+ *
+ * \param bo The buffer object.
+ *
+ * Call bo->mutex locked.
+ */
+
+void drm_bo_unmap_virtual(struct drm_buffer_object *bo)
+{
+	struct drm_device *dev = bo->dev;
+	loff_t offset = ((loff_t) bo->map_list.hash.key) << PAGE_SHIFT;
+	loff_t holelen = ((loff_t) bo->mem.num_pages) << PAGE_SHIFT;
+
+	if (!dev->dev_mapping)
+		return;
+
+	unmap_mapping_range(dev->dev_mapping, offset, holelen, 1);
+}
+
+static void drm_bo_takedown_vm_locked(struct drm_buffer_object *bo)
+{
+	struct drm_map_list *list;
+	drm_local_map_t *map;
+	struct drm_device *dev = bo->dev;
+
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+	if (bo->type != drm_bo_type_dc)
+		return;
+
+	list = &bo->map_list;
+	if (list->user_token) {
+		drm_ht_remove_item(&dev->map_hash, &list->hash);
+		list->user_token = 0;
+	}
+	if (list->file_offset_node) {
+		drm_mm_put_block(list->file_offset_node);
+		list->file_offset_node = NULL;
+	}
+
+	map = list->map;
+	if (!map)
+		return;
+
+	drm_free(map, sizeof(*map), DRM_MEM_BUFOBJ);
+	list->map = NULL;
+	list->user_token = 0ULL;
+	drm_bo_usage_deref_locked(&bo);
+}
+
+static int drm_bo_setup_vm_locked(struct drm_buffer_object *bo)
+{
+	struct drm_map_list *list = &bo->map_list;
+	drm_local_map_t *map;
+	struct drm_device *dev = bo->dev;
+
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+	list->map = drm_calloc(1, sizeof(*map), DRM_MEM_BUFOBJ);
+	if (!list->map)
+		return -ENOMEM;
+
+	map = list->map;
+	map->offset = 0;
+	map->type = _DRM_TTM;
+	map->flags = _DRM_REMOVABLE;
+	map->size = bo->mem.num_pages * PAGE_SIZE;
+	atomic_inc(&bo->usage);
+	map->handle = (void *)bo;
+
+	list->file_offset_node = drm_mm_search_free(&dev->offset_manager,
+						    bo->mem.num_pages, 0, 0);
+
+	if (!list->file_offset_node) {
+		drm_bo_takedown_vm_locked(bo);
+		return -ENOMEM;
+	}
+
+	list->file_offset_node = drm_mm_get_block(list->file_offset_node,
+						  bo->mem.num_pages, 0);
+	if (!list->file_offset_node) {
+		drm_bo_takedown_vm_locked(bo);
+		return -ENOMEM;
+	}
+
+	list->hash.key = list->file_offset_node->start;
+	if (drm_ht_insert_item(&dev->map_hash, &list->hash)) {
+		drm_bo_takedown_vm_locked(bo);
+		return -ENOMEM;
+	}
+
+	list->user_token = ((uint64_t) list->hash.key) << PAGE_SHIFT;
+
+	return 0;
+}
+
+int drm_bo_version_ioctl(struct drm_device *dev, void *data,
+			 struct drm_file *file_priv)
+{
+	struct drm_bo_version_arg *arg = (struct drm_bo_version_arg *)data;
+
+	arg->major = DRM_BO_INIT_MAJOR;
+	arg->minor = DRM_BO_INIT_MINOR;
+	arg->patchlevel = DRM_BO_INIT_PATCH;
+
+	return 0;
+}
Index: linux-2.6.28/drivers/gpu/drm/drm_bo_lock.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_bo_lock.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,175 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstr<74>m <thomas-at-tungstengraphics-dot-com>
+ */
+
+/*
+ * This file implements a simple replacement for the buffer manager use
+ * of the heavyweight hardware lock.
+ * The lock is a read-write lock. Taking it in read mode is fast, and
+ * intended for in-kernel use only.
+ * Taking it in write mode is slow.
+ *
+ * The write mode is used only when there is a need to block all
+ * user-space processes from allocating a
+ * new memory area.
+ * Typical use in write mode is X server VT switching, and it's allowed
+ * to leave kernel space with the write lock held. If a user-space process
+ * dies while having the write-lock, it will be released during the file
+ * descriptor release.
+ *
+ * The read lock is typically placed at the start of an IOCTL- or
+ * user-space callable function that may end up allocating a memory area.
+ * This includes setstatus, super-ioctls and no_pfn; the latter may move
+ * unmappable regions to mappable. It's a bug to leave kernel space with the
+ * read lock held.
+ *
+ * Both read- and write lock taking is interruptible for low signal-delivery
+ * latency. The locking functions will return -EAGAIN if interrupted by a
+ * signal.
+ *
+ * Locking order: The lock should be taken BEFORE any kernel mutexes
+ * or spinlocks.
+ */
+
+#include "drmP.h"
+
+void drm_bo_init_lock(struct drm_bo_lock *lock)
+{
+	DRM_INIT_WAITQUEUE(&lock->queue);
+	atomic_set(&lock->write_lock_pending, 0);
+	atomic_set(&lock->readers, 0);
+}
+
+void drm_bo_read_unlock(struct drm_bo_lock *lock)
+{
+	if (unlikely(atomic_add_negative(-1, &lock->readers)))
+		BUG();
+	if (atomic_read(&lock->readers) == 0)
+		wake_up_interruptible(&lock->queue);
+}
+EXPORT_SYMBOL(drm_bo_read_unlock);
+
+int drm_bo_read_lock(struct drm_bo_lock *lock)
+{
+	while (unlikely(atomic_read(&lock->write_lock_pending) != 0)) {
+		int ret;
+		ret = wait_event_interruptible
+		    (lock->queue, atomic_read(&lock->write_lock_pending) == 0);
+		if (ret)
+			return -EAGAIN;
+	}
+
+	while (unlikely(!atomic_add_unless(&lock->readers, 1, -1))) {
+		int ret;
+		ret = wait_event_interruptible
+		    (lock->queue, atomic_add_unless(&lock->readers, 1, -1));
+		if (ret)
+			return -EAGAIN;
+	}
+	return 0;
+}
+EXPORT_SYMBOL(drm_bo_read_lock);
+
+static int __drm_bo_write_unlock(struct drm_bo_lock *lock)
+{
+	if (unlikely(atomic_cmpxchg(&lock->readers, -1, 0) != -1))
+		return -EINVAL;
+	if (unlikely(atomic_cmpxchg(&lock->write_lock_pending, 1, 0) != 1))
+		return -EINVAL;
+	wake_up_interruptible(&lock->queue);
+	return 0;
+}
+
+static void drm_bo_write_lock_remove(struct drm_file *file_priv,
+				     struct drm_user_object *item)
+{
+	struct drm_bo_lock *lock = container_of(item, struct drm_bo_lock, base);
+	int ret;
+
+	ret = __drm_bo_write_unlock(lock);
+	BUG_ON(ret);
+}
+
+int drm_bo_write_lock(struct drm_bo_lock *lock, struct drm_file *file_priv)
+{
+	int ret = 0;
+	struct drm_device *dev;
+
+	if (unlikely(atomic_cmpxchg(&lock->write_lock_pending, 0, 1) != 0))
+		return -EINVAL;
+
+	while (unlikely(atomic_cmpxchg(&lock->readers, 0, -1) != 0)) {
+		ret = wait_event_interruptible
+		    (lock->queue, atomic_cmpxchg(&lock->readers, 0, -1) == 0);
+
+		if (ret) {
+			atomic_set(&lock->write_lock_pending, 0);
+			wake_up_interruptible(&lock->queue);
+			return -EAGAIN;
+		}
+	}
+
+	/*
+	 * Add a dummy user-object, the destructor of which will
+	 * make sure the lock is released if the client dies
+	 * while holding it.
+	 */
+
+	dev = file_priv->minor->dev;
+	mutex_lock(&dev->struct_mutex);
+	ret = drm_add_user_object(file_priv, &lock->base, 0);
+	lock->base.remove = &drm_bo_write_lock_remove;
+	lock->base.type = drm_lock_type;
+	if (ret)
+		(void)__drm_bo_write_unlock(lock);
+
+	mutex_unlock(&dev->struct_mutex);
+
+	return ret;
+}
+
+int drm_bo_write_unlock(struct drm_bo_lock *lock, struct drm_file *file_priv)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_ref_object *ro;
+
+	mutex_lock(&dev->struct_mutex);
+
+	if (lock->base.owner != file_priv) {
+		mutex_unlock(&dev->struct_mutex);
+		return -EINVAL;
+	}
+	ro = drm_lookup_ref_object(file_priv, &lock->base, _DRM_REF_USE);
+	BUG_ON(!ro);
+	drm_remove_ref_object(file_priv, ro);
+	lock->base.owner = NULL;
+
+	mutex_unlock(&dev->struct_mutex);
+	return 0;
+}
Index: linux-2.6.28/drivers/gpu/drm/drm_bo_move.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_bo_move.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,590 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstr<74>m <thomas-at-tungstengraphics-dot-com>
+ */
+
+#include "drmP.h"
+
+/**
+ * Free the old memory node unless it's a pinned region and we
+ * have not been requested to free also pinned regions.
+ */
+
+static void drm_bo_free_old_node(struct drm_buffer_object *bo)
+{
+	struct drm_bo_mem_reg *old_mem = &bo->mem;
+
+	if (old_mem->mm_node && (old_mem->mm_node != bo->pinned_node)) {
+		mutex_lock(&bo->dev->struct_mutex);
+		drm_mm_put_block(old_mem->mm_node);
+		mutex_unlock(&bo->dev->struct_mutex);
+	}
+	old_mem->mm_node = NULL;
+}
+
+int drm_bo_move_ttm(struct drm_buffer_object *bo,
+		    int evict, int no_wait, struct drm_bo_mem_reg *new_mem)
+{
+	struct drm_ttm *ttm = bo->ttm;
+	struct drm_bo_mem_reg *old_mem = &bo->mem;
+	uint64_t save_flags = old_mem->flags;
+	uint64_t save_mask = old_mem->mask;
+	int ret;
+
+	if (old_mem->mem_type != DRM_BO_MEM_LOCAL) {
+		if (evict)
+			drm_ttm_evict(ttm);
+		else
+			drm_ttm_unbind(ttm);
+
+		drm_bo_free_old_node(bo);
+		DRM_FLAG_MASKED(old_mem->flags,
+				DRM_BO_FLAG_CACHED | DRM_BO_FLAG_MAPPABLE |
+				DRM_BO_FLAG_MEM_LOCAL, DRM_BO_MASK_MEMTYPE);
+		old_mem->mem_type = DRM_BO_MEM_LOCAL;
+		save_flags = old_mem->flags;
+	}
+	if (new_mem->mem_type != DRM_BO_MEM_LOCAL) {
+		ret = drm_bind_ttm(ttm, new_mem);
+		if (ret)
+			return ret;
+	}
+
+	*old_mem = *new_mem;
+	new_mem->mm_node = NULL;
+	old_mem->mask = save_mask;
+	DRM_FLAG_MASKED(save_flags, new_mem->flags, DRM_BO_MASK_MEMTYPE);
+	return 0;
+}
+EXPORT_SYMBOL(drm_bo_move_ttm);
+
+/**
+ * \c Return a kernel virtual address to the buffer object PCI memory.
+ *
+ * \param bo The buffer object.
+ * \return Failure indication.
+ *
+ * Returns -EINVAL if the buffer object is currently not mappable.
+ * Returns -ENOMEM if the ioremap operation failed.
+ * Otherwise returns zero.
+ *
+ * After a successfull call, bo->iomap contains the virtual address, or NULL
+ * if the buffer object content is not accessible through PCI space.
+ * Call bo->mutex locked.
+ */
+
+int drm_mem_reg_ioremap(struct drm_device *dev, struct drm_bo_mem_reg *mem,
+			void **virtual)
+{
+	struct drm_buffer_manager *bm = &dev->bm;
+	struct drm_mem_type_manager *man = &bm->man[mem->mem_type];
+	unsigned long bus_offset;
+	unsigned long bus_size;
+	unsigned long bus_base;
+	int ret;
+	void *addr;
+
+	*virtual = NULL;
+	ret = drm_bo_pci_offset(dev, mem, &bus_base, &bus_offset, &bus_size);
+	if (ret || bus_size == 0)
+		return ret;
+
+	if (!(man->flags & _DRM_FLAG_NEEDS_IOREMAP))
+		addr = (void *)(((u8 *) man->io_addr) + bus_offset);
+	else {
+		addr = ioremap_nocache(bus_base + bus_offset, bus_size);
+		if (!addr)
+			return -ENOMEM;
+	}
+	*virtual = addr;
+	return 0;
+}
+EXPORT_SYMBOL(drm_mem_reg_ioremap);
+
+/**
+ * \c Unmap mapping obtained using drm_bo_ioremap
+ *
+ * \param bo The buffer object.
+ *
+ * Call bo->mutex locked.
+ */
+
+void drm_mem_reg_iounmap(struct drm_device *dev, struct drm_bo_mem_reg *mem,
+			 void *virtual)
+{
+	struct drm_buffer_manager *bm;
+	struct drm_mem_type_manager *man;
+
+	bm = &dev->bm;
+	man = &bm->man[mem->mem_type];
+
+	if (virtual && (man->flags & _DRM_FLAG_NEEDS_IOREMAP))
+		iounmap(virtual);
+}
+EXPORT_SYMBOL(drm_mem_reg_iounmap);
+
+static int drm_copy_io_page(void *dst, void *src, unsigned long page)
+{
+	uint32_t *dstP =
+	    (uint32_t *) ((unsigned long)dst + (page << PAGE_SHIFT));
+	uint32_t *srcP =
+	    (uint32_t *) ((unsigned long)src + (page << PAGE_SHIFT));
+
+	int i;
+	for (i = 0; i < PAGE_SIZE / sizeof(uint32_t); ++i)
+		iowrite32(ioread32(srcP++), dstP++);
+	return 0;
+}
+
+static int drm_copy_io_ttm_page(struct drm_ttm *ttm, void *src,
+				unsigned long page)
+{
+	struct page *d = drm_ttm_get_page(ttm, page);
+	void *dst;
+
+	if (!d)
+		return -ENOMEM;
+
+	src = (void *)((unsigned long)src + (page << PAGE_SHIFT));
+	dst = kmap(d);
+	if (!dst)
+		return -ENOMEM;
+
+	memcpy_fromio(dst, src, PAGE_SIZE);
+	kunmap(d);
+	return 0;
+}
+
+static int drm_copy_ttm_io_page(struct drm_ttm *ttm, void *dst, unsigned long page)
+{
+	struct page *s = drm_ttm_get_page(ttm, page);
+	void *src;
+
+	if (!s)
+		return -ENOMEM;
+
+	dst = (void *)((unsigned long)dst + (page << PAGE_SHIFT));
+	src = kmap(s);
+	if (!src)
+		return -ENOMEM;
+
+	memcpy_toio(dst, src, PAGE_SIZE);
+	kunmap(s);
+	return 0;
+}
+
+int drm_bo_move_memcpy(struct drm_buffer_object *bo,
+		       int evict, int no_wait, struct drm_bo_mem_reg *new_mem)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_mem_type_manager *man = &dev->bm.man[new_mem->mem_type];
+	struct drm_ttm *ttm = bo->ttm;
+	struct drm_bo_mem_reg *old_mem = &bo->mem;
+	struct drm_bo_mem_reg old_copy = *old_mem;
+	void *old_iomap;
+	void *new_iomap;
+	int ret;
+	uint64_t save_flags = old_mem->flags;
+	uint64_t save_mask = old_mem->mask;
+	unsigned long i;
+	unsigned long page;
+	unsigned long add = 0;
+	int dir;
+
+	ret = drm_mem_reg_ioremap(dev, old_mem, &old_iomap);
+	if (ret)
+		return ret;
+	ret = drm_mem_reg_ioremap(dev, new_mem, &new_iomap);
+	if (ret)
+		goto out;
+
+	if (old_iomap == NULL && new_iomap == NULL)
+		goto out2;
+	if (old_iomap == NULL && ttm == NULL)
+		goto out2;
+
+	add = 0;
+	dir = 1;
+
+	if ((old_mem->mem_type == new_mem->mem_type) &&
+	    (new_mem->mm_node->start <
+	     old_mem->mm_node->start + old_mem->mm_node->size)) {
+		dir = -1;
+		add = new_mem->num_pages - 1;
+	}
+
+	for (i = 0; i < new_mem->num_pages; ++i) {
+		page = i * dir + add;
+		if (old_iomap == NULL)
+			ret = drm_copy_ttm_io_page(ttm, new_iomap, page);
+		else if (new_iomap == NULL)
+			ret = drm_copy_io_ttm_page(ttm, old_iomap, page);
+		else
+			ret = drm_copy_io_page(new_iomap, old_iomap, page);
+		if (ret)
+			goto out1;
+	}
+	mb();
+out2:
+	drm_bo_free_old_node(bo);
+
+	*old_mem = *new_mem;
+	new_mem->mm_node = NULL;
+	old_mem->mask = save_mask;
+	DRM_FLAG_MASKED(save_flags, new_mem->flags, DRM_BO_MASK_MEMTYPE);
+
+	if ((man->flags & _DRM_FLAG_MEMTYPE_FIXED) && (ttm != NULL)) {
+		drm_ttm_unbind(ttm);
+		drm_destroy_ttm(ttm);
+		bo->ttm = NULL;
+	}
+
+out1:
+	drm_mem_reg_iounmap(dev, new_mem, new_iomap);
+out:
+	drm_mem_reg_iounmap(dev, &old_copy, old_iomap);
+	return ret;
+}
+EXPORT_SYMBOL(drm_bo_move_memcpy);
+
+/*
+ * Transfer a buffer object's memory and LRU status to a newly
+ * created object. User-space references remains with the old
+ * object. Call bo->mutex locked.
+ */
+
+int drm_buffer_object_transfer(struct drm_buffer_object *bo,
+			       struct drm_buffer_object **new_obj)
+{
+	struct drm_buffer_object *fbo;
+	struct drm_device *dev = bo->dev;
+	struct drm_buffer_manager *bm = &dev->bm;
+
+	fbo = drm_calloc(1, sizeof(*fbo), DRM_MEM_BUFOBJ);
+	if (!fbo)
+		return -ENOMEM;
+
+	*fbo = *bo;
+	mutex_init(&fbo->mutex);
+	mutex_lock(&fbo->mutex);
+	mutex_lock(&dev->struct_mutex);
+
+	DRM_INIT_WAITQUEUE(&bo->event_queue);
+	INIT_LIST_HEAD(&fbo->ddestroy);
+	INIT_LIST_HEAD(&fbo->lru);
+	INIT_LIST_HEAD(&fbo->pinned_lru);
+#ifdef DRM_ODD_MM_COMPAT
+	INIT_LIST_HEAD(&fbo->vma_list);
+	INIT_LIST_HEAD(&fbo->p_mm_list);
+#endif
+
+	fbo->fence = drm_fence_reference_locked(bo->fence);
+	fbo->pinned_node = NULL;
+	fbo->mem.mm_node->private = (void *)fbo;
+	atomic_set(&fbo->usage, 1);
+	atomic_inc(&bm->count);
+	mutex_unlock(&dev->struct_mutex);
+	mutex_unlock(&fbo->mutex);
+	bo->reserved_size = 0;
+	*new_obj = fbo;
+	return 0;
+}
+
+/*
+ * Since move is underway, we need to block signals in this function.
+ * We cannot restart until it has finished.
+ */
+
+int drm_bo_move_accel_cleanup(struct drm_buffer_object *bo,
+			      int evict, int no_wait, uint32_t fence_class,
+			      uint32_t fence_type, uint32_t fence_flags,
+			      struct drm_bo_mem_reg *new_mem)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_mem_type_manager *man = &dev->bm.man[new_mem->mem_type];
+	struct drm_bo_mem_reg *old_mem = &bo->mem;
+	int ret;
+	uint64_t save_flags = old_mem->flags;
+	uint64_t save_mask = old_mem->mask;
+	struct drm_buffer_object *old_obj;
+
+	if (bo->fence)
+		drm_fence_usage_deref_unlocked(&bo->fence);
+	ret = drm_fence_object_create(dev, fence_class, fence_type,
+				      fence_flags | DRM_FENCE_FLAG_EMIT,
+				      &bo->fence);
+	bo->fence_type = fence_type;
+	if (ret)
+		return ret;
+
+#ifdef DRM_ODD_MM_COMPAT
+	/*
+	 * In this mode, we don't allow pipelining a copy blit,
+	 * since the buffer will be accessible from user space
+	 * the moment we return and rebuild the page tables.
+	 *
+	 * With normal vm operation, page tables are rebuilt
+	 * on demand using fault(), which waits for buffer idle.
+	 */
+	if (1)
+#else
+	if (evict || ((bo->mem.mm_node == bo->pinned_node) &&
+		      bo->mem.mm_node != NULL))
+#endif
+	{
+		ret = drm_bo_wait(bo, 0, 1, 0);
+		if (ret)
+			return ret;
+
+		drm_bo_free_old_node(bo);
+
+		if ((man->flags & _DRM_FLAG_MEMTYPE_FIXED) && (bo->ttm != NULL)) {
+			drm_ttm_unbind(bo->ttm);
+			drm_destroy_ttm(bo->ttm);
+			bo->ttm = NULL;
+		}
+	} else {
+
+		/* This should help pipeline ordinary buffer moves.
+		 *
+		 * Hang old buffer memory on a new buffer object,
+		 * and leave it to be released when the GPU
+		 * operation has completed.
+		 */
+
+		ret = drm_buffer_object_transfer(bo, &old_obj);
+
+		if (ret)
+			return ret;
+
+		if (!(man->flags & _DRM_FLAG_MEMTYPE_FIXED))
+			old_obj->ttm = NULL;
+		else
+			bo->ttm = NULL;
+
+		mutex_lock(&dev->struct_mutex);
+		list_del_init(&old_obj->lru);
+		DRM_FLAG_MASKED(bo->priv_flags, 0, _DRM_BO_FLAG_UNFENCED);
+		drm_bo_add_to_lru(old_obj);
+
+		drm_bo_usage_deref_locked(&old_obj);
+		mutex_unlock(&dev->struct_mutex);
+
+	}
+
+	*old_mem = *new_mem;
+	new_mem->mm_node = NULL;
+	old_mem->mask = save_mask;
+	DRM_FLAG_MASKED(save_flags, new_mem->flags, DRM_BO_MASK_MEMTYPE);
+	return 0;
+}
+EXPORT_SYMBOL(drm_bo_move_accel_cleanup);
+
+int drm_bo_same_page(unsigned long offset,
+		     unsigned long offset2)
+{
+	return (offset & PAGE_MASK) == (offset2 & PAGE_MASK);
+}
+EXPORT_SYMBOL(drm_bo_same_page);
+
+unsigned long drm_bo_offset_end(unsigned long offset,
+				unsigned long end)
+{
+	offset = (offset + PAGE_SIZE) & PAGE_MASK;
+	return (end < offset) ? end : offset;
+}
+EXPORT_SYMBOL(drm_bo_offset_end);
+
+static pgprot_t drm_kernel_io_prot(uint32_t map_type)
+{
+	pgprot_t tmp = PAGE_KERNEL;
+
+#if defined(__i386__) || defined(__x86_64__)
+	if (boot_cpu_data.x86 > 3 && map_type != _DRM_AGP) {
+		pgprot_val(tmp) |= _PAGE_PCD;
+		pgprot_val(tmp) &= ~_PAGE_PWT;
+	}
+#elif defined(__powerpc__)
+	pgprot_val(tmp) |= _PAGE_NO_CACHE;
+	if (map_type == _DRM_REGISTERS)
+		pgprot_val(tmp) |= _PAGE_GUARDED;
+#endif
+#if defined(__ia64__)
+	if (map_type == _DRM_TTM)
+		tmp = pgprot_writecombine(tmp);
+	else
+		tmp = pgprot_noncached(tmp);
+#endif
+	return tmp;
+}
+
+static int drm_bo_ioremap(struct drm_buffer_object *bo, unsigned long bus_base,
+			  unsigned long bus_offset, unsigned long bus_size,
+			  struct drm_bo_kmap_obj *map)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_bo_mem_reg *mem = &bo->mem;
+	struct drm_mem_type_manager *man = &dev->bm.man[mem->mem_type];
+
+	if (!(man->flags & _DRM_FLAG_NEEDS_IOREMAP)) {
+		map->bo_kmap_type = bo_map_premapped;
+		map->virtual = (void *)(((u8 *) man->io_addr) + bus_offset);
+	} else {
+		map->bo_kmap_type = bo_map_iomap;
+		map->virtual = ioremap_nocache(bus_base + bus_offset, bus_size);
+	}
+	return (!map->virtual) ? -ENOMEM : 0;
+}
+
+static int drm_bo_kmap_ttm(struct drm_buffer_object *bo,
+			   unsigned long start_page, unsigned long num_pages,
+			   struct drm_bo_kmap_obj *map)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_bo_mem_reg *mem = &bo->mem;
+	struct drm_mem_type_manager *man = &dev->bm.man[mem->mem_type];
+	pgprot_t prot;
+	struct drm_ttm *ttm = bo->ttm;
+	struct page *d;
+	int i;
+
+	BUG_ON(!ttm);
+
+	if (num_pages == 1 && (mem->flags & DRM_BO_FLAG_CACHED)) {
+
+		/*
+		 * We're mapping a single page, and the desired
+		 * page protection is consistent with the bo.
+		 */
+
+		map->bo_kmap_type = bo_map_kmap;
+		map->page = drm_ttm_get_page(ttm, start_page);
+		map->virtual = kmap(map->page);
+	} else {
+		/*
+		 * Populate the part we're mapping;
+		 */
+
+		for (i = start_page; i < start_page + num_pages; ++i) {
+			d = drm_ttm_get_page(ttm, i);
+			if (!d)
+				return -ENOMEM;
+		}
+
+		/*
+		 * We need to use vmap to get the desired page protection
+		 * or to make the buffer object look contigous.
+		 */
+
+		prot = (mem->flags & DRM_BO_FLAG_CACHED) ?
+			PAGE_KERNEL :
+			drm_kernel_io_prot(man->drm_bus_maptype);
+		map->bo_kmap_type = bo_map_vmap;
+		map->virtual = vmap(ttm->pages + start_page,
+				    num_pages, 0, prot);
+	}
+	return (!map->virtual) ? -ENOMEM : 0;
+}
+
+/*
+ * This function is to be used for kernel mapping of buffer objects.
+ * It chooses the appropriate mapping method depending on the memory type
+ * and caching policy the buffer currently has.
+ * Mapping multiple pages or buffers that live in io memory is a bit slow and
+ * consumes vmalloc space. Be restrictive with such mappings.
+ * Mapping single pages usually returns the logical kernel address,
+ * (which is fast)
+ * BUG may use slower temporary mappings for high memory pages or
+ * uncached / write-combined pages.
+ *
+ * The function fills in a drm_bo_kmap_obj which can be used to return the
+ * kernel virtual address of the buffer.
+ *
+ * Code servicing a non-priviliged user request is only allowed to map one
+ * page at a time. We might need to implement a better scheme to stop such
+ * processes from consuming all vmalloc space.
+ */
+
+int drm_bo_kmap(struct drm_buffer_object *bo, unsigned long start_page,
+		unsigned long num_pages, struct drm_bo_kmap_obj *map)
+{
+	int ret;
+	unsigned long bus_base;
+	unsigned long bus_offset;
+	unsigned long bus_size;
+
+	map->virtual = NULL;
+
+	if (num_pages > bo->num_pages)
+		return -EINVAL;
+	if (start_page > bo->num_pages)
+		return -EINVAL;
+#if 0
+	if (num_pages > 1 && !DRM_SUSER(DRM_CURPROC))
+		return -EPERM;
+#endif
+	ret = drm_bo_pci_offset(bo->dev, &bo->mem, &bus_base,
+				&bus_offset, &bus_size);
+
+	if (ret)
+		return ret;
+
+	if (bus_size == 0) {
+		return drm_bo_kmap_ttm(bo, start_page, num_pages, map);
+	} else {
+		bus_offset += start_page << PAGE_SHIFT;
+		bus_size = num_pages << PAGE_SHIFT;
+		return drm_bo_ioremap(bo, bus_base, bus_offset, bus_size, map);
+	}
+}
+EXPORT_SYMBOL(drm_bo_kmap);
+
+void drm_bo_kunmap(struct drm_bo_kmap_obj *map)
+{
+	if (!map->virtual)
+		return;
+
+	switch (map->bo_kmap_type) {
+	case bo_map_iomap:
+		iounmap(map->virtual);
+		break;
+	case bo_map_vmap:
+		vunmap(map->virtual);
+		break;
+	case bo_map_kmap:
+		kunmap(map->page);
+		break;
+	case bo_map_premapped:
+		break;
+	default:
+		BUG();
+	}
+	map->virtual = NULL;
+	map->page = NULL;
+}
+EXPORT_SYMBOL(drm_bo_kunmap);
Index: linux-2.6.28/drivers/gpu/drm/drm_bufs.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/drm_bufs.c	2009-02-25 15:36:50.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_bufs.c	2009-02-25 15:37:02.000000000 +0000
@@ -435,6 +435,8 @@
 	case _DRM_GEM:
 		DRM_ERROR("tried to rmmap GEM object\n");
 		break;
+	case _DRM_TTM:
+		BUG_ON(1);
 	}
 	drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 
Index: linux-2.6.28/drivers/gpu/drm/drm_drv.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/drm_drv.c	2009-02-25 15:36:50.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_drv.c	2009-02-25 15:37:02.000000000 +0000
@@ -143,6 +143,34 @@
 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETFB, drm_mode_getfb, DRM_MASTER|DRM_CONTROL_ALLOW),
 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB, drm_mode_addfb, DRM_MASTER|DRM_CONTROL_ALLOW),
 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_RMFB, drm_mode_rmfb, DRM_MASTER|DRM_CONTROL_ALLOW),
+
+	DRM_IOCTL_DEF(DRM_IOCTL_MM_INIT, drm_mm_init_ioctl,
+		      DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
+	DRM_IOCTL_DEF(DRM_IOCTL_MM_TAKEDOWN, drm_mm_takedown_ioctl,
+		      DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
+	DRM_IOCTL_DEF(DRM_IOCTL_MM_LOCK, drm_mm_lock_ioctl,
+		      DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
+	DRM_IOCTL_DEF(DRM_IOCTL_MM_UNLOCK, drm_mm_unlock_ioctl,
+		      DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
+
+	DRM_IOCTL_DEF(DRM_IOCTL_FENCE_CREATE, drm_fence_create_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_FENCE_REFERENCE, drm_fence_reference_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_FENCE_UNREFERENCE, drm_fence_unreference_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_FENCE_SIGNALED, drm_fence_signaled_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_FENCE_FLUSH, drm_fence_flush_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_FENCE_WAIT, drm_fence_wait_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_FENCE_EMIT, drm_fence_emit_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_FENCE_BUFFERS, drm_fence_buffers_ioctl, DRM_AUTH),
+
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_CREATE, drm_bo_create_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_MAP, drm_bo_map_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_UNMAP, drm_bo_unmap_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_REFERENCE, drm_bo_reference_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_UNREFERENCE, drm_bo_unreference_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_SETSTATUS, drm_bo_setstatus_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_INFO, drm_bo_info_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_WAIT_IDLE, drm_bo_wait_idle_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_IOCTL_BO_VERSION, drm_bo_version_ioctl, 0),
 };
 
 #define DRM_CORE_IOCTL_COUNT	ARRAY_SIZE( drm_ioctls )
@@ -317,6 +345,9 @@
 	if (dev->driver->unload)
 		dev->driver->unload(dev);
 
+	drm_bo_driver_finish(dev);
+	drm_fence_manager_takedown(dev);
+
 	if (drm_core_has_AGP(dev) && dev->agp) {
 		drm_free(dev->agp, sizeof(*dev->agp), DRM_MEM_AGPLISTS);
 		dev->agp = NULL;
@@ -324,6 +355,8 @@
 
 	drm_ht_remove(&dev->map_hash);
 	drm_ctxbitmap_cleanup(dev);
+	drm_mm_takedown(&dev->offset_manager);
+	drm_ht_remove(&dev->object_hash);
 
 	if (drm_core_check_feature(dev, DRIVER_MODESET))
 		drm_put_minor(&dev->control);
@@ -336,6 +369,17 @@
 		DRM_ERROR("Cannot unload module\n");
 }
 
+void drm_cleanup_pci(struct pci_dev *pdev)
+{
+	struct drm_device *dev = pci_get_drvdata(pdev);
+
+	pci_set_drvdata(pdev, NULL);
+	pci_release_regions(pdev);
+	if (dev)
+		drm_cleanup(dev);
+}
+EXPORT_SYMBOL(drm_cleanup_pci);
+
 void drm_exit(struct drm_driver *driver)
 {
 	struct drm_device *dev, *tmp;
Index: linux-2.6.28/drivers/gpu/drm/drm_fence.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_fence.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,829 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstr<74>m <thomas-at-tungstengraphics-dot-com>
+ */
+
+#include "drmP.h"
+
+
+/*
+ * Convenience function to be called by fence::wait methods that
+ * need polling.
+ */
+
+int drm_fence_wait_polling(struct drm_fence_object *fence, int lazy,
+			   int interruptible, uint32_t mask,
+			   unsigned long end_jiffies)
+{
+	struct drm_device *dev = fence->dev;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fc = &fm->fence_class[fence->fence_class];
+	uint32_t count = 0;
+	int ret;
+
+	DECLARE_WAITQUEUE(entry, current);
+	add_wait_queue(&fc->fence_queue, &entry);
+
+	ret = 0;
+
+	for (;;) {
+		__set_current_state((interruptible) ?
+				    TASK_INTERRUPTIBLE :
+				    TASK_UNINTERRUPTIBLE);
+		if (drm_fence_object_signaled(fence, mask))
+			break;
+		if (time_after_eq(jiffies, end_jiffies)) {
+			ret = -EBUSY;
+			break;
+		}
+		if (lazy)
+			schedule_timeout(1);
+		else if ((++count & 0x0F) == 0){
+			__set_current_state(TASK_RUNNING);
+			schedule();
+			__set_current_state((interruptible) ?
+					    TASK_INTERRUPTIBLE :
+					    TASK_UNINTERRUPTIBLE);
+		}
+		if (interruptible && signal_pending(current)) {
+			ret = -EAGAIN;
+			break;
+		}
+	}
+	__set_current_state(TASK_RUNNING);
+	remove_wait_queue(&fc->fence_queue, &entry);
+	return ret;
+}
+EXPORT_SYMBOL(drm_fence_wait_polling);
+
+/*
+ * Typically called by the IRQ handler.
+ */
+
+void drm_fence_handler(struct drm_device *dev, uint32_t fence_class,
+		       uint32_t sequence, uint32_t type, uint32_t error)
+{
+	int wake = 0;
+	uint32_t diff;
+	uint32_t relevant_type;
+	uint32_t new_type;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fc = &fm->fence_class[fence_class];
+	struct drm_fence_driver *driver = dev->driver->fence_driver;
+	struct list_head *head;
+	struct drm_fence_object *fence, *next;
+	int found = 0;
+
+	if (list_empty(&fc->ring))
+		return;
+
+	list_for_each_entry(fence, &fc->ring, ring) {
+		diff = (sequence - fence->sequence) & driver->sequence_mask;
+		if (diff > driver->wrap_diff) {
+			found = 1;
+			break;
+		}
+	}
+
+	fc->waiting_types &= ~type;
+	head = (found) ? &fence->ring : &fc->ring;
+
+	list_for_each_entry_safe_reverse(fence, next, head, ring) {
+		if (&fence->ring == &fc->ring)
+			break;
+
+		if (error) {
+			fence->error = error;
+			fence->signaled_types = fence->type;
+			list_del_init(&fence->ring);
+			wake = 1;
+			break;
+		}
+
+		if (type & DRM_FENCE_TYPE_EXE)
+			type |= fence->native_types;
+
+		relevant_type = type & fence->type;
+		new_type = (fence->signaled_types | relevant_type) ^
+			fence->signaled_types;
+
+		if (new_type) {
+			fence->signaled_types |= new_type;
+			DRM_DEBUG("Fence 0x%08lx signaled 0x%08x\n",
+				  fence->base.hash.key, fence->signaled_types);
+
+			if (driver->needed_flush)
+				fc->pending_flush |= driver->needed_flush(fence);
+
+			if (new_type & fence->waiting_types)
+				wake = 1;
+		}
+
+		fc->waiting_types |= fence->waiting_types & ~fence->signaled_types;
+
+		if (!(fence->type & ~fence->signaled_types)) {
+			DRM_DEBUG("Fence completely signaled 0x%08lx\n",
+				  fence->base.hash.key);
+			list_del_init(&fence->ring);
+		}
+	}
+
+	/*
+	 * Reinstate lost waiting types.
+	 */
+
+	if ((fc->waiting_types & type) != type) {
+		head = head->prev;
+		list_for_each_entry(fence, head, ring) {
+			if (&fence->ring == &fc->ring)
+				break;
+			diff = (fc->highest_waiting_sequence - fence->sequence) &
+				driver->sequence_mask;
+			if (diff > driver->wrap_diff)
+				break;
+
+			fc->waiting_types |= fence->waiting_types & ~fence->signaled_types;
+		}
+	}
+
+	if (wake)
+		wake_up_all(&fc->fence_queue);
+}
+EXPORT_SYMBOL(drm_fence_handler);
+
+static void drm_fence_unring(struct drm_device *dev, struct list_head *ring)
+{
+	struct drm_fence_manager *fm = &dev->fm;
+	unsigned long flags;
+
+	write_lock_irqsave(&fm->lock, flags);
+	list_del_init(ring);
+	write_unlock_irqrestore(&fm->lock, flags);
+}
+
+void drm_fence_usage_deref_locked(struct drm_fence_object **fence)
+{
+	struct drm_fence_object *tmp_fence = *fence;
+	struct drm_device *dev = tmp_fence->dev;
+	struct drm_fence_manager *fm = &dev->fm;
+
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+	*fence = NULL;
+	if (atomic_dec_and_test(&tmp_fence->usage)) {
+		drm_fence_unring(dev, &tmp_fence->ring);
+		DRM_DEBUG("Destroyed a fence object 0x%08lx\n",
+			  tmp_fence->base.hash.key);
+		atomic_dec(&fm->count);
+		BUG_ON(!list_empty(&tmp_fence->base.list));
+		drm_free(tmp_fence, sizeof(*tmp_fence), DRM_MEM_FENCE);
+	}
+}
+EXPORT_SYMBOL(drm_fence_usage_deref_locked);
+
+void drm_fence_usage_deref_unlocked(struct drm_fence_object **fence)
+{
+	struct drm_fence_object *tmp_fence = *fence;
+	struct drm_device *dev = tmp_fence->dev;
+	struct drm_fence_manager *fm = &dev->fm;
+
+	*fence = NULL;
+	if (atomic_dec_and_test(&tmp_fence->usage)) {
+		mutex_lock(&dev->struct_mutex);
+		if (atomic_read(&tmp_fence->usage) == 0) {
+			drm_fence_unring(dev, &tmp_fence->ring);
+			atomic_dec(&fm->count);
+			BUG_ON(!list_empty(&tmp_fence->base.list));
+			drm_free(tmp_fence, sizeof(*tmp_fence), DRM_MEM_FENCE);
+		}
+		mutex_unlock(&dev->struct_mutex);
+	}
+}
+EXPORT_SYMBOL(drm_fence_usage_deref_unlocked);
+
+struct drm_fence_object
+*drm_fence_reference_locked(struct drm_fence_object *src)
+{
+	DRM_ASSERT_LOCKED(&src->dev->struct_mutex);
+
+	atomic_inc(&src->usage);
+	return src;
+}
+
+void drm_fence_reference_unlocked(struct drm_fence_object **dst,
+				  struct drm_fence_object *src)
+{
+	mutex_lock(&src->dev->struct_mutex);
+	*dst = src;
+	atomic_inc(&src->usage);
+	mutex_unlock(&src->dev->struct_mutex);
+}
+EXPORT_SYMBOL(drm_fence_reference_unlocked);
+
+static void drm_fence_object_destroy(struct drm_file *priv,
+				     struct drm_user_object *base)
+{
+	struct drm_fence_object *fence =
+	    drm_user_object_entry(base, struct drm_fence_object, base);
+
+	drm_fence_usage_deref_locked(&fence);
+}
+
+int drm_fence_object_signaled(struct drm_fence_object *fence, uint32_t mask)
+{
+	unsigned long flags;
+	int signaled;
+	struct drm_device *dev = fence->dev;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_driver *driver = dev->driver->fence_driver;
+
+	mask &= fence->type;
+	read_lock_irqsave(&fm->lock, flags);
+	signaled = (mask & fence->signaled_types) == mask;
+	read_unlock_irqrestore(&fm->lock, flags);
+	if (!signaled && driver->poll) {
+		write_lock_irqsave(&fm->lock, flags);
+		driver->poll(dev, fence->fence_class, mask);
+		signaled = (mask & fence->signaled_types) == mask;
+		write_unlock_irqrestore(&fm->lock, flags);
+	}
+	return signaled;
+}
+EXPORT_SYMBOL(drm_fence_object_signaled);
+
+
+int drm_fence_object_flush(struct drm_fence_object *fence,
+			   uint32_t type)
+{
+	struct drm_device *dev = fence->dev;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fc = &fm->fence_class[fence->fence_class];
+	struct drm_fence_driver *driver = dev->driver->fence_driver;
+	unsigned long irq_flags;
+	uint32_t saved_pending_flush;
+	uint32_t diff;
+	int call_flush;
+
+	if (type & ~fence->type) {
+		DRM_ERROR("Flush trying to extend fence type, "
+			  "0x%x, 0x%x\n", type, fence->type);
+		return -EINVAL;
+	}
+
+	write_lock_irqsave(&fm->lock, irq_flags);
+	fence->waiting_types |= type;
+	fc->waiting_types |= fence->waiting_types;
+	diff = (fence->sequence - fc->highest_waiting_sequence) &
+		driver->sequence_mask;
+
+	if (diff < driver->wrap_diff)
+		fc->highest_waiting_sequence = fence->sequence;
+
+	/*
+	 * fence->waiting_types has changed. Determine whether
+	 * we need to initiate some kind of flush as a result of this.
+	 */
+
+	saved_pending_flush = fc->pending_flush;
+	if (driver->needed_flush)
+		fc->pending_flush |= driver->needed_flush(fence);
+
+	if (driver->poll)
+		driver->poll(dev, fence->fence_class, fence->waiting_types);
+
+	call_flush = fc->pending_flush;
+	write_unlock_irqrestore(&fm->lock, irq_flags);
+
+	if (call_flush && driver->flush)
+		driver->flush(dev, fence->fence_class);
+
+	return 0;
+}
+EXPORT_SYMBOL(drm_fence_object_flush);
+
+/*
+ * Make sure old fence objects are signaled before their fence sequences are
+ * wrapped around and reused.
+ */
+
+void drm_fence_flush_old(struct drm_device *dev, uint32_t fence_class,
+			 uint32_t sequence)
+{
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fc = &fm->fence_class[fence_class];
+	struct drm_fence_object *fence;
+	unsigned long irq_flags;
+	struct drm_fence_driver *driver = dev->driver->fence_driver;
+	int call_flush;
+
+	uint32_t diff;
+
+	write_lock_irqsave(&fm->lock, irq_flags);
+
+	list_for_each_entry_reverse(fence, &fc->ring, ring) {
+		diff = (sequence - fence->sequence) & driver->sequence_mask;
+		if (diff <= driver->flush_diff)
+			break;
+
+		fence->waiting_types = fence->type;
+		fc->waiting_types |= fence->type;
+
+		if (driver->needed_flush)
+			fc->pending_flush |= driver->needed_flush(fence);
+	}
+
+	if (driver->poll)
+		driver->poll(dev, fence_class, fc->waiting_types);
+
+	call_flush = fc->pending_flush;
+	write_unlock_irqrestore(&fm->lock, irq_flags);
+
+	if (call_flush && driver->flush)
+		driver->flush(dev, fence->fence_class);
+
+	/*
+	 * FIXME: Shold we implement a wait here for really old fences?
+	 */
+
+}
+EXPORT_SYMBOL(drm_fence_flush_old);
+
+int drm_fence_object_wait(struct drm_fence_object *fence,
+			  int lazy, int ignore_signals, uint32_t mask)
+{
+	struct drm_device *dev = fence->dev;
+	struct drm_fence_driver *driver = dev->driver->fence_driver;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fc = &fm->fence_class[fence->fence_class];
+	int ret = 0;
+	unsigned long _end = 3 * DRM_HZ;
+
+	if (mask & ~fence->type) {
+		DRM_ERROR("Wait trying to extend fence type"
+			  " 0x%08x 0x%08x\n", mask, fence->type);
+		BUG();
+		return -EINVAL;
+	}
+
+	if (driver->wait)
+		return driver->wait(fence, lazy, !ignore_signals, mask);
+
+
+	drm_fence_object_flush(fence, mask);
+	if (driver->has_irq(dev, fence->fence_class, mask)) {
+		if (!ignore_signals)
+			ret = wait_event_interruptible_timeout
+				(fc->fence_queue,
+				 drm_fence_object_signaled(fence, mask),
+				 3 * DRM_HZ);
+		else
+			ret = wait_event_timeout
+				(fc->fence_queue,
+				 drm_fence_object_signaled(fence, mask),
+				 3 * DRM_HZ);
+
+		if (unlikely(ret == -ERESTARTSYS))
+			return -EAGAIN;
+
+		if (unlikely(ret == 0))
+			return -EBUSY;
+
+		return 0;
+	}
+
+	return drm_fence_wait_polling(fence, lazy, !ignore_signals, mask,
+				      _end);
+}
+EXPORT_SYMBOL(drm_fence_object_wait);
+
+
+
+int drm_fence_object_emit(struct drm_fence_object *fence, uint32_t fence_flags,
+			  uint32_t fence_class, uint32_t type)
+{
+	struct drm_device *dev = fence->dev;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_driver *driver = dev->driver->fence_driver;
+	struct drm_fence_class_manager *fc = &fm->fence_class[fence->fence_class];
+	unsigned long flags;
+	uint32_t sequence;
+	uint32_t native_types;
+	int ret;
+
+	drm_fence_unring(dev, &fence->ring);
+	ret = driver->emit(dev, fence_class, fence_flags, &sequence,
+			   &native_types);
+	if (ret)
+		return ret;
+
+	write_lock_irqsave(&fm->lock, flags);
+	fence->fence_class = fence_class;
+	fence->type = type;
+	fence->waiting_types = 0;
+	fence->signaled_types = 0;
+	fence->error = 0;
+	fence->sequence = sequence;
+	fence->native_types = native_types;
+	if (list_empty(&fc->ring))
+		fc->highest_waiting_sequence = sequence - 1;
+	list_add_tail(&fence->ring, &fc->ring);
+	fc->latest_queued_sequence = sequence;
+	write_unlock_irqrestore(&fm->lock, flags);
+	return 0;
+}
+EXPORT_SYMBOL(drm_fence_object_emit);
+
+static int drm_fence_object_init(struct drm_device *dev, uint32_t fence_class,
+				 uint32_t type,
+				 uint32_t fence_flags,
+				 struct drm_fence_object *fence)
+{
+	int ret = 0;
+	unsigned long flags;
+	struct drm_fence_manager *fm = &dev->fm;
+
+	mutex_lock(&dev->struct_mutex);
+	atomic_set(&fence->usage, 1);
+	mutex_unlock(&dev->struct_mutex);
+
+	write_lock_irqsave(&fm->lock, flags);
+	INIT_LIST_HEAD(&fence->ring);
+
+	/*
+	 *  Avoid hitting BUG() for kernel-only fence objects.
+	 */
+
+	INIT_LIST_HEAD(&fence->base.list);
+	fence->fence_class = fence_class;
+	fence->type = type;
+	fence->signaled_types = 0;
+	fence->waiting_types = 0;
+	fence->sequence = 0;
+	fence->error = 0;
+	fence->dev = dev;
+	write_unlock_irqrestore(&fm->lock, flags);
+	if (fence_flags & DRM_FENCE_FLAG_EMIT) {
+		ret = drm_fence_object_emit(fence, fence_flags,
+					    fence->fence_class, type);
+	}
+	return ret;
+}
+
+int drm_fence_add_user_object(struct drm_file *priv,
+			      struct drm_fence_object *fence, int shareable)
+{
+	struct drm_device *dev = priv->minor->dev;
+	int ret;
+
+	mutex_lock(&dev->struct_mutex);
+	ret = drm_add_user_object(priv, &fence->base, shareable);
+	if (ret)
+		goto out;
+	atomic_inc(&fence->usage);
+	fence->base.type = drm_fence_type;
+	fence->base.remove = &drm_fence_object_destroy;
+	DRM_DEBUG("Fence 0x%08lx created\n", fence->base.hash.key);
+out:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+EXPORT_SYMBOL(drm_fence_add_user_object);
+
+int drm_fence_object_create(struct drm_device *dev, uint32_t fence_class,
+			    uint32_t type, unsigned flags,
+			    struct drm_fence_object **c_fence)
+{
+	struct drm_fence_object *fence;
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+
+	fence = drm_calloc(1, sizeof(*fence), DRM_MEM_FENCE);
+	if (!fence) {
+		DRM_INFO("Out of memory creating fence object.\n");
+		return -ENOMEM;
+	}
+	ret = drm_fence_object_init(dev, fence_class, type, flags, fence);
+	if (ret) {
+		drm_fence_usage_deref_unlocked(&fence);
+		return ret;
+	}
+	*c_fence = fence;
+	atomic_inc(&fm->count);
+
+	return 0;
+}
+EXPORT_SYMBOL(drm_fence_object_create);
+
+void drm_fence_manager_init(struct drm_device *dev)
+{
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fence_class;
+	struct drm_fence_driver *fed = dev->driver->fence_driver;
+	int i;
+	unsigned long flags;
+
+	rwlock_init(&fm->lock);
+	write_lock_irqsave(&fm->lock, flags);
+	fm->initialized = 0;
+	if (!fed)
+	    goto out_unlock;
+
+	fm->initialized = 1;
+	fm->num_classes = fed->num_classes;
+	BUG_ON(fm->num_classes > _DRM_FENCE_CLASSES);
+
+	for (i = 0; i < fm->num_classes; ++i) {
+	    fence_class = &fm->fence_class[i];
+
+	    memset(fence_class, 0, sizeof(*fence_class));
+	    INIT_LIST_HEAD(&fence_class->ring);
+	    DRM_INIT_WAITQUEUE(&fence_class->fence_queue);
+	}
+
+	atomic_set(&fm->count, 0);
+ out_unlock:
+	write_unlock_irqrestore(&fm->lock, flags);
+}
+
+void drm_fence_fill_arg(struct drm_fence_object *fence,
+			struct drm_fence_arg *arg)
+{
+	struct drm_device *dev = fence->dev;
+	struct drm_fence_manager *fm = &dev->fm;
+	unsigned long irq_flags;
+
+	read_lock_irqsave(&fm->lock, irq_flags);
+	arg->handle = fence->base.hash.key;
+	arg->fence_class = fence->fence_class;
+	arg->type = fence->type;
+	arg->signaled = fence->signaled_types;
+	arg->error = fence->error;
+	arg->sequence = fence->sequence;
+	read_unlock_irqrestore(&fm->lock, irq_flags);
+}
+EXPORT_SYMBOL(drm_fence_fill_arg);
+
+void drm_fence_manager_takedown(struct drm_device *dev)
+{
+}
+
+struct drm_fence_object *drm_lookup_fence_object(struct drm_file *priv,
+						 uint32_t handle)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct drm_user_object *uo;
+	struct drm_fence_object *fence;
+
+	mutex_lock(&dev->struct_mutex);
+	uo = drm_lookup_user_object(priv, handle);
+	if (!uo || (uo->type != drm_fence_type)) {
+		mutex_unlock(&dev->struct_mutex);
+		return NULL;
+	}
+	fence = drm_fence_reference_locked(drm_user_object_entry(uo, struct drm_fence_object, base));
+	mutex_unlock(&dev->struct_mutex);
+	return fence;
+}
+
+int drm_fence_create_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_arg *arg = data;
+	struct drm_fence_object *fence;
+	ret = 0;
+
+	if (!fm->initialized) {
+		DRM_ERROR("The DRM driver does not support fencing.\n");
+		return -EINVAL;
+	}
+
+	if (arg->flags & DRM_FENCE_FLAG_EMIT)
+		LOCK_TEST_WITH_RETURN(dev, file_priv);
+	ret = drm_fence_object_create(dev, arg->fence_class,
+				      arg->type, arg->flags, &fence);
+	if (ret)
+		return ret;
+	ret = drm_fence_add_user_object(file_priv, fence,
+					arg->flags &
+					DRM_FENCE_FLAG_SHAREABLE);
+	if (ret) {
+		drm_fence_usage_deref_unlocked(&fence);
+		return ret;
+	}
+
+	/*
+	 * usage > 0. No need to lock dev->struct_mutex;
+	 */
+
+	arg->handle = fence->base.hash.key;
+
+	drm_fence_fill_arg(fence, arg);
+	drm_fence_usage_deref_unlocked(&fence);
+
+	return ret;
+}
+
+int drm_fence_reference_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_arg *arg = data;
+	struct drm_fence_object *fence;
+	struct drm_user_object *uo;
+	ret = 0;
+
+	if (!fm->initialized) {
+		DRM_ERROR("The DRM driver does not support fencing.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_user_object_ref(file_priv, arg->handle, drm_fence_type, &uo);
+	if (ret)
+		return ret;
+	fence = drm_lookup_fence_object(file_priv, arg->handle);
+	drm_fence_fill_arg(fence, arg);
+	drm_fence_usage_deref_unlocked(&fence);
+
+	return ret;
+}
+
+
+int drm_fence_unreference_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_arg *arg = data;
+	ret = 0;
+
+	if (!fm->initialized) {
+		DRM_ERROR("The DRM driver does not support fencing.\n");
+		return -EINVAL;
+	}
+
+	return drm_user_object_unref(file_priv, arg->handle, drm_fence_type);
+}
+
+int drm_fence_signaled_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_arg *arg = data;
+	struct drm_fence_object *fence;
+	ret = 0;
+
+	if (!fm->initialized) {
+		DRM_ERROR("The DRM driver does not support fencing.\n");
+		return -EINVAL;
+	}
+
+	fence = drm_lookup_fence_object(file_priv, arg->handle);
+	if (!fence)
+		return -EINVAL;
+
+	drm_fence_fill_arg(fence, arg);
+	drm_fence_usage_deref_unlocked(&fence);
+
+	return ret;
+}
+
+int drm_fence_flush_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_arg *arg = data;
+	struct drm_fence_object *fence;
+	ret = 0;
+
+	if (!fm->initialized) {
+		DRM_ERROR("The DRM driver does not support fencing.\n");
+		return -EINVAL;
+	}
+
+	fence = drm_lookup_fence_object(file_priv, arg->handle);
+	if (!fence)
+		return -EINVAL;
+	ret = drm_fence_object_flush(fence, arg->type);
+
+	drm_fence_fill_arg(fence, arg);
+	drm_fence_usage_deref_unlocked(&fence);
+
+	return ret;
+}
+
+
+int drm_fence_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_arg *arg = data;
+	struct drm_fence_object *fence;
+	ret = 0;
+
+	if (!fm->initialized) {
+		DRM_ERROR("The DRM driver does not support fencing.\n");
+		return -EINVAL;
+	}
+
+	fence = drm_lookup_fence_object(file_priv, arg->handle);
+	if (!fence)
+		return -EINVAL;
+	ret = drm_fence_object_wait(fence,
+				    arg->flags & DRM_FENCE_FLAG_WAIT_LAZY,
+				    0, arg->type);
+
+	drm_fence_fill_arg(fence, arg);
+	drm_fence_usage_deref_unlocked(&fence);
+
+	return ret;
+}
+
+
+int drm_fence_emit_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_arg *arg = data;
+	struct drm_fence_object *fence;
+	ret = 0;
+
+	if (!fm->initialized) {
+		DRM_ERROR("The DRM driver does not support fencing.\n");
+		return -EINVAL;
+	}
+
+	LOCK_TEST_WITH_RETURN(dev, file_priv);
+	fence = drm_lookup_fence_object(file_priv, arg->handle);
+	if (!fence)
+		return -EINVAL;
+	ret = drm_fence_object_emit(fence, arg->flags, arg->fence_class,
+				    arg->type);
+
+	drm_fence_fill_arg(fence, arg);
+	drm_fence_usage_deref_unlocked(&fence);
+
+	return ret;
+}
+
+int drm_fence_buffers_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv)
+{
+	int ret;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_arg *arg = data;
+	struct drm_fence_object *fence;
+	ret = 0;
+
+	if (!fm->initialized) {
+		DRM_ERROR("The DRM driver does not support fencing.\n");
+		return -EINVAL;
+	}
+
+	if (!dev->bm.initialized) {
+		DRM_ERROR("Buffer object manager is not initialized\n");
+		return -EINVAL;
+	}
+	LOCK_TEST_WITH_RETURN(dev, file_priv);
+	ret = drm_fence_buffer_objects(dev, NULL, arg->flags,
+				       NULL, &fence);
+	if (ret)
+		return ret;
+
+	if (!(arg->flags & DRM_FENCE_FLAG_NO_USER)) {
+		ret = drm_fence_add_user_object(file_priv, fence,
+						arg->flags &
+						DRM_FENCE_FLAG_SHAREABLE);
+		if (ret)
+			return ret;
+	}
+
+	arg->handle = fence->base.hash.key;
+
+	drm_fence_fill_arg(fence, arg);
+	drm_fence_usage_deref_unlocked(&fence);
+
+	return ret;
+}
Index: linux-2.6.28/drivers/gpu/drm/drm_fops.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/drm_fops.c	2009-02-25 15:36:50.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_fops.c	2009-02-25 15:37:02.000000000 +0000
@@ -1,3 +1,4 @@
+
 /**
  * \file drm_fops.c
  * File operations for DRM
@@ -232,6 +233,7 @@
 	int minor_id = iminor(inode);
 	struct drm_file *priv;
 	int ret;
+	int i, j;
 
 	if (filp->f_flags & O_EXCL)
 		return -EBUSY;	/* No exclusive opens */
@@ -257,10 +259,24 @@
 
 	INIT_LIST_HEAD(&priv->lhead);
 	INIT_LIST_HEAD(&priv->fbs);
+	INIT_LIST_HEAD(&priv->refd_objects);
 
 	if (dev->driver->driver_features & DRIVER_GEM)
 		drm_gem_open(dev, priv);
 
+	for (i = 0; i < _DRM_NO_REF_TYPES; ++i) {
+		ret = drm_ht_create(&priv->refd_object_hash[i],
+				    DRM_FILE_HASH_ORDER);
+		if (ret)
+			break;
+	}
+
+	if (ret) {
+		for (j = 0; j < i; ++j)
+			drm_ht_remove(&priv->refd_object_hash[j]);
+		goto out_free;
+	}
+
 	if (dev->driver->open) {
 		ret = dev->driver->open(dev, priv);
 		if (ret < 0)
Index: linux-2.6.28/drivers/gpu/drm/drm_irq.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/drm_irq.c	2009-02-25 15:36:50.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_irq.c	2009-02-25 15:37:02.000000000 +0000
@@ -124,6 +124,7 @@
 
 	dev->num_crtcs = 0;
 }
+EXPORT_SYMBOL(drm_vblank_cleanup);
 
 int drm_vblank_init(struct drm_device *dev, int num_crtcs)
 {
@@ -697,7 +698,7 @@
  *
  * If a signal is not requested, then calls vblank_wait().
  */
-static void drm_vbl_send_signals(struct drm_device *dev, int crtc)
+void drm_vbl_send_signals(struct drm_device *dev, int crtc)
 {
 	struct drm_vbl_sig *vbl_sig, *tmp;
 	struct list_head *vbl_sigs;
@@ -726,6 +727,7 @@
 
 	spin_unlock_irqrestore(&dev->vbl_lock, flags);
 }
+EXPORT_SYMBOL(drm_vbl_send_signals);
 
 /**
  * drm_handle_vblank - handle a vblank event
Index: linux-2.6.28/drivers/gpu/drm/drm_object.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_object.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,294 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstr<74>m <thomas-at-tungstengraphics-dot-com>
+ */
+
+#include "drmP.h"
+
+int drm_add_user_object(struct drm_file *priv, struct drm_user_object *item,
+			int shareable)
+{
+	struct drm_device *dev = priv->minor->dev;
+	int ret;
+
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+
+	/* The refcount will be bumped to 1 when we add the ref object below. */
+	atomic_set(&item->refcount, 0);
+	item->shareable = shareable;
+	item->owner = priv;
+
+	ret = drm_ht_just_insert_please(&dev->object_hash, &item->hash,
+					(unsigned long)item, 32, 0, 0);
+	if (ret)
+		return ret;
+
+	ret = drm_add_ref_object(priv, item, _DRM_REF_USE);
+	if (ret)
+		ret = drm_ht_remove_item(&dev->object_hash, &item->hash);
+
+	return ret;
+}
+EXPORT_SYMBOL(drm_add_user_object);
+
+struct drm_user_object *drm_lookup_user_object(struct drm_file *priv, uint32_t key)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct drm_hash_item *hash;
+	int ret;
+	struct drm_user_object *item;
+
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+
+	ret = drm_ht_find_item(&dev->object_hash, key, &hash);
+	if (ret)
+		return NULL;
+
+	item = drm_hash_entry(hash, struct drm_user_object, hash);
+
+	if (priv != item->owner) {
+		struct drm_open_hash *ht = &priv->refd_object_hash[_DRM_REF_USE];
+		ret = drm_ht_find_item(ht, (unsigned long)item, &hash);
+		if (ret) {
+			DRM_ERROR("Object not registered for usage\n");
+			return NULL;
+		}
+	}
+	return item;
+}
+EXPORT_SYMBOL(drm_lookup_user_object);
+
+static void drm_deref_user_object(struct drm_file *priv, struct drm_user_object *item)
+{
+	struct drm_device *dev = priv->minor->dev;
+	int ret;
+
+	if (atomic_dec_and_test(&item->refcount)) {
+		ret = drm_ht_remove_item(&dev->object_hash, &item->hash);
+		BUG_ON(ret);
+		item->remove(priv, item);
+	}
+}
+
+static int drm_object_ref_action(struct drm_file *priv, struct drm_user_object *ro,
+				 enum drm_ref_type action)
+{
+	int ret = 0;
+
+	switch (action) {
+	case _DRM_REF_USE:
+		atomic_inc(&ro->refcount);
+		break;
+	default:
+		if (!ro->ref_struct_locked) {
+			break;
+		} else {
+			ro->ref_struct_locked(priv, ro, action);
+		}
+	}
+	return ret;
+}
+
+int drm_add_ref_object(struct drm_file *priv, struct drm_user_object *referenced_object,
+		       enum drm_ref_type ref_action)
+{
+	int ret = 0;
+	struct drm_ref_object *item;
+	struct drm_open_hash *ht = &priv->refd_object_hash[ref_action];
+
+	DRM_ASSERT_LOCKED(&priv->minor->dev->struct_mutex);
+	if (!referenced_object->shareable && priv != referenced_object->owner) {
+		DRM_ERROR("Not allowed to reference this object\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * If this is not a usage reference, Check that usage has been registered
+	 * first. Otherwise strange things may happen on destruction.
+	 */
+
+	if ((ref_action != _DRM_REF_USE) && priv != referenced_object->owner) {
+		item =
+		    drm_lookup_ref_object(priv, referenced_object,
+					  _DRM_REF_USE);
+		if (!item) {
+			DRM_ERROR
+			    ("Object not registered for usage by this client\n");
+			return -EINVAL;
+		}
+	}
+
+	if (NULL !=
+	    (item =
+	     drm_lookup_ref_object(priv, referenced_object, ref_action))) {
+		atomic_inc(&item->refcount);
+		return drm_object_ref_action(priv, referenced_object,
+					     ref_action);
+	}
+
+	item = drm_calloc(1, sizeof(*item), DRM_MEM_OBJECTS);
+	if (item == NULL) {
+		DRM_ERROR("Could not allocate reference object\n");
+		return -ENOMEM;
+	}
+
+	atomic_set(&item->refcount, 1);
+	item->hash.key = (unsigned long)referenced_object;
+	ret = drm_ht_insert_item(ht, &item->hash);
+	item->unref_action = ref_action;
+
+	if (ret)
+		goto out;
+
+	list_add(&item->list, &priv->refd_objects);
+	ret = drm_object_ref_action(priv, referenced_object, ref_action);
+out:
+	return ret;
+}
+
+struct drm_ref_object *drm_lookup_ref_object(struct drm_file *priv,
+					struct drm_user_object *referenced_object,
+					enum drm_ref_type ref_action)
+{
+	struct drm_hash_item *hash;
+	int ret;
+
+	DRM_ASSERT_LOCKED(&priv->minor->dev->struct_mutex);
+	ret = drm_ht_find_item(&priv->refd_object_hash[ref_action],
+			       (unsigned long)referenced_object, &hash);
+	if (ret)
+		return NULL;
+
+	return drm_hash_entry(hash, struct drm_ref_object, hash);
+}
+EXPORT_SYMBOL(drm_lookup_ref_object);
+
+static void drm_remove_other_references(struct drm_file *priv,
+					struct drm_user_object *ro)
+{
+	int i;
+	struct drm_open_hash *ht;
+	struct drm_hash_item *hash;
+	struct drm_ref_object *item;
+
+	for (i = _DRM_REF_USE + 1; i < _DRM_NO_REF_TYPES; ++i) {
+		ht = &priv->refd_object_hash[i];
+		while (!drm_ht_find_item(ht, (unsigned long)ro, &hash)) {
+			item = drm_hash_entry(hash, struct drm_ref_object, hash);
+			drm_remove_ref_object(priv, item);
+		}
+	}
+}
+
+void drm_remove_ref_object(struct drm_file *priv, struct drm_ref_object *item)
+{
+	int ret;
+	struct drm_user_object *user_object = (struct drm_user_object *) item->hash.key;
+	struct drm_open_hash *ht = &priv->refd_object_hash[item->unref_action];
+	enum drm_ref_type unref_action;
+
+	DRM_ASSERT_LOCKED(&priv->minor->dev->struct_mutex);
+	unref_action = item->unref_action;
+	if (atomic_dec_and_test(&item->refcount)) {
+		ret = drm_ht_remove_item(ht, &item->hash);
+		BUG_ON(ret);
+		list_del_init(&item->list);
+		if (unref_action == _DRM_REF_USE)
+			drm_remove_other_references(priv, user_object);
+		drm_free(item, sizeof(*item), DRM_MEM_OBJECTS);
+	}
+
+	switch (unref_action) {
+	case _DRM_REF_USE:
+		drm_deref_user_object(priv, user_object);
+		break;
+	default:
+		BUG_ON(!user_object->unref);
+		user_object->unref(priv, user_object, unref_action);
+		break;
+	}
+
+}
+EXPORT_SYMBOL(drm_remove_ref_object);
+
+int drm_user_object_ref(struct drm_file *priv, uint32_t user_token,
+			enum drm_object_type type, struct drm_user_object **object)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct drm_user_object *uo;
+	struct drm_hash_item *hash;
+	int ret;
+
+	mutex_lock(&dev->struct_mutex);
+	ret = drm_ht_find_item(&dev->object_hash, user_token, &hash);
+	if (ret) {
+		DRM_ERROR("Could not find user object to reference.\n");
+		goto out_err;
+	}
+	uo = drm_hash_entry(hash, struct drm_user_object, hash);
+	if (uo->type != type) {
+		ret = -EINVAL;
+		goto out_err;
+	}
+	ret = drm_add_ref_object(priv, uo, _DRM_REF_USE);
+	if (ret)
+		goto out_err;
+	mutex_unlock(&dev->struct_mutex);
+	*object = uo;
+	return 0;
+out_err:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
+int drm_user_object_unref(struct drm_file *priv, uint32_t user_token,
+			  enum drm_object_type type)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct drm_user_object *uo;
+	struct drm_ref_object *ro;
+	int ret;
+
+	mutex_lock(&dev->struct_mutex);
+	uo = drm_lookup_user_object(priv, user_token);
+	if (!uo || (uo->type != type)) {
+		ret = -EINVAL;
+		goto out_err;
+	}
+	ro = drm_lookup_ref_object(priv, uo, _DRM_REF_USE);
+	if (!ro) {
+		ret = -EINVAL;
+		goto out_err;
+	}
+	drm_remove_ref_object(priv, ro);
+	mutex_unlock(&dev->struct_mutex);
+	return 0;
+out_err:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
Index: linux-2.6.28/drivers/gpu/drm/drm_regman.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_regman.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,200 @@
+/**************************************************************************
+ * Copyright (c) 2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * An allocate-fence manager implementation intended for sets of base-registers
+ * or tiling-registers.
+ */
+
+#include "drmP.h"
+
+/*
+ * Allocate a compatible register and put it on the unfenced list.
+ */
+
+int drm_regs_alloc(struct drm_reg_manager *manager,
+		   const void *data,
+		   uint32_t fence_class,
+		   uint32_t fence_type,
+		   int interruptible, int no_wait, struct drm_reg **reg)
+{
+	struct drm_reg *entry, *next_entry;
+	int ret;
+
+	*reg = NULL;
+
+	/*
+	 * Search the unfenced list.
+	 */
+
+	list_for_each_entry(entry, &manager->unfenced, head) {
+		if (manager->reg_reusable(entry, data)) {
+			entry->new_fence_type |= fence_type;
+			goto out;
+		}
+	}
+
+	/*
+	 * Search the lru list.
+	 */
+
+	list_for_each_entry_safe(entry, next_entry, &manager->lru, head) {
+		struct drm_fence_object *fence = entry->fence;
+		if (fence->fence_class == fence_class &&
+		    (entry->fence_type & fence_type) == entry->fence_type &&
+		    manager->reg_reusable(entry, data)) {
+			list_del(&entry->head);
+			entry->new_fence_type = fence_type;
+			list_add_tail(&entry->head, &manager->unfenced);
+			goto out;
+		}
+	}
+
+	/*
+	 * Search the free list.
+	 */
+
+	list_for_each_entry(entry, &manager->free, head) {
+		list_del(&entry->head);
+		entry->new_fence_type = fence_type;
+		list_add_tail(&entry->head, &manager->unfenced);
+		goto out;
+	}
+
+	if (no_wait)
+		return -EBUSY;
+
+	/*
+	 * Go back to the lru list and try to expire fences.
+	 */
+
+	list_for_each_entry_safe(entry, next_entry, &manager->lru, head) {
+		BUG_ON(!entry->fence);
+		ret = drm_fence_object_wait(entry->fence, 0, !interruptible,
+					    entry->fence_type);
+		if (ret)
+			return ret;
+
+		drm_fence_usage_deref_unlocked(&entry->fence);
+		list_del(&entry->head);
+		entry->new_fence_type = fence_type;
+		list_add_tail(&entry->head, &manager->unfenced);
+		goto out;
+	}
+
+	/*
+	 * Oops. All registers are used up :(.
+	 */
+
+	return -EBUSY;
+out:
+	*reg = entry;
+	return 0;
+}
+EXPORT_SYMBOL(drm_regs_alloc);
+
+void drm_regs_fence(struct drm_reg_manager *manager,
+		    struct drm_fence_object *fence)
+{
+	struct drm_reg *entry;
+	struct drm_reg *next_entry;
+
+	if (!fence) {
+
+		/*
+		 * Old fence (if any) is still valid.
+		 * Put back on free and lru lists.
+		 */
+
+		list_for_each_entry_safe_reverse(entry, next_entry,
+						 &manager->unfenced, head) {
+			list_del(&entry->head);
+			list_add(&entry->head, (entry->fence) ?
+				 &manager->lru : &manager->free);
+		}
+	} else {
+
+		/*
+		 * Fence with a new fence and put on lru list.
+		 */
+
+		list_for_each_entry_safe(entry, next_entry, &manager->unfenced,
+					 head) {
+			list_del(&entry->head);
+			if (entry->fence)
+				drm_fence_usage_deref_unlocked(&entry->fence);
+			drm_fence_reference_unlocked(&entry->fence, fence);
+
+			entry->fence_type = entry->new_fence_type;
+			BUG_ON((entry->fence_type & fence->type) !=
+			       entry->fence_type);
+
+			list_add_tail(&entry->head, &manager->lru);
+		}
+	}
+}
+EXPORT_SYMBOL(drm_regs_fence);
+
+void drm_regs_free(struct drm_reg_manager *manager)
+{
+	struct drm_reg *entry;
+	struct drm_reg *next_entry;
+
+	drm_regs_fence(manager, NULL);
+
+	list_for_each_entry_safe(entry, next_entry, &manager->free, head) {
+		list_del(&entry->head);
+		manager->reg_destroy(entry);
+	}
+
+	list_for_each_entry_safe(entry, next_entry, &manager->lru, head) {
+
+		(void)drm_fence_object_wait(entry->fence, 1, 1,
+					    entry->fence_type);
+		list_del(&entry->head);
+		drm_fence_usage_deref_unlocked(&entry->fence);
+		manager->reg_destroy(entry);
+	}
+}
+EXPORT_SYMBOL(drm_regs_free);
+
+void drm_regs_add(struct drm_reg_manager *manager, struct drm_reg *reg)
+{
+	reg->fence = NULL;
+	list_add_tail(&reg->head, &manager->free);
+}
+EXPORT_SYMBOL(drm_regs_add);
+
+void drm_regs_init(struct drm_reg_manager *manager,
+		   int (*reg_reusable) (const struct drm_reg *, const void *),
+		   void (*reg_destroy) (struct drm_reg *))
+{
+	INIT_LIST_HEAD(&manager->free);
+	INIT_LIST_HEAD(&manager->lru);
+	INIT_LIST_HEAD(&manager->unfenced);
+	manager->reg_reusable = reg_reusable;
+	manager->reg_destroy = reg_destroy;
+}
+EXPORT_SYMBOL(drm_regs_init);
Index: linux-2.6.28/drivers/gpu/drm/drm_stub.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/drm_stub.c	2009-02-25 15:36:50.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_stub.c	2009-02-25 15:37:02.000000000 +0000
@@ -201,6 +201,7 @@
 	init_timer(&dev->timer);
 	mutex_init(&dev->struct_mutex);
 	mutex_init(&dev->ctxlist_mutex);
+	mutex_init(&dev->bm.evict_mutex);
 
 	idr_init(&dev->drw_idr);
 
@@ -216,6 +217,18 @@
 		return -ENOMEM;
 	}
 
+	if (drm_mm_init(&dev->offset_manager, DRM_FILE_PAGE_OFFSET_START,
+			DRM_FILE_PAGE_OFFSET_SIZE)) {
+		drm_ht_remove(&dev->map_hash);
+		return -ENOMEM;
+	}
+
+	if (drm_ht_create(&dev->object_hash, DRM_OBJECT_HASH_ORDER)) {
+		drm_ht_remove(&dev->map_hash);
+		drm_mm_takedown(&dev->offset_manager);
+		return -ENOMEM;
+	}
+
 	/* the DRM has 6 basic counters */
 	dev->counters = 6;
 	dev->types[0] = _DRM_STAT_LOCK;
@@ -261,6 +274,7 @@
 		}
 	}
 
+	drm_fence_manager_init(dev);
 	return 0;
 
       error_out_unreg:
@@ -409,6 +423,8 @@
 	drm_free(dev, sizeof(*dev), DRM_MEM_STUB);
 	return ret;
 }
+EXPORT_SYMBOL(drm_get_dev);
+
 
 /**
  * Put a device minor number.
Index: linux-2.6.28/drivers/gpu/drm/drm_ttm.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_ttm.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,430 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstr<74>m <thomas-at-tungstengraphics-dot-com>
+ */
+
+#include "drmP.h"
+#include <asm/agp.h>
+
+static void drm_ttm_ipi_handler(void *null)
+{
+	flush_agp_cache();
+}
+
+void drm_ttm_cache_flush(void)
+{
+	if (on_each_cpu(drm_ttm_ipi_handler, NULL, 1) != 0)
+		DRM_ERROR("Timed out waiting for drm cache flush.\n");
+}
+EXPORT_SYMBOL(drm_ttm_cache_flush);
+
+/*
+ * Use kmalloc if possible. Otherwise fall back to vmalloc.
+ */
+
+static void ttm_alloc_pages(struct drm_ttm *ttm)
+{
+	unsigned long size = ttm->num_pages * sizeof(*ttm->pages);
+	ttm->pages = NULL;
+
+	if (size <= PAGE_SIZE)
+		ttm->pages = drm_calloc(1, size, DRM_MEM_TTM);
+
+	if (!ttm->pages) {
+		ttm->pages = vmalloc_user(size);
+		if (ttm->pages)
+			ttm->page_flags |= DRM_TTM_PAGE_VMALLOC;
+	}
+}
+
+static void ttm_free_pages(struct drm_ttm *ttm)
+{
+	unsigned long size = ttm->num_pages * sizeof(*ttm->pages);
+
+	if (ttm->page_flags & DRM_TTM_PAGE_VMALLOC) {
+		vfree(ttm->pages);
+		ttm->page_flags &= ~DRM_TTM_PAGE_VMALLOC;
+	} else {
+		drm_free(ttm->pages, size, DRM_MEM_TTM);
+	}
+	ttm->pages = NULL;
+}
+
+static struct page *drm_ttm_alloc_page(void)
+{
+	struct page *page;
+
+	page = alloc_page(GFP_KERNEL | __GFP_ZERO | GFP_DMA32);
+	if (!page)
+		return NULL;
+	return page;
+}
+
+/*
+ * Change caching policy for the linear kernel map
+ * for range of pages in a ttm.
+ */
+
+static int drm_set_caching(struct drm_ttm *ttm, int noncached)
+{
+	int i;
+	struct page **cur_page;
+	int do_tlbflush = 0;
+
+	if ((ttm->page_flags & DRM_TTM_PAGE_UNCACHED) == noncached)
+		return 0;
+
+	if (noncached)
+		drm_ttm_cache_flush();
+
+	for (i = 0; i < ttm->num_pages; ++i) {
+		cur_page = ttm->pages + i;
+		if (*cur_page) {
+			if (!PageHighMem(*cur_page)) {
+				if (noncached) {
+					map_page_into_agp(*cur_page);
+				} else {
+					unmap_page_from_agp(*cur_page);
+				}
+				do_tlbflush = 1;
+			}
+		}
+	}
+	//if (do_tlbflush)
+	//	flush_agp_mappings();
+
+	DRM_FLAG_MASKED(ttm->page_flags, noncached, DRM_TTM_PAGE_UNCACHED);
+
+	return 0;
+}
+
+
+static void drm_ttm_free_user_pages(struct drm_ttm *ttm)
+{
+	int write;
+	int dirty;
+	struct page *page;
+	int i;
+
+	BUG_ON(!(ttm->page_flags & DRM_TTM_PAGE_USER));
+	write = ((ttm->page_flags & DRM_TTM_PAGE_USER_WRITE) != 0);
+	dirty = ((ttm->page_flags & DRM_TTM_PAGE_USER_DIRTY) != 0);
+
+	for (i = 0; i < ttm->num_pages; ++i) {
+		page = ttm->pages[i];
+		if (page == NULL)
+			continue;
+
+		if (page == ttm->dummy_read_page) {
+			BUG_ON(write);
+			continue;
+		}
+
+		if (write && dirty && !PageReserved(page))
+			set_page_dirty_lock(page);
+
+		ttm->pages[i] = NULL;
+		put_page(page);
+	}
+}
+
+static void drm_ttm_free_alloced_pages(struct drm_ttm *ttm)
+{
+	int i;
+	struct drm_buffer_manager *bm = &ttm->dev->bm;
+	struct page **cur_page;
+
+	for (i = 0; i < ttm->num_pages; ++i) {
+		cur_page = ttm->pages + i;
+		if (*cur_page) {
+			if (page_count(*cur_page) != 1)
+				DRM_ERROR("Erroneous page count. Leaking pages.\n");
+			if (page_mapped(*cur_page))
+				DRM_ERROR("Erroneous map count. Leaking page mappings.\n");
+			__free_page(*cur_page);
+			--bm->cur_pages;
+		}
+	}
+}
+
+/*
+ * Free all resources associated with a ttm.
+ */
+
+int drm_destroy_ttm(struct drm_ttm *ttm)
+{
+	struct drm_ttm_backend *be;
+
+	if (!ttm)
+		return 0;
+
+	be = ttm->be;
+	if (be) {
+		be->func->destroy(be);
+		ttm->be = NULL;
+	}
+
+	if (ttm->pages) {
+		if (ttm->page_flags & DRM_TTM_PAGE_UNCACHED)
+			drm_set_caching(ttm, 0);
+
+		if (ttm->page_flags & DRM_TTM_PAGE_USER)
+			drm_ttm_free_user_pages(ttm);
+		else
+			drm_ttm_free_alloced_pages(ttm);
+
+		ttm_free_pages(ttm);
+	}
+
+	return 0;
+}
+
+struct page *drm_ttm_get_page(struct drm_ttm *ttm, int index)
+{
+	struct page *p;
+	struct drm_buffer_manager *bm = &ttm->dev->bm;
+
+	p = ttm->pages[index];
+	if (!p) {
+		p = drm_ttm_alloc_page();
+		if (!p)
+			return NULL;
+		ttm->pages[index] = p;
+		++bm->cur_pages;
+	}
+	return p;
+}
+EXPORT_SYMBOL(drm_ttm_get_page);
+
+int drm_ttm_set_user(struct drm_ttm *ttm,
+		     struct task_struct *tsk,
+		     int write,
+		     unsigned long start,
+		     unsigned long num_pages,
+		     struct page *dummy_read_page)
+{
+	struct mm_struct *mm = tsk->mm;
+	int ret;
+	int i;
+
+	BUG_ON(num_pages != ttm->num_pages);
+
+	ttm->dummy_read_page = dummy_read_page;
+	ttm->page_flags |= DRM_TTM_PAGE_USER |
+		((write) ? DRM_TTM_PAGE_USER_WRITE : 0);
+
+
+	down_read(&mm->mmap_sem);
+	ret = get_user_pages(tsk, mm, start, num_pages,
+			     write, 0, ttm->pages, NULL);
+	up_read(&mm->mmap_sem);
+
+	if (ret != num_pages && write) {
+		drm_ttm_free_user_pages(ttm);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < num_pages; ++i) {
+		if (ttm->pages[i] == NULL)
+			ttm->pages[i] = ttm->dummy_read_page;
+	}
+
+	return 0;
+}
+
+int drm_ttm_populate(struct drm_ttm *ttm)
+{
+	struct page *page;
+	unsigned long i;
+	struct drm_ttm_backend *be;
+
+	if (ttm->state != ttm_unpopulated)
+		return 0;
+
+	be = ttm->be;
+	for (i = 0; i < ttm->num_pages; ++i) {
+		page = drm_ttm_get_page(ttm, i);
+		if (!page)
+			return -ENOMEM;
+	}
+	be->func->populate(be, ttm->num_pages, ttm->pages);
+	ttm->state = ttm_unbound;
+	return 0;
+}
+
+static inline size_t drm_size_align(size_t size)
+{
+	size_t tmpSize = 4;
+	if (size > PAGE_SIZE)
+		return PAGE_ALIGN(size);
+	while (tmpSize < size)
+		tmpSize <<= 1;
+
+	return (size_t) tmpSize;
+}
+
+/*
+ * Calculate the estimated pinned memory usage of a ttm.
+ */
+
+unsigned long drm_ttm_size(struct drm_device *dev,
+			   unsigned long num_pages,
+			   int user_bo)
+{
+	struct drm_bo_driver *bo_driver = dev->driver->bo_driver;
+	unsigned long tmp;
+
+	tmp = drm_size_align(sizeof(struct drm_ttm)) +
+		drm_size_align(num_pages * sizeof(struct page *)) +
+		((user_bo) ? 0 : drm_size_align(num_pages * PAGE_SIZE));
+
+	if (bo_driver->backend_size)
+		tmp += bo_driver->backend_size(dev, num_pages);
+	else
+		tmp += drm_size_align(num_pages * sizeof(struct page *)) +
+			3*drm_size_align(sizeof(struct drm_ttm_backend));
+	return tmp;
+}
+
+
+/*
+ * Initialize a ttm.
+ */
+
+struct drm_ttm *drm_ttm_init(struct drm_device *dev, unsigned long size)
+{
+	struct drm_bo_driver *bo_driver = dev->driver->bo_driver;
+	struct drm_ttm *ttm;
+
+	if (!bo_driver)
+		return NULL;
+
+	ttm = drm_calloc(1, sizeof(*ttm), DRM_MEM_TTM);
+	if (!ttm)
+		return NULL;
+
+	ttm->dev = dev;
+	atomic_set(&ttm->vma_count, 0);
+
+	ttm->destroy = 0;
+	ttm->num_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+	ttm->page_flags = 0;
+
+	/*
+	 * Account also for AGP module memory usage.
+	 */
+
+	ttm_alloc_pages(ttm);
+	if (!ttm->pages) {
+		drm_destroy_ttm(ttm);
+		DRM_ERROR("Failed allocating page table\n");
+		return NULL;
+	}
+	ttm->be = bo_driver->create_ttm_backend_entry(dev);
+	if (!ttm->be) {
+		drm_destroy_ttm(ttm);
+		DRM_ERROR("Failed creating ttm backend entry\n");
+		return NULL;
+	}
+	ttm->state = ttm_unpopulated;
+	return ttm;
+}
+
+/*
+ * Unbind a ttm region from the aperture.
+ */
+
+void drm_ttm_evict(struct drm_ttm *ttm)
+{
+	struct drm_ttm_backend *be = ttm->be;
+	int ret;
+
+	if (ttm->state == ttm_bound) {
+		ret = be->func->unbind(be);
+		BUG_ON(ret);
+	}
+
+	ttm->state = ttm_evicted;
+}
+
+void drm_ttm_fixup_caching(struct drm_ttm *ttm)
+{
+
+	if (ttm->state == ttm_evicted) {
+		struct drm_ttm_backend *be = ttm->be;
+		if (be->func->needs_ub_cache_adjust(be))
+			drm_set_caching(ttm, 0);
+		ttm->state = ttm_unbound;
+	}
+}
+
+void drm_ttm_unbind(struct drm_ttm *ttm)
+{
+	if (ttm->state == ttm_bound)
+		drm_ttm_evict(ttm);
+
+	drm_ttm_fixup_caching(ttm);
+}
+
+int drm_bind_ttm(struct drm_ttm *ttm, struct drm_bo_mem_reg *bo_mem)
+{
+	struct drm_bo_driver *bo_driver = ttm->dev->driver->bo_driver;
+	int ret = 0;
+	struct drm_ttm_backend *be;
+
+	if (!ttm)
+		return -EINVAL;
+	if (ttm->state == ttm_bound)
+		return 0;
+
+	be = ttm->be;
+
+	ret = drm_ttm_populate(ttm);
+	if (ret)
+		return ret;
+
+	if (ttm->state == ttm_unbound && !(bo_mem->flags & DRM_BO_FLAG_CACHED))
+		drm_set_caching(ttm, DRM_TTM_PAGE_UNCACHED);
+	else if ((bo_mem->flags & DRM_BO_FLAG_CACHED_MAPPED) &&
+		   bo_driver->ttm_cache_flush)
+		bo_driver->ttm_cache_flush(ttm);
+
+	ret = be->func->bind(be, bo_mem);
+	if (ret) {
+		ttm->state = ttm_evicted;
+		DRM_ERROR("Couldn't bind backend.\n");
+		return ret;
+	}
+
+	ttm->state = ttm_bound;
+	if (ttm->page_flags & DRM_TTM_PAGE_USER)
+		ttm->page_flags |= DRM_TTM_PAGE_USER_DIRTY;
+	return 0;
+}
+EXPORT_SYMBOL(drm_bind_ttm);
Index: linux-2.6.28/drivers/gpu/drm/drm_vm.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/drm_vm.c	2009-02-25 15:36:50.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_vm.c	2009-02-25 15:37:02.000000000 +0000
@@ -40,6 +40,10 @@
 
 static void drm_vm_open(struct vm_area_struct *vma);
 static void drm_vm_close(struct vm_area_struct *vma);
+static int drm_bo_mmap_locked(struct vm_area_struct *vma,
+			      struct file *filp,
+			      drm_local_map_t *map);
+
 
 static pgprot_t drm_io_prot(uint32_t map_type, struct vm_area_struct *vma)
 {
@@ -270,6 +274,9 @@
 			case _DRM_GEM:
 				DRM_ERROR("tried to rmmap GEM object\n");
 				break;
+			case _DRM_TTM:
+				BUG_ON(1);
+				break;
 			}
 			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 		}
@@ -650,6 +657,8 @@
 		vma->vm_flags |= VM_RESERVED;
 		vma->vm_page_prot = drm_dma_prot(map->type, vma);
 		break;
+	case _DRM_TTM:
+		return drm_bo_mmap_locked(vma, filp, map);
 	default:
 		return -EINVAL;	/* This should never happen. */
 	}
@@ -674,3 +683,213 @@
 	return ret;
 }
 EXPORT_SYMBOL(drm_mmap);
+
+/**
+ * buffer object vm functions.
+ */
+
+/**
+ * \c Pagefault method for buffer objects.
+ *
+ * \param vma Virtual memory area.
+ * \param address File offset.
+ * \return Error or refault. The pfn is manually inserted.
+ *
+ * It's important that pfns are inserted while holding the bo->mutex lock.
+ * otherwise we might race with unmap_mapping_range() which is always
+ * called with the bo->mutex lock held.
+ *
+ * We're modifying the page attribute bits of the vma->vm_page_prot field,
+ * without holding the mmap_sem in write mode. Only in read mode.
+ * These bits are not used by the mm subsystem code, and we consider them
+ * protected by the bo->mutex lock.
+ */
+
+#define DRM_NOPFN_EXTRA 15 /* Fault 16 pages at a time in */
+
+int drm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+	struct drm_buffer_object *bo = (struct drm_buffer_object *) vma->vm_private_data;
+	unsigned long page_offset;
+	struct page *page = NULL;
+	struct drm_ttm *ttm = NULL;
+	struct drm_device *dev;
+	unsigned long pfn;
+	int err;
+	unsigned long bus_base;
+	unsigned long bus_offset;
+	unsigned long bus_size;
+	int i;
+	unsigned long ret = VM_FAULT_NOPAGE;
+	unsigned long address = (unsigned long)vmf->virtual_address;
+
+	if (address > vma->vm_end)
+		return VM_FAULT_SIGBUS;
+
+	dev = bo->dev;
+	err = drm_bo_read_lock(&dev->bm.bm_lock);
+	if (err)
+		return VM_FAULT_NOPAGE;
+
+	err = mutex_lock_interruptible(&bo->mutex);
+	if (err) {
+		drm_bo_read_unlock(&dev->bm.bm_lock);
+		return VM_FAULT_NOPAGE;
+	}
+
+	err = drm_bo_wait(bo, 0, 0, 0);
+	if (err) {
+		ret = (err != -EAGAIN) ? VM_FAULT_SIGBUS : VM_FAULT_NOPAGE;
+		goto out_unlock;
+	}
+
+	/*
+	 * If buffer happens to be in a non-mappable location,
+	 * move it to a mappable.
+	 */
+
+	if (!(bo->mem.flags & DRM_BO_FLAG_MAPPABLE)) {
+		uint32_t new_mask = bo->mem.mask |
+			DRM_BO_FLAG_MAPPABLE |
+			DRM_BO_FLAG_FORCE_MAPPABLE;
+		err = drm_bo_move_buffer(bo, new_mask, 0, 0);
+		if (err) {
+			ret = (err != -EAGAIN) ? VM_FAULT_SIGBUS : VM_FAULT_NOPAGE;
+			goto out_unlock;
+		}
+	}
+
+	err = drm_bo_pci_offset(dev, &bo->mem, &bus_base, &bus_offset,
+				&bus_size);
+
+	if (err) {
+		ret = VM_FAULT_SIGBUS;
+		goto out_unlock;
+	}
+
+	page_offset = (address - vma->vm_start) >> PAGE_SHIFT;
+
+	if (bus_size) {
+		struct drm_mem_type_manager *man = &dev->bm.man[bo->mem.mem_type];
+
+		pfn = ((bus_base + bus_offset) >> PAGE_SHIFT) + page_offset;
+		vma->vm_page_prot = drm_io_prot(man->drm_bus_maptype, vma);
+	} else {
+		ttm = bo->ttm;
+
+		drm_ttm_fixup_caching(ttm);
+		page = drm_ttm_get_page(ttm, page_offset);
+		if (!page) {
+			ret = VM_FAULT_OOM;
+			goto out_unlock;
+		}
+		pfn = page_to_pfn(page);
+		vma->vm_page_prot = (bo->mem.flags & DRM_BO_FLAG_CACHED) ?
+			vm_get_page_prot(vma->vm_flags) :
+			drm_io_prot(_DRM_TTM, vma);
+	}
+
+	err = vm_insert_pfn(vma, address, pfn);
+	if (err) {
+		ret = (err != -EAGAIN) ? VM_FAULT_OOM : VM_FAULT_NOPAGE;
+		goto out_unlock;
+	}
+
+	for (i=0; i<DRM_NOPFN_EXTRA; ++i) {
+
+		if (++page_offset == bo->mem.num_pages)
+			break;
+		address = vma->vm_start + (page_offset << PAGE_SHIFT);
+		if (address >= vma->vm_end)
+			break;
+		if (bus_size) {
+			pfn = ((bus_base + bus_offset) >> PAGE_SHIFT)
+				+ page_offset;
+		} else {
+			page = drm_ttm_get_page(ttm, page_offset);
+			if (!page)
+				break;
+			pfn = page_to_pfn(page);
+		}
+		if (vm_insert_pfn(vma, address, pfn))
+			break;
+	}
+out_unlock:
+	mutex_unlock(&bo->mutex);
+	drm_bo_read_unlock(&dev->bm.bm_lock);
+	return ret;
+}
+EXPORT_SYMBOL(drm_bo_vm_fault);
+
+static void drm_bo_vm_open_locked(struct vm_area_struct *vma)
+{
+	struct drm_buffer_object *bo = (struct drm_buffer_object *) vma->vm_private_data;
+
+	drm_vm_open_locked(vma);
+	atomic_inc(&bo->usage);
+}
+
+/**
+ * \c vma open method for buffer objects.
+ *
+ * \param vma virtual memory area.
+ */
+
+static void drm_bo_vm_open(struct vm_area_struct *vma)
+{
+	struct drm_buffer_object *bo = (struct drm_buffer_object *) vma->vm_private_data;
+	struct drm_device *dev = bo->dev;
+
+	mutex_lock(&dev->struct_mutex);
+	drm_bo_vm_open_locked(vma);
+	mutex_unlock(&dev->struct_mutex);
+}
+
+/**
+ * \c vma close method for buffer objects.
+ *
+ * \param vma virtual memory area.
+ */
+
+static void drm_bo_vm_close(struct vm_area_struct *vma)
+{
+	struct drm_buffer_object *bo = (struct drm_buffer_object *) vma->vm_private_data;
+	struct drm_device *dev = bo->dev;
+
+	drm_vm_close(vma);
+	if (bo) {
+		mutex_lock(&dev->struct_mutex);
+		drm_bo_usage_deref_locked((struct drm_buffer_object **)
+					  &vma->vm_private_data);
+		mutex_unlock(&dev->struct_mutex);
+	}
+	return;
+}
+
+static struct vm_operations_struct drm_bo_vm_ops = {
+	.fault = drm_bo_vm_fault,
+	.open = drm_bo_vm_open,
+	.close = drm_bo_vm_close,
+};
+
+/**
+ * mmap buffer object memory.
+ *
+ * \param vma virtual memory area.
+ * \param file_priv DRM file private.
+ * \param map The buffer object drm map.
+ * \return zero on success or a negative number on failure.
+ */
+
+int drm_bo_mmap_locked(struct vm_area_struct *vma,
+		       struct file *filp,
+		       drm_local_map_t *map)
+{
+	vma->vm_ops = &drm_bo_vm_ops;
+	vma->vm_private_data = map->handle;
+	vma->vm_file = filp;
+	vma->vm_flags |= VM_RESERVED | VM_IO;
+	vma->vm_flags |= VM_PFNMAP;
+	drm_bo_vm_open_locked(vma);
+	return 0;
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/Makefile
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/Makefile	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,12 @@
+#
+# Makefile for the drm device driver.  This driver provides support for the
+# Direct Rendering Infrastructure (DRI) in XFree86 4.1.0 and higher.
+
+ccflags-y := -Iinclude/drm
+
+psb-y := psb_drv.o psb_mmu.o psb_sgx.o psb_irq.o psb_fence.o psb_buffer.o \
+	 psb_gtt.o psb_fb.o psb_msvdx.o \
+	 psb_msvdxinit.o psb_regman.o psb_reset.o psb_scene.o \
+	 psb_schedule.o psb_xhw.o
+
+obj-$(CONFIG_DRM_PSB) += psb.o
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_buffer.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_buffer.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,437 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thomas-at-tungstengraphics.com>
+ */
+#include "drmP.h"
+#include "psb_drv.h"
+#include "psb_schedule.h"
+
+struct drm_psb_ttm_backend {
+	struct drm_ttm_backend base;
+	struct page **pages;
+	unsigned int desired_tile_stride;
+	unsigned int hw_tile_stride;
+	int mem_type;
+	unsigned long offset;
+	unsigned long num_pages;
+};
+
+int psb_fence_types(struct drm_buffer_object *bo, uint32_t * class,
+		    uint32_t * type)
+{
+	switch (*class) {
+	case PSB_ENGINE_TA:
+		*type = DRM_FENCE_TYPE_EXE |
+		    _PSB_FENCE_TYPE_TA_DONE | _PSB_FENCE_TYPE_RASTER_DONE;
+		if (bo->mem.mask & PSB_BO_FLAG_TA)
+			*type &= ~_PSB_FENCE_TYPE_RASTER_DONE;
+		if (bo->mem.mask & PSB_BO_FLAG_SCENE)
+			*type |= _PSB_FENCE_TYPE_SCENE_DONE;
+		if (bo->mem.mask & PSB_BO_FLAG_FEEDBACK)
+			*type |= _PSB_FENCE_TYPE_FEEDBACK;
+		break;
+	default:
+		*type = DRM_FENCE_TYPE_EXE;
+	}
+	return 0;
+}
+
+static inline size_t drm_size_align(size_t size)
+{
+	size_t tmpSize = 4;
+	if (size > PAGE_SIZE)
+		return PAGE_ALIGN(size);
+	while (tmpSize < size)
+		tmpSize <<= 1;
+
+	return (size_t) tmpSize;
+}
+
+/*
+ * Poulsbo GPU virtual space looks like this
+ * (We currently use only one MMU context).
+ *
+ * gatt_start = Start of GATT aperture in bus space.
+ * stolen_end = End of GATT populated by stolen memory in bus space.
+ * gatt_end   = End of GATT
+ * twod_end   = MIN(gatt_start + 256_MEM, gatt_end)
+ *
+ * 0x00000000 -> 0x10000000 Temporary mapping space for tiling- and copy operations.
+ *                          This space is not managed and is protected by the
+ *                          temp_mem mutex.
+ *
+ * 0x10000000 -> 0x20000000 DRM_PSB_MEM_KERNEL For kernel buffers.
+ *
+ * 0x20000000 -> gatt_start DRM_PSB_MEM_MMU    For generic MMU-only use.
+ *
+ * gatt_start -> stolen_end DRM_BO_MEM_VRAM    Pre-populated GATT pages.
+ *
+ * stolen_end -> twod_end   DRM_BO_MEM_TT      GATT memory usable by 2D engine.
+ *
+ * twod_end -> gatt_end     DRM_BO_MEM_APER    GATT memory not usable by 2D engine.
+ *
+ * gatt_end ->   0xffffffff Currently unused.
+ */
+
+int psb_init_mem_type(struct drm_device *dev, uint32_t type,
+		      struct drm_mem_type_manager *man)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct psb_gtt *pg = dev_priv->pg;
+
+	switch (type) {
+	case DRM_BO_MEM_LOCAL:
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CACHED;
+		man->drm_bus_maptype = 0;
+		break;
+	case DRM_PSB_MEM_KERNEL:
+		man->io_offset = 0x00000000;
+		man->io_size = 0x00000000;
+		man->io_addr = NULL;
+		man->drm_bus_maptype = _DRM_TTM;
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CSELECT | _DRM_FLAG_MEMTYPE_CMA;
+		man->gpu_offset = PSB_MEM_KERNEL_START;
+		break;
+	case DRM_PSB_MEM_MMU:
+		man->io_offset = 0x00000000;
+		man->io_size = 0x00000000;
+		man->io_addr = NULL;
+		man->drm_bus_maptype = _DRM_TTM;
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CSELECT | _DRM_FLAG_MEMTYPE_CMA;
+		man->gpu_offset = PSB_MEM_MMU_START;
+		break;
+	case DRM_PSB_MEM_PDS:
+		man->io_offset = 0x00000000;
+		man->io_size = 0x00000000;
+		man->io_addr = NULL;
+		man->drm_bus_maptype = _DRM_TTM;
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CSELECT | _DRM_FLAG_MEMTYPE_CMA;
+		man->gpu_offset = PSB_MEM_PDS_START;
+		break;
+	case DRM_PSB_MEM_RASTGEOM:
+		man->io_offset = 0x00000000;
+		man->io_size = 0x00000000;
+		man->io_addr = NULL;
+		man->drm_bus_maptype = _DRM_TTM;
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CSELECT | _DRM_FLAG_MEMTYPE_CMA;
+		man->gpu_offset = PSB_MEM_RASTGEOM_START;
+		break;
+	case DRM_BO_MEM_VRAM:
+		man->io_addr = NULL;
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_FIXED | _DRM_FLAG_NEEDS_IOREMAP;
+#ifdef PSB_WORKING_HOST_MMU_ACCESS
+		man->drm_bus_maptype = _DRM_AGP;
+		man->io_offset = pg->gatt_start;
+		man->io_size = pg->gatt_pages << PAGE_SHIFT;
+#else
+		man->drm_bus_maptype = _DRM_TTM;	/* Forces uncached */
+		man->io_offset = pg->stolen_base;
+		man->io_size = pg->stolen_size;
+#endif
+		man->gpu_offset = pg->gatt_start;
+		break;
+	case DRM_BO_MEM_TT:	/* Mappable GATT memory */
+		man->io_offset = pg->gatt_start;
+		man->io_size = pg->gatt_pages << PAGE_SHIFT;
+		man->io_addr = NULL;
+#ifdef PSB_WORKING_HOST_MMU_ACCESS
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CSELECT | _DRM_FLAG_NEEDS_IOREMAP;
+		man->drm_bus_maptype = _DRM_AGP;
+#else
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CSELECT | _DRM_FLAG_MEMTYPE_CMA;
+		man->drm_bus_maptype = _DRM_TTM;
+#endif
+		man->gpu_offset = pg->gatt_start;
+		break;
+	case DRM_PSB_MEM_APER:	/*MMU memory. Mappable. Not usable for 2D. */
+		man->io_offset = pg->gatt_start;
+		man->io_size = pg->gatt_pages << PAGE_SHIFT;
+		man->io_addr = NULL;
+#ifdef PSB_WORKING_HOST_MMU_ACCESS
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CSELECT | _DRM_FLAG_NEEDS_IOREMAP;
+		man->drm_bus_maptype = _DRM_AGP;
+#else
+		man->flags = _DRM_FLAG_MEMTYPE_MAPPABLE |
+		    _DRM_FLAG_MEMTYPE_CSELECT | _DRM_FLAG_MEMTYPE_CMA;
+		man->drm_bus_maptype = _DRM_TTM;
+#endif
+		man->gpu_offset = pg->gatt_start;
+		break;
+	default:
+		DRM_ERROR("Unsupported memory type %u\n", (unsigned)type);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+uint32_t psb_evict_mask(struct drm_buffer_object * bo)
+{
+	switch (bo->mem.mem_type) {
+	case DRM_BO_MEM_VRAM:
+		return DRM_BO_FLAG_MEM_TT;
+	default:
+		return DRM_BO_FLAG_MEM_LOCAL;
+	}
+}
+
+int psb_invalidate_caches(struct drm_device *dev, uint64_t flags)
+{
+	return 0;
+}
+
+static int psb_move_blit(struct drm_buffer_object *bo,
+			 int evict, int no_wait, struct drm_bo_mem_reg *new_mem)
+{
+	struct drm_bo_mem_reg *old_mem = &bo->mem;
+	int dir = 0;
+
+	if ((old_mem->mem_type == new_mem->mem_type) &&
+	    (new_mem->mm_node->start <
+	     old_mem->mm_node->start + old_mem->mm_node->size)) {
+		dir = 1;
+	}
+
+	psb_emit_2d_copy_blit(bo->dev,
+			      old_mem->mm_node->start << PAGE_SHIFT,
+			      new_mem->mm_node->start << PAGE_SHIFT,
+			      new_mem->num_pages, dir);
+
+	return drm_bo_move_accel_cleanup(bo, evict, no_wait, 0,
+					 DRM_FENCE_TYPE_EXE, 0, new_mem);
+}
+
+/*
+ * Flip destination ttm into cached-coherent GATT,
+ * then blit and subsequently move out again.
+ */
+
+static int psb_move_flip(struct drm_buffer_object *bo,
+			 int evict, int no_wait, struct drm_bo_mem_reg *new_mem)
+{
+	struct drm_device *dev = bo->dev;
+	struct drm_bo_mem_reg tmp_mem;
+	int ret;
+
+	tmp_mem = *new_mem;
+	tmp_mem.mm_node = NULL;
+	tmp_mem.mask = DRM_BO_FLAG_MEM_TT |
+	    DRM_BO_FLAG_CACHED | DRM_BO_FLAG_FORCE_CACHING;
+
+	ret = drm_bo_mem_space(bo, &tmp_mem, no_wait);
+	if (ret)
+		return ret;
+	ret = drm_bind_ttm(bo->ttm, &tmp_mem);
+	if (ret)
+		goto out_cleanup;
+	ret = psb_move_blit(bo, 1, no_wait, &tmp_mem);
+	if (ret)
+		goto out_cleanup;
+
+	ret = drm_bo_move_ttm(bo, evict, no_wait, new_mem);
+      out_cleanup:
+	if (tmp_mem.mm_node) {
+		mutex_lock(&dev->struct_mutex);
+		if (tmp_mem.mm_node != bo->pinned_node)
+			drm_mm_put_block(tmp_mem.mm_node);
+		tmp_mem.mm_node = NULL;
+		mutex_unlock(&dev->struct_mutex);
+	}
+	return ret;
+}
+
+int psb_move(struct drm_buffer_object *bo,
+	     int evict, int no_wait, struct drm_bo_mem_reg *new_mem)
+{
+	struct drm_bo_mem_reg *old_mem = &bo->mem;
+
+	if (old_mem->mem_type == DRM_BO_MEM_LOCAL) {
+		return drm_bo_move_memcpy(bo, evict, no_wait, new_mem);
+	} else if (new_mem->mem_type == DRM_BO_MEM_LOCAL) {
+		if (psb_move_flip(bo, evict, no_wait, new_mem))
+			return drm_bo_move_memcpy(bo, evict, no_wait, new_mem);
+	} else {
+		if (psb_move_blit(bo, evict, no_wait, new_mem))
+			return drm_bo_move_memcpy(bo, evict, no_wait, new_mem);
+	}
+	return 0;
+}
+
+static int drm_psb_tbe_nca(struct drm_ttm_backend *backend)
+{
+	return ((backend->flags & DRM_BE_FLAG_BOUND_CACHED) ? 0 : 1);
+}
+
+static int drm_psb_tbe_populate(struct drm_ttm_backend *backend,
+				unsigned long num_pages, struct page **pages)
+{
+	struct drm_psb_ttm_backend *psb_be =
+	    container_of(backend, struct drm_psb_ttm_backend, base);
+
+	psb_be->pages = pages;
+	return 0;
+}
+
+static int drm_psb_tbe_unbind(struct drm_ttm_backend *backend)
+{
+	struct drm_device *dev = backend->dev;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct drm_psb_ttm_backend *psb_be =
+	    container_of(backend, struct drm_psb_ttm_backend, base);
+	struct psb_mmu_pd *pd = psb_mmu_get_default_pd(dev_priv->mmu);
+	struct drm_mem_type_manager *man = &dev->bm.man[psb_be->mem_type];
+
+	PSB_DEBUG_RENDER("MMU unbind.\n");
+
+	if (psb_be->mem_type == DRM_BO_MEM_TT) {
+		uint32_t gatt_p_offset = (psb_be->offset - man->gpu_offset) >>
+		    PAGE_SHIFT;
+
+		(void)psb_gtt_remove_pages(dev_priv->pg, gatt_p_offset,
+					   psb_be->num_pages,
+					   psb_be->desired_tile_stride,
+					   psb_be->hw_tile_stride);
+	}
+
+	psb_mmu_remove_pages(pd, psb_be->offset,
+			     psb_be->num_pages,
+			     psb_be->desired_tile_stride,
+			     psb_be->hw_tile_stride);
+
+	return 0;
+}
+
+static int drm_psb_tbe_bind(struct drm_ttm_backend *backend,
+			    struct drm_bo_mem_reg *bo_mem)
+{
+	struct drm_device *dev = backend->dev;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct drm_psb_ttm_backend *psb_be =
+	    container_of(backend, struct drm_psb_ttm_backend, base);
+	struct psb_mmu_pd *pd = psb_mmu_get_default_pd(dev_priv->mmu);
+	struct drm_mem_type_manager *man = &dev->bm.man[bo_mem->mem_type];
+	int type;
+	int ret = 0;
+
+	psb_be->mem_type = bo_mem->mem_type;
+	psb_be->num_pages = bo_mem->num_pages;
+	psb_be->desired_tile_stride = bo_mem->desired_tile_stride;
+	psb_be->hw_tile_stride = bo_mem->hw_tile_stride;
+	psb_be->desired_tile_stride = 0;
+	psb_be->hw_tile_stride = 0;
+	psb_be->offset = (bo_mem->mm_node->start << PAGE_SHIFT) +
+	    man->gpu_offset;
+
+	type = (bo_mem->flags & DRM_BO_FLAG_CACHED) ? PSB_MMU_CACHED_MEMORY : 0;
+
+	PSB_DEBUG_RENDER("MMU bind.\n");
+	if (psb_be->mem_type == DRM_BO_MEM_TT) {
+		uint32_t gatt_p_offset = (psb_be->offset - man->gpu_offset) >>
+		    PAGE_SHIFT;
+
+		ret = psb_gtt_insert_pages(dev_priv->pg, psb_be->pages,
+					   gatt_p_offset,
+					   psb_be->num_pages,
+					   psb_be->desired_tile_stride,
+					   psb_be->hw_tile_stride, type);
+	}
+
+	ret = psb_mmu_insert_pages(pd, psb_be->pages,
+				   psb_be->offset, psb_be->num_pages,
+				   psb_be->desired_tile_stride,
+				   psb_be->hw_tile_stride, type);
+	if (ret)
+		goto out_err;
+
+	DRM_FLAG_MASKED(backend->flags, (bo_mem->flags & DRM_BO_FLAG_CACHED) ?
+			DRM_BE_FLAG_BOUND_CACHED : 0, DRM_BE_FLAG_BOUND_CACHED);
+
+	return 0;
+      out_err:
+	drm_psb_tbe_unbind(backend);
+	return ret;
+
+}
+
+static void drm_psb_tbe_clear(struct drm_ttm_backend *backend)
+{
+	struct drm_psb_ttm_backend *psb_be =
+	    container_of(backend, struct drm_psb_ttm_backend, base);
+
+	psb_be->pages = NULL;
+	return;
+}
+
+static void drm_psb_tbe_destroy(struct drm_ttm_backend *backend)
+{
+	struct drm_psb_ttm_backend *psb_be =
+	    container_of(backend, struct drm_psb_ttm_backend, base);
+
+	if (backend)
+		drm_free(psb_be, sizeof(*psb_be), DRM_MEM_TTM);
+}
+
+static struct drm_ttm_backend_func psb_ttm_backend = {
+	.needs_ub_cache_adjust = drm_psb_tbe_nca,
+	.populate = drm_psb_tbe_populate,
+	.clear = drm_psb_tbe_clear,
+	.bind = drm_psb_tbe_bind,
+	.unbind = drm_psb_tbe_unbind,
+	.destroy = drm_psb_tbe_destroy,
+};
+
+struct drm_ttm_backend *drm_psb_tbe_init(struct drm_device *dev)
+{
+	struct drm_psb_ttm_backend *psb_be;
+
+	psb_be = drm_calloc(1, sizeof(*psb_be), DRM_MEM_TTM);
+	if (!psb_be)
+		return NULL;
+	psb_be->pages = NULL;
+	psb_be->base.func = &psb_ttm_backend;
+	psb_be->base.dev = dev;
+
+	return &psb_be->base;
+}
+
+int psb_tbe_size(struct drm_device *dev, unsigned long num_pages)
+{
+	/*
+	 * Return the size of the structures themselves and the
+	 * estimated size of the pagedir and pagetable entries.
+	 */
+
+	return drm_size_align(sizeof(struct drm_psb_ttm_backend)) +
+		8*num_pages;
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_drm.h
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_drm.h	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,370 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ */
+
+#ifndef _PSB_DRM_H_
+#define _PSB_DRM_H_
+
+#if defined(__linux__) && !defined(__KERNEL__)
+#include<stdint.h>
+#endif
+
+/*
+ * Intel Poulsbo driver package version.
+ *
+ */
+/* #define PSB_PACKAGE_VERSION "ED"__DATE__*/
+#define PSB_PACKAGE_VERSION "2.1.0.32L.0019"
+
+#define DRM_PSB_SAREA_MAJOR 0
+#define DRM_PSB_SAREA_MINOR 1
+#define PSB_FIXED_SHIFT 16
+
+/*
+ * Public memory types.
+ */
+
+#define DRM_PSB_MEM_MMU DRM_BO_MEM_PRIV1
+#define DRM_PSB_FLAG_MEM_MMU DRM_BO_FLAG_MEM_PRIV1
+#define DRM_PSB_MEM_PDS DRM_BO_MEM_PRIV2
+#define DRM_PSB_FLAG_MEM_PDS DRM_BO_FLAG_MEM_PRIV2
+#define DRM_PSB_MEM_APER DRM_BO_MEM_PRIV3
+#define DRM_PSB_FLAG_MEM_APER DRM_BO_FLAG_MEM_PRIV3
+#define DRM_PSB_MEM_RASTGEOM DRM_BO_MEM_PRIV4
+#define DRM_PSB_FLAG_MEM_RASTGEOM DRM_BO_FLAG_MEM_PRIV4
+#define PSB_MEM_RASTGEOM_START   0x30000000
+
+typedef int32_t psb_fixed;
+typedef uint32_t psb_ufixed;
+
+static inline psb_fixed psb_int_to_fixed(int a)
+{
+	return a * (1 << PSB_FIXED_SHIFT);
+}
+
+static inline psb_ufixed psb_unsigned_to_ufixed(unsigned int a)
+{
+	return a << PSB_FIXED_SHIFT;
+}
+
+/*Status of the command sent to the gfx device.*/
+typedef enum {
+	DRM_CMD_SUCCESS,
+	DRM_CMD_FAILED,
+	DRM_CMD_HANG
+} drm_cmd_status_t;
+
+struct drm_psb_scanout {
+	uint32_t buffer_id;	/* DRM buffer object ID */
+	uint32_t rotation;	/* Rotation as in RR_rotation definitions */
+	uint32_t stride;	/* Buffer stride in bytes */
+	uint32_t depth;		/* Buffer depth in bits (NOT) bpp */
+	uint32_t width;		/* Buffer width in pixels */
+	uint32_t height;	/* Buffer height in lines */
+	psb_fixed transform[3][3];	/* Buffer composite transform */
+	/* (scaling, rot, reflect) */
+};
+
+#define DRM_PSB_SAREA_OWNERS 16
+#define DRM_PSB_SAREA_OWNER_2D 0
+#define DRM_PSB_SAREA_OWNER_3D 1
+
+#define DRM_PSB_SAREA_SCANOUTS 3
+
+struct drm_psb_sarea {
+	/* Track changes of this data structure */
+
+	uint32_t major;
+	uint32_t minor;
+
+	/* Last context to touch part of hw */
+	uint32_t ctx_owners[DRM_PSB_SAREA_OWNERS];
+
+	/* Definition of front- and rotated buffers */
+	uint32_t num_scanouts;
+	struct drm_psb_scanout scanouts[DRM_PSB_SAREA_SCANOUTS];
+
+	int pipeA_x;
+	int pipeA_y;
+	int pipeA_w;
+	int pipeA_h;
+	int pipeB_x;
+	int pipeB_y;
+	int pipeB_w;
+	int pipeB_h;
+	uint32_t msvdx_state;
+	uint32_t msvdx_context;
+};
+
+#define PSB_RELOC_MAGIC         0x67676767
+#define PSB_RELOC_SHIFT_MASK    0x0000FFFF
+#define PSB_RELOC_SHIFT_SHIFT   0
+#define PSB_RELOC_ALSHIFT_MASK  0xFFFF0000
+#define PSB_RELOC_ALSHIFT_SHIFT 16
+
+#define PSB_RELOC_OP_OFFSET     0	/* Offset of the indicated
+					 * buffer
+					 */
+#define PSB_RELOC_OP_2D_OFFSET  1	/* Offset of the indicated
+					 *  buffer, relative to 2D
+					 *  base address
+					 */
+#define PSB_RELOC_OP_PDS_OFFSET 2	/* Offset of the indicated buffer,
+					 *  relative to PDS base address
+					 */
+#define PSB_RELOC_OP_STRIDE     3	/* Stride of the indicated
+					 * buffer (for tiling)
+					 */
+#define PSB_RELOC_OP_USE_OFFSET 4	/* Offset of USE buffer
+					 * relative to base reg
+					 */
+#define PSB_RELOC_OP_USE_REG    5	/* Base reg of USE buffer */
+
+struct drm_psb_reloc {
+	uint32_t reloc_op;
+	uint32_t where;		/* offset in destination buffer */
+	uint32_t buffer;	/* Buffer reloc applies to */
+	uint32_t mask;		/* Destination format: */
+	uint32_t shift;		/* Destination format: */
+	uint32_t pre_add;	/* Destination format: */
+	uint32_t background;	/* Destination add */
+	uint32_t dst_buffer;	/* Destination buffer. Index into buffer_list */
+	uint32_t arg0;		/* Reloc-op dependant */
+	uint32_t arg1;
+};
+
+#define PSB_BO_FLAG_TA              (1ULL << 48)
+#define PSB_BO_FLAG_SCENE           (1ULL << 49)
+#define PSB_BO_FLAG_FEEDBACK        (1ULL << 50)
+#define PSB_BO_FLAG_USSE            (1ULL << 51)
+
+#define PSB_ENGINE_2D 0
+#define PSB_ENGINE_VIDEO 1
+#define PSB_ENGINE_RASTERIZER 2
+#define PSB_ENGINE_TA 3
+#define PSB_ENGINE_HPRAST 4
+
+/*
+ * For this fence class we have a couple of
+ * fence types.
+ */
+
+#define _PSB_FENCE_EXE_SHIFT           0
+#define _PSB_FENCE_TA_DONE_SHIFT       1
+#define _PSB_FENCE_RASTER_DONE_SHIFT   2
+#define _PSB_FENCE_SCENE_DONE_SHIFT    3
+#define _PSB_FENCE_FEEDBACK_SHIFT      4
+
+#define _PSB_ENGINE_TA_FENCE_TYPES   5
+#define _PSB_FENCE_TYPE_TA_DONE     (1 << _PSB_FENCE_TA_DONE_SHIFT)
+#define _PSB_FENCE_TYPE_RASTER_DONE (1 << _PSB_FENCE_RASTER_DONE_SHIFT)
+#define _PSB_FENCE_TYPE_SCENE_DONE  (1 << _PSB_FENCE_SCENE_DONE_SHIFT)
+#define _PSB_FENCE_TYPE_FEEDBACK    (1 << _PSB_FENCE_FEEDBACK_SHIFT)
+
+#define PSB_ENGINE_HPRAST 4
+#define PSB_NUM_ENGINES 5
+
+#define PSB_TA_FLAG_FIRSTPASS    (1 << 0)
+#define PSB_TA_FLAG_LASTPASS     (1 << 1)
+
+#define PSB_FEEDBACK_OP_VISTEST (1 << 0)
+
+struct drm_psb_scene {
+	int handle_valid;
+	uint32_t handle;
+	uint32_t w;
+	uint32_t h;
+	uint32_t num_buffers;
+};
+
+struct drm_psb_hw_info
+{
+        uint32_t rev_id;
+        uint32_t caps;
+};
+
+typedef struct drm_psb_cmdbuf_arg {
+	uint64_t buffer_list;	/* List of buffers to validate */
+	uint64_t clip_rects;	/* See i915 counterpart */
+	uint64_t scene_arg;
+	uint64_t fence_arg;
+
+	uint32_t ta_flags;
+
+	uint32_t ta_handle;	/* TA reg-value pairs */
+	uint32_t ta_offset;
+	uint32_t ta_size;
+
+	uint32_t oom_handle;
+	uint32_t oom_offset;
+	uint32_t oom_size;
+
+	uint32_t cmdbuf_handle;	/* 2D Command buffer object or, */
+	uint32_t cmdbuf_offset;	/* rasterizer reg-value pairs */
+	uint32_t cmdbuf_size;
+
+	uint32_t reloc_handle;	/* Reloc buffer object */
+	uint32_t reloc_offset;
+	uint32_t num_relocs;
+
+	int32_t damage;		/* Damage front buffer with cliprects */
+	/* Not implemented yet */
+	uint32_t fence_flags;
+	uint32_t engine;
+
+	/*
+	 * Feedback;
+	 */
+
+	uint32_t feedback_ops;
+	uint32_t feedback_handle;
+	uint32_t feedback_offset;
+	uint32_t feedback_breakpoints;
+	uint32_t feedback_size;
+} drm_psb_cmdbuf_arg_t;
+
+struct drm_psb_xhw_init_arg {
+	uint32_t operation;
+	uint32_t buffer_handle;
+};
+
+/*
+ * Feedback components:
+ */
+
+/*
+ * Vistest component. The number of these in the feedback buffer
+ * equals the number of vistest breakpoints + 1.
+ * This is currently the only feedback component.
+ */
+
+struct drm_psb_vistest {
+	uint32_t vt[8];
+};
+
+#define PSB_HW_COOKIE_SIZE 16
+#define PSB_HW_FEEDBACK_SIZE 8
+#define PSB_HW_OOM_CMD_SIZE 6
+
+struct drm_psb_xhw_arg {
+	uint32_t op;
+	int ret;
+	uint32_t irq_op;
+	uint32_t issue_irq;
+	uint32_t cookie[PSB_HW_COOKIE_SIZE];
+	union {
+		struct {
+			uint32_t w;
+			uint32_t h;
+			uint32_t size;
+			uint32_t clear_p_start;
+			uint32_t clear_num_pages;
+		} si;
+		struct {
+			uint32_t fire_flags;
+			uint32_t hw_context;
+			uint32_t offset;
+			uint32_t engine;
+			uint32_t flags;
+			uint32_t rca;
+			uint32_t num_oom_cmds;
+			uint32_t oom_cmds[PSB_HW_OOM_CMD_SIZE];
+		} sb;
+		struct {
+			uint32_t pages;
+			uint32_t size;
+		} bi;
+		struct {
+			uint32_t bca;
+			uint32_t rca;
+			uint32_t flags;
+		} oom;
+		struct {
+			uint32_t pt_offset;
+			uint32_t param_offset;
+			uint32_t flags;
+		} bl;
+		struct {
+			uint32_t value;
+		} cl;
+		uint32_t feedback[PSB_HW_FEEDBACK_SIZE];
+	} arg;
+};
+
+#define DRM_PSB_CMDBUF          0x00
+#define DRM_PSB_XHW_INIT        0x01
+#define DRM_PSB_XHW             0x02
+#define DRM_PSB_SCENE_UNREF     0x03
+/* Controlling the kernel modesetting buffers */
+#define DRM_PSB_KMS_OFF		0x04
+#define DRM_PSB_KMS_ON		0x05
+#define DRM_PSB_HW_INFO         0x06
+
+#define PSB_XHW_INIT            0x00
+#define PSB_XHW_TAKEDOWN        0x01
+
+#define PSB_XHW_FIRE_RASTER     0x00
+#define PSB_XHW_SCENE_INFO      0x01
+#define PSB_XHW_SCENE_BIND_FIRE 0x02
+#define PSB_XHW_TA_MEM_INFO     0x03
+#define PSB_XHW_RESET_DPM       0x04
+#define PSB_XHW_OOM             0x05
+#define PSB_XHW_TERMINATE       0x06
+#define PSB_XHW_VISTEST         0x07
+#define PSB_XHW_RESUME          0x08
+#define PSB_XHW_TA_MEM_LOAD	0x09
+#define PSB_XHW_CHECK_LOCKUP    0x0a
+
+#define PSB_SCENE_FLAG_DIRTY       (1 << 0)
+#define PSB_SCENE_FLAG_COMPLETE    (1 << 1)
+#define PSB_SCENE_FLAG_SETUP       (1 << 2)
+#define PSB_SCENE_FLAG_SETUP_ONLY  (1 << 3)
+#define PSB_SCENE_FLAG_CLEARED     (1 << 4)
+
+#define PSB_TA_MEM_FLAG_TA            (1 << 0)
+#define PSB_TA_MEM_FLAG_RASTER        (1 << 1)
+#define PSB_TA_MEM_FLAG_HOSTA         (1 << 2)
+#define PSB_TA_MEM_FLAG_HOSTD         (1 << 3)
+#define PSB_TA_MEM_FLAG_INIT          (1 << 4)
+#define PSB_TA_MEM_FLAG_NEW_PT_OFFSET (1 << 5)
+
+/*Raster fire will deallocate memory */
+#define PSB_FIRE_FLAG_RASTER_DEALLOC  (1 << 0)
+/*Isp reset needed due to change in ZLS format */
+#define PSB_FIRE_FLAG_NEEDS_ISP_RESET (1 << 1)
+/*These are set by Xpsb. */
+#define PSB_FIRE_FLAG_XHW_MASK        0xff000000
+/*The task has had at least one OOM and Xpsb will
+  send back messages on each fire. */
+#define PSB_FIRE_FLAG_XHW_OOM         (1 << 24)
+
+#define PSB_SCENE_ENGINE_TA    0
+#define PSB_SCENE_ENGINE_RASTER    1
+#define PSB_SCENE_NUM_ENGINES      2
+
+struct drm_psb_dev_info_arg {
+	uint32_t num_use_attribute_registers;
+};
+#define DRM_PSB_DEVINFO         0x01
+
+#endif
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_drv.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_drv.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,1028 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "psb_drm.h"
+#include "psb_drv.h"
+#include "psb_reg.h"
+#include "../i915/i915_reg.h"
+#include "psb_msvdx.h"
+#include "drm_pciids.h"
+#include "psb_scene.h"
+#include "drm_crtc.h"
+#include "drm_crtc_helper.h"
+#include <linux/cpu.h>
+#include <linux/notifier.h>
+#include <linux/fb.h>
+
+extern int drm_helper_probe_connector_modes(struct drm_device *dev, uint32_t maxX, uint32_t maxY);
+
+int drm_psb_debug = 0;
+EXPORT_SYMBOL(drm_psb_debug);
+static int drm_psb_trap_pagefaults = 0;
+static int drm_psb_clock_gating = 0;
+static int drm_psb_ta_mem_size = 32 * 1024;
+int drm_psb_disable_vsync = 1;
+int drm_psb_no_fb = 0;
+int drm_psb_force_pipeb = 0;
+char* psb_init_mode;
+
+
+MODULE_PARM_DESC(debug, "Enable debug output");
+MODULE_PARM_DESC(clock_gating, "clock gating");
+MODULE_PARM_DESC(no_fb, "Disable FBdev");
+MODULE_PARM_DESC(trap_pagefaults, "Error and reset on MMU pagefaults");
+MODULE_PARM_DESC(disable_vsync, "Disable vsync interrupts");
+MODULE_PARM_DESC(force_pipeb, "Forces PIPEB to become primary fb");
+MODULE_PARM_DESC(ta_mem_size, "TA memory size in kiB");
+MODULE_PARM_DESC(mode, "initial mode name");
+MODULE_PARM_DESC(xres, "initial mode width");
+MODULE_PARM_DESC(yres, "initial mode height");
+
+module_param_named(debug, drm_psb_debug, int, 0600);
+module_param_named(clock_gating, drm_psb_clock_gating, int, 0600);
+module_param_named(no_fb, drm_psb_no_fb, int, 0600);
+module_param_named(trap_pagefaults, drm_psb_trap_pagefaults, int, 0600);
+module_param_named(disable_vsync, drm_psb_disable_vsync, int, 0600);
+module_param_named(force_pipeb, drm_psb_force_pipeb, int, 0600);
+module_param_named(ta_mem_size, drm_psb_ta_mem_size, int, 0600);
+module_param_named(mode, psb_init_mode, charp, 0600);
+
+static struct pci_device_id pciidlist[] = {
+	psb_PCI_IDS
+};
+
+#define DRM_PSB_CMDBUF_IOCTL    DRM_IOW(DRM_PSB_CMDBUF, \
+					struct drm_psb_cmdbuf_arg)
+#define DRM_PSB_XHW_INIT_IOCTL  DRM_IOR(DRM_PSB_XHW_INIT, \
+					struct drm_psb_xhw_init_arg)
+#define DRM_PSB_XHW_IOCTL       DRM_IO(DRM_PSB_XHW)
+
+#define DRM_PSB_SCENE_UNREF_IOCTL DRM_IOWR(DRM_PSB_SCENE_UNREF, \
+					   struct drm_psb_scene)
+#define DRM_PSB_HW_INFO_IOCTL DRM_IOR(DRM_PSB_HW_INFO, \
+                                           struct drm_psb_hw_info)
+
+#define DRM_PSB_KMS_OFF_IOCTL	DRM_IO(DRM_PSB_KMS_OFF)
+#define DRM_PSB_KMS_ON_IOCTL	DRM_IO(DRM_PSB_KMS_ON)
+
+static struct drm_ioctl_desc psb_ioctls[] = {
+	DRM_IOCTL_DEF(DRM_PSB_CMDBUF_IOCTL, psb_cmdbuf_ioctl, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_PSB_XHW_INIT_IOCTL, psb_xhw_init_ioctl,
+		      DRM_ROOT_ONLY),
+	DRM_IOCTL_DEF(DRM_PSB_XHW_IOCTL, psb_xhw_ioctl, DRM_ROOT_ONLY),
+	DRM_IOCTL_DEF(DRM_PSB_SCENE_UNREF_IOCTL, drm_psb_scene_unref_ioctl,
+		      DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_PSB_KMS_OFF_IOCTL, psbfb_kms_off_ioctl,
+		      DRM_ROOT_ONLY),
+	DRM_IOCTL_DEF(DRM_PSB_KMS_ON_IOCTL, psbfb_kms_on_ioctl, DRM_ROOT_ONLY),
+	DRM_IOCTL_DEF(DRM_PSB_HW_INFO_IOCTL, psb_hw_info_ioctl, DRM_AUTH),
+};
+static int psb_max_ioctl = DRM_ARRAY_SIZE(psb_ioctls);
+
+static int probe(struct pci_dev *pdev, const struct pci_device_id *ent);
+
+static int dri_library_name(struct drm_device *dev, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "psb\n");
+}
+
+static void psb_set_uopt(struct drm_psb_uopt *uopt)
+{
+	uopt->clock_gating = drm_psb_clock_gating;
+}
+
+static void psb_lastclose(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+
+	if (!dev->dev_private)
+		return;
+
+	mutex_lock(&dev->struct_mutex);
+	if (dev_priv->ta_mem)
+		psb_ta_mem_unref_devlocked(&dev_priv->ta_mem);
+	mutex_unlock(&dev->struct_mutex);
+	mutex_lock(&dev_priv->cmdbuf_mutex);
+	if (dev_priv->buffers) {
+		vfree(dev_priv->buffers);
+		dev_priv->buffers = NULL;
+	}
+	mutex_unlock(&dev_priv->cmdbuf_mutex);
+}
+
+static void psb_do_takedown(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+
+	mutex_lock(&dev->struct_mutex);
+	if (dev->bm.initialized) {
+		if (dev_priv->have_mem_rastgeom) {
+			drm_bo_clean_mm(dev, DRM_PSB_MEM_RASTGEOM);
+			dev_priv->have_mem_rastgeom = 0;
+		}
+		if (dev_priv->have_mem_mmu) {
+			drm_bo_clean_mm(dev, DRM_PSB_MEM_MMU);
+			dev_priv->have_mem_mmu = 0;
+		}
+		if (dev_priv->have_mem_aper) {
+			drm_bo_clean_mm(dev, DRM_PSB_MEM_APER);
+			dev_priv->have_mem_aper = 0;
+		}
+		if (dev_priv->have_tt) {
+			drm_bo_clean_mm(dev, DRM_BO_MEM_TT);
+			dev_priv->have_tt = 0;
+		}
+		if (dev_priv->have_vram) {
+			drm_bo_clean_mm(dev, DRM_BO_MEM_VRAM);
+			dev_priv->have_vram = 0;
+		}
+	}
+	mutex_unlock(&dev->struct_mutex);
+
+	if (dev_priv->has_msvdx)
+		psb_msvdx_uninit(dev);
+
+	if (dev_priv->comm) {
+		kunmap(dev_priv->comm_page);
+		dev_priv->comm = NULL;
+	}
+	if (dev_priv->comm_page) {
+		__free_page(dev_priv->comm_page);
+		dev_priv->comm_page = NULL;
+	}
+}
+
+void psb_clockgating(struct drm_psb_private *dev_priv)
+{
+	uint32_t clock_gating;
+
+	if (dev_priv->uopt.clock_gating == 1) {
+		PSB_DEBUG_INIT("Disabling clock gating.\n");
+
+		clock_gating = (_PSB_C_CLKGATECTL_CLKG_DISABLED <<
+				_PSB_C_CLKGATECTL_2D_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_DISABLED <<
+		     _PSB_C_CLKGATECTL_ISP_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_DISABLED <<
+		     _PSB_C_CLKGATECTL_TSP_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_DISABLED <<
+		     _PSB_C_CLKGATECTL_TA_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_DISABLED <<
+		     _PSB_C_CLKGATECTL_DPM_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_DISABLED <<
+		     _PSB_C_CLKGATECTL_USE_CLKG_SHIFT);
+
+	} else if (dev_priv->uopt.clock_gating == 2) {
+		PSB_DEBUG_INIT("Enabling clock gating.\n");
+
+		clock_gating = (_PSB_C_CLKGATECTL_CLKG_AUTO <<
+				_PSB_C_CLKGATECTL_2D_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_AUTO <<
+		     _PSB_C_CLKGATECTL_ISP_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_AUTO <<
+		     _PSB_C_CLKGATECTL_TSP_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_AUTO <<
+		     _PSB_C_CLKGATECTL_TA_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_AUTO <<
+		     _PSB_C_CLKGATECTL_DPM_CLKG_SHIFT) |
+		    (_PSB_C_CLKGATECTL_CLKG_AUTO <<
+		     _PSB_C_CLKGATECTL_USE_CLKG_SHIFT);
+	} else
+		clock_gating = PSB_RSGX32(PSB_CR_CLKGATECTL);
+
+#ifdef FIX_TG_2D_CLOCKGATE
+	clock_gating &= ~_PSB_C_CLKGATECTL_2D_CLKG_MASK;
+	clock_gating |= (_PSB_C_CLKGATECTL_CLKG_DISABLED <<
+			 _PSB_C_CLKGATECTL_2D_CLKG_SHIFT);
+#endif
+	PSB_WSGX32(clock_gating, PSB_CR_CLKGATECTL);
+	(void)PSB_RSGX32(PSB_CR_CLKGATECTL);
+}
+
+static int psb_master_create(struct drm_device *dev, struct drm_master *master)
+{
+	struct drm_i915_master_private *master_priv;
+
+	master_priv = drm_calloc(1, sizeof(*master_priv), DRM_MEM_DRIVER);
+	if (!master_priv)
+		return -ENOMEM;
+
+	master->driver_priv = master_priv;
+	return 0;
+}
+
+static void psb_master_destroy(struct drm_device *dev, struct drm_master *master)
+{
+	struct drm_i915_master_private *master_priv = master->driver_priv;
+
+	if (!master_priv)
+		return;
+
+	drm_free(master_priv, sizeof(*master_priv), DRM_MEM_DRIVER);
+
+	master->driver_priv = NULL;
+}
+
+
+static int psb_do_init(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct psb_gtt *pg = dev_priv->pg;
+
+	uint32_t stolen_gtt;
+	uint32_t tt_start;
+	uint32_t tt_pages;
+
+	int ret = -ENOMEM;
+
+	DRM_ERROR("Debug is 0x%08x\n", drm_psb_debug);
+
+	dev_priv->ta_mem_pages =
+	    PSB_ALIGN_TO(drm_psb_ta_mem_size * 1024, PAGE_SIZE) >> PAGE_SHIFT;
+	dev_priv->comm_page = alloc_page(GFP_KERNEL);
+	if (!dev_priv->comm_page)
+		goto out_err;
+
+	dev_priv->comm = kmap(dev_priv->comm_page);
+	memset((void *)dev_priv->comm, 0, PAGE_SIZE);
+
+	dev_priv->has_msvdx = 1;
+	if (psb_msvdx_init(dev))
+		dev_priv->has_msvdx = 0;
+
+	/*
+	 * Initialize sequence numbers for the different command
+	 * submission mechanisms.
+	 */
+
+	dev_priv->sequence[PSB_ENGINE_2D] = 0;
+	dev_priv->sequence[PSB_ENGINE_RASTERIZER] = 0;
+	dev_priv->sequence[PSB_ENGINE_TA] = 0;
+	dev_priv->sequence[PSB_ENGINE_HPRAST] = 0;
+
+	if (pg->gatt_start & 0x0FFFFFFF) {
+		DRM_ERROR("Gatt must be 256M aligned. This is a bug.\n");
+		ret = -EINVAL;
+		goto out_err;
+	}
+
+	stolen_gtt = (pg->stolen_size >> PAGE_SHIFT) * 4;
+	stolen_gtt = (stolen_gtt + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	stolen_gtt = (stolen_gtt < pg->gtt_pages) ? stolen_gtt : pg->gtt_pages;
+
+	dev_priv->gatt_free_offset = pg->gatt_start +
+	    (stolen_gtt << PAGE_SHIFT) * 1024;
+
+	/*
+	 * Insert a cache-coherent communications page in mmu space
+	 * just after the stolen area. Will be used for fencing etc.
+	 */
+
+	dev_priv->comm_mmu_offset = dev_priv->gatt_free_offset;
+	dev_priv->gatt_free_offset += PAGE_SIZE;
+
+	ret = psb_mmu_insert_pages(psb_mmu_get_default_pd(dev_priv->mmu),
+				   &dev_priv->comm_page,
+				   dev_priv->comm_mmu_offset, 1, 0, 0,
+				   PSB_MMU_CACHED_MEMORY);
+
+	if (ret)
+		goto out_err;
+
+	if (1 || drm_debug) {
+		uint32_t core_id = PSB_RSGX32(PSB_CR_CORE_ID);
+		uint32_t core_rev = PSB_RSGX32(PSB_CR_CORE_REVISION);
+		DRM_INFO("SGX core id = 0x%08x\n", core_id);
+		DRM_INFO("SGX core rev major = 0x%02x, minor = 0x%02x\n",
+			 (core_rev & _PSB_CC_REVISION_MAJOR_MASK) >>
+			 _PSB_CC_REVISION_MAJOR_SHIFT,
+			 (core_rev & _PSB_CC_REVISION_MINOR_MASK) >>
+			 _PSB_CC_REVISION_MINOR_SHIFT);
+		DRM_INFO
+		    ("SGX core rev maintenance = 0x%02x, designer = 0x%02x\n",
+		     (core_rev & _PSB_CC_REVISION_MAINTENANCE_MASK) >>
+		     _PSB_CC_REVISION_MAINTENANCE_SHIFT,
+		     (core_rev & _PSB_CC_REVISION_DESIGNER_MASK) >>
+		     _PSB_CC_REVISION_DESIGNER_SHIFT);
+	}
+
+	dev_priv->irqmask_lock = SPIN_LOCK_UNLOCKED;
+	dev_priv->fence0_irq_on = 0;
+
+	tt_pages = (pg->gatt_pages < PSB_TT_PRIV0_PLIMIT) ?
+	    pg->gatt_pages : PSB_TT_PRIV0_PLIMIT;
+	tt_start = dev_priv->gatt_free_offset - pg->gatt_start;
+	tt_pages -= tt_start >> PAGE_SHIFT;
+
+	mutex_lock(&dev->struct_mutex);
+
+	if (!drm_bo_init_mm(dev, DRM_BO_MEM_VRAM, 0,
+			    pg->stolen_size >> PAGE_SHIFT)) {
+		dev_priv->have_vram = 1;
+	}
+
+	if (!drm_bo_init_mm(dev, DRM_BO_MEM_TT, tt_start >> PAGE_SHIFT,
+			    tt_pages)) {
+		dev_priv->have_tt = 1;
+	}
+
+	if (!drm_bo_init_mm(dev, DRM_PSB_MEM_MMU, 0x00000000,
+			    (pg->gatt_start -
+			     PSB_MEM_MMU_START) >> PAGE_SHIFT)) {
+		dev_priv->have_mem_mmu = 1;
+	}
+
+	if (!drm_bo_init_mm(dev, DRM_PSB_MEM_RASTGEOM, 0x00000000,
+			    (PSB_MEM_MMU_START -
+			     PSB_MEM_RASTGEOM_START) >> PAGE_SHIFT)) {
+		dev_priv->have_mem_rastgeom = 1;
+	}
+#if 0
+	if (pg->gatt_pages > PSB_TT_PRIV0_PLIMIT) {
+		if (!drm_bo_init_mm(dev, DRM_PSB_MEM_APER, PSB_TT_PRIV0_PLIMIT,
+				    pg->gatt_pages - PSB_TT_PRIV0_PLIMIT)) {
+			dev_priv->have_mem_aper = 1;
+		}
+	}
+#endif
+
+	mutex_unlock(&dev->struct_mutex);
+
+	return 0;
+      out_err:
+	psb_do_takedown(dev);
+	return ret;
+}
+
+static int psb_driver_unload(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+
+	intel_modeset_cleanup(dev);
+
+	if (dev_priv) {
+		psb_watchdog_takedown(dev_priv);
+		psb_do_takedown(dev);
+		psb_xhw_takedown(dev_priv);
+		psb_scheduler_takedown(&dev_priv->scheduler);
+
+		mutex_lock(&dev->struct_mutex);
+		if (dev_priv->have_mem_pds) {
+			drm_bo_clean_mm(dev, DRM_PSB_MEM_PDS);
+			dev_priv->have_mem_pds = 0;
+		}
+		if (dev_priv->have_mem_kernel) {
+			drm_bo_clean_mm(dev, DRM_PSB_MEM_KERNEL);
+			dev_priv->have_mem_kernel = 0;
+		}
+		mutex_unlock(&dev->struct_mutex);
+
+		(void)drm_bo_driver_finish(dev);
+
+		if (dev_priv->pf_pd) {
+			psb_mmu_free_pagedir(dev_priv->pf_pd);
+			dev_priv->pf_pd = NULL;
+		}
+		if (dev_priv->mmu) {
+			struct psb_gtt *pg = dev_priv->pg;
+
+			down_read(&pg->sem);
+			psb_mmu_remove_pfn_sequence(psb_mmu_get_default_pd
+						    (dev_priv->mmu),
+						    pg->gatt_start,
+						    pg->
+						    stolen_size >> PAGE_SHIFT);
+			up_read(&pg->sem);
+			psb_mmu_driver_takedown(dev_priv->mmu);
+			dev_priv->mmu = NULL;
+		}
+		psb_gtt_takedown(dev_priv->pg, 1);
+		if (dev_priv->scratch_page) {
+			__free_page(dev_priv->scratch_page);
+			dev_priv->scratch_page = NULL;
+		}
+		psb_takedown_use_base(dev_priv);
+		if (dev_priv->common.regs) {
+			iounmap(dev_priv->common.regs);
+			dev_priv->common.regs = NULL;
+		}
+		if (dev_priv->sgx_reg) {
+			iounmap(dev_priv->sgx_reg);
+			dev_priv->sgx_reg = NULL;
+		}
+		if (dev_priv->msvdx_reg) {
+			iounmap(dev_priv->msvdx_reg);
+			dev_priv->msvdx_reg = NULL;
+		}
+
+		drm_free(dev_priv, sizeof(*dev_priv), DRM_MEM_DRIVER);
+		dev->dev_private = NULL;
+	}
+	return 0;
+}
+
+static void psb_user_framebuffer_destroy(struct drm_framebuffer *fb)
+{
+	struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
+	struct drm_device *dev = fb->dev;
+
+	//if (fb->fbdev)
+	//	intelfb_remove(dev, fb);
+
+	drm_framebuffer_cleanup(fb);
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(intel_fb->obj);
+	mutex_unlock(&dev->struct_mutex);
+
+	kfree(intel_fb);
+}
+
+static int psb_user_framebuffer_create_handle(struct drm_framebuffer *fb,
+						struct drm_file *file_priv,
+						unsigned int *handle)
+{
+	struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
+	struct drm_gem_object *object = intel_fb->obj;
+
+	return drm_gem_handle_create(file_priv, object, handle);
+}
+
+static const struct drm_framebuffer_funcs psb_fb_funcs = {
+	.destroy = psb_user_framebuffer_destroy,
+	.create_handle = psb_user_framebuffer_create_handle,
+};
+
+int psb_framebuffer_create(struct drm_device *dev,
+			     struct drm_mode_fb_cmd *mode_cmd,
+			     struct drm_framebuffer **fb,
+			     struct drm_gem_object *obj)
+{
+	struct intel_framebuffer *intel_fb;
+	int ret;
+
+	intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
+	if (!intel_fb)
+		return -ENOMEM;
+
+	ret = drm_framebuffer_init(dev, &intel_fb->base, &psb_fb_funcs);
+	if (ret) {
+		DRM_ERROR("framebuffer init failed %d\n", ret);
+		return ret;
+	}
+
+	drm_helper_mode_fill_fb_struct(&intel_fb->base, mode_cmd);
+
+	intel_fb->obj = obj;
+
+	*fb = &intel_fb->base;
+
+	return 0;
+}
+
+
+static struct drm_framebuffer *
+psb_user_framebuffer_create(struct drm_device *dev,
+			      struct drm_file *filp,
+			      struct drm_mode_fb_cmd *mode_cmd)
+{
+	struct drm_gem_object *obj;
+	struct drm_framebuffer *fb;
+	int ret;
+
+	obj = drm_gem_object_lookup(dev, filp, mode_cmd->handle);
+	if (!obj)
+		return NULL;
+
+	ret = psb_framebuffer_create(dev, mode_cmd, &fb, obj);
+	if (ret) {
+		drm_gem_object_unreference(obj);
+		return NULL;
+	}
+
+	return fb;
+}
+
+
+int psbfb_probe2(struct drm_device *dev)
+{
+	return 0;
+}
+
+static const struct drm_mode_config_funcs psb_mode_funcs = {
+	.fb_create = psb_user_framebuffer_create,
+	.fb_changed = psbfb_probe2,
+};
+
+static int psb_driver_load(struct drm_device *dev, unsigned long chipset)
+{
+	struct drm_psb_private *dev_priv;
+	unsigned long resource_start;
+	struct psb_gtt *pg;
+	int ret = -ENOMEM;
+
+	DRM_INFO("psb - %s\n", PSB_PACKAGE_VERSION);
+	dev_priv = drm_calloc(1, sizeof(*dev_priv), DRM_MEM_DRIVER);
+	if (dev_priv == NULL)
+		return -ENOMEM;
+
+	mutex_init(&dev_priv->temp_mem);
+	mutex_init(&dev_priv->cmdbuf_mutex);
+	mutex_init(&dev_priv->reset_mutex);
+	psb_init_disallowed();
+
+	atomic_set(&dev_priv->msvdx_mmu_invaldc, 0);
+
+#ifdef FIX_TG_16
+	atomic_set(&dev_priv->lock_2d, 0);
+	atomic_set(&dev_priv->ta_wait_2d, 0);
+	atomic_set(&dev_priv->ta_wait_2d_irq, 0);
+	atomic_set(&dev_priv->waiters_2d, 0);;
+	DRM_INIT_WAITQUEUE(&dev_priv->queue_2d);
+#else
+	mutex_init(&dev_priv->mutex_2d);
+#endif
+
+	spin_lock_init(&dev_priv->reloc_lock);
+
+	DRM_INIT_WAITQUEUE(&dev_priv->rel_mapped_queue);
+	DRM_INIT_WAITQUEUE(&dev_priv->event_2d_queue);
+
+	dev->dev_private = (void *)dev_priv;
+	dev_priv->chipset = chipset;
+	psb_set_uopt(&dev_priv->uopt);
+
+	psb_watchdog_init(dev_priv);
+	psb_scheduler_init(dev, &dev_priv->scheduler);
+
+	resource_start = pci_resource_start(dev->pdev, PSB_MMIO_RESOURCE);
+
+	dev_priv->msvdx_reg =
+	    ioremap(resource_start + PSB_MSVDX_OFFSET, PSB_MSVDX_SIZE);
+	if (!dev_priv->msvdx_reg)
+		goto out_err;
+
+	dev_priv->common.regs =
+	    ioremap(resource_start + PSB_VDC_OFFSET, PSB_VDC_SIZE);
+	if (!dev_priv->common.regs)
+		goto out_err;
+
+	dev_priv->sgx_reg =
+	    ioremap(resource_start + PSB_SGX_OFFSET, PSB_SGX_SIZE);
+	if (!dev_priv->sgx_reg)
+		goto out_err;
+
+	psb_clockgating(dev_priv);
+	if (psb_init_use_base(dev_priv, 3, 13))
+		goto out_err;
+
+	dev_priv->scratch_page = alloc_page(GFP_DMA32 | __GFP_ZERO);
+	if (!dev_priv->scratch_page)
+		goto out_err;
+
+	dev_priv->pg = psb_gtt_alloc(dev);
+	if (!dev_priv->pg)
+		goto out_err;
+
+	ret = psb_gtt_init(dev_priv->pg, 0);
+	if (ret)
+		goto out_err;
+
+	dev_priv->mmu = psb_mmu_driver_init(dev_priv->sgx_reg,
+					    drm_psb_trap_pagefaults, 0,
+					    &dev_priv->msvdx_mmu_invaldc);
+	if (!dev_priv->mmu)
+		goto out_err;
+
+	pg = dev_priv->pg;
+
+	/*
+	 * Make sgx MMU aware of the stolen memory area we call VRAM.
+	 */
+
+	down_read(&pg->sem);
+	ret =
+	    psb_mmu_insert_pfn_sequence(psb_mmu_get_default_pd(dev_priv->mmu),
+					pg->stolen_base >> PAGE_SHIFT,
+					pg->gatt_start,
+					pg->stolen_size >> PAGE_SHIFT, 0);
+	up_read(&pg->sem);
+	if (ret)
+		goto out_err;
+
+	dev_priv->pf_pd = psb_mmu_alloc_pd(dev_priv->mmu, 1, 0);
+	if (!dev_priv->pf_pd)
+		goto out_err;
+
+	/*
+	 * Make all presumably unused requestors page-fault by making them
+	 * use context 1 which does not have any valid mappings.
+	 */
+
+	PSB_WSGX32(0x00000000, PSB_CR_BIF_BANK0);
+	PSB_WSGX32(0x00000000, PSB_CR_BIF_BANK1);
+	PSB_RSGX32(PSB_CR_BIF_BANK1);
+
+	psb_mmu_set_pd_context(psb_mmu_get_default_pd(dev_priv->mmu), 0);
+	psb_mmu_set_pd_context(dev_priv->pf_pd, 1);
+	psb_mmu_enable_requestor(dev_priv->mmu, _PSB_MMU_ER_MASK);
+
+	psb_init_2d(dev_priv);
+
+	ret = drm_bo_driver_init(dev);
+	if (ret)
+		goto out_err;
+
+	ret = drm_bo_init_mm(dev, DRM_PSB_MEM_KERNEL, 0x00000000,
+			     (PSB_MEM_PDS_START - PSB_MEM_KERNEL_START)
+			     >> PAGE_SHIFT);
+	if (ret)
+		goto out_err;
+	dev_priv->have_mem_kernel = 1;
+
+	ret = drm_bo_init_mm(dev, DRM_PSB_MEM_PDS, 0x00000000,
+			     (PSB_MEM_RASTGEOM_START - PSB_MEM_PDS_START)
+			     >> PAGE_SHIFT);
+	if (ret)
+		goto out_err;
+	dev_priv->have_mem_pds = 1;
+
+	ret = psb_do_init(dev);
+	if (ret)
+		return ret;
+
+	ret = psb_xhw_init(dev);
+	if (ret)
+		return ret;
+
+	PSB_WSGX32(PSB_MEM_PDS_START, PSB_CR_PDS_EXEC_BASE);
+	PSB_WSGX32(PSB_MEM_RASTGEOM_START, PSB_CR_BIF_3D_REQ_BASE);
+
+	intel_modeset_init(dev);
+
+	dev->mode_config.funcs = (void *)&psb_mode_funcs;
+
+	drm_helper_initial_config(dev, false);
+
+	return 0;
+      out_err:
+	psb_driver_unload(dev);
+	return ret;
+}
+
+int psb_driver_device_is_agp(struct drm_device *dev)
+{
+	return 0;
+}
+
+static int psb_prepare_msvdx_suspend(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fc = &fm->fence_class[PSB_ENGINE_VIDEO];
+	struct drm_fence_object *fence;
+	int ret = 0;
+	int signaled = 0;
+	int count = 0;
+	unsigned long _end = jiffies + 3 * DRM_HZ;
+
+	PSB_DEBUG_GENERAL("MSVDXACPI Entering psb_prepare_msvdx_suspend....\n");
+
+	/*set the msvdx-reset flag here.. */
+	dev_priv->msvdx_needs_reset = 1;
+
+	/*Ensure that all pending IRQs are serviced, */
+	list_for_each_entry(fence, &fc->ring, ring) {
+		count++;
+		do {
+			DRM_WAIT_ON(ret, fc->fence_queue, 3 * DRM_HZ,
+				    (signaled =
+				     drm_fence_object_signaled(fence,
+							       DRM_FENCE_TYPE_EXE)));
+			if (signaled)
+				break;
+			if (time_after_eq(jiffies, _end))
+				PSB_DEBUG_GENERAL
+				    ("MSVDXACPI: fence 0x%x didn't get signaled for 3 secs; we will suspend anyways\n",
+				     (unsigned int)fence);
+		} while (ret == -EINTR);
+
+	}
+
+	/* Issue software reset */
+        PSB_WMSVDX32 (msvdx_sw_reset_all, MSVDX_CONTROL);
+
+        ret = psb_wait_for_register (dev_priv, MSVDX_CONTROL, 0,
+                           MSVDX_CONTROL_CR_MSVDX_SOFT_RESET_MASK);
+
+	PSB_DEBUG_GENERAL("MSVDXACPI: All MSVDX IRQs (%d) serviced...\n",
+			  count);
+	return 0;
+}
+
+static int psb_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+	struct drm_device *dev = pci_get_drvdata(pdev);
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+        struct drm_connector *output;
+
+	if (drm_psb_no_fb == 0)
+		psbfb_suspend(dev);
+	else {
+		if(num_registered_fb)
+		{
+			list_for_each_entry(output, &dev->mode_config.connector_list, head) {
+				//if(output->encoder->crtc != NULL)
+				//	intel_crtc_mode_save(output->encoder->crtc);
+				//if(output->funcs->save)
+				//	output->funcs->save(output);
+			}
+		}
+	}
+
+	dev_priv->saveCLOCKGATING = PSB_RSGX32(PSB_CR_CLKGATECTL);
+	(void)psb_idle_3d(dev);
+	(void)psb_idle_2d(dev);
+	flush_scheduled_work();
+
+	psb_takedown_use_base(dev_priv);
+
+	if (dev_priv->has_msvdx)
+		psb_prepare_msvdx_suspend(dev);
+
+	pci_save_state(pdev);
+	pci_disable_device(pdev);
+	pci_set_power_state(pdev, PCI_D3hot);
+
+	return 0;
+}
+
+static int psb_resume(struct pci_dev *pdev)
+{
+	struct drm_device *dev = pci_get_drvdata(pdev);
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct psb_gtt *pg = dev_priv->pg;
+        struct drm_connector *output;
+	int ret;
+
+	pci_set_power_state(pdev, PCI_D0);
+	pci_restore_state(pdev);
+	ret = pci_enable_device(pdev);
+	if (ret)
+		return ret;
+
+	INIT_LIST_HEAD(&dev_priv->resume_buf.head);
+	dev_priv->msvdx_needs_reset = 1;
+
+	PSB_WVDC32(pg->pge_ctl | _PSB_PGETBL_ENABLED, PSB_PGETBL_CTL);
+	pci_write_config_word(pdev, PSB_GMCH_CTRL,
+			      pg->gmch_ctrl | _PSB_GMCH_ENABLED);
+
+	/*
+	 * The GTT page tables are probably not saved.
+	 * However, TT and VRAM is empty at this point.
+	 */
+
+	psb_gtt_init(dev_priv->pg, 1);
+
+	/*
+	 * The SGX loses it's register contents.
+	 * Restore BIF registers. The MMU page tables are
+	 * "normal" pages, so their contents should be kept.
+	 */
+
+	PSB_WSGX32(dev_priv->saveCLOCKGATING, PSB_CR_CLKGATECTL);
+	PSB_WSGX32(0x00000000, PSB_CR_BIF_BANK0);
+	PSB_WSGX32(0x00000000, PSB_CR_BIF_BANK1);
+	PSB_RSGX32(PSB_CR_BIF_BANK1);
+
+	psb_mmu_set_pd_context(psb_mmu_get_default_pd(dev_priv->mmu), 0);
+	psb_mmu_set_pd_context(dev_priv->pf_pd, 1);
+	psb_mmu_enable_requestor(dev_priv->mmu, _PSB_MMU_ER_MASK);
+
+	/*
+	 * 2D Base registers..
+	 */
+	psb_init_2d(dev_priv);
+
+	if (drm_psb_no_fb == 0) {
+            list_for_each_entry(output, &dev->mode_config.connector_list, head) {
+                if(output->encoder->crtc != NULL)
+                    drm_crtc_helper_set_mode(output->encoder->crtc, &output->encoder->crtc->mode,
+                              output->encoder->crtc->x, output->encoder->crtc->y, NULL);
+            }
+        }
+
+	/*
+	 * Persistant 3D base registers and USSE base registers..
+	 */
+
+	PSB_WSGX32(PSB_MEM_PDS_START, PSB_CR_PDS_EXEC_BASE);
+	PSB_WSGX32(PSB_MEM_RASTGEOM_START, PSB_CR_BIF_3D_REQ_BASE);
+	psb_init_use_base(dev_priv, 3, 13);
+
+	/*
+	 * Now, re-initialize the 3D engine.
+	 */
+
+	psb_xhw_resume(dev_priv, &dev_priv->resume_buf);
+
+	psb_scheduler_ta_mem_check(dev_priv);
+	if (dev_priv->ta_mem && !dev_priv->force_ta_mem_load) {
+		psb_xhw_ta_mem_load(dev_priv, &dev_priv->resume_buf,
+				    PSB_TA_MEM_FLAG_TA |
+				    PSB_TA_MEM_FLAG_RASTER |
+				    PSB_TA_MEM_FLAG_HOSTA |
+				    PSB_TA_MEM_FLAG_HOSTD |
+				    PSB_TA_MEM_FLAG_INIT,
+				    dev_priv->ta_mem->ta_memory->offset,
+				    dev_priv->ta_mem->hw_data->offset,
+				    dev_priv->ta_mem->hw_cookie);
+	}
+
+	if (drm_psb_no_fb == 0)
+		psbfb_resume(dev);
+
+	else {
+		if(num_registered_fb)
+		{
+			struct fb_info *fb_info=registered_fb[0];
+			list_for_each_entry(output, &dev->mode_config.connector_list, head) {
+				//if(output->encoder->crtc != NULL)
+				//	intel_crtc_mode_restore(output->encoder->crtc);
+			}
+			if(fb_info)
+			{
+				fb_set_suspend(fb_info, 0);
+				printk("set the fb_set_suspend resume end\n");
+			}
+		}
+	}
+
+
+	return 0;
+}
+
+/* always available as we are SIGIO'd */
+static unsigned int psb_poll(struct file *filp, struct poll_table_struct *wait)
+{
+	return (POLLIN | POLLRDNORM);
+}
+
+static int psb_release(struct inode *inode, struct file *filp)
+{
+	struct drm_file *file_priv = (struct drm_file *)filp->private_data;
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+
+	if (dev_priv && dev_priv->xhw_file) {
+		psb_xhw_init_takedown(dev_priv, file_priv, 1);
+	}
+	return drm_release(inode, filp);
+}
+
+extern struct drm_fence_driver psb_fence_driver;
+
+/*
+ * Use this memory type priority if no eviction is needed.
+ */
+static uint32_t psb_mem_prios[] = { DRM_BO_MEM_VRAM,
+	DRM_BO_MEM_TT,
+	DRM_PSB_MEM_KERNEL,
+	DRM_PSB_MEM_MMU,
+	DRM_PSB_MEM_RASTGEOM,
+	DRM_PSB_MEM_PDS,
+	DRM_PSB_MEM_APER,
+	DRM_BO_MEM_LOCAL
+};
+
+/*
+ * Use this memory type priority if need to evict.
+ */
+static uint32_t psb_busy_prios[] = { DRM_BO_MEM_TT,
+	DRM_BO_MEM_VRAM,
+	DRM_PSB_MEM_KERNEL,
+	DRM_PSB_MEM_MMU,
+	DRM_PSB_MEM_RASTGEOM,
+	DRM_PSB_MEM_PDS,
+	DRM_PSB_MEM_APER,
+	DRM_BO_MEM_LOCAL
+};
+
+static struct drm_bo_driver psb_bo_driver = {
+	.mem_type_prio = psb_mem_prios,
+	.mem_busy_prio = psb_busy_prios,
+	.num_mem_type_prio = ARRAY_SIZE(psb_mem_prios),
+	.num_mem_busy_prio = ARRAY_SIZE(psb_busy_prios),
+	.create_ttm_backend_entry = drm_psb_tbe_init,
+	.fence_type = psb_fence_types,
+	.invalidate_caches = psb_invalidate_caches,
+	.init_mem_type = psb_init_mem_type,
+	.evict_mask = psb_evict_mask,
+	.move = psb_move,
+	.backend_size = psb_tbe_size,
+	.command_stream_barrier = NULL,
+};
+
+static struct drm_driver driver = {
+	.driver_features = DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED |
+	    DRIVER_IRQ_VBL | DRIVER_IRQ_VBL2,
+	.load = psb_driver_load,
+	.unload = psb_driver_unload,
+	.dri_library_name = dri_library_name,
+	.get_reg_ofs = drm_core_get_reg_ofs,
+	.ioctls = psb_ioctls,
+	.device_is_agp = psb_driver_device_is_agp,
+	.get_vblank_counter = psb_get_vblank_counter,
+	.enable_vblank = psb_enable_vblank,
+	.disable_vblank = psb_disable_vblank,
+	.irq_preinstall = psb_irq_preinstall,
+	.irq_postinstall = psb_irq_postinstall,
+	.irq_uninstall = psb_irq_uninstall,
+	.irq_handler = psb_irq_handler,
+	.master_create = psb_master_create,
+	.master_destroy = psb_master_destroy,
+	.fb_probe = psbfb_probe,
+	.fb_remove = psbfb_remove,
+	.firstopen = NULL,
+	.lastclose = psb_lastclose,
+	.fops = {
+		 .owner = THIS_MODULE,
+		 .open = drm_open,
+		 .release = psb_release,
+		 .ioctl = drm_ioctl,
+		 .mmap = drm_mmap,
+		 .poll = psb_poll,
+		 .fasync = drm_fasync,
+		 },
+	.pci_driver = {
+		       .name = DRIVER_NAME,
+		       .id_table = pciidlist,
+		       .probe = probe,
+		       .remove = __devexit_p(drm_cleanup_pci),
+		       .resume = psb_resume,
+		       .suspend = psb_suspend,
+		       },
+	.fence_driver = &psb_fence_driver,
+	.bo_driver = &psb_bo_driver,
+	.name = DRIVER_NAME,
+	.desc = DRIVER_DESC,
+	.date = PSB_DRM_DRIVER_DATE,
+	.major = PSB_DRM_DRIVER_MAJOR,
+	.minor = PSB_DRM_DRIVER_MINOR,
+	.patchlevel = PSB_DRM_DRIVER_PATCHLEVEL
+};
+
+static int probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+	return drm_get_dev(pdev, ent, &driver);
+}
+
+static int __init psb_init(void)
+{
+	driver.num_ioctls = psb_max_ioctl;
+
+	return drm_init(&driver);
+}
+
+static void __exit psb_exit(void)
+{
+	drm_exit(&driver);
+}
+
+module_init(psb_init);
+module_exit(psb_exit);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_drv.h
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_drv.h	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,549 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ */
+#ifndef _PSB_DRV_H_
+#define _PSB_DRV_H_
+
+#include "drmP.h"
+#include "psb_drm.h"
+#include "psb_reg.h"
+#include "psb_schedule.h"
+#include "psb_priv.h"
+#include "../i915/intel_drv.h"
+
+
+enum {
+	CHIP_PSB_8108 = 0,
+	CHIP_PSB_8109 = 1
+};
+
+/*
+ * Hardware bugfixes
+ */
+
+#define FIX_TG_16
+#define FIX_TG_2D_CLOCKGATE
+
+#define DRIVER_NAME "psb"
+#define DRIVER_DESC "drm driver for the Intel GMA500"
+#define DRIVER_AUTHOR "Tungsten Graphics Inc."
+
+#define PSB_DRM_DRIVER_DATE "20080613"
+#define PSB_DRM_DRIVER_MAJOR 4
+#define PSB_DRM_DRIVER_MINOR 12
+#define PSB_DRM_DRIVER_PATCHLEVEL 0
+
+#define PSB_VDC_OFFSET           0x00000000
+#define PSB_VDC_SIZE             0x000080000
+#define PSB_SGX_SIZE             0x8000
+#define PSB_SGX_OFFSET           0x00040000
+#define PSB_MMIO_RESOURCE        0
+#define PSB_GATT_RESOURCE        2
+#define PSB_GTT_RESOURCE         3
+#define PSB_GMCH_CTRL            0x52
+#define PSB_BSM                  0x5C
+#define _PSB_GMCH_ENABLED        0x4
+#define PSB_PGETBL_CTL           0x2020
+#define _PSB_PGETBL_ENABLED      0x00000001
+#define PSB_SGX_2D_SLAVE_PORT    0x4000
+#define PSB_TT_PRIV0_LIMIT       (256*1024*1024)
+#define PSB_TT_PRIV0_PLIMIT      (PSB_TT_PRIV0_LIMIT >> PAGE_SHIFT)
+#define PSB_NUM_VALIDATE_BUFFERS 1024
+#define PSB_MEM_KERNEL_START     0x10000000
+#define PSB_MEM_PDS_START        0x20000000
+#define PSB_MEM_MMU_START        0x40000000
+
+#define DRM_PSB_MEM_KERNEL       DRM_BO_MEM_PRIV0
+#define DRM_PSB_FLAG_MEM_KERNEL  DRM_BO_FLAG_MEM_PRIV0
+
+/*
+ * Flags for external memory type field.
+ */
+
+#define PSB_MSVDX_OFFSET        0x50000	/*MSVDX Base offset */
+#define PSB_MSVDX_SIZE          0x8000	/*MSVDX MMIO region is 0x50000 - 0x57fff ==> 32KB */
+
+#define PSB_MMU_CACHED_MEMORY     0x0001	/* Bind to MMU only */
+#define PSB_MMU_RO_MEMORY         0x0002	/* MMU RO memory */
+#define PSB_MMU_WO_MEMORY         0x0004	/* MMU WO memory */
+
+/*
+ * PTE's and PDE's
+ */
+
+#define PSB_PDE_MASK              0x003FFFFF
+#define PSB_PDE_SHIFT             22
+#define PSB_PTE_SHIFT             12
+
+#define PSB_PTE_VALID             0x0001	/* PTE / PDE valid */
+#define PSB_PTE_WO                0x0002	/* Write only */
+#define PSB_PTE_RO                0x0004	/* Read only */
+#define PSB_PTE_CACHED            0x0008	/* CPU cache coherent */
+
+/*
+ * VDC registers and bits
+ */
+#define PSB_HWSTAM                0x2098
+#define PSB_INSTPM                0x20C0
+#define PSB_INT_IDENTITY_R        0x20A4
+#define _PSB_VSYNC_PIPEB_FLAG     (1<<5)
+#define _PSB_VSYNC_PIPEA_FLAG     (1<<7)
+#define _PSB_IRQ_SGX_FLAG         (1<<18)
+#define _PSB_IRQ_MSVDX_FLAG       (1<<19)
+#define PSB_INT_MASK_R            0x20A8
+#define PSB_INT_ENABLE_R          0x20A0
+#define PSB_PIPEASTAT             0x70024
+#define _PSB_VBLANK_INTERRUPT_ENABLE (1 << 17)
+#define _PSB_VBLANK_CLEAR         (1 << 1)
+#define PSB_PIPEBSTAT             0x71024
+
+#define _PSB_MMU_ER_MASK      0x0001FF00
+#define _PSB_MMU_ER_HOST      (1 << 16)
+#define GPIOA			0x5010
+#define GPIOB			0x5014
+#define GPIOC			0x5018
+#define GPIOD			0x501c
+#define GPIOE			0x5020
+#define GPIOF			0x5024
+#define GPIOG			0x5028
+#define GPIOH			0x502c
+#define GPIO_CLOCK_DIR_MASK		(1 << 0)
+#define GPIO_CLOCK_DIR_IN		(0 << 1)
+#define GPIO_CLOCK_DIR_OUT		(1 << 1)
+#define GPIO_CLOCK_VAL_MASK		(1 << 2)
+#define GPIO_CLOCK_VAL_OUT		(1 << 3)
+#define GPIO_CLOCK_VAL_IN		(1 << 4)
+#define GPIO_CLOCK_PULLUP_DISABLE	(1 << 5)
+#define GPIO_DATA_DIR_MASK		(1 << 8)
+#define GPIO_DATA_DIR_IN		(0 << 9)
+#define GPIO_DATA_DIR_OUT		(1 << 9)
+#define GPIO_DATA_VAL_MASK		(1 << 10)
+#define GPIO_DATA_VAL_OUT		(1 << 11)
+#define GPIO_DATA_VAL_IN		(1 << 12)
+#define GPIO_DATA_PULLUP_DISABLE	(1 << 13)
+
+#define VCLK_DIVISOR_VGA0   0x6000
+#define VCLK_DIVISOR_VGA1   0x6004
+#define VCLK_POST_DIV       0x6010
+
+#define I915_READ(reg)          readl(dev_priv->common.regs + (reg))
+#define I915_WRITE(reg, val)     writel(val, dev_priv->common.regs + (reg))
+
+#define PSB_COMM_2D (PSB_ENGINE_2D << 4)
+#define PSB_COMM_3D (PSB_ENGINE_3D << 4)
+#define PSB_COMM_TA (PSB_ENGINE_TA << 4)
+#define PSB_COMM_HP (PSB_ENGINE_HP << 4)
+#define PSB_COMM_USER_IRQ (1024 >> 2)
+#define PSB_COMM_USER_IRQ_LOST (PSB_COMM_USER_IRQ + 1)
+#define PSB_COMM_FW (2048 >> 2)
+
+#define PSB_UIRQ_VISTEST               1
+#define PSB_UIRQ_OOM_REPLY             2
+#define PSB_UIRQ_FIRE_TA_REPLY         3
+#define PSB_UIRQ_FIRE_RASTER_REPLY     4
+
+#define PSB_2D_SIZE (256*1024*1024)
+#define PSB_MAX_RELOC_PAGES 1024
+
+#define PSB_LOW_REG_OFFS 0x0204
+#define PSB_HIGH_REG_OFFS 0x0600
+
+#define PSB_NUM_VBLANKS 2
+
+#define PSB_COMM_2D (PSB_ENGINE_2D << 4)
+#define PSB_COMM_3D (PSB_ENGINE_3D << 4)
+#define PSB_COMM_TA (PSB_ENGINE_TA << 4)
+#define PSB_COMM_HP (PSB_ENGINE_HP << 4)
+#define PSB_COMM_FW (2048 >> 2)
+
+#define PSB_2D_SIZE (256*1024*1024)
+#define PSB_MAX_RELOC_PAGES 1024
+
+#define PSB_LOW_REG_OFFS 0x0204
+#define PSB_HIGH_REG_OFFS 0x0600
+
+#define PSB_NUM_VBLANKS 2
+#define PSB_WATCHDOG_DELAY (DRM_HZ / 10)
+
+/*
+ * User options.
+ */
+
+
+struct psb_gtt {
+	struct drm_device *dev;
+	int initialized;
+	uint32_t gatt_start;
+	uint32_t gtt_start;
+	uint32_t gtt_phys_start;
+	unsigned gtt_pages;
+	unsigned gatt_pages;
+	uint32_t stolen_base;
+	uint32_t pge_ctl;
+	u16 gmch_ctrl;
+	unsigned long stolen_size;
+	uint32_t *gtt_map;
+	struct rw_semaphore sem;
+};
+
+struct psb_use_base {
+	struct list_head head;
+	struct drm_fence_object *fence;
+	unsigned int reg;
+	unsigned long offset;
+	unsigned int dm;
+};
+
+struct psb_buflist_item;
+
+struct psb_msvdx_cmd_queue {
+	struct list_head head;
+	void *cmd;
+	unsigned long cmd_size;
+	uint32_t sequence;
+};
+
+
+struct psb_mmu_driver;
+
+extern struct psb_mmu_driver *psb_mmu_driver_init(uint8_t __iomem * registers,
+						  int trap_pagefaults,
+						  int invalid_type,
+						  atomic_t *msvdx_mmu_invaldc);
+extern void psb_mmu_driver_takedown(struct psb_mmu_driver *driver);
+extern struct psb_mmu_pd *psb_mmu_get_default_pd(struct psb_mmu_driver *driver);
+extern void psb_mmu_mirror_gtt(struct psb_mmu_pd *pd, uint32_t mmu_offset,
+			       uint32_t gtt_start, uint32_t gtt_pages);
+extern void psb_mmu_test(struct psb_mmu_driver *driver, uint32_t offset);
+extern struct psb_mmu_pd *psb_mmu_alloc_pd(struct psb_mmu_driver *driver,
+					   int trap_pagefaults,
+					   int invalid_type);
+extern void psb_mmu_free_pagedir(struct psb_mmu_pd *pd);
+extern void psb_mmu_flush(struct psb_mmu_driver *driver);
+extern void psb_mmu_remove_pfn_sequence(struct psb_mmu_pd *pd,
+					unsigned long address,
+					uint32_t num_pages);
+extern int psb_mmu_insert_pfn_sequence(struct psb_mmu_pd *pd,
+				       uint32_t start_pfn,
+				       unsigned long address,
+				       uint32_t num_pages, int type);
+extern int psb_mmu_virtual_to_pfn(struct psb_mmu_pd *pd, uint32_t virtual,
+				  unsigned long *pfn);
+
+/*
+ * Enable / disable MMU for different requestors.
+ */
+
+extern void psb_mmu_enable_requestor(struct psb_mmu_driver *driver,
+				     uint32_t mask);
+extern void psb_mmu_disable_requestor(struct psb_mmu_driver *driver,
+				      uint32_t mask);
+extern void psb_mmu_set_pd_context(struct psb_mmu_pd *pd, int hw_context);
+extern int psb_mmu_insert_pages(struct psb_mmu_pd *pd, struct page **pages,
+				unsigned long address, uint32_t num_pages,
+				uint32_t desired_tile_stride,
+				uint32_t hw_tile_stride, int type);
+extern void psb_mmu_remove_pages(struct psb_mmu_pd *pd, unsigned long address,
+				 uint32_t num_pages,
+				 uint32_t desired_tile_stride,
+				 uint32_t hw_tile_stride);
+/*
+ * psb_sgx.c
+ */
+
+extern int psb_blit_sequence(struct drm_psb_private *dev_priv,
+			     uint32_t sequence);
+extern void psb_init_2d(struct drm_psb_private *dev_priv);
+extern int psb_idle_2d(struct drm_device *dev);
+extern int psb_idle_3d(struct drm_device *dev);
+extern int psb_emit_2d_copy_blit(struct drm_device *dev,
+				 uint32_t src_offset,
+				 uint32_t dst_offset, uint32_t pages,
+				 int direction);
+extern int psb_cmdbuf_ioctl(struct drm_device *dev, void *data,
+			    struct drm_file *file_priv);
+extern int psb_reg_submit(struct drm_psb_private *dev_priv, uint32_t * regs,
+			  unsigned int cmds);
+extern int psb_submit_copy_cmdbuf(struct drm_device *dev,
+				  struct drm_buffer_object *cmd_buffer,
+				  unsigned long cmd_offset,
+				  unsigned long cmd_size, int engine,
+				  uint32_t * copy_buffer);
+extern void psb_fence_or_sync(struct drm_file *priv,
+			      int engine,
+			      struct drm_psb_cmdbuf_arg *arg,
+			      struct drm_fence_arg *fence_arg,
+			      struct drm_fence_object **fence_p);
+extern void psb_init_disallowed(void);
+
+/*
+ * psb_irq.c
+ */
+
+extern u32 psb_get_vblank_counter(struct drm_device *dev, int pipe);
+extern int psb_enable_vblank(struct drm_device *dev, int crtc);
+extern void psb_disable_vblank(struct drm_device *dev, int crtc);
+extern irqreturn_t psb_irq_handler(DRM_IRQ_ARGS);
+extern void psb_irq_preinstall(struct drm_device *dev);
+extern int psb_irq_postinstall(struct drm_device *dev);
+extern void psb_irq_uninstall(struct drm_device *dev);
+
+/*
+ * psb_fence.c
+ */
+
+extern void psb_fence_handler(struct drm_device *dev, uint32_t class);
+extern void psb_2D_irq_off(struct drm_psb_private *dev_priv);
+extern void psb_2D_irq_on(struct drm_psb_private *dev_priv);
+extern uint32_t psb_fence_advance_sequence(struct drm_device *dev,
+					   uint32_t class);
+extern int psb_fence_emit_sequence(struct drm_device *dev, uint32_t fence_class,
+				   uint32_t flags, uint32_t * sequence,
+				   uint32_t * native_type);
+extern void psb_fence_error(struct drm_device *dev,
+			    uint32_t class,
+			    uint32_t sequence, uint32_t type, int error);
+
+/*MSVDX stuff*/
+extern void psb_msvdx_irq_off(struct drm_psb_private *dev_priv);
+extern void psb_msvdx_irq_on(struct drm_psb_private *dev_priv);
+extern int psb_hw_info_ioctl(struct drm_device *dev, void *data,
+                            struct drm_file *file_priv);
+
+/*
+ * psb_buffer.c
+ */
+extern struct drm_ttm_backend *drm_psb_tbe_init(struct drm_device *dev);
+extern int psb_fence_types(struct drm_buffer_object *bo, uint32_t * class,
+			   uint32_t * type);
+extern uint32_t psb_evict_mask(struct drm_buffer_object *bo);
+extern int psb_invalidate_caches(struct drm_device *dev, uint64_t flags);
+extern int psb_init_mem_type(struct drm_device *dev, uint32_t type,
+			     struct drm_mem_type_manager *man);
+extern int psb_move(struct drm_buffer_object *bo,
+		    int evict, int no_wait, struct drm_bo_mem_reg *new_mem);
+extern int psb_tbe_size(struct drm_device *dev, unsigned long num_pages);
+
+/*
+ * psb_gtt.c
+ */
+extern int psb_gtt_init(struct psb_gtt *pg, int resume);
+extern int psb_gtt_insert_pages(struct psb_gtt *pg, struct page **pages,
+				unsigned offset_pages, unsigned num_pages,
+				unsigned desired_tile_stride,
+				unsigned hw_tile_stride, int type);
+extern int psb_gtt_remove_pages(struct psb_gtt *pg, unsigned offset_pages,
+				unsigned num_pages,
+				unsigned desired_tile_stride,
+				unsigned hw_tile_stride);
+
+extern struct psb_gtt *psb_gtt_alloc(struct drm_device *dev);
+extern void psb_gtt_takedown(struct psb_gtt *pg, int free);
+
+/*
+ * psb_fb.c
+ */
+extern int psbfb_probe(struct drm_device *dev, struct drm_crtc *crtc);
+extern int psbfb_remove(struct drm_device *dev, struct drm_crtc *crtc);
+extern int psbfb_kms_off_ioctl(struct drm_device *dev, void *data,
+			       struct drm_file *file_priv);
+extern int psbfb_kms_on_ioctl(struct drm_device *dev, void *data,
+			      struct drm_file *file_priv);
+extern void psbfb_suspend(struct drm_device *dev);
+extern void psbfb_resume(struct drm_device *dev);
+
+/*
+ * psb_reset.c
+ */
+
+extern void psb_reset(struct drm_psb_private *dev_priv, int reset_2d);
+extern void psb_schedule_watchdog(struct drm_psb_private *dev_priv);
+extern void psb_watchdog_init(struct drm_psb_private *dev_priv);
+extern void psb_watchdog_takedown(struct drm_psb_private *dev_priv);
+extern void psb_print_pagefault(struct drm_psb_private *dev_priv);
+
+/*
+ * psb_regman.c
+ */
+
+extern void psb_takedown_use_base(struct drm_psb_private *dev_priv);
+extern int psb_grab_use_base(struct drm_psb_private *dev_priv,
+			     unsigned long dev_virtual,
+			     unsigned long size,
+			     unsigned int data_master,
+			     uint32_t fence_class,
+			     uint32_t fence_type,
+			     int no_wait,
+			     int ignore_signals,
+			     int *r_reg, uint32_t * r_offset);
+extern int psb_init_use_base(struct drm_psb_private *dev_priv,
+			     unsigned int reg_start, unsigned int reg_num);
+
+/*
+ * psb_xhw.c
+ */
+
+extern int psb_xhw_ioctl(struct drm_device *dev, void *data,
+			 struct drm_file *file_priv);
+extern int psb_xhw_init_ioctl(struct drm_device *dev, void *data,
+			      struct drm_file *file_priv);
+extern int psb_xhw_init(struct drm_device *dev);
+extern void psb_xhw_takedown(struct drm_psb_private *dev_priv);
+extern void psb_xhw_init_takedown(struct drm_psb_private *dev_priv,
+				  struct drm_file *file_priv, int closing);
+extern int psb_xhw_scene_bind_fire(struct drm_psb_private *dev_priv,
+				   struct psb_xhw_buf *buf,
+				   uint32_t fire_flags,
+				   uint32_t hw_context,
+				   uint32_t * cookie,
+				   uint32_t * oom_cmds,
+				   uint32_t num_oom_cmds,
+				   uint32_t offset,
+				   uint32_t engine, uint32_t flags);
+extern int psb_xhw_fire_raster(struct drm_psb_private *dev_priv,
+			       struct psb_xhw_buf *buf, uint32_t fire_flags);
+extern int psb_xhw_scene_info(struct drm_psb_private *dev_priv,
+			      struct psb_xhw_buf *buf,
+			      uint32_t w,
+			      uint32_t h,
+			      uint32_t * hw_cookie,
+			      uint32_t * bo_size,
+			      uint32_t * clear_p_start,
+			      uint32_t * clear_num_pages);
+
+extern int psb_xhw_reset_dpm(struct drm_psb_private *dev_priv,
+			     struct psb_xhw_buf *buf);
+extern int psb_xhw_check_lockup(struct drm_psb_private *dev_priv,
+				struct psb_xhw_buf *buf, uint32_t * value);
+extern int psb_xhw_ta_mem_info(struct drm_psb_private *dev_priv,
+			       struct psb_xhw_buf *buf,
+			       uint32_t pages,
+			       uint32_t * hw_cookie, uint32_t * size);
+extern int psb_xhw_ta_oom(struct drm_psb_private *dev_priv,
+			  struct psb_xhw_buf *buf, uint32_t * cookie);
+extern void psb_xhw_ta_oom_reply(struct drm_psb_private *dev_priv,
+				 struct psb_xhw_buf *buf,
+				 uint32_t * cookie,
+				 uint32_t * bca,
+				 uint32_t * rca, uint32_t * flags);
+extern int psb_xhw_vistest(struct drm_psb_private *dev_priv,
+			   struct psb_xhw_buf *buf);
+extern int psb_xhw_handler(struct drm_psb_private *dev_priv);
+extern int psb_xhw_resume(struct drm_psb_private *dev_priv,
+			  struct psb_xhw_buf *buf);
+extern void psb_xhw_fire_reply(struct drm_psb_private *dev_priv,
+			       struct psb_xhw_buf *buf, uint32_t * cookie);
+extern int psb_xhw_ta_mem_load(struct drm_psb_private *dev_priv,
+			       struct psb_xhw_buf *buf,
+			       uint32_t flags,
+			       uint32_t param_offset,
+			       uint32_t pt_offset, uint32_t * hw_cookie);
+extern void psb_xhw_clean_buf(struct drm_psb_private *dev_priv,
+			      struct psb_xhw_buf *buf);
+
+extern void psb_i2c_init(struct drm_psb_private *dev_priv);
+
+/*
+ * psb_schedule.c: HW bug fixing.
+ */
+
+#ifdef FIX_TG_16
+
+extern void psb_2d_unlock(struct drm_psb_private *dev_priv);
+extern void psb_2d_lock(struct drm_psb_private *dev_priv);
+extern void psb_resume_ta_2d_idle(struct drm_psb_private *dev_priv);
+
+#else
+
+#define psb_2d_lock(_dev_priv) mutex_lock(&(_dev_priv)->mutex_2d)
+#define psb_2d_unlock(_dev_priv) mutex_unlock(&(_dev_priv)->mutex_2d)
+
+#endif
+
+/*
+ * Utilities
+ */
+
+#define PSB_WVDC32(_val, _offs) I915_WRITE(_offs, _val)
+#define PSB_RVDC32(_offs) I915_READ(_offs)
+
+#define PSB_ALIGN_TO(_val, _align) \
+  (((_val) + ((_align) - 1)) & ~((_align) - 1))
+#define PSB_WSGX32(_val, _offs) \
+  iowrite32(_val, dev_priv->sgx_reg + (_offs))
+#define PSB_RSGX32(_offs) \
+  ioread32(dev_priv->sgx_reg + (_offs))
+#define PSB_WMSVDX32(_val, _offs) \
+  iowrite32(_val, dev_priv->msvdx_reg + (_offs))
+#define PSB_RMSVDX32(_offs) \
+  ioread32(dev_priv->msvdx_reg + (_offs))
+
+#define PSB_ALPL(_val, _base)			\
+  (((_val) >> (_base ## _ALIGNSHIFT)) << (_base ## _SHIFT))
+#define PSB_ALPLM(_val, _base)			\
+  ((((_val) >> (_base ## _ALIGNSHIFT)) << (_base ## _SHIFT)) & (_base ## _MASK))
+
+#define PSB_D_RENDER  (1 << 16)
+
+#define PSB_D_GENERAL (1 << 0)
+#define PSB_D_INIT    (1 << 1)
+#define PSB_D_IRQ     (1 << 2)
+#define PSB_D_FW      (1 << 3)
+#define PSB_D_PERF    (1 << 4)
+#define PSB_D_TMP    (1 << 5)
+#define PSB_D_RELOC   (1 << 6)
+
+extern int drm_psb_debug;
+extern int drm_psb_no_fb;
+extern int drm_psb_disable_vsync;
+
+#define PSB_DEBUG_FW(_fmt, _arg...) \
+	PSB_DEBUG(PSB_D_FW, _fmt, ##_arg)
+#define PSB_DEBUG_GENERAL(_fmt, _arg...) \
+	PSB_DEBUG(PSB_D_GENERAL, _fmt, ##_arg)
+#define PSB_DEBUG_INIT(_fmt, _arg...) \
+	PSB_DEBUG(PSB_D_INIT, _fmt, ##_arg)
+#define PSB_DEBUG_IRQ(_fmt, _arg...) \
+	PSB_DEBUG(PSB_D_IRQ, _fmt, ##_arg)
+#define PSB_DEBUG_RENDER(_fmt, _arg...) \
+	PSB_DEBUG(PSB_D_RENDER, _fmt, ##_arg)
+#define PSB_DEBUG_PERF(_fmt, _arg...) \
+	PSB_DEBUG(PSB_D_PERF, _fmt, ##_arg)
+#define PSB_DEBUG_TMP(_fmt, _arg...) \
+	PSB_DEBUG(PSB_D_TMP, _fmt, ##_arg)
+#define PSB_DEBUG_RELOC(_fmt, _arg...) \
+	PSB_DEBUG(PSB_D_RELOC, _fmt, ##_arg)
+
+#if DRM_DEBUG_CODE
+#define PSB_DEBUG(_flag, _fmt, _arg...)					\
+	do {								\
+	  if (unlikely((_flag) & drm_psb_debug))			\
+			printk(KERN_DEBUG				\
+			       "[psb:0x%02x:%s] " _fmt , _flag,	\
+			       __FUNCTION__ , ##_arg);			\
+	} while (0)
+#else
+#define PSB_DEBUG(_fmt, _arg...)     do { } while (0)
+#endif
+
+#endif
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_fb.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_fb.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,1219 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/tty.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/console.h>
+
+#include "drmP.h"
+#include "drm.h"
+#include "drm_crtc.h"
+#include "psb_drv.h"
+
+struct psbfb_vm_info {
+	struct drm_buffer_object *bo;
+	struct address_space *f_mapping;
+	struct mutex vm_mutex;
+	atomic_t refcount;
+};
+
+struct psbfb_par {
+	struct drm_device *dev;
+	struct drm_crtc *crtc;
+	struct drm_connector *output;
+	struct psbfb_vm_info *vi;
+	int dpms_state;
+};
+
+static void psbfb_vm_info_deref(struct psbfb_vm_info **vi)
+{
+	struct psbfb_vm_info *tmp = *vi;
+	*vi = NULL;
+	if (atomic_dec_and_test(&tmp->refcount)) {
+		drm_bo_usage_deref_unlocked(&tmp->bo);
+		drm_free(tmp, sizeof(*tmp), DRM_MEM_MAPS);
+	}
+}
+
+static struct psbfb_vm_info *psbfb_vm_info_ref(struct psbfb_vm_info *vi)
+{
+	atomic_inc(&vi->refcount);
+	return vi;
+}
+
+static struct psbfb_vm_info *psbfb_vm_info_create(void)
+{
+	struct psbfb_vm_info *vi;
+
+	vi = drm_calloc(1, sizeof(*vi), DRM_MEM_MAPS);
+	if (!vi)
+		return NULL;
+
+	mutex_init(&vi->vm_mutex);
+	atomic_set(&vi->refcount, 1);
+	return vi;
+}
+
+#define CMAP_TOHW(_val, _width) ((((_val) << (_width)) + 0x7FFF - (_val)) >> 16)
+
+static int psbfb_setcolreg(unsigned regno, unsigned red, unsigned green,
+			   unsigned blue, unsigned transp, struct fb_info *info)
+{
+	struct psbfb_par *par = info->par;
+	struct drm_crtc *crtc = par->crtc;
+	uint32_t v;
+
+	if (!crtc->fb)
+		return -ENOMEM;
+
+	if (regno > 255)
+		return 1;
+
+	if (crtc->fb->depth == 8) {
+		intel_crtc_fb_gamma_set(crtc, red, green, blue, regno);
+		return 0;
+	}
+
+	red = CMAP_TOHW(red, info->var.red.length);
+	blue = CMAP_TOHW(blue, info->var.blue.length);
+	green = CMAP_TOHW(green, info->var.green.length);
+	transp = CMAP_TOHW(transp, info->var.transp.length);
+
+	v = (red << info->var.red.offset) |
+	    (green << info->var.green.offset) |
+	    (blue << info->var.blue.offset) |
+	    (transp << info->var.transp.offset);
+
+	switch (crtc->fb->bits_per_pixel) {
+	case 16:
+		((uint32_t *) info->pseudo_palette)[regno] = v;
+		break;
+	case 24:
+	case 32:
+		((uint32_t *) info->pseudo_palette)[regno] = v;
+		break;
+	}
+
+	return 0;
+}
+
+static int psbfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+{
+	struct psbfb_par *par = info->par;
+	//struct drm_device *dev = par->dev;
+	struct drm_framebuffer *fb = par->crtc->fb;
+	//struct drm_display_mode *drm_mode;
+	//struct drm_connector *output;
+	int depth;
+	int pitch;
+	int bpp = var->bits_per_pixel;
+
+	if (!fb)
+		return -ENOMEM;
+
+	if (!var->pixclock)
+		return -EINVAL;
+
+	/* don't support virtuals for now */
+	if (var->xres_virtual > var->xres)
+		return -EINVAL;
+
+	if (var->yres_virtual > var->yres)
+		return -EINVAL;
+
+	switch (bpp) {
+	case 8:
+		depth = 8;
+		break;
+	case 16:
+		depth = (var->green.length == 6) ? 16 : 15;
+		break;
+	case 24:		/* assume this is 32bpp / depth 24 */
+		bpp = 32;
+		/* fallthrough */
+	case 32:
+		depth = (var->transp.length > 0) ? 32 : 24;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	pitch = ((var->xres * ((bpp + 1) / 8)) + 0x3f) & ~0x3f;
+
+	/* Check that we can resize */
+	if ((pitch * var->yres) > (fb->bo->num_pages << PAGE_SHIFT)) {
+		/* Need to resize the fb object.
+		 * But the generic fbdev code doesn't really understand
+		 * that we can do this. So disable for now.
+		 */
+		DRM_INFO("Can't support requested size, too big!\n");
+		return -EINVAL;
+	}
+
+	switch (depth) {
+	case 8:
+		var->red.offset = 0;
+		var->green.offset = 0;
+		var->blue.offset = 0;
+		var->red.length = 8;
+		var->green.length = 8;
+		var->blue.length = 8;
+		var->transp.length = 0;
+		var->transp.offset = 0;
+		break;
+	case 15:
+		var->red.offset = 10;
+		var->green.offset = 5;
+		var->blue.offset = 0;
+		var->red.length = 5;
+		var->green.length = 5;
+		var->blue.length = 5;
+		var->transp.length = 1;
+		var->transp.offset = 15;
+		break;
+	case 16:
+		var->red.offset = 11;
+		var->green.offset = 5;
+		var->blue.offset = 0;
+		var->red.length = 5;
+		var->green.length = 6;
+		var->blue.length = 5;
+		var->transp.length = 0;
+		var->transp.offset = 0;
+		break;
+	case 24:
+		var->red.offset = 16;
+		var->green.offset = 8;
+		var->blue.offset = 0;
+		var->red.length = 8;
+		var->green.length = 8;
+		var->blue.length = 8;
+		var->transp.length = 0;
+		var->transp.offset = 0;
+		break;
+	case 32:
+		var->red.offset = 16;
+		var->green.offset = 8;
+		var->blue.offset = 0;
+		var->red.length = 8;
+		var->green.length = 8;
+		var->blue.length = 8;
+		var->transp.length = 8;
+		var->transp.offset = 24;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int psbfb_move_fb_bo(struct fb_info *info, struct drm_buffer_object *bo,
+			    uint64_t mem_type_flags)
+{
+	struct psbfb_par *par;
+	loff_t holelen;
+	int ret;
+
+	/*
+	 * Kill all user-space mappings of this device. They will be
+	 * faulted back using nopfn when accessed.
+	 */
+
+	par = info->par;
+	holelen = ((loff_t) bo->mem.num_pages) << PAGE_SHIFT;
+	mutex_lock(&par->vi->vm_mutex);
+	if (par->vi->f_mapping) {
+		unmap_mapping_range(par->vi->f_mapping, 0, holelen, 1);
+	}
+
+	ret = drm_bo_do_validate(bo,
+				 mem_type_flags,
+				 DRM_BO_MASK_MEM |
+				 DRM_BO_FLAG_NO_EVICT,
+				 DRM_BO_HINT_DONT_FENCE, 0, 1, NULL);
+
+	mutex_unlock(&par->vi->vm_mutex);
+	return ret;
+}
+
+/* this will let fbcon do the mode init */
+static int psbfb_set_par(struct fb_info *info)
+{
+	struct psbfb_par *par = info->par;
+	struct drm_framebuffer *fb = par->crtc->fb;
+	struct drm_device *dev = par->dev;
+	struct drm_display_mode *drm_mode;
+	struct fb_var_screeninfo *var = &info->var;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	//struct drm_connector *output;
+	int pitch;
+	int depth;
+	int bpp = var->bits_per_pixel;
+
+	if (!fb)
+		return -ENOMEM;
+
+	switch (bpp) {
+	case 8:
+		depth = 8;
+		break;
+	case 16:
+		depth = (var->green.length == 6) ? 16 : 15;
+		break;
+	case 24:		/* assume this is 32bpp / depth 24 */
+		bpp = 32;
+		/* fallthrough */
+	case 32:
+		depth = (var->transp.length > 0) ? 32 : 24;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	pitch = ((var->xres * ((bpp + 1) / 8)) + 0x3f) & ~0x3f;
+
+	if ((pitch * var->yres) > (fb->bo->num_pages << PAGE_SHIFT)) {
+		/* Need to resize the fb object.
+		 * But the generic fbdev code doesn't really understand
+		 * that we can do this. So disable for now.
+		 */
+		DRM_INFO("Can't support requested size, too big!\n");
+		return -EINVAL;
+	}
+
+	fb->offset = fb->bo->offset - dev_priv->pg->gatt_start;
+	fb->width = var->xres;
+	fb->height = var->yres;
+	fb->bits_per_pixel = bpp;
+	fb->pitch = pitch;
+	fb->depth = depth;
+
+	info->fix.line_length = fb->pitch;
+	info->fix.visual =
+	    (fb->depth == 8) ? FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_DIRECTCOLOR;
+
+	/* some fbdev's apps don't want these to change */
+	info->fix.smem_start = dev->mode_config.fb_base + fb->offset;
+
+	/* we have to align the output base address because the fb->bo
+	   may be moved in the previous drm_bo_do_validate().
+	   Otherwise the output screens may go black when exit the X
+	   window and re-enter the console */
+	info->screen_base = fb->kmap.virtual;
+
+	/* Should we walk the output's modelist or just create our own ???
+	 * For now, we create and destroy a mode based on the incoming
+	 * parameters. But there's commented out code below which scans
+	 * the output list too.
+	 */
+
+	drm_mode = drm_mode_create(dev);
+	drm_mode->hdisplay = var->xres;
+	drm_mode->hsync_start = drm_mode->hdisplay + var->right_margin;
+	drm_mode->hsync_end = drm_mode->hsync_start + var->hsync_len;
+	drm_mode->htotal = drm_mode->hsync_end + var->left_margin;
+	drm_mode->vdisplay = var->yres;
+	drm_mode->vsync_start = drm_mode->vdisplay + var->lower_margin;
+	drm_mode->vsync_end = drm_mode->vsync_start + var->vsync_len;
+	drm_mode->vtotal = drm_mode->vsync_end + var->upper_margin;
+	drm_mode->clock = PICOS2KHZ(var->pixclock);
+	drm_mode->vrefresh = drm_mode_vrefresh(drm_mode);
+	drm_mode_set_name(drm_mode);
+	drm_mode_set_crtcinfo(drm_mode, CRTC_INTERLACE_HALVE_V);
+
+
+	if (!drm_crtc_helper_set_mode(par->crtc, drm_mode, 0, 0, NULL))
+		return -EINVAL;
+
+	/* Have to destroy our created mode if we're not searching the mode
+	 * list for it.
+	 */
+	drm_mode_destroy(dev, drm_mode);
+
+	return 0;
+}
+
+extern int psb_2d_submit(struct drm_psb_private *, uint32_t *, uint32_t);;
+
+static int psb_accel_2d_fillrect(struct drm_psb_private *dev_priv,
+				 uint32_t dst_offset, uint32_t dst_stride,
+				 uint32_t dst_format, uint16_t dst_x,
+				 uint16_t dst_y, uint16_t size_x,
+				 uint16_t size_y, uint32_t fill)
+{
+	uint32_t buffer[10];
+	uint32_t *buf;
+	int ret;
+
+	buf = buffer;
+
+	*buf++ = PSB_2D_FENCE_BH;
+
+	*buf++ =
+	    PSB_2D_DST_SURF_BH | dst_format | (dst_stride <<
+					       PSB_2D_DST_STRIDE_SHIFT);
+	*buf++ = dst_offset;
+
+	*buf++ =
+	    PSB_2D_BLIT_BH |
+	    PSB_2D_ROT_NONE |
+	    PSB_2D_COPYORDER_TL2BR |
+	    PSB_2D_DSTCK_DISABLE |
+	    PSB_2D_SRCCK_DISABLE | PSB_2D_USE_FILL | PSB_2D_ROP3_PATCOPY;
+
+	*buf++ = fill << PSB_2D_FILLCOLOUR_SHIFT;
+	*buf++ =
+	    (dst_x << PSB_2D_DST_XSTART_SHIFT) | (dst_y <<
+						  PSB_2D_DST_YSTART_SHIFT);
+	*buf++ =
+	    (size_x << PSB_2D_DST_XSIZE_SHIFT) | (size_y <<
+						  PSB_2D_DST_YSIZE_SHIFT);
+	*buf++ = PSB_2D_FLUSH_BH;
+
+	psb_2d_lock(dev_priv);
+	ret = psb_2d_submit(dev_priv, buffer, buf - buffer);
+	psb_2d_unlock(dev_priv);
+
+	return ret;
+}
+
+static void psbfb_fillrect_accel(struct fb_info *info,
+				 const struct fb_fillrect *r)
+{
+	struct psbfb_par *par = info->par;
+	struct drm_framebuffer *fb = par->crtc->fb;
+	struct drm_psb_private *dev_priv = par->dev->dev_private;
+	uint32_t offset;
+	uint32_t stride;
+	uint32_t format;
+
+	if (!fb)
+		return;
+
+	offset = fb->offset;
+	stride = fb->pitch;
+
+	switch (fb->depth) {
+	case 8:
+		format = PSB_2D_DST_332RGB;
+		break;
+	case 15:
+		format = PSB_2D_DST_555RGB;
+		break;
+	case 16:
+		format = PSB_2D_DST_565RGB;
+		break;
+	case 24:
+	case 32:
+		/* this is wrong but since we don't do blending its okay */
+		format = PSB_2D_DST_8888ARGB;
+		break;
+	default:
+		/* software fallback */
+		cfb_fillrect(info, r);
+		return;
+	}
+
+	psb_accel_2d_fillrect(dev_priv,
+			      offset, stride, format,
+			      r->dx, r->dy, r->width, r->height, r->color);
+}
+
+static void psbfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+{
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_fillrect(info, rect);
+		return;
+	}
+	if (in_interrupt() || in_atomic()) {
+		/*
+		 * Catch case when we're shutting down.
+		 */
+		cfb_fillrect(info, rect);
+		return;
+	}
+	psbfb_fillrect_accel(info, rect);
+}
+
+uint32_t psb_accel_2d_copy_direction(int xdir, int ydir)
+{
+	if (xdir < 0)
+		return ((ydir <
+			 0) ? PSB_2D_COPYORDER_BR2TL : PSB_2D_COPYORDER_TR2BL);
+	else
+		return ((ydir <
+			 0) ? PSB_2D_COPYORDER_BL2TR : PSB_2D_COPYORDER_TL2BR);
+}
+
+/*
+ * @srcOffset in bytes
+ * @srcStride in bytes
+ * @srcFormat psb 2D format defines
+ * @dstOffset in bytes
+ * @dstStride in bytes
+ * @dstFormat psb 2D format defines
+ * @srcX offset in pixels
+ * @srcY offset in pixels
+ * @dstX offset in pixels
+ * @dstY offset in pixels
+ * @sizeX of the copied area
+ * @sizeY of the copied area
+ */
+static int psb_accel_2d_copy(struct drm_psb_private *dev_priv,
+			     uint32_t src_offset, uint32_t src_stride,
+			     uint32_t src_format, uint32_t dst_offset,
+			     uint32_t dst_stride, uint32_t dst_format,
+			     uint16_t src_x, uint16_t src_y, uint16_t dst_x,
+			     uint16_t dst_y, uint16_t size_x, uint16_t size_y)
+{
+	uint32_t blit_cmd;
+	uint32_t buffer[10];
+	uint32_t *buf;
+	uint32_t direction;
+	int ret;
+
+	buf = buffer;
+
+	direction = psb_accel_2d_copy_direction(src_x - dst_x, src_y - dst_y);
+
+	if (direction == PSB_2D_COPYORDER_BR2TL ||
+	    direction == PSB_2D_COPYORDER_TR2BL) {
+		src_x += size_x - 1;
+		dst_x += size_x - 1;
+	}
+	if (direction == PSB_2D_COPYORDER_BR2TL ||
+	    direction == PSB_2D_COPYORDER_BL2TR) {
+		src_y += size_y - 1;
+		dst_y += size_y - 1;
+	}
+
+	blit_cmd =
+	    PSB_2D_BLIT_BH |
+	    PSB_2D_ROT_NONE |
+	    PSB_2D_DSTCK_DISABLE |
+	    PSB_2D_SRCCK_DISABLE |
+	    PSB_2D_USE_PAT | PSB_2D_ROP3_SRCCOPY | direction;
+
+	*buf++ = PSB_2D_FENCE_BH;
+	*buf++ =
+	    PSB_2D_DST_SURF_BH | dst_format | (dst_stride <<
+					       PSB_2D_DST_STRIDE_SHIFT);
+	*buf++ = dst_offset;
+	*buf++ =
+	    PSB_2D_SRC_SURF_BH | src_format | (src_stride <<
+					       PSB_2D_SRC_STRIDE_SHIFT);
+	*buf++ = src_offset;
+	*buf++ =
+	    PSB_2D_SRC_OFF_BH | (src_x << PSB_2D_SRCOFF_XSTART_SHIFT) | (src_y
+									 <<
+									 PSB_2D_SRCOFF_YSTART_SHIFT);
+	*buf++ = blit_cmd;
+	*buf++ =
+	    (dst_x << PSB_2D_DST_XSTART_SHIFT) | (dst_y <<
+						  PSB_2D_DST_YSTART_SHIFT);
+	*buf++ =
+	    (size_x << PSB_2D_DST_XSIZE_SHIFT) | (size_y <<
+						  PSB_2D_DST_YSIZE_SHIFT);
+	*buf++ = PSB_2D_FLUSH_BH;
+
+	psb_2d_lock(dev_priv);
+	ret = psb_2d_submit(dev_priv, buffer, buf - buffer);
+	psb_2d_unlock(dev_priv);
+	return ret;
+}
+
+static void psbfb_copyarea_accel(struct fb_info *info,
+				 const struct fb_copyarea *a)
+{
+	struct psbfb_par *par = info->par;
+	struct drm_framebuffer *fb = par->crtc->fb;
+	struct drm_psb_private *dev_priv = par->dev->dev_private;
+	uint32_t offset;
+	uint32_t stride;
+	uint32_t src_format;
+	uint32_t dst_format;
+
+	if (!fb)
+		return;
+
+	offset = fb->offset;
+	stride = fb->pitch;
+
+	if (a->width == 8 || a->height == 8) {
+		psb_2d_lock(dev_priv);
+		psb_idle_2d(par->dev);
+		psb_2d_unlock(dev_priv);
+		cfb_copyarea(info, a);
+		return;
+	}
+
+	switch (fb->depth) {
+	case 8:
+		src_format = PSB_2D_SRC_332RGB;
+		dst_format = PSB_2D_DST_332RGB;
+		break;
+	case 15:
+		src_format = PSB_2D_SRC_555RGB;
+		dst_format = PSB_2D_DST_555RGB;
+		break;
+	case 16:
+		src_format = PSB_2D_SRC_565RGB;
+		dst_format = PSB_2D_DST_565RGB;
+		break;
+	case 24:
+	case 32:
+		/* this is wrong but since we don't do blending its okay */
+		src_format = PSB_2D_SRC_8888ARGB;
+		dst_format = PSB_2D_DST_8888ARGB;
+		break;
+	default:
+		/* software fallback */
+		cfb_copyarea(info, a);
+		return;
+	}
+
+	psb_accel_2d_copy(dev_priv,
+			  offset, stride, src_format,
+			  offset, stride, dst_format,
+			  a->sx, a->sy, a->dx, a->dy, a->width, a->height);
+}
+
+static void psbfb_copyarea(struct fb_info *info,
+			   const struct fb_copyarea *region)
+{
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_copyarea(info, region);
+		return;
+	}
+	if (in_interrupt() || in_atomic()) {
+		/*
+		 * Catch case when we're shutting down.
+		 */
+		cfb_copyarea(info, region);
+		return;
+	}
+
+	psbfb_copyarea_accel(info, region);
+}
+
+void psbfb_imageblit(struct fb_info *info, const struct fb_image *image)
+{
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_imageblit(info, image);
+		return;
+	}
+	if (in_interrupt() || in_atomic()) {
+		cfb_imageblit(info, image);
+		return;
+	}
+
+	cfb_imageblit(info, image);
+}
+
+static int psbfb_blank(int blank_mode, struct fb_info *info)
+{
+	int dpms_mode;
+	struct psbfb_par *par = info->par;
+	struct drm_connector *output;
+	struct drm_crtc_helper_funcs *crtc_funcs;
+
+	par->dpms_state = blank_mode;
+
+	switch(blank_mode) {
+	case FB_BLANK_UNBLANK:
+		dpms_mode = DRM_MODE_DPMS_ON;
+		break;
+	case FB_BLANK_NORMAL:
+		if (!par->crtc)
+			return 0;
+		crtc_funcs = par->crtc->helper_private;
+
+		(*crtc_funcs->dpms)(par->crtc, DRM_MODE_DPMS_STANDBY);
+		return 0;
+	case FB_BLANK_HSYNC_SUSPEND:
+	default:
+		dpms_mode = DRM_MODE_DPMS_STANDBY;
+		break;
+	case FB_BLANK_VSYNC_SUSPEND:
+		dpms_mode = DRM_MODE_DPMS_SUSPEND;
+		break;
+	case FB_BLANK_POWERDOWN:
+		dpms_mode = DRM_MODE_DPMS_OFF;
+		break;
+	}
+
+	if (!par->crtc)
+		return 0;
+
+	crtc_funcs = par->crtc->helper_private;
+
+	list_for_each_entry(output, &par->dev->mode_config.connector_list, head) {
+		if (output->encoder->crtc == par->crtc)
+			(*output->funcs->dpms)(output, dpms_mode);
+	}
+
+	return 0;
+}
+
+
+static int psbfb_kms_off(struct drm_device *dev, int suspend)
+{
+	struct drm_framebuffer *fb = 0;
+	struct drm_buffer_object *bo = 0;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	int ret = 0;
+
+	DRM_DEBUG("psbfb_kms_off_ioctl\n");
+
+	mutex_lock(&dev->mode_config.mutex);
+	list_for_each_entry(fb, &dev->mode_config.fb_list, head) {
+		struct fb_info *info = fb->fbdev;
+		struct psbfb_par *par = info->par;
+		int save_dpms_state;
+
+		if (suspend)
+			fb_set_suspend(info, 1);
+		else
+			info->state &= ~FBINFO_STATE_RUNNING;
+
+		info->screen_base = NULL;
+
+		bo = fb->bo;
+
+		if (!bo)
+			continue;
+
+		drm_bo_kunmap(&fb->kmap);
+
+		/*
+		 * We don't take the 2D lock here as we assume that the
+		 * 2D engine will eventually idle anyway.
+		 */
+
+		if (!suspend) {
+			uint32_t dummy2 = 0;
+			(void) psb_fence_emit_sequence(dev, PSB_ENGINE_2D, 0,
+							&dummy2, &dummy2);
+			psb_2d_lock(dev_priv);
+			(void)psb_idle_2d(dev);
+			psb_2d_unlock(dev_priv);
+		} else
+			psb_idle_2d(dev);
+
+		save_dpms_state = par->dpms_state;
+		psbfb_blank(FB_BLANK_NORMAL, info);
+		par->dpms_state = save_dpms_state;
+
+		ret = psbfb_move_fb_bo(info, bo, DRM_BO_FLAG_MEM_LOCAL);
+
+		if (ret)
+			goto out_err;
+	}
+      out_err:
+	mutex_unlock(&dev->mode_config.mutex);
+
+	return ret;
+}
+
+int psbfb_kms_off_ioctl(struct drm_device *dev, void *data,
+			struct drm_file *file_priv)
+{
+	int ret;
+
+	acquire_console_sem();
+	ret = psbfb_kms_off(dev, 0);
+	release_console_sem();
+
+	return ret;
+}
+
+static int psbfb_kms_on(struct drm_device *dev, int resume)
+{
+	struct drm_framebuffer *fb = 0;
+	struct drm_buffer_object *bo = 0;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	int ret = 0;
+	int dummy;
+
+	DRM_DEBUG("psbfb_kms_on_ioctl\n");
+
+	if (!resume) {
+		uint32_t dummy2 = 0;
+		(void) psb_fence_emit_sequence(dev, PSB_ENGINE_2D, 0,
+						       &dummy2, &dummy2);
+		psb_2d_lock(dev_priv);
+		(void)psb_idle_2d(dev);
+		psb_2d_unlock(dev_priv);
+	} else
+		psb_idle_2d(dev);
+
+	mutex_lock(&dev->mode_config.mutex);
+	list_for_each_entry(fb, &dev->mode_config.fb_list, head) {
+		struct fb_info *info = fb->fbdev;
+		struct psbfb_par *par = info->par;
+
+		bo = fb->bo;
+		if (!bo)
+			continue;
+
+		ret = psbfb_move_fb_bo(info, bo,
+				       DRM_BO_FLAG_MEM_TT |
+				       DRM_BO_FLAG_MEM_VRAM |
+				       DRM_BO_FLAG_NO_EVICT);
+		if (ret)
+			goto out_err;
+
+		ret = drm_bo_kmap(bo, 0, bo->num_pages, &fb->kmap);
+		if (ret)
+			goto out_err;
+
+		info->screen_base = drm_bmo_virtual(&fb->kmap, &dummy);
+		fb->offset = bo->offset - dev_priv->pg->gatt_start;
+
+		if (ret)
+			goto out_err;
+
+		if (resume)
+			fb_set_suspend(info, 0);
+		else
+			info->state |= FBINFO_STATE_RUNNING;
+
+		/*
+		 * Re-run modesetting here, since the VDS scanout offset may
+		 * have changed.
+		 */
+
+		if (par->crtc->enabled) {
+			psbfb_set_par(info);
+			psbfb_blank(par->dpms_state, info);
+		}
+	}
+      out_err:
+	mutex_unlock(&dev->mode_config.mutex);
+
+	return ret;
+}
+
+int psbfb_kms_on_ioctl(struct drm_device *dev, void *data,
+		       struct drm_file *file_priv)
+{
+	int ret;
+
+	acquire_console_sem();
+	ret = psbfb_kms_on(dev, 0);
+	release_console_sem();
+
+	drm_helper_disable_unused_functions(dev);
+
+	return ret;
+}
+
+void psbfb_suspend(struct drm_device *dev)
+{
+	acquire_console_sem();
+	psbfb_kms_off(dev, 1);
+	release_console_sem();
+}
+
+void psbfb_resume(struct drm_device *dev)
+{
+	acquire_console_sem();
+	psbfb_kms_on(dev, 1);
+	release_console_sem();
+
+	drm_helper_disable_unused_functions(dev);
+}
+
+/*
+ * FIXME: Before kernel inclusion, migrate nopfn to fault.
+ * Also, these should be the default vm ops for buffer object type fbs.
+ */
+
+extern unsigned long drm_bo_vm_fault(struct vm_area_struct *vma,
+				     struct vm_fault *vmf);
+
+/*
+ * This wrapper is a bit ugly and is here because we need access to a mutex
+ * that we can lock both around nopfn and around unmap_mapping_range + move.
+ * Normally, this would've been done using the bo mutex, but unfortunately
+ * we cannot lock it around drm_bo_do_validate(), since that would imply
+ * recursive locking.
+ */
+
+static int psbfb_fault(struct vm_area_struct *vma,
+				 struct vm_fault *vmf)
+{
+	struct psbfb_vm_info *vi = (struct psbfb_vm_info *)vma->vm_private_data;
+	struct vm_area_struct tmp_vma;
+	int ret;
+
+	mutex_lock(&vi->vm_mutex);
+	tmp_vma = *vma;
+	tmp_vma.vm_private_data = vi->bo;
+	ret = drm_bo_vm_fault(&tmp_vma, vmf);
+	mutex_unlock(&vi->vm_mutex);
+	return ret;
+}
+
+static void psbfb_vm_open(struct vm_area_struct *vma)
+{
+	struct psbfb_vm_info *vi = (struct psbfb_vm_info *)vma->vm_private_data;
+
+	atomic_inc(&vi->refcount);
+}
+
+static void psbfb_vm_close(struct vm_area_struct *vma)
+{
+	psbfb_vm_info_deref((struct psbfb_vm_info **)&vma->vm_private_data);
+}
+
+static struct vm_operations_struct psbfb_vm_ops = {
+	.fault = psbfb_fault,
+	.open = psbfb_vm_open,
+	.close = psbfb_vm_close,
+};
+
+static int psbfb_mmap(struct fb_info *info, struct vm_area_struct *vma)
+{
+	struct psbfb_par *par = info->par;
+	struct drm_framebuffer *fb = par->crtc->fb;
+	struct drm_buffer_object *bo = fb->bo;
+	unsigned long size = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+	unsigned long offset = vma->vm_pgoff;
+
+	if (vma->vm_pgoff != 0)
+		return -EINVAL;
+	if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+		return -EINVAL;
+	if (offset + size > bo->num_pages)
+		return -EINVAL;
+
+	mutex_lock(&par->vi->vm_mutex);
+	if (!par->vi->f_mapping)
+		par->vi->f_mapping = vma->vm_file->f_mapping;
+	mutex_unlock(&par->vi->vm_mutex);
+
+	vma->vm_private_data = psbfb_vm_info_ref(par->vi);
+
+	vma->vm_ops = &psbfb_vm_ops;
+	vma->vm_flags |= VM_PFNMAP;
+
+	return 0;
+}
+
+int psbfb_sync(struct fb_info *info)
+{
+	struct psbfb_par *par = info->par;
+	struct drm_psb_private *dev_priv = par->dev->dev_private;
+
+	psb_2d_lock(dev_priv);
+	psb_idle_2d(par->dev);
+	psb_2d_unlock(dev_priv);
+
+	return 0;
+}
+
+static struct fb_ops psbfb_ops = {
+	.owner = THIS_MODULE,
+	.fb_check_var = psbfb_check_var,
+	.fb_set_par = psbfb_set_par,
+	.fb_setcolreg = psbfb_setcolreg,
+	.fb_fillrect = psbfb_fillrect,
+	.fb_copyarea = psbfb_copyarea,
+	.fb_imageblit = psbfb_imageblit,
+	.fb_mmap = psbfb_mmap,
+	.fb_sync = psbfb_sync,
+	.fb_blank = psbfb_blank,
+};
+
+static void psb_user_framebuffer_destroy(struct drm_framebuffer *fb)
+{
+	drm_framebuffer_cleanup(fb);
+	kfree(fb);
+}
+
+static const struct drm_framebuffer_funcs psb_fb_funcs = {
+	.destroy = psb_user_framebuffer_destroy,
+};
+
+int psbfb_probe(struct drm_device *dev, struct drm_crtc *crtc)
+{
+	struct fb_info *info;
+	struct psbfb_par *par;
+	struct device *device = &dev->pdev->dev;
+	struct drm_framebuffer *fb;
+	struct drm_display_mode *mode = crtc->desired_mode;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct drm_buffer_object *fbo = NULL;
+	int ret;
+	int is_iomem;
+
+	if (drm_psb_no_fb) {
+		/* need to do this as the DRM will disable the output */
+		crtc->enabled = 1;
+		return 0;
+	}
+
+	fb = kzalloc(sizeof(struct drm_framebuffer), GFP_KERNEL);
+	if (!fb)
+		return -ENOMEM;
+
+
+	ret = drm_framebuffer_init(dev, fb, &psb_fb_funcs);
+	if (!fb) {
+		DRM_ERROR("failed to allocate fb.\n");
+		return -ENOMEM;
+	}
+	crtc->fb = fb;
+
+	fb->width = mode->hdisplay;
+	fb->height = mode->vdisplay;
+
+	fb->bits_per_pixel = 32;
+	fb->depth = 24;
+	fb->pitch =
+	    ((fb->width * ((fb->bits_per_pixel + 1) / 8)) + 0x3f) & ~0x3f;
+
+	info = framebuffer_alloc(sizeof(struct psbfb_par), device);
+	if (!info) {
+		kfree(fb);
+		return -ENOMEM;
+	}
+
+	ret = drm_buffer_object_create(dev,
+				       fb->pitch * fb->height,
+				       drm_bo_type_kernel,
+				       DRM_BO_FLAG_READ |
+				       DRM_BO_FLAG_WRITE |
+				       DRM_BO_FLAG_MEM_TT |
+				       DRM_BO_FLAG_MEM_VRAM |
+				       DRM_BO_FLAG_NO_EVICT,
+				       DRM_BO_HINT_DONT_FENCE, 0, 0, &fbo);
+	if (ret || !fbo) {
+		DRM_ERROR("failed to allocate framebuffer\n");
+		goto out_err0;
+	}
+
+	fb->offset = fbo->offset - dev_priv->pg->gatt_start;
+	fb->bo = fbo;
+	DRM_DEBUG("allocated %dx%d fb: 0x%08lx, bo %p\n", fb->width,
+		  fb->height, fb->offset, fbo);
+
+	fb->fbdev = info;
+
+	par = info->par;
+
+	par->dev = dev;
+	par->crtc = crtc;
+	par->vi = psbfb_vm_info_create();
+	if (!par->vi)
+		goto out_err1;
+
+	mutex_lock(&dev->struct_mutex);
+	par->vi->bo = fbo;
+	atomic_inc(&fbo->usage);
+	mutex_unlock(&dev->struct_mutex);
+
+	par->vi->f_mapping = NULL;
+	info->fbops = &psbfb_ops;
+
+	strcpy(info->fix.id, "psbfb");
+	info->fix.type = FB_TYPE_PACKED_PIXELS;
+	info->fix.visual = FB_VISUAL_DIRECTCOLOR;
+	info->fix.type_aux = 0;
+	info->fix.xpanstep = 1;
+	info->fix.ypanstep = 1;
+	info->fix.ywrapstep = 0;
+	info->fix.accel = FB_ACCEL_NONE;	/* ??? */
+	info->fix.type_aux = 0;
+	info->fix.mmio_start = 0;
+	info->fix.mmio_len = 0;
+	info->fix.line_length = fb->pitch;
+	info->fix.smem_start = dev->mode_config.fb_base + fb->offset;
+	info->fix.smem_len = info->fix.line_length * fb->height;
+
+	info->flags = FBINFO_DEFAULT |
+	    FBINFO_PARTIAL_PAN_OK /*| FBINFO_MISC_ALWAYS_SETPAR */ ;
+
+	ret = drm_bo_kmap(fb->bo, 0, fb->bo->num_pages, &fb->kmap);
+	if (ret) {
+		DRM_ERROR("error mapping fb: %d\n", ret);
+		goto out_err2;
+	}
+
+	info->screen_base = drm_bmo_virtual(&fb->kmap, &is_iomem);
+	memset(info->screen_base, 0x00, fb->pitch*fb->height);
+	info->screen_size = info->fix.smem_len;	/* FIXME */
+	info->pseudo_palette = fb->pseudo_palette;
+	info->var.xres_virtual = fb->width;
+	info->var.yres_virtual = fb->height;
+	info->var.bits_per_pixel = fb->bits_per_pixel;
+	info->var.xoffset = 0;
+	info->var.yoffset = 0;
+	info->var.activate = FB_ACTIVATE_NOW;
+	info->var.height = -1;
+	info->var.width = -1;
+	info->var.vmode = FB_VMODE_NONINTERLACED;
+
+	info->var.xres = mode->hdisplay;
+	info->var.right_margin = mode->hsync_start - mode->hdisplay;
+	info->var.hsync_len = mode->hsync_end - mode->hsync_start;
+	info->var.left_margin = mode->htotal - mode->hsync_end;
+	info->var.yres = mode->vdisplay;
+	info->var.lower_margin = mode->vsync_start - mode->vdisplay;
+	info->var.vsync_len = mode->vsync_end - mode->vsync_start;
+	info->var.upper_margin = mode->vtotal - mode->vsync_end;
+	info->var.pixclock = 10000000 / mode->htotal * 1000 /
+	    mode->vtotal * 100;
+	/* avoid overflow */
+	info->var.pixclock = info->var.pixclock * 1000 / mode->vrefresh;
+
+	info->pixmap.size = 64 * 1024;
+	info->pixmap.buf_align = 8;
+	info->pixmap.access_align = 32;
+	info->pixmap.flags = FB_PIXMAP_SYSTEM;
+	info->pixmap.scan_align = 1;
+
+	DRM_DEBUG("fb depth is %d\n", fb->depth);
+	DRM_DEBUG("   pitch is %d\n", fb->pitch);
+	switch (fb->depth) {
+	case 8:
+		info->var.red.offset = 0;
+		info->var.green.offset = 0;
+		info->var.blue.offset = 0;
+		info->var.red.length = 8;	/* 8bit DAC */
+		info->var.green.length = 8;
+		info->var.blue.length = 8;
+		info->var.transp.offset = 0;
+		info->var.transp.length = 0;
+		break;
+	case 15:
+		info->var.red.offset = 10;
+		info->var.green.offset = 5;
+		info->var.blue.offset = 0;
+		info->var.red.length = info->var.green.length =
+		    info->var.blue.length = 5;
+		info->var.transp.offset = 15;
+		info->var.transp.length = 1;
+		break;
+	case 16:
+		info->var.red.offset = 11;
+		info->var.green.offset = 5;
+		info->var.blue.offset = 0;
+		info->var.red.length = 5;
+		info->var.green.length = 6;
+		info->var.blue.length = 5;
+		info->var.transp.offset = 0;
+		break;
+	case 24:
+		info->var.red.offset = 16;
+		info->var.green.offset = 8;
+		info->var.blue.offset = 0;
+		info->var.red.length = info->var.green.length =
+		    info->var.blue.length = 8;
+		info->var.transp.offset = 0;
+		info->var.transp.length = 0;
+		break;
+	case 32:
+		info->var.red.offset = 16;
+		info->var.green.offset = 8;
+		info->var.blue.offset = 0;
+		info->var.red.length = info->var.green.length =
+		    info->var.blue.length = 8;
+		info->var.transp.offset = 24;
+		info->var.transp.length = 8;
+		break;
+	default:
+		break;
+	}
+
+	if (register_framebuffer(info) < 0)
+		goto out_err3;
+
+	if (psbfb_check_var(&info->var, info) < 0)
+		goto out_err4;
+
+	psbfb_set_par(info);
+
+	DRM_INFO("fb%d: %s frame buffer device\n", info->node, info->fix.id);
+
+	return 0;
+      out_err4:
+	unregister_framebuffer(info);
+      out_err3:
+	drm_bo_kunmap(&fb->kmap);
+      out_err2:
+	psbfb_vm_info_deref(&par->vi);
+      out_err1:
+	drm_bo_usage_deref_unlocked(&fb->bo);
+      out_err0:
+	drm_framebuffer_cleanup(fb);
+	framebuffer_release(info);
+	crtc->fb = NULL;
+	return -EINVAL;
+}
+
+EXPORT_SYMBOL(psbfb_probe);
+
+int psbfb_remove(struct drm_device *dev, struct drm_crtc *crtc)
+{
+	struct drm_framebuffer *fb;
+	struct fb_info *info;
+	struct psbfb_par *par;
+
+	if (drm_psb_no_fb)
+		return 0;
+
+	fb = crtc->fb;
+	info = fb->fbdev;
+
+	if (info) {
+		unregister_framebuffer(info);
+		drm_bo_kunmap(&fb->kmap);
+		par = info->par;
+		if (par)
+			psbfb_vm_info_deref(&par->vi);
+		drm_bo_usage_deref_unlocked(&fb->bo);
+		drm_framebuffer_cleanup(fb);
+		framebuffer_release(info);
+	}
+	return 0;
+}
+
+EXPORT_SYMBOL(psbfb_remove);
+
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_fence.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_fence.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,285 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstr<74>m <thomas-at-tungstengraphics-dot-com>
+ */
+
+#include "drmP.h"
+#include "psb_drv.h"
+
+static void psb_poll_ta(struct drm_device *dev, uint32_t waiting_types)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct drm_fence_driver *driver = dev->driver->fence_driver;
+	uint32_t cur_flag = 1;
+	uint32_t flags = 0;
+	uint32_t sequence = 0;
+	uint32_t remaining = 0xFFFFFFFF;
+	uint32_t diff;
+
+	struct psb_scheduler *scheduler;
+	struct psb_scheduler_seq *seq;
+	struct drm_fence_class_manager *fc =
+	    &dev->fm.fence_class[PSB_ENGINE_TA];
+
+	if (unlikely(!dev_priv))
+		return;
+
+	scheduler = &dev_priv->scheduler;
+	seq = scheduler->seq;
+
+	while (likely(waiting_types & remaining)) {
+		if (!(waiting_types & cur_flag))
+			goto skip;
+		if (seq->reported)
+			goto skip;
+		if (flags == 0)
+			sequence = seq->sequence;
+		else if (sequence != seq->sequence) {
+			drm_fence_handler(dev, PSB_ENGINE_TA,
+					  sequence, flags, 0);
+			sequence = seq->sequence;
+			flags = 0;
+		}
+		flags |= cur_flag;
+
+		/*
+		 * Sequence may not have ended up on the ring yet.
+		 * In that case, report it but don't mark it as
+		 * reported. A subsequent poll will report it again.
+		 */
+
+		diff = (fc->latest_queued_sequence - sequence) &
+		    driver->sequence_mask;
+		if (diff < driver->wrap_diff)
+			seq->reported = 1;
+
+	      skip:
+		cur_flag <<= 1;
+		remaining <<= 1;
+		seq++;
+	}
+
+	if (flags) {
+		drm_fence_handler(dev, PSB_ENGINE_TA, sequence, flags, 0);
+	}
+}
+
+static void psb_poll_other(struct drm_device *dev, uint32_t fence_class,
+			   uint32_t waiting_types)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fc = &fm->fence_class[fence_class];
+	uint32_t sequence;
+
+	if (unlikely(!dev_priv))
+		return;
+
+	if (waiting_types) {
+		if (fence_class == PSB_ENGINE_VIDEO)
+			sequence = dev_priv->msvdx_current_sequence;
+		else
+			sequence = dev_priv->comm[fence_class << 4];
+
+		drm_fence_handler(dev, fence_class, sequence,
+				  DRM_FENCE_TYPE_EXE, 0);
+
+		switch (fence_class) {
+		case PSB_ENGINE_2D:
+			if (dev_priv->fence0_irq_on && !fc->waiting_types) {
+				psb_2D_irq_off(dev_priv);
+				dev_priv->fence0_irq_on = 0;
+			} else if (!dev_priv->fence0_irq_on
+				   && fc->waiting_types) {
+				psb_2D_irq_on(dev_priv);
+				dev_priv->fence0_irq_on = 1;
+			}
+			break;
+#if 0
+			/*
+			 * FIXME: MSVDX irq switching
+			 */
+
+		case PSB_ENGINE_VIDEO:
+			if (dev_priv->fence2_irq_on && !fc->waiting_types) {
+				psb_msvdx_irq_off(dev_priv);
+				dev_priv->fence2_irq_on = 0;
+			} else if (!dev_priv->fence2_irq_on
+				   && fc->pending_exe_flush) {
+				psb_msvdx_irq_on(dev_priv);
+				dev_priv->fence2_irq_on = 1;
+			}
+			break;
+#endif
+		default:
+			return;
+		}
+	}
+}
+
+static void psb_fence_poll(struct drm_device *dev,
+			   uint32_t fence_class, uint32_t waiting_types)
+{
+	switch (fence_class) {
+	case PSB_ENGINE_TA:
+		psb_poll_ta(dev, waiting_types);
+		break;
+	default:
+		psb_poll_other(dev, fence_class, waiting_types);
+		break;
+	}
+}
+
+void psb_fence_error(struct drm_device *dev,
+		     uint32_t fence_class,
+		     uint32_t sequence, uint32_t type, int error)
+{
+	struct drm_fence_manager *fm = &dev->fm;
+	unsigned long irq_flags;
+
+	BUG_ON(fence_class >= PSB_NUM_ENGINES);
+	write_lock_irqsave(&fm->lock, irq_flags);
+	drm_fence_handler(dev, fence_class, sequence, type, error);
+	write_unlock_irqrestore(&fm->lock, irq_flags);
+}
+
+int psb_fence_emit_sequence(struct drm_device *dev, uint32_t fence_class,
+			    uint32_t flags, uint32_t * sequence,
+			    uint32_t * native_type)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	uint32_t seq = 0;
+	int ret;
+
+	if (!dev_priv)
+		return -EINVAL;
+
+	if (fence_class >= PSB_NUM_ENGINES)
+		return -EINVAL;
+
+	switch (fence_class) {
+	case PSB_ENGINE_2D:
+		spin_lock(&dev_priv->sequence_lock);
+		seq = ++dev_priv->sequence[fence_class];
+		spin_unlock(&dev_priv->sequence_lock);
+		ret = psb_blit_sequence(dev_priv, seq);
+		if (ret)
+			return ret;
+		break;
+	case PSB_ENGINE_VIDEO:
+		spin_lock(&dev_priv->sequence_lock);
+		seq = ++dev_priv->sequence[fence_class];
+		spin_unlock(&dev_priv->sequence_lock);
+		break;
+	default:
+		spin_lock(&dev_priv->sequence_lock);
+		seq = dev_priv->sequence[fence_class];
+		spin_unlock(&dev_priv->sequence_lock);
+	}
+
+	*sequence = seq;
+	*native_type = DRM_FENCE_TYPE_EXE;
+
+	return 0;
+}
+
+uint32_t psb_fence_advance_sequence(struct drm_device * dev,
+				    uint32_t fence_class)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	uint32_t sequence;
+
+	spin_lock(&dev_priv->sequence_lock);
+	sequence = ++dev_priv->sequence[fence_class];
+	spin_unlock(&dev_priv->sequence_lock);
+
+	return sequence;
+}
+
+void psb_fence_handler(struct drm_device *dev, uint32_t fence_class)
+{
+	struct drm_fence_manager *fm = &dev->fm;
+	struct drm_fence_class_manager *fc = &fm->fence_class[fence_class];
+
+#ifdef FIX_TG_16
+	if (fence_class == 0) {
+		struct drm_psb_private *dev_priv =
+		    (struct drm_psb_private *)dev->dev_private;
+
+		if ((atomic_read(&dev_priv->ta_wait_2d_irq) == 1) &&
+		    (PSB_RSGX32(PSB_CR_2D_SOCIF) == _PSB_C2_SOCIF_EMPTY) &&
+		    ((PSB_RSGX32(PSB_CR_2D_BLIT_STATUS) &
+		      _PSB_C2B_STATUS_BUSY) == 0))
+			psb_resume_ta_2d_idle(dev_priv);
+	}
+#endif
+	write_lock(&fm->lock);
+	psb_fence_poll(dev, fence_class, fc->waiting_types);
+	write_unlock(&fm->lock);
+}
+
+static int psb_fence_wait(struct drm_fence_object *fence,
+			  int lazy, int interruptible, uint32_t mask)
+{
+	struct drm_device *dev = fence->dev;
+	struct drm_fence_class_manager *fc =
+	    &dev->fm.fence_class[fence->fence_class];
+	int ret = 0;
+	unsigned long timeout = DRM_HZ *
+	    ((fence->fence_class == PSB_ENGINE_TA) ? 30 : 3);
+
+	drm_fence_object_flush(fence, mask);
+	if (interruptible)
+		ret = wait_event_interruptible_timeout
+		    (fc->fence_queue, drm_fence_object_signaled(fence, mask),
+		     timeout);
+	else
+		ret = wait_event_timeout
+		    (fc->fence_queue, drm_fence_object_signaled(fence, mask),
+		     timeout);
+
+	if (unlikely(ret == -ERESTARTSYS))
+		return -EAGAIN;
+
+	if (unlikely(ret == 0))
+		return -EBUSY;
+
+	return 0;
+}
+
+struct drm_fence_driver psb_fence_driver = {
+	.num_classes = PSB_NUM_ENGINES,
+	.wrap_diff = (1 << 30),
+	.flush_diff = (1 << 29),
+	.sequence_mask = 0xFFFFFFFFU,
+	.has_irq = NULL,
+	.emit = psb_fence_emit_sequence,
+	.flush = NULL,
+	.poll = psb_fence_poll,
+	.needed_flush = NULL,
+	.wait = psb_fence_wait
+};
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_gtt.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_gtt.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,253 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thomas-at-tungstengraphics.com>
+ */
+#include "drmP.h"
+#include "psb_drv.h"
+
+static inline uint32_t psb_gtt_mask_pte(uint32_t pfn, int type)
+{
+	uint32_t mask = PSB_PTE_VALID;
+
+	if (type & PSB_MMU_CACHED_MEMORY)
+		mask |= PSB_PTE_CACHED;
+	if (type & PSB_MMU_RO_MEMORY)
+		mask |= PSB_PTE_RO;
+	if (type & PSB_MMU_WO_MEMORY)
+		mask |= PSB_PTE_WO;
+
+	return (pfn << PAGE_SHIFT) | mask;
+}
+
+struct psb_gtt *psb_gtt_alloc(struct drm_device *dev)
+{
+	struct psb_gtt *tmp = drm_calloc(1, sizeof(*tmp), DRM_MEM_DRIVER);
+
+	if (!tmp)
+		return NULL;
+
+	init_rwsem(&tmp->sem);
+	tmp->dev = dev;
+
+	return tmp;
+}
+
+void psb_gtt_takedown(struct psb_gtt *pg, int free)
+{
+	struct drm_psb_private *dev_priv = pg->dev->dev_private;
+
+	if (!pg)
+		return;
+
+	if (pg->gtt_map) {
+		iounmap(pg->gtt_map);
+		pg->gtt_map = NULL;
+	}
+	if (pg->initialized) {
+		pci_write_config_word(pg->dev->pdev, PSB_GMCH_CTRL,
+				      pg->gmch_ctrl);
+		PSB_WVDC32(pg->pge_ctl, PSB_PGETBL_CTL);
+		(void)PSB_RVDC32(PSB_PGETBL_CTL);
+	}
+	if (free)
+		drm_free(pg, sizeof(*pg), DRM_MEM_DRIVER);
+}
+
+int psb_gtt_init(struct psb_gtt *pg, int resume)
+{
+	struct drm_device *dev = pg->dev;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	unsigned gtt_pages;
+	unsigned long stolen_size;
+	unsigned i, num_pages;
+	unsigned pfn_base;
+
+	int ret = 0;
+	uint32_t pte;
+
+	printk(KERN_ERR "Bar A1\n");
+
+	pci_read_config_word(dev->pdev, PSB_GMCH_CTRL, &pg->gmch_ctrl);
+	pci_write_config_word(dev->pdev, PSB_GMCH_CTRL,
+			      pg->gmch_ctrl | _PSB_GMCH_ENABLED);
+
+	printk(KERN_ERR "Bar A2\n");
+
+	pg->pge_ctl = PSB_RVDC32(PSB_PGETBL_CTL);
+	PSB_WVDC32(pg->pge_ctl | _PSB_PGETBL_ENABLED, PSB_PGETBL_CTL);
+	(void)PSB_RVDC32(PSB_PGETBL_CTL);
+
+	printk(KERN_ERR "Bar A3\n");
+
+	pg->initialized = 1;
+
+	pg->gtt_phys_start = pg->pge_ctl & PAGE_MASK;
+	pg->gatt_start = pci_resource_start(dev->pdev, PSB_GATT_RESOURCE);
+	pg->gtt_start = pci_resource_start(dev->pdev, PSB_GTT_RESOURCE);
+	gtt_pages = pci_resource_len(dev->pdev, PSB_GTT_RESOURCE) >> PAGE_SHIFT;
+	pg->gatt_pages = pci_resource_len(dev->pdev, PSB_GATT_RESOURCE)
+	    >> PAGE_SHIFT;
+
+	printk(KERN_ERR "Bar A4\n");
+	pci_read_config_dword(dev->pdev, PSB_BSM, &pg->stolen_base);
+	stolen_size = pg->gtt_phys_start - pg->stolen_base - PAGE_SIZE;
+
+	printk(KERN_ERR "Bar A5\n");
+
+	PSB_DEBUG_INIT("GTT phys start: 0x%08x.\n", pg->gtt_phys_start);
+	PSB_DEBUG_INIT("GTT start: 0x%08x.\n", pg->gtt_start);
+	PSB_DEBUG_INIT("GATT start: 0x%08x.\n", pg->gatt_start);
+	PSB_DEBUG_INIT("GTT pages: %u\n", gtt_pages);
+	PSB_DEBUG_INIT("Stolen size: %lu kiB\n", stolen_size / 1024);
+
+	if (resume && (gtt_pages != pg->gtt_pages) &&
+	    (stolen_size != pg->stolen_size)) {
+		DRM_ERROR("GTT resume error.\n");
+		ret = -EINVAL;
+		goto out_err;
+	}
+
+	printk(KERN_ERR "Bar A6\n");
+
+	pg->gtt_pages = gtt_pages;
+	pg->stolen_size = stolen_size;
+	pg->gtt_map =
+	    ioremap_nocache(pg->gtt_phys_start, gtt_pages << PAGE_SHIFT);
+	if (!pg->gtt_map) {
+		DRM_ERROR("Failure to map gtt.\n");
+		ret = -ENOMEM;
+		goto out_err;
+	}
+
+	printk(KERN_ERR "Bar A7\n");
+
+	/*
+	 * insert stolen pages.
+	 */
+
+	pfn_base = pg->stolen_base >> PAGE_SHIFT;
+	num_pages = stolen_size >> PAGE_SHIFT;
+	PSB_DEBUG_INIT("Set up %d stolen pages starting at 0x%08x\n",
+		       num_pages, pfn_base);
+	for (i = 0; i < num_pages; ++i) {
+		pte = psb_gtt_mask_pte(pfn_base + i, 0);
+		iowrite32(pte, pg->gtt_map + i);
+	}
+
+	printk(KERN_ERR "Bar A8\n");
+
+	/*
+	 * Init rest of gtt.
+	 */
+
+	pfn_base = page_to_pfn(dev_priv->scratch_page);
+	pte = psb_gtt_mask_pte(pfn_base, 0);
+	PSB_DEBUG_INIT("Initializing the rest of a total "
+		       "of %d gtt pages.\n", pg->gatt_pages);
+
+	printk(KERN_ERR "Bar A10\n");
+
+	for (; i < pg->gatt_pages; ++i)
+		iowrite32(pte, pg->gtt_map + i);
+	(void)ioread32(pg->gtt_map + i - 1);
+
+	printk(KERN_ERR "Bar A11\n");
+
+	return 0;
+
+      out_err:
+	psb_gtt_takedown(pg, 0);
+	return ret;
+}
+
+int psb_gtt_insert_pages(struct psb_gtt *pg, struct page **pages,
+			 unsigned offset_pages, unsigned num_pages,
+			 unsigned desired_tile_stride, unsigned hw_tile_stride,
+			 int type)
+{
+	unsigned rows = 1;
+	unsigned add;
+	unsigned row_add;
+	unsigned i;
+	unsigned j;
+	uint32_t *cur_page = NULL;
+	uint32_t pte;
+
+	if (hw_tile_stride)
+		rows = num_pages / desired_tile_stride;
+	else
+		desired_tile_stride = num_pages;
+
+	add = desired_tile_stride;
+	row_add = hw_tile_stride;
+
+	down_read(&pg->sem);
+	for (i = 0; i < rows; ++i) {
+		cur_page = pg->gtt_map + offset_pages;
+		for (j = 0; j < desired_tile_stride; ++j) {
+			pte = psb_gtt_mask_pte(page_to_pfn(*pages++), type);
+			iowrite32(pte, cur_page++);
+		}
+		offset_pages += add;
+	}
+	(void)ioread32(cur_page - 1);
+	up_read(&pg->sem);
+
+	return 0;
+}
+
+int psb_gtt_remove_pages(struct psb_gtt *pg, unsigned offset_pages,
+			 unsigned num_pages, unsigned desired_tile_stride,
+			 unsigned hw_tile_stride)
+{
+	struct drm_psb_private *dev_priv = pg->dev->dev_private;
+	unsigned rows = 1;
+	unsigned add;
+	unsigned row_add;
+	unsigned i;
+	unsigned j;
+	uint32_t *cur_page = NULL;
+	unsigned pfn_base = page_to_pfn(dev_priv->scratch_page);
+	uint32_t pte = psb_gtt_mask_pte(pfn_base, 0);
+
+	if (hw_tile_stride)
+		rows = num_pages / desired_tile_stride;
+	else
+		desired_tile_stride = num_pages;
+
+	add = desired_tile_stride;
+	row_add = hw_tile_stride;
+
+	down_read(&pg->sem);
+	for (i = 0; i < rows; ++i) {
+		cur_page = pg->gtt_map + offset_pages;
+		for (j = 0; j < desired_tile_stride; ++j) {
+			iowrite32(pte, cur_page++);
+		}
+		offset_pages += add;
+	}
+	(void)ioread32(cur_page - 1);
+	up_read(&pg->sem);
+
+	return 0;
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_irq.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_irq.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,519 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ */
+
+#include "drmP.h"
+#include "psb_drv.h"
+#include "psb_reg.h"
+#include "psb_msvdx.h"
+#include "../i915/i915_reg.h"
+
+/*
+ * Video display controller interrupt.
+ */
+
+static inline u32
+psb_pipestat(int pipe)
+{
+	if (pipe == 0)
+		return PIPEASTAT;
+	if (pipe == 1)
+		return PIPEBSTAT;
+	BUG();
+}
+
+void
+psb_enable_pipestat(struct drm_psb_private *dev_priv, int pipe, u32 mask)
+{
+	//struct drm_i915_common_private *dev_priv_common = dev_priv;
+
+	if ((dev_priv->pipestat[pipe] & mask) != mask) {
+		u32 reg = psb_pipestat(pipe);
+
+		dev_priv->pipestat[pipe] |= mask;
+		/* Enable the interrupt, clear any pending status */
+		I915_WRITE(reg, dev_priv->pipestat[pipe] | (mask >> 16));
+		(void) I915_READ(reg);
+	}
+}
+
+void
+psb_disable_pipestat(struct drm_psb_private *dev_priv, int pipe, u32 mask)
+{
+	//struct drm_i915_common_private *dev_priv_common = (struct drm_i915_common_private *) dev_priv;
+
+	if ((dev_priv->pipestat[pipe] & mask) != 0) {
+		u32 reg = psb_pipestat(pipe);
+
+		dev_priv->pipestat[pipe] &= ~mask;
+		I915_WRITE(reg, dev_priv->pipestat[pipe]);
+		(void) I915_READ(reg);
+	}
+}
+
+
+/**
+ * i915_pipe_enabled - check if a pipe is enabled
+ * @dev: DRM device
+ * @pipe: pipe to check
+ *
+ * Reading certain registers when the pipe is disabled can hang the chip.
+ * Use this routine to make sure the PLL is running and the pipe is active
+ * before reading such registers if unsure.
+ */
+static int
+i915_pipe_enabled(struct drm_device *dev, int pipe)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	unsigned long pipeconf = pipe ? PIPEBCONF : PIPEACONF;
+
+	if (I915_READ(pipeconf) & PIPEACONF_ENABLE)
+		return 1;
+
+	return 0;
+}
+
+/* Called from drm generic code, passed a 'crtc', which
+ * we use as a pipe index
+ */
+u32 psb_get_vblank_counter(struct drm_device *dev, int pipe)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	unsigned long high_frame;
+	unsigned long low_frame;
+	u32 high1, high2, low, count;
+
+	high_frame = pipe ? PIPEBFRAMEHIGH : PIPEAFRAMEHIGH;
+	low_frame = pipe ? PIPEBFRAMEPIXEL : PIPEAFRAMEPIXEL;
+
+	if (!i915_pipe_enabled(dev, pipe)) {
+		DRM_ERROR("trying to get vblank count for disabled pipe %d\n", pipe);
+		return 0;
+	}
+
+	/*
+	 * High & low register fields aren't synchronized, so make sure
+	 * we get a low value that's stable across two reads of the high
+	 * register.
+	 */
+	do {
+		high1 = ((I915_READ(high_frame) & PIPE_FRAME_HIGH_MASK) >>
+			 PIPE_FRAME_HIGH_SHIFT);
+		low =  ((I915_READ(low_frame) & PIPE_FRAME_LOW_MASK) >>
+			PIPE_FRAME_LOW_SHIFT);
+		high2 = ((I915_READ(high_frame) & PIPE_FRAME_HIGH_MASK) >>
+			 PIPE_FRAME_HIGH_SHIFT);
+	} while (high1 != high2);
+
+	count = (high1 << 8) | low;
+
+	return count;
+}
+
+/* Called from drm generic code, passed 'crtc' which
+ * we use as a pipe index
+ */
+int psb_enable_vblank(struct drm_device *dev, int pipe)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	unsigned long irqflags;
+	int pipeconf_reg = (pipe == 0) ? PIPEACONF : PIPEBCONF;
+	u32 pipeconf;
+
+	pipeconf = I915_READ(pipeconf_reg);
+	if (!(pipeconf & PIPEACONF_ENABLE))
+		return -EINVAL;
+
+	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+	psb_enable_pipestat(dev_priv, pipe, PIPE_VBLANK_INTERRUPT_ENABLE);
+	spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
+	return 0;
+}
+
+/* Called from drm generic code, passed 'crtc' which
+ * we use as a pipe index
+ */
+void psb_disable_vblank(struct drm_device *dev, int pipe)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+	psb_disable_pipestat(dev_priv, pipe,
+			      PIPE_VBLANK_INTERRUPT_ENABLE |
+			      PIPE_START_VBLANK_INTERRUPT_ENABLE);
+	spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
+}
+
+
+
+static void psb_vdc_interrupt(struct drm_device *dev, uint32_t vdc_stat)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;	uint32_t pipe_stats;
+	int wake = 0;
+
+	if (!drm_psb_disable_vsync && (vdc_stat & _PSB_VSYNC_PIPEA_FLAG)) {
+		pipe_stats = PSB_RVDC32(PSB_PIPEASTAT);
+		atomic_inc(&dev->_vblank_count[0]);
+		wake = 1;
+		PSB_WVDC32(pipe_stats | _PSB_VBLANK_INTERRUPT_ENABLE |
+			   _PSB_VBLANK_CLEAR, PSB_PIPEASTAT);
+	}
+
+	if (!drm_psb_disable_vsync && (vdc_stat & _PSB_VSYNC_PIPEB_FLAG)) {
+		pipe_stats = PSB_RVDC32(PSB_PIPEBSTAT);
+		atomic_inc(&dev->_vblank_count[1]);
+		wake = 1;
+		PSB_WVDC32(pipe_stats | _PSB_VBLANK_INTERRUPT_ENABLE |
+			   _PSB_VBLANK_CLEAR, PSB_PIPEBSTAT);
+	}
+
+	PSB_WVDC32(vdc_stat, PSB_INT_IDENTITY_R);
+	(void)PSB_RVDC32(PSB_INT_IDENTITY_R);
+	DRM_READMEMORYBARRIER();
+
+	if (wake) {
+		int i;
+		DRM_WAKEUP(dev->vbl_queue);
+
+		for (i = 0; i < 2; i++)
+			drm_vbl_send_signals(dev, i);
+	}
+}
+
+/*
+ * SGX interrupt source 1.
+ */
+
+static void psb_sgx_interrupt(struct drm_device *dev, uint32_t sgx_stat,
+			      uint32_t sgx_stat2)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+
+	if (sgx_stat & _PSB_CE_TWOD_COMPLETE) {
+		DRM_WAKEUP(&dev_priv->event_2d_queue);
+		psb_fence_handler(dev, 0);
+	}
+
+	if (unlikely(sgx_stat2 & _PSB_CE2_BIF_REQUESTER_FAULT))
+		psb_print_pagefault(dev_priv);
+
+	psb_scheduler_handler(dev_priv, sgx_stat);
+}
+
+/*
+ * MSVDX interrupt.
+ */
+static void psb_msvdx_interrupt(struct drm_device *dev, uint32_t msvdx_stat)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+
+	if (msvdx_stat & MSVDX_INTERRUPT_STATUS_CR_MMU_FAULT_IRQ_MASK) {
+		/*Ideally we should we should never get to this */
+		PSB_DEBUG_GENERAL
+		    ("******MSVDX: msvdx_stat: 0x%x fence2_irq_on=%d ***** (MMU FAULT)\n",
+		     msvdx_stat, dev_priv->fence2_irq_on);
+
+		/* Pause MMU */
+		PSB_WMSVDX32(MSVDX_MMU_CONTROL0_CR_MMU_PAUSE_MASK,
+			     MSVDX_MMU_CONTROL0);
+		DRM_WRITEMEMORYBARRIER();
+
+		/* Clear this interupt bit only */
+		PSB_WMSVDX32(MSVDX_INTERRUPT_STATUS_CR_MMU_FAULT_IRQ_MASK,
+			     MSVDX_INTERRUPT_CLEAR);
+		PSB_RMSVDX32(MSVDX_INTERRUPT_CLEAR);
+		DRM_READMEMORYBARRIER();
+
+		dev_priv->msvdx_needs_reset = 1;
+	} else if (msvdx_stat & MSVDX_INTERRUPT_STATUS_CR_MTX_IRQ_MASK) {
+		PSB_DEBUG_GENERAL
+		    ("******MSVDX: msvdx_stat: 0x%x fence2_irq_on=%d ***** (MTX)\n",
+		     msvdx_stat, dev_priv->fence2_irq_on);
+
+		/* Clear all interupt bits */
+		PSB_WMSVDX32(0xffff, MSVDX_INTERRUPT_CLEAR);
+		PSB_RMSVDX32(MSVDX_INTERRUPT_CLEAR);
+		DRM_READMEMORYBARRIER();
+
+		psb_msvdx_mtx_interrupt(dev);
+	}
+}
+
+irqreturn_t psb_irq_handler(DRM_IRQ_ARGS)
+{
+	struct drm_device *dev = (struct drm_device *)arg;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+
+	uint32_t vdc_stat;
+	uint32_t sgx_stat;
+	uint32_t sgx_stat2;
+	uint32_t msvdx_stat;
+	int handled = 0;
+
+	spin_lock(&dev_priv->irqmask_lock);
+
+	vdc_stat = PSB_RVDC32(PSB_INT_IDENTITY_R);
+	sgx_stat = PSB_RSGX32(PSB_CR_EVENT_STATUS);
+	sgx_stat2 = PSB_RSGX32(PSB_CR_EVENT_STATUS2);
+	msvdx_stat = PSB_RMSVDX32(MSVDX_INTERRUPT_STATUS);
+
+	sgx_stat2 &= dev_priv->sgx2_irq_mask;
+	sgx_stat &= dev_priv->sgx_irq_mask;
+	PSB_WSGX32(sgx_stat2, PSB_CR_EVENT_HOST_CLEAR2);
+	PSB_WSGX32(sgx_stat, PSB_CR_EVENT_HOST_CLEAR);
+	(void)PSB_RSGX32(PSB_CR_EVENT_HOST_CLEAR);
+
+	vdc_stat &= dev_priv->vdc_irq_mask;
+	spin_unlock(&dev_priv->irqmask_lock);
+
+	if (msvdx_stat) {
+		psb_msvdx_interrupt(dev, msvdx_stat);
+		handled = 1;
+	}
+
+	if (vdc_stat) {
+		/* MSVDX IRQ status is part of vdc_irq_mask */
+		psb_vdc_interrupt(dev, vdc_stat);
+		handled = 1;
+	}
+
+	if (sgx_stat || sgx_stat2) {
+		psb_sgx_interrupt(dev, sgx_stat, sgx_stat2);
+		handled = 1;
+	}
+
+	if (!handled) {
+		return IRQ_NONE;
+	}
+
+	return IRQ_HANDLED;
+}
+
+void psb_msvdx_irq_preinstall(struct drm_psb_private *dev_priv)
+{
+	unsigned long mtx_int = 0;
+	dev_priv->vdc_irq_mask |= _PSB_IRQ_MSVDX_FLAG;
+
+	/*Clear MTX interrupt */
+	REGIO_WRITE_FIELD_LITE(mtx_int, MSVDX_INTERRUPT_STATUS, CR_MTX_IRQ, 1);
+	PSB_WMSVDX32(mtx_int, MSVDX_INTERRUPT_CLEAR);
+}
+
+void psb_irq_preinstall(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	spin_lock(&dev_priv->irqmask_lock);
+	PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+	PSB_WVDC32(0x00000000, PSB_INT_MASK_R);
+	PSB_WVDC32(0x00000000, PSB_INT_ENABLE_R);
+	PSB_WSGX32(0x00000000, PSB_CR_EVENT_HOST_ENABLE);
+	(void)PSB_RSGX32(PSB_CR_EVENT_HOST_ENABLE);
+
+	dev_priv->sgx_irq_mask = _PSB_CE_PIXELBE_END_RENDER |
+	    _PSB_CE_DPM_3D_MEM_FREE |
+	    _PSB_CE_TA_FINISHED |
+	    _PSB_CE_DPM_REACHED_MEM_THRESH |
+	    _PSB_CE_DPM_OUT_OF_MEMORY_GBL |
+	    _PSB_CE_DPM_OUT_OF_MEMORY_MT |
+	    _PSB_CE_TA_TERMINATE | _PSB_CE_SW_EVENT;
+
+	dev_priv->sgx2_irq_mask = _PSB_CE2_BIF_REQUESTER_FAULT;
+
+	dev_priv->vdc_irq_mask = _PSB_IRQ_SGX_FLAG | _PSB_IRQ_MSVDX_FLAG;
+
+	if (!drm_psb_disable_vsync)
+		dev_priv->vdc_irq_mask |= _PSB_VSYNC_PIPEA_FLAG |
+		    _PSB_VSYNC_PIPEB_FLAG;
+
+	/*Clear MTX interrupt */
+	{
+		unsigned long mtx_int = 0;
+		REGIO_WRITE_FIELD_LITE(mtx_int, MSVDX_INTERRUPT_STATUS,
+				       CR_MTX_IRQ, 1);
+		PSB_WMSVDX32(mtx_int, MSVDX_INTERRUPT_CLEAR);
+	}
+	spin_unlock(&dev_priv->irqmask_lock);
+}
+
+void psb_msvdx_irq_postinstall(struct drm_psb_private *dev_priv)
+{
+	/* Enable Mtx Interupt to host */
+	unsigned long enables = 0;
+	PSB_DEBUG_GENERAL("Setting up MSVDX IRQs.....\n");
+	REGIO_WRITE_FIELD_LITE(enables, MSVDX_INTERRUPT_STATUS, CR_MTX_IRQ, 1);
+	PSB_WMSVDX32(enables, MSVDX_HOST_INTERRUPT_ENABLE);
+}
+
+int psb_irq_postinstall(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+	PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
+	PSB_WSGX32(dev_priv->sgx2_irq_mask, PSB_CR_EVENT_HOST_ENABLE2);
+	PSB_WSGX32(dev_priv->sgx_irq_mask, PSB_CR_EVENT_HOST_ENABLE);
+	(void)PSB_RSGX32(PSB_CR_EVENT_HOST_ENABLE);
+	/****MSVDX IRQ Setup...*****/
+	/* Enable Mtx Interupt to host */
+	{
+		unsigned long enables = 0;
+		PSB_DEBUG_GENERAL("Setting up MSVDX IRQs.....\n");
+		REGIO_WRITE_FIELD_LITE(enables, MSVDX_INTERRUPT_STATUS,
+				       CR_MTX_IRQ, 1);
+		PSB_WMSVDX32(enables, MSVDX_HOST_INTERRUPT_ENABLE);
+	}
+	dev_priv->irq_enabled = 1;
+	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
+	return 0;
+}
+
+void psb_irq_uninstall(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+
+	dev_priv->sgx_irq_mask = 0x00000000;
+	dev_priv->sgx2_irq_mask = 0x00000000;
+	dev_priv->vdc_irq_mask = 0x00000000;
+
+	PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+	PSB_WVDC32(0xFFFFFFFF, PSB_INT_MASK_R);
+	PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
+	PSB_WSGX32(dev_priv->sgx_irq_mask, PSB_CR_EVENT_HOST_ENABLE);
+	PSB_WSGX32(dev_priv->sgx2_irq_mask, PSB_CR_EVENT_HOST_ENABLE2);
+	wmb();
+	PSB_WVDC32(PSB_RVDC32(PSB_INT_IDENTITY_R), PSB_INT_IDENTITY_R);
+	PSB_WSGX32(PSB_RSGX32(PSB_CR_EVENT_STATUS), PSB_CR_EVENT_HOST_CLEAR);
+	PSB_WSGX32(PSB_RSGX32(PSB_CR_EVENT_STATUS2), PSB_CR_EVENT_HOST_CLEAR2);
+
+	/****MSVDX IRQ Setup...*****/
+	/* Clear interrupt enabled flag */
+	PSB_WMSVDX32(0, MSVDX_HOST_INTERRUPT_ENABLE);
+
+	dev_priv->irq_enabled = 0;
+	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
+
+}
+
+void psb_2D_irq_off(struct drm_psb_private *dev_priv)
+{
+	unsigned long irqflags;
+	uint32_t old_mask;
+	uint32_t cleared_mask;
+
+	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+	--dev_priv->irqen_count_2d;
+	if (dev_priv->irq_enabled && dev_priv->irqen_count_2d == 0) {
+
+		old_mask = dev_priv->sgx_irq_mask;
+		dev_priv->sgx_irq_mask &= ~_PSB_CE_TWOD_COMPLETE;
+		PSB_WSGX32(dev_priv->sgx_irq_mask, PSB_CR_EVENT_HOST_ENABLE);
+		(void)PSB_RSGX32(PSB_CR_EVENT_HOST_ENABLE);
+
+		cleared_mask = (old_mask ^ dev_priv->sgx_irq_mask) & old_mask;
+		PSB_WSGX32(cleared_mask, PSB_CR_EVENT_HOST_CLEAR);
+		(void)PSB_RSGX32(PSB_CR_EVENT_HOST_CLEAR);
+	}
+	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
+}
+
+void psb_2D_irq_on(struct drm_psb_private *dev_priv)
+{
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+	if (dev_priv->irq_enabled && dev_priv->irqen_count_2d == 0) {
+		dev_priv->sgx_irq_mask |= _PSB_CE_TWOD_COMPLETE;
+		PSB_WSGX32(dev_priv->sgx_irq_mask, PSB_CR_EVENT_HOST_ENABLE);
+		(void)PSB_RSGX32(PSB_CR_EVENT_HOST_ENABLE);
+	}
+	++dev_priv->irqen_count_2d;
+	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
+}
+#if 0
+static int psb_vblank_do_wait(struct drm_device *dev, unsigned int *sequence,
+			      atomic_t * counter, int crtc)
+{
+	unsigned int cur_vblank;
+	int ret = 0;
+
+	DRM_WAIT_ON(ret, dev->vbl_queue[crtc], 3 * DRM_HZ,
+		    (((cur_vblank = atomic_read(counter))
+		      - *sequence) <= (1 << 23)));
+
+	*sequence = cur_vblank;
+
+	return ret;
+}
+
+int psb_vblank_wait(struct drm_device *dev, unsigned int *sequence)
+{
+	int ret;
+
+	ret = psb_vblank_do_wait(dev, sequence, &dev->_vblank_count[0], 0);
+	return ret;
+}
+
+int psb_vblank_wait2(struct drm_device *dev, unsigned int *sequence)
+{
+	int ret;
+
+	ret = psb_vblank_do_wait(dev, sequence, &dev->_vblank_count[1], 1);
+	return ret;
+}
+#endif
+
+void psb_msvdx_irq_off(struct drm_psb_private *dev_priv)
+{
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+	if (dev_priv->irq_enabled) {
+		dev_priv->vdc_irq_mask &= ~_PSB_IRQ_MSVDX_FLAG;
+		PSB_WSGX32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
+		(void)PSB_RSGX32(PSB_INT_ENABLE_R);
+	}
+	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
+}
+
+void psb_msvdx_irq_on(struct drm_psb_private *dev_priv)
+{
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+	if (dev_priv->irq_enabled) {
+		dev_priv->vdc_irq_mask |= _PSB_IRQ_MSVDX_FLAG;
+		PSB_WSGX32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
+		(void)PSB_RSGX32(PSB_INT_ENABLE_R);
+	}
+	spin_unlock_irqrestore(&dev_priv->irqmask_lock, irqflags);
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_mmu.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_mmu.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,1037 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+#include "drmP.h"
+#include "psb_drv.h"
+#include "psb_reg.h"
+
+/*
+ * Code for the SGX MMU:
+ */
+
+/*
+ * clflush on one processor only:
+ * clflush should apparently flush the cache line on all processors in an
+ * SMP system.
+ */
+
+/*
+ * kmap atomic:
+ * The usage of the slots must be completely encapsulated within a spinlock, and
+ * no other functions that may be using the locks for other purposed may be
+ * called from within the locked region.
+ * Since the slots are per processor, this will guarantee that we are the only
+ * user.
+ */
+
+/*
+ * TODO: Inserting ptes from an interrupt handler:
+ * This may be desirable for some SGX functionality where the GPU can fault in
+ * needed pages. For that, we need to make an atomic insert_pages function, that
+ * may fail.
+ * If it fails, the caller need to insert the page using a workqueue function,
+ * but on average it should be fast.
+ */
+
+struct psb_mmu_driver {
+	/* protects driver- and pd structures. Always take in read mode
+	 * before taking the page table spinlock.
+	 */
+	struct rw_semaphore sem;
+
+	/* protects page tables, directory tables and pt tables.
+	 * and pt structures.
+	 */
+	spinlock_t lock;
+
+	atomic_t needs_tlbflush;
+	atomic_t *msvdx_mmu_invaldc;
+	uint8_t __iomem *register_map;
+	struct psb_mmu_pd *default_pd;
+	uint32_t bif_ctrl;
+	int has_clflush;
+	int clflush_add;
+	unsigned long clflush_mask;
+};
+
+struct psb_mmu_pd;
+
+struct psb_mmu_pt {
+	struct psb_mmu_pd *pd;
+	uint32_t index;
+	uint32_t count;
+	struct page *p;
+	uint32_t *v;
+};
+
+struct psb_mmu_pd {
+	struct psb_mmu_driver *driver;
+	int hw_context;
+	struct psb_mmu_pt **tables;
+	struct page *p;
+	struct page *dummy_pt;
+	struct page *dummy_page;
+	uint32_t pd_mask;
+	uint32_t invalid_pde;
+	uint32_t invalid_pte;
+};
+
+static inline uint32_t psb_mmu_pt_index(uint32_t offset)
+{
+	return (offset >> PSB_PTE_SHIFT) & 0x3FF;
+}
+static inline uint32_t psb_mmu_pd_index(uint32_t offset)
+{
+	return (offset >> PSB_PDE_SHIFT);
+}
+
+#if defined(CONFIG_X86)
+static inline void psb_clflush(void *addr)
+{
+	__asm__ __volatile__("clflush (%0)\n"::"r"(addr):"memory");
+}
+
+static inline void psb_mmu_clflush(struct psb_mmu_driver *driver, void *addr)
+{
+	if (!driver->has_clflush)
+		return;
+
+	mb();
+	psb_clflush(addr);
+	mb();
+}
+#else
+
+static inline void psb_mmu_clflush(struct psb_mmu_driver *driver, void *addr)
+{;
+}
+
+#endif
+
+static inline void psb_iowrite32(const struct psb_mmu_driver *d,
+				 uint32_t val, uint32_t offset)
+{
+	iowrite32(val, d->register_map + offset);
+}
+
+static inline uint32_t psb_ioread32(const struct psb_mmu_driver *d,
+				    uint32_t offset)
+{
+	return ioread32(d->register_map + offset);
+}
+
+static void psb_mmu_flush_pd_locked(struct psb_mmu_driver *driver, int force)
+{
+	if (atomic_read(&driver->needs_tlbflush) || force) {
+		uint32_t val = psb_ioread32(driver, PSB_CR_BIF_CTRL);
+		psb_iowrite32(driver, val | _PSB_CB_CTRL_INVALDC,
+			      PSB_CR_BIF_CTRL);
+		wmb();
+		psb_iowrite32(driver, val & ~_PSB_CB_CTRL_INVALDC,
+			      PSB_CR_BIF_CTRL);
+		(void)psb_ioread32(driver, PSB_CR_BIF_CTRL);
+		if (driver->msvdx_mmu_invaldc)
+			atomic_set(driver->msvdx_mmu_invaldc, 1);
+	}
+	atomic_set(&driver->needs_tlbflush, 0);
+}
+
+static void psb_mmu_flush_pd(struct psb_mmu_driver *driver, int force)
+{
+	down_write(&driver->sem);
+	psb_mmu_flush_pd_locked(driver, force);
+	up_write(&driver->sem);
+}
+
+void psb_mmu_flush(struct psb_mmu_driver *driver)
+{
+	uint32_t val;
+
+	down_write(&driver->sem);
+	val = psb_ioread32(driver, PSB_CR_BIF_CTRL);
+	if (atomic_read(&driver->needs_tlbflush))
+		psb_iowrite32(driver, val | _PSB_CB_CTRL_INVALDC,
+			      PSB_CR_BIF_CTRL);
+	else
+		psb_iowrite32(driver, val | _PSB_CB_CTRL_FLUSH,
+			      PSB_CR_BIF_CTRL);
+	wmb();
+	psb_iowrite32(driver,
+		      val & ~(_PSB_CB_CTRL_FLUSH | _PSB_CB_CTRL_INVALDC),
+		      PSB_CR_BIF_CTRL);
+	(void)psb_ioread32(driver, PSB_CR_BIF_CTRL);
+	atomic_set(&driver->needs_tlbflush, 0);
+	if (driver->msvdx_mmu_invaldc)
+		atomic_set(driver->msvdx_mmu_invaldc, 1);
+	up_write(&driver->sem);
+}
+
+void psb_mmu_set_pd_context(struct psb_mmu_pd *pd, int hw_context)
+{
+	uint32_t offset = (hw_context == 0) ? PSB_CR_BIF_DIR_LIST_BASE0 :
+	    PSB_CR_BIF_DIR_LIST_BASE1 + hw_context * 4;
+
+	drm_ttm_cache_flush();
+	down_write(&pd->driver->sem);
+	psb_iowrite32(pd->driver, (page_to_pfn(pd->p) << PAGE_SHIFT), offset);
+	wmb();
+	psb_mmu_flush_pd_locked(pd->driver, 1);
+	pd->hw_context = hw_context;
+	up_write(&pd->driver->sem);
+
+}
+
+static inline unsigned long psb_pd_addr_end(unsigned long addr,
+					    unsigned long end)
+{
+
+	addr = (addr + PSB_PDE_MASK + 1) & ~PSB_PDE_MASK;
+	return (addr < end) ? addr : end;
+}
+
+static inline uint32_t psb_mmu_mask_pte(uint32_t pfn, int type)
+{
+	uint32_t mask = PSB_PTE_VALID;
+
+	if (type & PSB_MMU_CACHED_MEMORY)
+		mask |= PSB_PTE_CACHED;
+	if (type & PSB_MMU_RO_MEMORY)
+		mask |= PSB_PTE_RO;
+	if (type & PSB_MMU_WO_MEMORY)
+		mask |= PSB_PTE_WO;
+
+	return (pfn << PAGE_SHIFT) | mask;
+}
+
+struct psb_mmu_pd *psb_mmu_alloc_pd(struct psb_mmu_driver *driver,
+				    int trap_pagefaults, int invalid_type)
+{
+	struct psb_mmu_pd *pd = kmalloc(sizeof(*pd), GFP_KERNEL);
+	uint32_t *v;
+	int i;
+
+	if (!pd)
+		return NULL;
+
+	pd->p = alloc_page(GFP_DMA32);
+	if (!pd->p)
+		goto out_err1;
+	pd->dummy_pt = alloc_page(GFP_DMA32);
+	if (!pd->dummy_pt)
+		goto out_err2;
+	pd->dummy_page = alloc_page(GFP_DMA32);
+	if (!pd->dummy_page)
+		goto out_err3;
+
+	if (!trap_pagefaults) {
+		pd->invalid_pde = psb_mmu_mask_pte(page_to_pfn(pd->dummy_pt),
+						   invalid_type |
+						   PSB_MMU_CACHED_MEMORY);
+		pd->invalid_pte = psb_mmu_mask_pte(page_to_pfn(pd->dummy_page),
+						   invalid_type |
+						   PSB_MMU_CACHED_MEMORY);
+	} else {
+		pd->invalid_pde = 0;
+		pd->invalid_pte = 0;
+	}
+
+	v = kmap(pd->dummy_pt);
+	for (i = 0; i < (PAGE_SIZE / sizeof(uint32_t)); ++i) {
+		v[i] = pd->invalid_pte;
+	}
+	kunmap(pd->dummy_pt);
+
+	v = kmap(pd->p);
+	for (i = 0; i < (PAGE_SIZE / sizeof(uint32_t)); ++i) {
+		v[i] = pd->invalid_pde;
+	}
+	kunmap(pd->p);
+
+	clear_page(kmap(pd->dummy_page));
+	kunmap(pd->dummy_page);
+
+	pd->tables = vmalloc_user(sizeof(struct psb_mmu_pt *) * 1024);
+	if (!pd->tables)
+		goto out_err4;
+
+	pd->hw_context = -1;
+	pd->pd_mask = PSB_PTE_VALID;
+	pd->driver = driver;
+
+	return pd;
+
+      out_err4:
+	__free_page(pd->dummy_page);
+      out_err3:
+	__free_page(pd->dummy_pt);
+      out_err2:
+	__free_page(pd->p);
+      out_err1:
+	kfree(pd);
+	return NULL;
+}
+
+void psb_mmu_free_pt(struct psb_mmu_pt *pt)
+{
+	__free_page(pt->p);
+	kfree(pt);
+}
+
+void psb_mmu_free_pagedir(struct psb_mmu_pd *pd)
+{
+	struct psb_mmu_driver *driver = pd->driver;
+	struct psb_mmu_pt *pt;
+	int i;
+
+	down_write(&driver->sem);
+	if (pd->hw_context != -1) {
+		psb_iowrite32(driver, 0,
+			      PSB_CR_BIF_DIR_LIST_BASE0 + pd->hw_context * 4);
+		psb_mmu_flush_pd_locked(driver, 1);
+	}
+
+	/* Should take the spinlock here, but we don't need to do that
+	   since we have the semaphore in write mode. */
+
+	for (i = 0; i < 1024; ++i) {
+		pt = pd->tables[i];
+		if (pt)
+			psb_mmu_free_pt(pt);
+	}
+
+	vfree(pd->tables);
+	__free_page(pd->dummy_page);
+	__free_page(pd->dummy_pt);
+	__free_page(pd->p);
+	kfree(pd);
+	up_write(&driver->sem);
+}
+
+static struct psb_mmu_pt *psb_mmu_alloc_pt(struct psb_mmu_pd *pd)
+{
+	struct psb_mmu_pt *pt = kmalloc(sizeof(*pt), GFP_KERNEL);
+	void *v;
+	uint32_t clflush_add = pd->driver->clflush_add >> PAGE_SHIFT;
+	uint32_t clflush_count = PAGE_SIZE / clflush_add;
+	spinlock_t *lock = &pd->driver->lock;
+	uint8_t *clf;
+	uint32_t *ptes;
+	int i;
+
+	if (!pt)
+		return NULL;
+
+	pt->p = alloc_page(GFP_DMA32);
+	if (!pt->p) {
+		kfree(pt);
+		return NULL;
+	}
+
+	spin_lock(lock);
+
+	v = kmap_atomic(pt->p, KM_USER0);
+	clf = (uint8_t *) v;
+	ptes = (uint32_t *) v;
+	for (i = 0; i < (PAGE_SIZE / sizeof(uint32_t)); ++i) {
+		*ptes++ = pd->invalid_pte;
+	}
+
+#if defined(CONFIG_X86)
+	if (pd->driver->has_clflush && pd->hw_context != -1) {
+		mb();
+		for (i = 0; i < clflush_count; ++i) {
+			psb_clflush(clf);
+			clf += clflush_add;
+		}
+		mb();
+	}
+#endif
+	kunmap_atomic(v, KM_USER0);
+	spin_unlock(lock);
+
+	pt->count = 0;
+	pt->pd = pd;
+	pt->index = 0;
+
+	return pt;
+}
+
+struct psb_mmu_pt *psb_mmu_pt_alloc_map_lock(struct psb_mmu_pd *pd,
+					     unsigned long addr)
+{
+	uint32_t index = psb_mmu_pd_index(addr);
+	struct psb_mmu_pt *pt;
+	volatile uint32_t *v;
+	spinlock_t *lock = &pd->driver->lock;
+
+	spin_lock(lock);
+	pt = pd->tables[index];
+	while (!pt) {
+		spin_unlock(lock);
+		pt = psb_mmu_alloc_pt(pd);
+		if (!pt)
+			return NULL;
+		spin_lock(lock);
+
+		if (pd->tables[index]) {
+			spin_unlock(lock);
+			psb_mmu_free_pt(pt);
+			spin_lock(lock);
+			pt = pd->tables[index];
+			continue;
+		}
+
+		v = kmap_atomic(pd->p, KM_USER0);
+		pd->tables[index] = pt;
+		v[index] = (page_to_pfn(pt->p) << 12) | pd->pd_mask;
+		pt->index = index;
+		kunmap_atomic((void *)v, KM_USER0);
+
+		if (pd->hw_context != -1) {
+			psb_mmu_clflush(pd->driver, (void *)&v[index]);
+			atomic_set(&pd->driver->needs_tlbflush, 1);
+		}
+	}
+	pt->v = kmap_atomic(pt->p, KM_USER0);
+	return pt;
+}
+
+static struct psb_mmu_pt *psb_mmu_pt_map_lock(struct psb_mmu_pd *pd,
+					      unsigned long addr)
+{
+	uint32_t index = psb_mmu_pd_index(addr);
+	struct psb_mmu_pt *pt;
+	spinlock_t *lock = &pd->driver->lock;
+
+	spin_lock(lock);
+	pt = pd->tables[index];
+	if (!pt) {
+		spin_unlock(lock);
+		return NULL;
+	}
+	pt->v = kmap_atomic(pt->p, KM_USER0);
+	return pt;
+}
+
+static void psb_mmu_pt_unmap_unlock(struct psb_mmu_pt *pt)
+{
+	struct psb_mmu_pd *pd = pt->pd;
+	volatile uint32_t *v;
+
+	kunmap_atomic(pt->v, KM_USER0);
+	if (pt->count == 0) {
+		v = kmap_atomic(pd->p, KM_USER0);
+		v[pt->index] = pd->invalid_pde;
+		pd->tables[pt->index] = NULL;
+
+		if (pd->hw_context != -1) {
+			psb_mmu_clflush(pd->driver, (void *)&v[pt->index]);
+			atomic_set(&pd->driver->needs_tlbflush, 1);
+		}
+		kunmap_atomic(pt->v, KM_USER0);
+		spin_unlock(&pd->driver->lock);
+		psb_mmu_free_pt(pt);
+		return;
+	}
+	spin_unlock(&pd->driver->lock);
+}
+
+static inline void psb_mmu_set_pte(struct psb_mmu_pt *pt, unsigned long addr,
+				   uint32_t pte)
+{
+	pt->v[psb_mmu_pt_index(addr)] = pte;
+}
+
+static inline void psb_mmu_invalidate_pte(struct psb_mmu_pt *pt,
+					  unsigned long addr)
+{
+	pt->v[psb_mmu_pt_index(addr)] = pt->pd->invalid_pte;
+}
+
+#if 0
+static uint32_t psb_mmu_check_pte_locked(struct psb_mmu_pd *pd,
+					 uint32_t mmu_offset)
+{
+	uint32_t *v;
+	uint32_t pfn;
+
+	v = kmap_atomic(pd->p, KM_USER0);
+	if (!v) {
+		printk(KERN_INFO "Could not kmap pde page.\n");
+		return 0;
+	}
+	pfn = v[psb_mmu_pd_index(mmu_offset)];
+	//      printk(KERN_INFO "pde is 0x%08x\n",pfn);
+	kunmap_atomic(v, KM_USER0);
+	if (((pfn & 0x0F) != PSB_PTE_VALID)) {
+		printk(KERN_INFO "Strange pde at 0x%08x: 0x%08x.\n",
+		       mmu_offset, pfn);
+	}
+	v = ioremap(pfn & 0xFFFFF000, 4096);
+	if (!v) {
+		printk(KERN_INFO "Could not kmap pte page.\n");
+		return 0;
+	}
+	pfn = v[psb_mmu_pt_index(mmu_offset)];
+	// printk(KERN_INFO "pte is 0x%08x\n",pfn);
+	iounmap(v);
+	if (((pfn & 0x0F) != PSB_PTE_VALID)) {
+		printk(KERN_INFO "Strange pte at 0x%08x: 0x%08x.\n",
+		       mmu_offset, pfn);
+	}
+	return pfn >> PAGE_SHIFT;
+}
+
+static void psb_mmu_check_mirrored_gtt(struct psb_mmu_pd *pd,
+				       uint32_t mmu_offset, uint32_t gtt_pages)
+{
+	uint32_t start;
+	uint32_t next;
+
+	printk(KERN_INFO "Checking mirrored gtt 0x%08x %d\n",
+	       mmu_offset, gtt_pages);
+	down_read(&pd->driver->sem);
+	start = psb_mmu_check_pte_locked(pd, mmu_offset);
+	mmu_offset += PAGE_SIZE;
+	gtt_pages -= 1;
+	while (gtt_pages--) {
+		next = psb_mmu_check_pte_locked(pd, mmu_offset);
+		if (next != start + 1) {
+			printk(KERN_INFO "Ptes out of order: 0x%08x, 0x%08x.\n",
+			       start, next);
+		}
+		start = next;
+		mmu_offset += PAGE_SIZE;
+	}
+	up_read(&pd->driver->sem);
+}
+
+#endif
+
+void psb_mmu_mirror_gtt(struct psb_mmu_pd *pd,
+			uint32_t mmu_offset, uint32_t gtt_start,
+			uint32_t gtt_pages)
+{
+	uint32_t *v;
+	uint32_t start = psb_mmu_pd_index(mmu_offset);
+	struct psb_mmu_driver *driver = pd->driver;
+
+	down_read(&driver->sem);
+	spin_lock(&driver->lock);
+
+	v = kmap_atomic(pd->p, KM_USER0);
+	v += start;
+
+	while (gtt_pages--) {
+		*v++ = gtt_start | pd->pd_mask;
+		gtt_start += PAGE_SIZE;
+	}
+
+	drm_ttm_cache_flush();
+	kunmap_atomic(v, KM_USER0);
+	spin_unlock(&driver->lock);
+
+	if (pd->hw_context != -1)
+		atomic_set(&pd->driver->needs_tlbflush, 1);
+
+	up_read(&pd->driver->sem);
+	psb_mmu_flush_pd(pd->driver, 0);
+}
+
+struct psb_mmu_pd *psb_mmu_get_default_pd(struct psb_mmu_driver *driver)
+{
+	struct psb_mmu_pd *pd;
+
+	down_read(&driver->sem);
+	pd = driver->default_pd;
+	up_read(&driver->sem);
+
+	return pd;
+}
+
+/* Returns the physical address of the PD shared by sgx/msvdx */
+uint32_t psb_get_default_pd_addr(struct psb_mmu_driver * driver)
+{
+	struct psb_mmu_pd *pd;
+
+	pd = psb_mmu_get_default_pd(driver);
+	return ((page_to_pfn(pd->p) << PAGE_SHIFT));
+}
+
+void psb_mmu_driver_takedown(struct psb_mmu_driver *driver)
+{
+	psb_iowrite32(driver, driver->bif_ctrl, PSB_CR_BIF_CTRL);
+	psb_mmu_free_pagedir(driver->default_pd);
+	kfree(driver);
+}
+
+struct psb_mmu_driver *psb_mmu_driver_init(uint8_t __iomem * registers,
+					   int trap_pagefaults,
+					   int invalid_type,
+					   atomic_t *msvdx_mmu_invaldc)
+{
+	struct psb_mmu_driver *driver;
+
+	driver = (struct psb_mmu_driver *)kmalloc(sizeof(*driver), GFP_KERNEL);
+
+	if (!driver)
+		return NULL;
+
+	driver->default_pd = psb_mmu_alloc_pd(driver, trap_pagefaults,
+					      invalid_type);
+	if (!driver->default_pd)
+		goto out_err1;
+
+	spin_lock_init(&driver->lock);
+	init_rwsem(&driver->sem);
+	down_write(&driver->sem);
+	driver->register_map = registers;
+	atomic_set(&driver->needs_tlbflush, 1);
+	driver->msvdx_mmu_invaldc = msvdx_mmu_invaldc;
+
+	driver->bif_ctrl = psb_ioread32(driver, PSB_CR_BIF_CTRL);
+	psb_iowrite32(driver, driver->bif_ctrl | _PSB_CB_CTRL_CLEAR_FAULT,
+		      PSB_CR_BIF_CTRL);
+	psb_iowrite32(driver, driver->bif_ctrl & ~_PSB_CB_CTRL_CLEAR_FAULT,
+		      PSB_CR_BIF_CTRL);
+
+	driver->has_clflush = 0;
+
+#if defined(CONFIG_X86)
+	if (boot_cpu_has(X86_FEATURE_CLFLSH)) {
+		uint32_t tfms, misc, cap0, cap4, clflush_size;
+
+		/*
+		 * clflush size is determined at kernel setup for x86_64 but not for
+		 * i386. We have to do it here.
+		 */
+
+		cpuid(0x00000001, &tfms, &misc, &cap0, &cap4);
+		clflush_size = ((misc >> 8) & 0xff) * 8;
+		driver->has_clflush = 1;
+		driver->clflush_add =
+		    PAGE_SIZE * clflush_size / sizeof(uint32_t);
+		driver->clflush_mask = driver->clflush_add - 1;
+		driver->clflush_mask = ~driver->clflush_mask;
+	}
+#endif
+
+	up_write(&driver->sem);
+	return driver;
+
+      out_err1:
+	kfree(driver);
+	return NULL;
+}
+
+#if defined(CONFIG_X86)
+static void psb_mmu_flush_ptes(struct psb_mmu_pd *pd, unsigned long address,
+			       uint32_t num_pages, uint32_t desired_tile_stride,
+			       uint32_t hw_tile_stride)
+{
+	struct psb_mmu_pt *pt;
+	uint32_t rows = 1;
+	uint32_t i;
+	unsigned long addr;
+	unsigned long end;
+	unsigned long next;
+	unsigned long add;
+	unsigned long row_add;
+	unsigned long clflush_add = pd->driver->clflush_add;
+	unsigned long clflush_mask = pd->driver->clflush_mask;
+
+	if (!pd->driver->has_clflush) {
+		drm_ttm_cache_flush();
+		return;
+	}
+
+	if (hw_tile_stride)
+		rows = num_pages / desired_tile_stride;
+	else
+		desired_tile_stride = num_pages;
+
+	add = desired_tile_stride << PAGE_SHIFT;
+	row_add = hw_tile_stride << PAGE_SHIFT;
+	mb();
+	for (i = 0; i < rows; ++i) {
+
+		addr = address;
+		end = addr + add;
+
+		do {
+			next = psb_pd_addr_end(addr, end);
+			pt = psb_mmu_pt_map_lock(pd, addr);
+			if (!pt)
+				continue;
+			do {
+				psb_clflush(&pt->v[psb_mmu_pt_index(addr)]);
+			} while (addr += clflush_add,
+				 (addr & clflush_mask) < next);
+
+			psb_mmu_pt_unmap_unlock(pt);
+		} while (addr = next, next != end);
+		address += row_add;
+	}
+	mb();
+}
+#else
+static void psb_mmu_flush_ptes(struct psb_mmu_pd *pd, unsigned long address,
+			       uint32_t num_pages, uint32_t desired_tile_stride,
+			       uint32_t hw_tile_stride)
+{
+	drm_ttm_cache_flush();
+}
+#endif
+
+void psb_mmu_remove_pfn_sequence(struct psb_mmu_pd *pd,
+				 unsigned long address, uint32_t num_pages)
+{
+	struct psb_mmu_pt *pt;
+	unsigned long addr;
+	unsigned long end;
+	unsigned long next;
+	unsigned long f_address = address;
+
+	down_read(&pd->driver->sem);
+
+	addr = address;
+	end = addr + (num_pages << PAGE_SHIFT);
+
+	do {
+		next = psb_pd_addr_end(addr, end);
+		pt = psb_mmu_pt_alloc_map_lock(pd, addr);
+		if (!pt)
+			goto out;
+		do {
+			psb_mmu_invalidate_pte(pt, addr);
+			--pt->count;
+		} while (addr += PAGE_SIZE, addr < next);
+		psb_mmu_pt_unmap_unlock(pt);
+
+	} while (addr = next, next != end);
+
+      out:
+	if (pd->hw_context != -1)
+		psb_mmu_flush_ptes(pd, f_address, num_pages, 1, 1);
+
+	up_read(&pd->driver->sem);
+
+	if (pd->hw_context != -1)
+		psb_mmu_flush(pd->driver);
+
+	return;
+}
+
+void psb_mmu_remove_pages(struct psb_mmu_pd *pd, unsigned long address,
+			  uint32_t num_pages, uint32_t desired_tile_stride,
+			  uint32_t hw_tile_stride)
+{
+	struct psb_mmu_pt *pt;
+	uint32_t rows = 1;
+	uint32_t i;
+	unsigned long addr;
+	unsigned long end;
+	unsigned long next;
+	unsigned long add;
+	unsigned long row_add;
+	unsigned long f_address = address;
+
+	if (hw_tile_stride)
+		rows = num_pages / desired_tile_stride;
+	else
+		desired_tile_stride = num_pages;
+
+	add = desired_tile_stride << PAGE_SHIFT;
+	row_add = hw_tile_stride << PAGE_SHIFT;
+
+	down_read(&pd->driver->sem);
+
+	/* Make sure we only need to flush this processor's cache */
+
+	for (i = 0; i < rows; ++i) {
+
+		addr = address;
+		end = addr + add;
+
+		do {
+			next = psb_pd_addr_end(addr, end);
+			pt = psb_mmu_pt_map_lock(pd, addr);
+			if (!pt)
+				continue;
+			do {
+				psb_mmu_invalidate_pte(pt, addr);
+				--pt->count;
+
+			} while (addr += PAGE_SIZE, addr < next);
+			psb_mmu_pt_unmap_unlock(pt);
+
+		} while (addr = next, next != end);
+		address += row_add;
+	}
+	if (pd->hw_context != -1)
+		psb_mmu_flush_ptes(pd, f_address, num_pages,
+				   desired_tile_stride, hw_tile_stride);
+
+	up_read(&pd->driver->sem);
+
+	if (pd->hw_context != -1)
+		psb_mmu_flush(pd->driver);
+}
+
+int psb_mmu_insert_pfn_sequence(struct psb_mmu_pd *pd, uint32_t start_pfn,
+				unsigned long address, uint32_t num_pages,
+				int type)
+{
+	struct psb_mmu_pt *pt;
+	uint32_t pte;
+	unsigned long addr;
+	unsigned long end;
+	unsigned long next;
+	unsigned long f_address = address;
+	int ret = -ENOMEM;
+
+	down_read(&pd->driver->sem);
+
+	addr = address;
+	end = addr + (num_pages << PAGE_SHIFT);
+
+	do {
+		next = psb_pd_addr_end(addr, end);
+		pt = psb_mmu_pt_alloc_map_lock(pd, addr);
+		if (!pt) {
+			ret = -ENOMEM;
+			goto out;
+		}
+		do {
+			pte = psb_mmu_mask_pte(start_pfn++, type);
+			psb_mmu_set_pte(pt, addr, pte);
+			pt->count++;
+		} while (addr += PAGE_SIZE, addr < next);
+		psb_mmu_pt_unmap_unlock(pt);
+
+	} while (addr = next, next != end);
+	ret = 0;
+
+      out:
+	if (pd->hw_context != -1)
+		psb_mmu_flush_ptes(pd, f_address, num_pages, 1, 1);
+
+	up_read(&pd->driver->sem);
+
+	if (pd->hw_context != -1)
+		psb_mmu_flush(pd->driver);
+
+	return 0;
+}
+
+int psb_mmu_insert_pages(struct psb_mmu_pd *pd, struct page **pages,
+			 unsigned long address, uint32_t num_pages,
+			 uint32_t desired_tile_stride, uint32_t hw_tile_stride,
+			 int type)
+{
+	struct psb_mmu_pt *pt;
+	uint32_t rows = 1;
+	uint32_t i;
+	uint32_t pte;
+	unsigned long addr;
+	unsigned long end;
+	unsigned long next;
+	unsigned long add;
+	unsigned long row_add;
+	unsigned long f_address = address;
+	int ret = -ENOMEM;
+
+	if (hw_tile_stride) {
+		if (num_pages % desired_tile_stride != 0)
+			return -EINVAL;
+		rows = num_pages / desired_tile_stride;
+	} else {
+		desired_tile_stride = num_pages;
+	}
+
+	add = desired_tile_stride << PAGE_SHIFT;
+	row_add = hw_tile_stride << PAGE_SHIFT;
+
+	down_read(&pd->driver->sem);
+
+	for (i = 0; i < rows; ++i) {
+
+		addr = address;
+		end = addr + add;
+
+		do {
+			next = psb_pd_addr_end(addr, end);
+			pt = psb_mmu_pt_alloc_map_lock(pd, addr);
+			if (!pt)
+				goto out;
+			do {
+				pte = psb_mmu_mask_pte(page_to_pfn(*pages++),
+						       type);
+				psb_mmu_set_pte(pt, addr, pte);
+				pt->count++;
+			} while (addr += PAGE_SIZE, addr < next);
+			psb_mmu_pt_unmap_unlock(pt);
+
+		} while (addr = next, next != end);
+
+		address += row_add;
+	}
+	ret = 0;
+      out:
+	if (pd->hw_context != -1)
+		psb_mmu_flush_ptes(pd, f_address, num_pages,
+				   desired_tile_stride, hw_tile_stride);
+
+	up_read(&pd->driver->sem);
+
+	if (pd->hw_context != -1)
+		psb_mmu_flush(pd->driver);
+
+	return 0;
+}
+
+void psb_mmu_enable_requestor(struct psb_mmu_driver *driver, uint32_t mask)
+{
+	mask &= _PSB_MMU_ER_MASK;
+	psb_iowrite32(driver, psb_ioread32(driver, PSB_CR_BIF_CTRL) & ~mask,
+		      PSB_CR_BIF_CTRL);
+	(void)psb_ioread32(driver, PSB_CR_BIF_CTRL);
+}
+
+void psb_mmu_disable_requestor(struct psb_mmu_driver *driver, uint32_t mask)
+{
+	mask &= _PSB_MMU_ER_MASK;
+	psb_iowrite32(driver, psb_ioread32(driver, PSB_CR_BIF_CTRL) | mask,
+		      PSB_CR_BIF_CTRL);
+	(void)psb_ioread32(driver, PSB_CR_BIF_CTRL);
+}
+
+int psb_mmu_virtual_to_pfn(struct psb_mmu_pd *pd, uint32_t virtual,
+			   unsigned long *pfn)
+{
+	int ret;
+	struct psb_mmu_pt *pt;
+	uint32_t tmp;
+	spinlock_t *lock = &pd->driver->lock;
+
+	down_read(&pd->driver->sem);
+	pt = psb_mmu_pt_map_lock(pd, virtual);
+	if (!pt) {
+		uint32_t *v;
+
+		spin_lock(lock);
+		v = kmap_atomic(pd->p, KM_USER0);
+		tmp = v[psb_mmu_pd_index(virtual)];
+		kunmap_atomic(v, KM_USER0);
+		spin_unlock(lock);
+
+		if (tmp != pd->invalid_pde || !(tmp & PSB_PTE_VALID) ||
+		    !(pd->invalid_pte & PSB_PTE_VALID)) {
+			ret = -EINVAL;
+			goto out;
+		}
+		ret = 0;
+		*pfn = pd->invalid_pte >> PAGE_SHIFT;
+		goto out;
+	}
+	tmp = pt->v[psb_mmu_pt_index(virtual)];
+	if (!(tmp & PSB_PTE_VALID)) {
+		ret = -EINVAL;
+	} else {
+		ret = 0;
+		*pfn = tmp >> PAGE_SHIFT;
+	}
+	psb_mmu_pt_unmap_unlock(pt);
+      out:
+	up_read(&pd->driver->sem);
+	return ret;
+}
+
+void psb_mmu_test(struct psb_mmu_driver *driver, uint32_t offset)
+{
+	struct page *p;
+	unsigned long pfn;
+	int ret = 0;
+	struct psb_mmu_pd *pd;
+	uint32_t *v;
+	uint32_t *vmmu;
+
+	pd = driver->default_pd;
+	if (!pd) {
+		printk(KERN_WARNING "Could not get default pd\n");
+	}
+
+	p = alloc_page(GFP_DMA32);
+
+	if (!p) {
+		printk(KERN_WARNING "Failed allocating page\n");
+		return;
+	}
+
+	v = kmap(p);
+	memset(v, 0x67, PAGE_SIZE);
+
+	pfn = (offset >> PAGE_SHIFT);
+
+	ret = psb_mmu_insert_pages(pd, &p, pfn << PAGE_SHIFT, 1, 0, 0,
+				   PSB_MMU_CACHED_MEMORY);
+	if (ret) {
+		printk(KERN_WARNING "Failed inserting mmu page\n");
+		goto out_err1;
+	}
+
+	/* Ioremap the page through the GART aperture */
+
+	vmmu = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
+	if (!vmmu) {
+		printk(KERN_WARNING "Failed ioremapping page\n");
+		goto out_err2;
+	}
+
+	/* Read from the page with mmu disabled. */
+	printk(KERN_INFO "Page first dword is 0x%08x\n", ioread32(vmmu));
+
+	/* Enable the mmu for host accesses and read again. */
+	psb_mmu_enable_requestor(driver, _PSB_MMU_ER_HOST);
+
+	printk(KERN_INFO "MMU Page first dword is (0x67676767) 0x%08x\n",
+	       ioread32(vmmu));
+	*v = 0x15243705;
+	printk(KERN_INFO "MMU Page new dword is (0x15243705) 0x%08x\n",
+	       ioread32(vmmu));
+	iowrite32(0x16243355, vmmu);
+	(void)ioread32(vmmu);
+	printk(KERN_INFO "Page new dword is (0x16243355) 0x%08x\n", *v);
+
+	printk(KERN_INFO "Int stat is 0x%08x\n",
+	       psb_ioread32(driver, PSB_CR_BIF_INT_STAT));
+	printk(KERN_INFO "Fault is 0x%08x\n",
+	       psb_ioread32(driver, PSB_CR_BIF_FAULT));
+
+	/* Disable MMU for host accesses and clear page fault register */
+	psb_mmu_disable_requestor(driver, _PSB_MMU_ER_HOST);
+	iounmap(vmmu);
+      out_err2:
+	psb_mmu_remove_pages(pd, pfn << PAGE_SHIFT, 1, 0, 0);
+      out_err1:
+	kunmap(p);
+	__free_page(p);
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_msvdx.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_msvdx.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,671 @@
+/**
+ * file psb_msvdx.c
+ * MSVDX I/O operations and IRQ handling
+ *
+ */
+
+/**************************************************************************
+ *
+ * Copyright (c) 2007 Intel Corporation, Hillsboro, OR, USA
+ * Copyright (c) Imagination Technologies Limited, UK
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "drmP.h"
+#include "drm_os_linux.h"
+#include "psb_drv.h"
+#include "psb_drm.h"
+#include "psb_msvdx.h"
+
+#include <asm/io.h>
+#include <linux/delay.h>
+
+#ifndef list_first_entry
+#define list_first_entry(ptr, type, member) \
+	list_entry((ptr)->next, type, member)
+#endif
+
+static int psb_msvdx_send (struct drm_device *dev, void *cmd,
+			   unsigned long cmd_size);
+
+int
+psb_msvdx_dequeue_send (struct drm_device *dev)
+{
+  struct drm_psb_private *dev_priv = dev->dev_private;
+  struct psb_msvdx_cmd_queue *msvdx_cmd = NULL;
+  int ret = 0;
+
+  if (list_empty (&dev_priv->msvdx_queue))
+    {
+      PSB_DEBUG_GENERAL ("MSVDXQUE: msvdx list empty.\n");
+      dev_priv->msvdx_busy = 0;
+      return -EINVAL;
+    }
+  msvdx_cmd =
+    list_first_entry (&dev_priv->msvdx_queue, struct psb_msvdx_cmd_queue,
+		      head);
+  PSB_DEBUG_GENERAL ("MSVDXQUE: Queue has id %08x\n", msvdx_cmd->sequence);
+  ret = psb_msvdx_send (dev, msvdx_cmd->cmd, msvdx_cmd->cmd_size);
+  if (ret)
+    {
+      PSB_DEBUG_GENERAL ("MSVDXQUE: psb_msvdx_send failed\n");
+      ret = -EINVAL;
+    }
+  list_del (&msvdx_cmd->head);
+  kfree (msvdx_cmd->cmd);
+  drm_free (msvdx_cmd, sizeof (struct psb_msvdx_cmd_queue), DRM_MEM_DRIVER);
+  return ret;
+}
+
+int
+psb_msvdx_map_command (struct drm_device *dev,
+		       struct drm_buffer_object *cmd_buffer,
+		       unsigned long cmd_offset, unsigned long cmd_size,
+		       void **msvdx_cmd, uint32_t sequence, int copy_cmd)
+{
+  struct drm_psb_private *dev_priv = dev->dev_private;
+  int ret = 0;
+  unsigned long cmd_page_offset = cmd_offset & ~PAGE_MASK;
+  unsigned long cmd_size_remaining;
+  struct drm_bo_kmap_obj cmd_kmap;
+  void *cmd, *tmp, *cmd_start;
+  int is_iomem;
+
+  /* command buffers may not exceed page boundary */
+  if (cmd_size + cmd_page_offset > PAGE_SIZE)
+    return -EINVAL;
+
+  ret = drm_bo_kmap (cmd_buffer, cmd_offset >> PAGE_SHIFT, 2, &cmd_kmap);
+
+  if (ret)
+    {
+      PSB_DEBUG_GENERAL ("MSVDXQUE:ret:%d\n", ret);
+      return ret;
+    }
+
+  cmd_start =
+    (void *) drm_bmo_virtual (&cmd_kmap, &is_iomem) + cmd_page_offset;
+  cmd = cmd_start;
+  cmd_size_remaining = cmd_size;
+
+  while (cmd_size_remaining > 0)
+    {
+      uint32_t mmu_ptd;
+      uint32_t cur_cmd_size = MEMIO_READ_FIELD (cmd, FWRK_GENMSG_SIZE);
+      uint32_t cur_cmd_id = MEMIO_READ_FIELD (cmd, FWRK_GENMSG_ID);
+      PSB_DEBUG_GENERAL
+	("cmd start at %08x cur_cmd_size = %d cur_cmd_id = %02x fence = %08x\n",
+	 (uint32_t) cmd, cur_cmd_size, cur_cmd_id, sequence);
+      if ((cur_cmd_size % sizeof (uint32_t))
+	  || (cur_cmd_size > cmd_size_remaining))
+	{
+	  ret = -EINVAL;
+	  PSB_DEBUG_GENERAL ("MSVDX: ret:%d\n", ret);
+	  goto out;
+	}
+
+      switch (cur_cmd_id)
+	{
+	case VA_MSGID_RENDER:
+	  /* Fence ID */
+	  MEMIO_WRITE_FIELD (cmd, FW_VA_RENDER_FENCE_VALUE, sequence);
+
+	  mmu_ptd = psb_get_default_pd_addr (dev_priv->mmu);
+          if (atomic_cmpxchg(&dev_priv->msvdx_mmu_invaldc, 1, 0) == 1)
+            {
+                mmu_ptd |= 1;
+                PSB_DEBUG_GENERAL ("MSVDX: Setting MMU invalidate flag\n");
+	    }
+	  /* PTD */
+	  MEMIO_WRITE_FIELD (cmd, FW_VA_RENDER_MMUPTD, mmu_ptd);
+	  break;
+
+	default:
+	  /* Msg not supported */
+	  ret = -EINVAL;
+	  PSB_DEBUG_GENERAL ("MSVDX: ret:%d\n", ret);
+	  goto out;
+	}
+
+      cmd += cur_cmd_size;
+      cmd_size_remaining -= cur_cmd_size;
+    }
+
+  if (copy_cmd)
+    {
+      PSB_DEBUG_GENERAL
+	("MSVDXQUE: psb_msvdx_map_command copying command...\n");
+      tmp = drm_calloc (1, cmd_size, DRM_MEM_DRIVER);
+      if (tmp == NULL)
+	{
+	  ret = -ENOMEM;
+	  PSB_DEBUG_GENERAL ("MSVDX: ret:%d\n", ret);
+	  goto out;
+	}
+      memcpy (tmp, cmd_start, cmd_size);
+      *msvdx_cmd = tmp;
+    }
+  else
+    {
+      PSB_DEBUG_GENERAL
+	("MSVDXQUE: psb_msvdx_map_command did NOT copy command...\n");
+      ret = psb_msvdx_send (dev, cmd_start, cmd_size);
+      if (ret)
+	{
+	  PSB_DEBUG_GENERAL ("MSVDXQUE: psb_msvdx_send failed\n");
+	  ret = -EINVAL;
+	}
+    }
+
+out:
+  drm_bo_kunmap (&cmd_kmap);
+
+  return ret;
+}
+
+int
+psb_submit_video_cmdbuf (struct drm_device *dev,
+			 struct drm_buffer_object *cmd_buffer,
+			 unsigned long cmd_offset, unsigned long cmd_size,
+			 struct drm_fence_object *fence)
+{
+  struct drm_psb_private *dev_priv = dev->dev_private;
+  uint32_t sequence = fence->sequence;
+  unsigned long irq_flags;
+  int ret = 0;
+
+  mutex_lock (&dev_priv->msvdx_mutex);
+  psb_schedule_watchdog (dev_priv);
+
+  spin_lock_irqsave (&dev_priv->msvdx_lock, irq_flags);
+  if (dev_priv->msvdx_needs_reset)
+    {
+      spin_unlock_irqrestore (&dev_priv->msvdx_lock, irq_flags);
+      PSB_DEBUG_GENERAL ("MSVDX: Needs reset\n");
+      if (psb_msvdx_reset (dev_priv))
+	{
+	  mutex_unlock (&dev_priv->msvdx_mutex);
+	  ret = -EBUSY;
+	  PSB_DEBUG_GENERAL ("MSVDX: Reset failed\n");
+	  return ret;
+	}
+      PSB_DEBUG_GENERAL ("MSVDX: Reset ok\n");
+      dev_priv->msvdx_needs_reset = 0;
+      dev_priv->msvdx_busy = 0;
+      dev_priv->msvdx_start_idle = 0;
+
+      psb_msvdx_init (dev);
+      psb_msvdx_irq_preinstall (dev_priv);
+      psb_msvdx_irq_postinstall (dev_priv);
+      PSB_DEBUG_GENERAL ("MSVDX: Init ok\n");
+      spin_lock_irqsave (&dev_priv->msvdx_lock, irq_flags);
+    }
+
+  if (!dev_priv->msvdx_busy)
+    {
+      dev_priv->msvdx_busy = 1;
+      spin_unlock_irqrestore (&dev_priv->msvdx_lock, irq_flags);
+      PSB_DEBUG_GENERAL
+	("MSVDXQUE: nothing in the queue sending sequence:%08x..\n",
+	 sequence);
+      ret =
+	psb_msvdx_map_command (dev, cmd_buffer, cmd_offset, cmd_size,
+			       NULL, sequence, 0);
+      if (ret)
+	{
+	  mutex_unlock (&dev_priv->msvdx_mutex);
+	  PSB_DEBUG_GENERAL ("MSVDXQUE: Failed to extract cmd...\n");
+	  return ret;
+	}
+    }
+  else
+    {
+      struct psb_msvdx_cmd_queue *msvdx_cmd;
+      void *cmd = NULL;
+
+      spin_unlock_irqrestore (&dev_priv->msvdx_lock, irq_flags);
+      /*queue the command to be sent when the h/w is ready */
+      PSB_DEBUG_GENERAL ("MSVDXQUE: queueing sequence:%08x..\n", sequence);
+      msvdx_cmd =
+	drm_calloc (1, sizeof (struct psb_msvdx_cmd_queue), DRM_MEM_DRIVER);
+      if (msvdx_cmd == NULL)
+	{
+	  mutex_unlock (&dev_priv->msvdx_mutex);
+	  PSB_DEBUG_GENERAL ("MSVDXQUE: Out of memory...\n");
+	  return -ENOMEM;
+	}
+
+      ret =
+	psb_msvdx_map_command (dev, cmd_buffer, cmd_offset, cmd_size,
+			       &cmd, sequence, 1);
+      if (ret)
+	{
+	  mutex_unlock (&dev_priv->msvdx_mutex);
+	  PSB_DEBUG_GENERAL ("MSVDXQUE: Failed to extract cmd...\n");
+	  drm_free (msvdx_cmd, sizeof (struct psb_msvdx_cmd_queue),
+		    DRM_MEM_DRIVER);
+	  return ret;
+	}
+      msvdx_cmd->cmd = cmd;
+      msvdx_cmd->cmd_size = cmd_size;
+      msvdx_cmd->sequence = sequence;
+      spin_lock_irqsave (&dev_priv->msvdx_lock, irq_flags);
+      list_add_tail (&msvdx_cmd->head, &dev_priv->msvdx_queue);
+      if (!dev_priv->msvdx_busy)
+	{
+	  dev_priv->msvdx_busy = 1;
+	  PSB_DEBUG_GENERAL ("MSVDXQUE: Need immediate dequeue\n");
+	  psb_msvdx_dequeue_send (dev);
+	}
+      spin_unlock_irqrestore (&dev_priv->msvdx_lock, irq_flags);
+    }
+  mutex_unlock (&dev_priv->msvdx_mutex);
+  return ret;
+}
+
+int
+psb_msvdx_send (struct drm_device *dev, void *cmd, unsigned long cmd_size)
+{
+  int ret = 0;
+  struct drm_psb_private *dev_priv = dev->dev_private;
+
+  while (cmd_size > 0)
+    {
+      uint32_t cur_cmd_size = MEMIO_READ_FIELD (cmd, FWRK_GENMSG_SIZE);
+      if (cur_cmd_size > cmd_size)
+	{
+	  ret = -EINVAL;
+	  PSB_DEBUG_GENERAL
+	    ("MSVDX: cmd_size = %d cur_cmd_size = %d\n",
+	     (int) cmd_size, cur_cmd_size);
+	  goto out;
+	}
+      /* Send the message to h/w */
+      ret = psb_mtx_send (dev_priv, cmd);
+      if (ret)
+	{
+	  PSB_DEBUG_GENERAL ("MSVDX: ret:%d\n", ret);
+	  goto out;
+	}
+      cmd += cur_cmd_size;
+      cmd_size -= cur_cmd_size;
+    }
+
+out:
+  PSB_DEBUG_GENERAL ("MSVDX: ret:%d\n", ret);
+  return ret;
+}
+
+int
+psb_mtx_send (struct drm_psb_private *dev_priv, const void *pvMsg)
+{
+
+  static uint32_t padMessage[FWRK_PADMSG_SIZE];
+
+  const uint32_t *pui32Msg = (uint32_t *) pvMsg;
+  uint32_t msgNumWords, wordsFree, readIndex, writeIndex;
+  int ret = 0;
+
+  PSB_DEBUG_GENERAL ("MSVDX: psb_mtx_send\n");
+
+  /* we need clocks enabled before we touch VEC local ram */
+  PSB_WMSVDX32 (clk_enable_all, MSVDX_MAN_CLK_ENABLE);
+
+  msgNumWords = (MEMIO_READ_FIELD (pvMsg, FWRK_GENMSG_SIZE) + 3) / 4;
+
+  if (msgNumWords > NUM_WORDS_MTX_BUF)
+    {
+      ret = -EINVAL;
+      PSB_DEBUG_GENERAL ("MSVDX: ret:%d\n", ret);
+      goto out;
+    }
+
+  readIndex = PSB_RMSVDX32 (MSVDX_COMMS_TO_MTX_RD_INDEX);
+  writeIndex = PSB_RMSVDX32 (MSVDX_COMMS_TO_MTX_WRT_INDEX);
+
+  if (writeIndex + msgNumWords > NUM_WORDS_MTX_BUF)
+    {				/* message would wrap, need to send a pad message */
+      BUG_ON (MEMIO_READ_FIELD (pvMsg, FWRK_GENMSG_ID) == FWRK_MSGID_PADDING);	/* Shouldn't happen for a PAD message itself */
+      /* if the read pointer is at zero then we must wait for it to change otherwise the write
+       * pointer will equal the read pointer,which should only happen when the buffer is empty
+       *
+       * This will only happens if we try to overfill the queue, queue management should make
+       * sure this never happens in the first place.
+       */
+      BUG_ON (0 == readIndex);
+      if (0 == readIndex)
+	{
+	  ret = -EINVAL;
+	  PSB_DEBUG_GENERAL ("MSVDX: ret:%d\n", ret);
+	  goto out;
+	}
+      /* Send a pad message */
+      MEMIO_WRITE_FIELD (padMessage, FWRK_GENMSG_SIZE,
+			 (NUM_WORDS_MTX_BUF - writeIndex) << 2);
+      MEMIO_WRITE_FIELD (padMessage, FWRK_GENMSG_ID, FWRK_MSGID_PADDING);
+      psb_mtx_send (dev_priv, padMessage);
+      writeIndex = PSB_RMSVDX32 (MSVDX_COMMS_TO_MTX_WRT_INDEX);
+    }
+
+  wordsFree =
+    (writeIndex >=
+     readIndex) ? NUM_WORDS_MTX_BUF - (writeIndex -
+				       readIndex) : readIndex - writeIndex;
+
+  BUG_ON (msgNumWords > wordsFree);
+  if (msgNumWords > wordsFree)
+    {
+      ret = -EINVAL;
+      PSB_DEBUG_GENERAL ("MSVDX: ret:%d\n", ret);
+      goto out;
+    }
+
+  while (msgNumWords > 0)
+    {
+      PSB_WMSVDX32 (*pui32Msg++, MSVDX_COMMS_TO_MTX_BUF + (writeIndex << 2));
+      msgNumWords--;
+      writeIndex++;
+      if (NUM_WORDS_MTX_BUF == writeIndex)
+	{
+	  writeIndex = 0;
+	}
+    }
+  PSB_WMSVDX32 (writeIndex, MSVDX_COMMS_TO_MTX_WRT_INDEX);
+
+  /* Make sure clocks are enabled before we kick */
+  PSB_WMSVDX32 (clk_enable_all, MSVDX_MAN_CLK_ENABLE);
+
+  /* signal an interrupt to let the mtx know there is a new message */
+  PSB_WMSVDX32 (1, MSVDX_MTX_KICKI);
+
+out:
+  return ret;
+}
+
+/*
+ * MSVDX MTX interrupt
+ */
+void
+psb_msvdx_mtx_interrupt (struct drm_device *dev)
+{
+  static uint32_t msgBuffer[128];
+  uint32_t readIndex, writeIndex;
+  uint32_t msgNumWords, msgWordOffset;
+  struct drm_psb_private *dev_priv =
+    (struct drm_psb_private *) dev->dev_private;
+
+  /* Are clocks enabled  - If not enable before attempting to read from VLR */
+  if (PSB_RMSVDX32 (MSVDX_MAN_CLK_ENABLE) != (clk_enable_all))
+    {
+      PSB_DEBUG_GENERAL
+	("MSVDX: Warning - Clocks disabled when Interupt set\n");
+      PSB_WMSVDX32 (clk_enable_all, MSVDX_MAN_CLK_ENABLE);
+    }
+
+  for (;;)
+    {
+      readIndex = PSB_RMSVDX32 (MSVDX_COMMS_TO_HOST_RD_INDEX);
+      writeIndex = PSB_RMSVDX32 (MSVDX_COMMS_TO_HOST_WRT_INDEX);
+
+      if (readIndex != writeIndex)
+	{
+	  msgWordOffset = 0;
+
+	  msgBuffer[msgWordOffset] =
+	    PSB_RMSVDX32 (MSVDX_COMMS_TO_HOST_BUF + (readIndex << 2));
+
+	  msgNumWords = (MEMIO_READ_FIELD (msgBuffer, FWRK_GENMSG_SIZE) + 3) / 4;	/* round to nearest word */
+
+	  /*ASSERT(msgNumWords <= sizeof(msgBuffer) / sizeof(uint32_t)); */
+
+	  if (++readIndex >= NUM_WORDS_HOST_BUF)
+	    readIndex = 0;
+
+	  for (msgWordOffset++; msgWordOffset < msgNumWords; msgWordOffset++)
+	    {
+	      msgBuffer[msgWordOffset] =
+		PSB_RMSVDX32 (MSVDX_COMMS_TO_HOST_BUF + (readIndex << 2));
+
+	      if (++readIndex >= NUM_WORDS_HOST_BUF)
+		{
+		  readIndex = 0;
+		}
+	    }
+
+	  /* Update the Read index */
+	  PSB_WMSVDX32 (readIndex, MSVDX_COMMS_TO_HOST_RD_INDEX);
+
+	  if (!dev_priv->msvdx_needs_reset)
+	    switch (MEMIO_READ_FIELD (msgBuffer, FWRK_GENMSG_ID))
+	      {
+	      case VA_MSGID_CMD_HW_PANIC:
+	      case VA_MSGID_CMD_FAILED:
+		{
+		  uint32_t ui32Fence = MEMIO_READ_FIELD (msgBuffer,
+							 FW_VA_CMD_FAILED_FENCE_VALUE);
+		  uint32_t ui32FaultStatus = MEMIO_READ_FIELD (msgBuffer,
+							       FW_VA_CMD_FAILED_IRQSTATUS);
+
+		 if(MEMIO_READ_FIELD (msgBuffer, FWRK_GENMSG_ID) == VA_MSGID_CMD_HW_PANIC )
+		  PSB_DEBUG_GENERAL
+		    ("MSVDX: VA_MSGID_CMD_HW_PANIC: Msvdx fault detected - Fence: %08x, Status: %08x - resetting and ignoring error\n",
+		     ui32Fence, ui32FaultStatus);
+		 else
+		  PSB_DEBUG_GENERAL
+		    ("MSVDX: VA_MSGID_CMD_FAILED: Msvdx fault detected - Fence: %08x, Status: %08x - resetting and ignoring error\n",
+		     ui32Fence, ui32FaultStatus);
+
+		  dev_priv->msvdx_needs_reset = 1;
+
+		 if(MEMIO_READ_FIELD (msgBuffer, FWRK_GENMSG_ID) == VA_MSGID_CMD_HW_PANIC)
+                   {
+                     if (dev_priv->
+                         msvdx_current_sequence
+                         - dev_priv->sequence[PSB_ENGINE_VIDEO] > 0x0FFFFFFF)
+                       dev_priv->msvdx_current_sequence++;
+                     PSB_DEBUG_GENERAL
+                       ("MSVDX: Fence ID missing, assuming %08x\n",
+                        dev_priv->msvdx_current_sequence);
+                   }
+		 else
+	           dev_priv->msvdx_current_sequence = ui32Fence;
+
+		  psb_fence_error (dev,
+				   PSB_ENGINE_VIDEO,
+				   dev_priv->
+				   msvdx_current_sequence,
+				   DRM_FENCE_TYPE_EXE, DRM_CMD_FAILED);
+
+		  /* Flush the command queue */
+		  psb_msvdx_flush_cmd_queue (dev);
+
+		  goto isrExit;
+		  break;
+		}
+	      case VA_MSGID_CMD_COMPLETED:
+		{
+		  uint32_t ui32Fence = MEMIO_READ_FIELD (msgBuffer,
+							 FW_VA_CMD_COMPLETED_FENCE_VALUE);
+		  uint32_t ui32Flags =
+		    MEMIO_READ_FIELD (msgBuffer, FW_VA_CMD_COMPLETED_FLAGS);
+
+		  PSB_DEBUG_GENERAL
+		    ("msvdx VA_MSGID_CMD_COMPLETED: FenceID: %08x, flags: 0x%x\n",
+		     ui32Fence, ui32Flags);
+		  dev_priv->msvdx_current_sequence = ui32Fence;
+
+		  psb_fence_handler (dev, PSB_ENGINE_VIDEO);
+
+
+		  if (ui32Flags & FW_VA_RENDER_HOST_INT)
+		    {
+		      /*Now send the next command from the msvdx cmd queue */
+		      psb_msvdx_dequeue_send (dev);
+		      goto isrExit;
+		    }
+		  break;
+		}
+	      case VA_MSGID_ACK:
+		PSB_DEBUG_GENERAL ("msvdx VA_MSGID_ACK\n");
+		break;
+
+	      case VA_MSGID_TEST1:
+		PSB_DEBUG_GENERAL ("msvdx VA_MSGID_TEST1\n");
+		break;
+
+	      case VA_MSGID_TEST2:
+		PSB_DEBUG_GENERAL ("msvdx VA_MSGID_TEST2\n");
+		break;
+		/* Don't need to do anything with these messages */
+
+	      case VA_MSGID_DEBLOCK_REQUIRED:
+		{
+		  uint32_t ui32ContextId = MEMIO_READ_FIELD (msgBuffer,
+							     FW_VA_DEBLOCK_REQUIRED_CONTEXT);
+
+		  /* The BE we now be locked. */
+
+		  /* Unblock rendec by reading the mtx2mtx end of slice */
+		  (void) PSB_RMSVDX32 (MSVDX_RENDEC_READ_DATA);
+
+		  PSB_DEBUG_GENERAL
+		    ("msvdx VA_MSGID_DEBLOCK_REQUIRED Context=%08x\n",
+		     ui32ContextId);
+		  goto isrExit;
+		  break;
+		}
+
+	      default:
+		{
+		  PSB_DEBUG_GENERAL
+		    ("ERROR: msvdx Unknown message from MTX \n");
+		}
+		break;
+
+	      }
+	}
+      else
+	{
+	  /* Get out of here if nothing */
+	  break;
+	}
+    }
+isrExit:
+
+#if 1
+  if (!dev_priv->msvdx_busy)
+  {
+    /* check that clocks are enabled before reading VLR */
+    if( PSB_RMSVDX32( MSVDX_MAN_CLK_ENABLE ) != (clk_enable_all) )
+        PSB_WMSVDX32 (clk_enable_all, MSVDX_MAN_CLK_ENABLE);
+
+   /* If the firmware says the hardware is idle and the CCB is empty then we can power down */
+   {
+   uint32_t ui32FWStatus = PSB_RMSVDX32( MSVDX_COMMS_FW_STATUS );
+   uint32_t ui32CCBRoff = PSB_RMSVDX32 ( MSVDX_COMMS_TO_MTX_RD_INDEX );
+   uint32_t ui32CCBWoff = PSB_RMSVDX32 ( MSVDX_COMMS_TO_MTX_WRT_INDEX );
+
+   if( (ui32FWStatus & MSVDX_FW_STATUS_HW_IDLE) && (ui32CCBRoff == ui32CCBWoff))
+   {
+	PSB_DEBUG_GENERAL("MSVDX_CLOCK: Setting clock to minimal...\n");
+        PSB_WMSVDX32 (clk_enable_minimal, MSVDX_MAN_CLK_ENABLE);
+   }
+   }
+   }
+#endif
+  DRM_MEMORYBARRIER ();
+}
+
+void
+psb_msvdx_lockup (struct drm_psb_private *dev_priv,
+		  int *msvdx_lockup, int *msvdx_idle)
+{
+	unsigned long irq_flags;
+//	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+
+  spin_lock_irqsave (&dev_priv->msvdx_lock, irq_flags);
+  *msvdx_lockup = 0;
+  *msvdx_idle = 1;
+
+  if (!dev_priv->has_msvdx)
+  {
+      spin_unlock_irqrestore (&dev_priv->msvdx_lock, irq_flags);
+      return;
+  }
+#if 0
+  PSB_DEBUG_GENERAL ("MSVDXTimer: current_sequence:%d "
+		     "last_sequence:%d and last_submitted_sequence :%d\n",
+		     dev_priv->msvdx_current_sequence,
+		     dev_priv->msvdx_last_sequence,
+		     dev_priv->sequence[PSB_ENGINE_VIDEO]);
+#endif
+  if (dev_priv->msvdx_current_sequence -
+      dev_priv->sequence[PSB_ENGINE_VIDEO] > 0x0FFFFFFF)
+    {
+
+      if (dev_priv->msvdx_current_sequence == dev_priv->msvdx_last_sequence)
+	{
+	  PSB_DEBUG_GENERAL
+	    ("MSVDXTimer: msvdx locked-up for sequence:%d\n",
+	     dev_priv->msvdx_current_sequence);
+	  *msvdx_lockup = 1;
+	}
+      else
+	{
+	  PSB_DEBUG_GENERAL ("MSVDXTimer: msvdx responded fine so far...\n");
+	  dev_priv->msvdx_last_sequence = dev_priv->msvdx_current_sequence;
+	  *msvdx_idle = 0;
+	}
+	if (dev_priv->msvdx_start_idle)
+		dev_priv->msvdx_start_idle = 0;
+    }
+    else
+    {
+	if (dev_priv->msvdx_needs_reset == 0)
+	{
+	    if (dev_priv->msvdx_start_idle && (dev_priv->msvdx_finished_sequence == dev_priv->msvdx_current_sequence))
+	    {
+		//if (dev_priv->msvdx_idle_start_jiffies + MSVDX_MAX_IDELTIME >= jiffies)
+		if (time_after_eq(jiffies, dev_priv->msvdx_idle_start_jiffies + MSVDX_MAX_IDELTIME))
+		{
+		    printk("set the msvdx clock to 0 in the %s\n", __FUNCTION__);
+      		    PSB_WMSVDX32 (0, MSVDX_MAN_CLK_ENABLE);
+		    dev_priv->msvdx_needs_reset = 1;
+		}
+		else
+		{
+		    *msvdx_idle = 0;
+		}
+	    }
+	    else
+	    {
+		dev_priv->msvdx_start_idle = 1;
+		dev_priv->msvdx_idle_start_jiffies = jiffies;
+		dev_priv->msvdx_finished_sequence = dev_priv->msvdx_current_sequence;
+		*msvdx_idle = 0;
+	    }
+	}
+    }
+    spin_unlock_irqrestore (&dev_priv->msvdx_lock, irq_flags);
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_msvdx.h
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_msvdx.h	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,564 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2007 Intel Corporation, Hillsboro, OR, USA
+ * Copyright (c) Imagination Technologies Limited, UK
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#ifndef _PSB_MSVDX_H_
+#define _PSB_MSVDX_H_
+
+#define assert(expr) \
+        if(unlikely(!(expr))) {                                   \
+        printk(KERN_ERR "Assertion failed! %s,%s,%s,line=%d\n", \
+        #expr,__FILE__,__FUNCTION__,__LINE__);          \
+        }
+
+#define PSB_ASSERT(x) assert (x)
+#define IMG_ASSERT(x) assert (x)
+
+#include "psb_drv.h"
+int
+psb_wait_for_register (struct drm_psb_private *dev_priv,
+                       uint32_t ui32Offset,
+                       uint32_t ui32Value, uint32_t ui32Enable);
+
+void psb_msvdx_mtx_interrupt (struct drm_device *dev);
+int psb_msvdx_init (struct drm_device *dev);
+int psb_msvdx_uninit (struct drm_device *dev);
+int psb_msvdx_reset (struct drm_psb_private *dev_priv);
+uint32_t psb_get_default_pd_addr (struct psb_mmu_driver *driver);
+int psb_mtx_send (struct drm_psb_private *dev_priv, const void *pvMsg);
+void psb_msvdx_irq_preinstall (struct drm_psb_private *dev_priv);
+void psb_msvdx_irq_postinstall (struct drm_psb_private *dev_priv);
+void psb_msvdx_flush_cmd_queue (struct drm_device *dev);
+extern void psb_msvdx_lockup (struct drm_psb_private *dev_priv,
+			      int *msvdx_lockup, int *msvdx_idle);
+#define MSVDX_DEVICE_NODE_FLAGS_MMU_NONOPT_INV	2	/*  Non-Optimal Invalidation is not default */
+#define FW_VA_RENDER_HOST_INT		0x00004000
+#define MSVDX_DEVICE_NODE_FLAGS_MMU_HW_INVALIDATION	0x00000020
+
+#define MSVDX_DEVICE_NODE_FLAG_BRN23154_BLOCK_ON_FE	0x00000200
+
+#define MSVDX_DEVICE_NODE_FLAGS_DEFAULT_D0 (MSVDX_DEVICE_NODE_FLAGS_MMU_NONOPT_INV | MSVDX_DEVICE_NODE_FLAGS_MMU_HW_INVALIDATION \
+						| MSVDX_DEVICE_NODE_FLAG_BRN23154_BLOCK_ON_FE)
+#define MSVDX_DEVICE_NODE_FLAGS_DEFAULT_D1 (MSVDX_DEVICE_NODE_FLAGS_MMU_HW_INVALIDATION \
+                                                | MSVDX_DEVICE_NODE_FLAG_BRN23154_BLOCK_ON_FE)
+
+
+#define POULSBO_D0	0x5
+#define POULSBO_D1	0x6
+#define PSB_REVID_OFFSET 0x8
+
+#define MSVDX_FW_STATUS_HW_IDLE	0x00000001 /* There is no work currently underway on the hardware*/
+
+#define clk_enable_all		MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_CORE_MAN_CLK_ENABLE_MASK			|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDEB_PROCESS_MAN_CLK_ENABLE_MASK	|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDEB_ACCESS_MAN_CLK_ENABLE_MASK	|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDMC_MAN_CLK_ENABLE_MASK			|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VEC_ENTDEC_MAN_CLK_ENABLE_MASK	|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VEC_ITRANS_MAN_CLK_ENABLE_MASK	|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_MTX_MAN_CLK_ENABLE_MASK
+
+#define clk_enable_minimal	MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_CORE_MAN_CLK_ENABLE_MASK | \
+				MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_MTX_MAN_CLK_ENABLE_MASK
+
+#define clk_enable_auto		MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDEB_PROCESS_AUTO_CLK_ENABLE_MASK	|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDEB_ACCESS_AUTO_CLK_ENABLE_MASK	|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDMC_AUTO_CLK_ENABLE_MASK			|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VEC_ENTDEC_AUTO_CLK_ENABLE_MASK	|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VEC_ITRANS_AUTO_CLK_ENABLE_MASK	|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_CORE_MAN_CLK_ENABLE_MASK			|		\
+							MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_MTX_MAN_CLK_ENABLE_MASK
+
+#define msvdx_sw_reset_all	MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_SOFT_RESET_MASK					|		\
+							MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_FE_SOFT_RESET_MASK					|		\
+							MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_BE_SOFT_RESET_MASK					|		\
+							MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_VEC_MEMIF_SOFT_RESET_MASK			|		\
+							MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_VEC_RENDEC_DEC_SOFT_RESET_MASK
+
+
+#define PCI_PORT5_REG80_FFUSE                           0xD0058000
+#define MTX_CODE_BASE		(0x80900000)
+#define MTX_DATA_BASE		(0x82880000)
+#define PC_START_ADDRESS	(0x80900000)
+
+#define MTX_CORE_CODE_MEM			(0x10 )
+#define MTX_CORE_DATA_MEM			(0x18 )
+
+#define MTX_INTERNAL_REG( R_SPECIFIER , U_SPECIFIER )		( ((R_SPECIFIER)<<4) | (U_SPECIFIER) )
+#define MTX_PC			MTX_INTERNAL_REG( 0 , 5 )
+
+#define RENDEC_A_SIZE	( 2 * 1024* 1024 )
+#define RENDEC_B_SIZE	( RENDEC_A_SIZE / 4 )
+
+#define MEMIO_READ_FIELD(vpMem, field)																				    \
+	((uint32_t)(((*((field##_TYPE *)(((uint32_t)vpMem) + field##_OFFSET))) & field##_MASK) >> field##_SHIFT))
+
+#define MEMIO_WRITE_FIELD(vpMem, field, ui32Value)														\
+	(*((field##_TYPE *)(((uint32_t)vpMem) + field##_OFFSET))) =										\
+	((*((field##_TYPE *)(((uint32_t)vpMem) + field##_OFFSET))) & (field##_TYPE)~field##_MASK) |		\
+		(field##_TYPE)(( (uint32_t) (ui32Value) << field##_SHIFT) & field##_MASK);
+
+#define MEMIO_WRITE_FIELD_LITE(vpMem, field, ui32Value)													\
+	 (*((field##_TYPE *)(((uint32_t)vpMem) + field##_OFFSET))) =										\
+	((*((field##_TYPE *)(((uint32_t)vpMem) + field##_OFFSET))) |		                                \
+		(field##_TYPE) (( (uint32_t) (ui32Value) << field##_SHIFT)) );
+
+#define REGIO_READ_FIELD(ui32RegValue, reg, field)							\
+	((ui32RegValue & reg##_##field##_MASK) >> reg##_##field##_SHIFT)
+
+#define REGIO_WRITE_FIELD(ui32RegValue, reg, field, ui32Value)					\
+	(ui32RegValue) =									\
+	((ui32RegValue) & ~(reg##_##field##_MASK)) |						\
+		(((ui32Value) << (reg##_##field##_SHIFT)) & (reg##_##field##_MASK));
+
+#define REGIO_WRITE_FIELD_LITE(ui32RegValue, reg, field, ui32Value)				\
+	(ui32RegValue) =									\
+	( (ui32RegValue) | ( (ui32Value) << (reg##_##field##_SHIFT) ) );
+
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_CORE_MAN_CLK_ENABLE_MASK		(0x00000001)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDEB_PROCESS_MAN_CLK_ENABLE_MASK		(0x00000002)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDEB_ACCESS_MAN_CLK_ENABLE_MASK		(0x00000004)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDMC_MAN_CLK_ENABLE_MASK		(0x00000008)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VEC_ENTDEC_MAN_CLK_ENABLE_MASK		(0x00000010)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VEC_ITRANS_MAN_CLK_ENABLE_MASK		(0x00000020)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_MTX_MAN_CLK_ENABLE_MASK		(0x00000040)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDEB_ACCESS_AUTO_CLK_ENABLE_MASK		(0x00040000)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VDMC_AUTO_CLK_ENABLE_MASK		(0x00080000)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VEC_ENTDEC_AUTO_CLK_ENABLE_MASK		(0x00100000)
+#define MSVDX_CORE_CR_MSVDX_MAN_CLK_ENABLE_CR_VEC_ITRANS_AUTO_CLK_ENABLE_MASK		(0x00200000)
+#define MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_SOFT_RESET_MASK		(0x00000100)
+#define MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_FE_SOFT_RESET_MASK		(0x00010000)
+#define MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_BE_SOFT_RESET_MASK		(0x00100000)
+#define MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_VEC_MEMIF_SOFT_RESET_MASK		(0x01000000)
+#define MSVDX_CORE_CR_MSVDX_CONTROL_CR_MSVDX_VEC_RENDEC_DEC_SOFT_RESET_MASK		(0x10000000)
+
+/* MTX registers */
+#define MSVDX_MTX_ENABLE		(0x0000)
+#define MSVDX_MTX_KICKI			(0x0088)
+#define MSVDX_MTX_REGISTER_READ_WRITE_REQUEST	(0x00FC)
+#define MSVDX_MTX_REGISTER_READ_WRITE_DATA	(0x00F8)
+#define MSVDX_MTX_RAM_ACCESS_DATA_TRANSFER	(0x0104)
+#define MSVDX_MTX_RAM_ACCESS_CONTROL	(0x0108)
+#define MSVDX_MTX_RAM_ACCESS_STATUS	(0x010C)
+#define MSVDX_MTX_SOFT_RESET		(0x0200)
+
+/* MSVDX registers */
+#define MSVDX_CONTROL			(0x0600)
+#define MSVDX_INTERRUPT_CLEAR		(0x060C)
+#define MSVDX_INTERRUPT_STATUS		(0x0608)
+#define MSVDX_HOST_INTERRUPT_ENABLE	(0x0610)
+#define MSVDX_MMU_CONTROL0		(0x0680)
+#define MSVDX_MTX_RAM_BANK		(0x06F0)
+#define MSVDX_MAN_CLK_ENABLE		(0x0620)
+
+/* RENDEC registers */
+#define MSVDX_RENDEC_CONTROL0		(0x0868)
+#define MSVDX_RENDEC_CONTROL1		(0x086C)
+#define MSVDX_RENDEC_BUFFER_SIZE	(0x0870)
+#define MSVDX_RENDEC_BASE_ADDR0		(0x0874)
+#define MSVDX_RENDEC_BASE_ADDR1		(0x0878)
+#define MSVDX_RENDEC_READ_DATA		(0x0898)
+#define MSVDX_RENDEC_CONTEXT0		(0x0950)
+#define MSVDX_RENDEC_CONTEXT1		(0x0954)
+#define MSVDX_RENDEC_CONTEXT2		(0x0958)
+#define MSVDX_RENDEC_CONTEXT3		(0x095C)
+#define MSVDX_RENDEC_CONTEXT4		(0x0960)
+#define MSVDX_RENDEC_CONTEXT5		(0x0964)
+
+/*
+ * This defines the MSVDX communication buffer
+ */
+#define MSVDX_COMMS_SIGNATURE_VALUE	(0xA5A5A5A5)	/*!< Signature value */
+#define NUM_WORDS_HOST_BUF		(100)	/*!< Host buffer size (in 32-bit words) */
+#define NUM_WORDS_MTX_BUF		(100)	/*!< MTX buffer size (in 32-bit words) */
+
+#define MSVDX_COMMS_AREA_ADDR (0x02cc0)
+
+#define MSVDX_COMMS_FW_STATUS			(MSVDX_COMMS_AREA_ADDR - 0x10)
+#define	MSVDX_COMMS_SCRATCH				(MSVDX_COMMS_AREA_ADDR - 0x08)
+#define	MSVDX_COMMS_MSG_COUNTER			(MSVDX_COMMS_AREA_ADDR - 0x04)
+#define	MSVDX_COMMS_SIGNATURE			(MSVDX_COMMS_AREA_ADDR + 0x00)
+#define	MSVDX_COMMS_TO_HOST_BUF_SIZE	(MSVDX_COMMS_AREA_ADDR + 0x04)
+#define MSVDX_COMMS_TO_HOST_RD_INDEX	(MSVDX_COMMS_AREA_ADDR + 0x08)
+#define MSVDX_COMMS_TO_HOST_WRT_INDEX	(MSVDX_COMMS_AREA_ADDR + 0x0C)
+#define MSVDX_COMMS_TO_MTX_BUF_SIZE		(MSVDX_COMMS_AREA_ADDR + 0x10)
+#define MSVDX_COMMS_TO_MTX_RD_INDEX		(MSVDX_COMMS_AREA_ADDR + 0x14)
+#define MSVDX_COMMS_OFFSET_FLAGS		(MSVDX_COMMS_AREA_ADDR + 0x18)
+#define MSVDX_COMMS_TO_MTX_WRT_INDEX	(MSVDX_COMMS_AREA_ADDR + 0x1C)
+#define MSVDX_COMMS_TO_HOST_BUF			(MSVDX_COMMS_AREA_ADDR + 0x20)
+#define MSVDX_COMMS_TO_MTX_BUF			(MSVDX_COMMS_TO_HOST_BUF + (NUM_WORDS_HOST_BUF << 2))
+
+#define MSVDX_COMMS_AREA_END			(MSVDX_COMMS_TO_MTX_BUF + (NUM_WORDS_HOST_BUF << 2))
+
+#if (MSVDX_COMMS_AREA_END != 0x03000)
+#error
+#endif
+
+#define MSVDX_MTX_REGISTER_READ_WRITE_REQUEST_MTX_DREADY_MASK		(0x80000000)
+#define MSVDX_MTX_REGISTER_READ_WRITE_REQUEST_MTX_DREADY_SHIFT		(31)
+
+#define MSVDX_MTX_REGISTER_READ_WRITE_REQUEST_MTX_RNW_MASK		(0x00010000)
+#define MSVDX_MTX_REGISTER_READ_WRITE_REQUEST_MTX_RNW_SHIFT		(16)
+
+#define MSVDX_MTX_RAM_ACCESS_CONTROL_MTX_MCMID_MASK		(0x0FF00000)
+#define MSVDX_MTX_RAM_ACCESS_CONTROL_MTX_MCMID_SHIFT		(20)
+
+#define MSVDX_MTX_RAM_ACCESS_CONTROL_MTX_MCM_ADDR_MASK		(0x000FFFFC)
+#define MSVDX_MTX_RAM_ACCESS_CONTROL_MTX_MCM_ADDR_SHIFT		(2)
+
+#define MSVDX_MTX_RAM_ACCESS_CONTROL_MTX_MCMAI_MASK		(0x00000002)
+#define MSVDX_MTX_RAM_ACCESS_CONTROL_MTX_MCMAI_SHIFT		(1)
+
+#define MSVDX_MTX_RAM_ACCESS_CONTROL_MTX_MCMR_MASK		(0x00000001)
+#define MSVDX_MTX_RAM_ACCESS_CONTROL_MTX_MCMR_SHIFT		(0)
+
+#define MSVDX_MTX_SOFT_RESET_MTX_RESET_MASK		(0x00000001)
+#define MSVDX_MTX_SOFT_RESET_MTX_RESET_SHIFT		(0)
+
+#define MSVDX_MTX_ENABLE_MTX_ENABLE_MASK		(0x00000001)
+#define MSVDX_MTX_ENABLE_MTX_ENABLE_SHIFT		(0)
+
+#define MSVDX_CONTROL_CR_MSVDX_SOFT_RESET_MASK		(0x00000100)
+#define MSVDX_CONTROL_CR_MSVDX_SOFT_RESET_SHIFT		(8)
+
+#define MSVDX_INTERRUPT_STATUS_CR_MMU_FAULT_IRQ_MASK		(0x00000F00)
+#define MSVDX_INTERRUPT_STATUS_CR_MMU_FAULT_IRQ_SHIFT		(8)
+
+#define MSVDX_INTERRUPT_STATUS_CR_MTX_IRQ_MASK		(0x00004000)
+#define MSVDX_INTERRUPT_STATUS_CR_MTX_IRQ_SHIFT		(14)
+
+#define MSVDX_MMU_CONTROL0_CR_MMU_PAUSE_MASK			(0x00000002)
+#define MSVDX_MMU_CONTROL0_CR_MMU_PAUSE_SHIFT			(1)
+
+#define MSVDX_MTX_RAM_BANK_CR_MTX_RAM_BANK_SIZE_MASK		(0x000F0000)
+#define MSVDX_MTX_RAM_BANK_CR_MTX_RAM_BANK_SIZE_SHIFT		(16)
+
+#define MSVDX_RENDEC_BUFFER_SIZE_RENDEC_BUFFER_SIZE0_MASK		(0x0000FFFF)
+#define MSVDX_RENDEC_BUFFER_SIZE_RENDEC_BUFFER_SIZE0_SHIFT		(0)
+
+#define MSVDX_RENDEC_BUFFER_SIZE_RENDEC_BUFFER_SIZE1_MASK		(0xFFFF0000)
+#define MSVDX_RENDEC_BUFFER_SIZE_RENDEC_BUFFER_SIZE1_SHIFT		(16)
+
+#define MSVDX_RENDEC_CONTROL1_RENDEC_DECODE_START_SIZE_MASK		(0x000000FF)
+#define MSVDX_RENDEC_CONTROL1_RENDEC_DECODE_START_SIZE_SHIFT		(0)
+
+#define MSVDX_RENDEC_CONTROL1_RENDEC_BURST_SIZE_W_MASK		(0x000C0000)
+#define MSVDX_RENDEC_CONTROL1_RENDEC_BURST_SIZE_W_SHIFT		(18)
+
+#define MSVDX_RENDEC_CONTROL1_RENDEC_BURST_SIZE_R_MASK		(0x00030000)
+#define MSVDX_RENDEC_CONTROL1_RENDEC_BURST_SIZE_R_SHIFT		(16)
+
+#define MSVDX_RENDEC_CONTROL1_RENDEC_EXTERNAL_MEMORY_MASK		(0x01000000)
+#define MSVDX_RENDEC_CONTROL1_RENDEC_EXTERNAL_MEMORY_SHIFT		(24)
+
+#define MSVDX_RENDEC_CONTROL0_RENDEC_INITIALISE_MASK		(0x00000001)
+#define MSVDX_RENDEC_CONTROL0_RENDEC_INITIALISE_SHIFT		(0)
+
+#define	FWRK_MSGID_START_PSR_HOSTMTX_MSG	(0x80)	/*!< Start of parser specific Host->MTX messages. */
+#define	FWRK_MSGID_START_PSR_MTXHOST_MSG	(0xC0)	/*!< Start of parser specific MTX->Host messages. */
+#define FWRK_MSGID_PADDING					( 0 )
+
+#define FWRK_GENMSG_SIZE_TYPE		uint8_t
+#define FWRK_GENMSG_SIZE_MASK		(0xFF)
+#define FWRK_GENMSG_SIZE_SHIFT		(0)
+#define FWRK_GENMSG_SIZE_OFFSET		(0x0000)
+#define FWRK_GENMSG_ID_TYPE		uint8_t
+#define FWRK_GENMSG_ID_MASK		(0xFF)
+#define FWRK_GENMSG_ID_SHIFT		(0)
+#define FWRK_GENMSG_ID_OFFSET		(0x0001)
+#define FWRK_PADMSG_SIZE		(2)
+
+/*!
+******************************************************************************
+ This type defines the framework specified message ids
+******************************************************************************/
+enum
+{
+  /*! Sent by the DXVA driver on the host to the mtx firmware.
+   */
+  VA_MSGID_INIT = FWRK_MSGID_START_PSR_HOSTMTX_MSG,
+  VA_MSGID_RENDER,
+  VA_MSGID_DEBLOCK,
+  VA_MSGID_OOLD,
+
+  /* Test Messages */
+  VA_MSGID_TEST1,
+  VA_MSGID_TEST2,
+
+  /*! Sent by the mtx firmware to itself.
+   */
+  VA_MSGID_RENDER_MC_INTERRUPT,
+
+  /*! Sent by the DXVA firmware on the MTX to the host.
+   */
+  VA_MSGID_CMD_COMPLETED = FWRK_MSGID_START_PSR_MTXHOST_MSG,
+  VA_MSGID_CMD_COMPLETED_BATCH,
+  VA_MSGID_DEBLOCK_REQUIRED,
+  VA_MSGID_TEST_RESPONCE,
+  VA_MSGID_ACK,
+
+  VA_MSGID_CMD_FAILED,
+  VA_MSGID_CMD_UNSUPPORTED,
+  VA_MSGID_CMD_HW_PANIC,
+};
+
+/* MSVDX Firmware interface */
+
+#define FW_VA_RENDER_SIZE		(32)
+
+// FW_VA_RENDER     MSG_SIZE
+#define FW_VA_RENDER_MSG_SIZE_ALIGNMENT		(1)
+#define FW_VA_RENDER_MSG_SIZE_TYPE		uint8_t
+#define FW_VA_RENDER_MSG_SIZE_MASK		(0xFF)
+#define FW_VA_RENDER_MSG_SIZE_LSBMASK		(0xFF)
+#define FW_VA_RENDER_MSG_SIZE_OFFSET		(0x0000)
+#define FW_VA_RENDER_MSG_SIZE_SHIFT		(0)
+
+// FW_VA_RENDER     ID
+#define FW_VA_RENDER_ID_ALIGNMENT		(1)
+#define FW_VA_RENDER_ID_TYPE		uint8_t
+#define FW_VA_RENDER_ID_MASK		(0xFF)
+#define FW_VA_RENDER_ID_LSBMASK		(0xFF)
+#define FW_VA_RENDER_ID_OFFSET		(0x0001)
+#define FW_VA_RENDER_ID_SHIFT		(0)
+
+// FW_VA_RENDER     BUFFER_SIZE
+#define FW_VA_RENDER_BUFFER_SIZE_ALIGNMENT		(2)
+#define FW_VA_RENDER_BUFFER_SIZE_TYPE		uint16_t
+#define FW_VA_RENDER_BUFFER_SIZE_MASK		(0x0FFF)
+#define FW_VA_RENDER_BUFFER_SIZE_LSBMASK		(0x0FFF)
+#define FW_VA_RENDER_BUFFER_SIZE_OFFSET		(0x0002)
+#define FW_VA_RENDER_BUFFER_SIZE_SHIFT		(0)
+
+// FW_VA_RENDER     MMUPTD
+#define FW_VA_RENDER_MMUPTD_ALIGNMENT		(4)
+#define FW_VA_RENDER_MMUPTD_TYPE		uint32_t
+#define FW_VA_RENDER_MMUPTD_MASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_MMUPTD_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_MMUPTD_OFFSET		(0x0004)
+#define FW_VA_RENDER_MMUPTD_SHIFT		(0)
+
+// FW_VA_RENDER     LLDMA_ADDRESS
+#define FW_VA_RENDER_LLDMA_ADDRESS_ALIGNMENT		(4)
+#define FW_VA_RENDER_LLDMA_ADDRESS_TYPE		uint32_t
+#define FW_VA_RENDER_LLDMA_ADDRESS_MASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_LLDMA_ADDRESS_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_LLDMA_ADDRESS_OFFSET		(0x0008)
+#define FW_VA_RENDER_LLDMA_ADDRESS_SHIFT		(0)
+
+// FW_VA_RENDER     CONTEXT
+#define FW_VA_RENDER_CONTEXT_ALIGNMENT		(4)
+#define FW_VA_RENDER_CONTEXT_TYPE		uint32_t
+#define FW_VA_RENDER_CONTEXT_MASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_CONTEXT_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_CONTEXT_OFFSET		(0x000C)
+#define FW_VA_RENDER_CONTEXT_SHIFT		(0)
+
+// FW_VA_RENDER     FENCE_VALUE
+#define FW_VA_RENDER_FENCE_VALUE_ALIGNMENT		(4)
+#define FW_VA_RENDER_FENCE_VALUE_TYPE		uint32_t
+#define FW_VA_RENDER_FENCE_VALUE_MASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_FENCE_VALUE_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_FENCE_VALUE_OFFSET		(0x0010)
+#define FW_VA_RENDER_FENCE_VALUE_SHIFT		(0)
+
+// FW_VA_RENDER     OPERATING_MODE
+#define FW_VA_RENDER_OPERATING_MODE_ALIGNMENT		(4)
+#define FW_VA_RENDER_OPERATING_MODE_TYPE		uint32_t
+#define FW_VA_RENDER_OPERATING_MODE_MASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_OPERATING_MODE_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_OPERATING_MODE_OFFSET		(0x0014)
+#define FW_VA_RENDER_OPERATING_MODE_SHIFT		(0)
+
+// FW_VA_RENDER     FIRST_MB_IN_SLICE
+#define FW_VA_RENDER_FIRST_MB_IN_SLICE_ALIGNMENT		(2)
+#define FW_VA_RENDER_FIRST_MB_IN_SLICE_TYPE		uint16_t
+#define FW_VA_RENDER_FIRST_MB_IN_SLICE_MASK		(0xFFFF)
+#define FW_VA_RENDER_FIRST_MB_IN_SLICE_LSBMASK		(0xFFFF)
+#define FW_VA_RENDER_FIRST_MB_IN_SLICE_OFFSET		(0x0018)
+#define FW_VA_RENDER_FIRST_MB_IN_SLICE_SHIFT		(0)
+
+// FW_VA_RENDER     LAST_MB_IN_FRAME
+#define FW_VA_RENDER_LAST_MB_IN_FRAME_ALIGNMENT		(2)
+#define FW_VA_RENDER_LAST_MB_IN_FRAME_TYPE		uint16_t
+#define FW_VA_RENDER_LAST_MB_IN_FRAME_MASK		(0xFFFF)
+#define FW_VA_RENDER_LAST_MB_IN_FRAME_LSBMASK		(0xFFFF)
+#define FW_VA_RENDER_LAST_MB_IN_FRAME_OFFSET		(0x001A)
+#define FW_VA_RENDER_LAST_MB_IN_FRAME_SHIFT		(0)
+
+// FW_VA_RENDER     FLAGS
+#define FW_VA_RENDER_FLAGS_ALIGNMENT		(4)
+#define FW_VA_RENDER_FLAGS_TYPE		uint32_t
+#define FW_VA_RENDER_FLAGS_MASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_FLAGS_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_RENDER_FLAGS_OFFSET		(0x001C)
+#define FW_VA_RENDER_FLAGS_SHIFT		(0)
+
+#define FW_VA_CMD_COMPLETED_SIZE		(12)
+
+// FW_VA_CMD_COMPLETED     MSG_SIZE
+#define FW_VA_CMD_COMPLETED_MSG_SIZE_ALIGNMENT		(1)
+#define FW_VA_CMD_COMPLETED_MSG_SIZE_TYPE		uint8_t
+#define FW_VA_CMD_COMPLETED_MSG_SIZE_MASK		(0xFF)
+#define FW_VA_CMD_COMPLETED_MSG_SIZE_LSBMASK		(0xFF)
+#define FW_VA_CMD_COMPLETED_MSG_SIZE_OFFSET		(0x0000)
+#define FW_VA_CMD_COMPLETED_MSG_SIZE_SHIFT		(0)
+
+// FW_VA_CMD_COMPLETED     ID
+#define FW_VA_CMD_COMPLETED_ID_ALIGNMENT		(1)
+#define FW_VA_CMD_COMPLETED_ID_TYPE		uint8_t
+#define FW_VA_CMD_COMPLETED_ID_MASK		(0xFF)
+#define FW_VA_CMD_COMPLETED_ID_LSBMASK		(0xFF)
+#define FW_VA_CMD_COMPLETED_ID_OFFSET		(0x0001)
+#define FW_VA_CMD_COMPLETED_ID_SHIFT		(0)
+
+// FW_VA_CMD_COMPLETED     FENCE_VALUE
+#define FW_VA_CMD_COMPLETED_FENCE_VALUE_ALIGNMENT		(4)
+#define FW_VA_CMD_COMPLETED_FENCE_VALUE_TYPE		uint32_t
+#define FW_VA_CMD_COMPLETED_FENCE_VALUE_MASK		(0xFFFFFFFF)
+#define FW_VA_CMD_COMPLETED_FENCE_VALUE_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_CMD_COMPLETED_FENCE_VALUE_OFFSET		(0x0004)
+#define FW_VA_CMD_COMPLETED_FENCE_VALUE_SHIFT		(0)
+
+// FW_VA_CMD_COMPLETED     FLAGS
+#define FW_VA_CMD_COMPLETED_FLAGS_ALIGNMENT		(4)
+#define FW_VA_CMD_COMPLETED_FLAGS_TYPE		uint32_t
+#define FW_VA_CMD_COMPLETED_FLAGS_MASK		(0xFFFFFFFF)
+#define FW_VA_CMD_COMPLETED_FLAGS_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_CMD_COMPLETED_FLAGS_OFFSET		(0x0008)
+#define FW_VA_CMD_COMPLETED_FLAGS_SHIFT		(0)
+
+#define FW_VA_CMD_FAILED_SIZE		(12)
+
+// FW_VA_CMD_FAILED     MSG_SIZE
+#define FW_VA_CMD_FAILED_MSG_SIZE_ALIGNMENT		(1)
+#define FW_VA_CMD_FAILED_MSG_SIZE_TYPE		uint8_t
+#define FW_VA_CMD_FAILED_MSG_SIZE_MASK		(0xFF)
+#define FW_VA_CMD_FAILED_MSG_SIZE_LSBMASK		(0xFF)
+#define FW_VA_CMD_FAILED_MSG_SIZE_OFFSET		(0x0000)
+#define FW_VA_CMD_FAILED_MSG_SIZE_SHIFT		(0)
+
+// FW_VA_CMD_FAILED     ID
+#define FW_VA_CMD_FAILED_ID_ALIGNMENT		(1)
+#define FW_VA_CMD_FAILED_ID_TYPE		uint8_t
+#define FW_VA_CMD_FAILED_ID_MASK		(0xFF)
+#define FW_VA_CMD_FAILED_ID_LSBMASK		(0xFF)
+#define FW_VA_CMD_FAILED_ID_OFFSET		(0x0001)
+#define FW_VA_CMD_FAILED_ID_SHIFT		(0)
+
+// FW_VA_CMD_FAILED     FLAGS
+#define FW_VA_CMD_FAILED_FLAGS_ALIGNMENT		(2)
+#define FW_VA_CMD_FAILED_FLAGS_TYPE		uint16_t
+#define FW_VA_CMD_FAILED_FLAGS_MASK		(0xFFFF)
+#define FW_VA_CMD_FAILED_FLAGS_LSBMASK		(0xFFFF)
+#define FW_VA_CMD_FAILED_FLAGS_OFFSET		(0x0002)
+#define FW_VA_CMD_FAILED_FLAGS_SHIFT		(0)
+
+// FW_VA_CMD_FAILED     FENCE_VALUE
+#define FW_VA_CMD_FAILED_FENCE_VALUE_ALIGNMENT		(4)
+#define FW_VA_CMD_FAILED_FENCE_VALUE_TYPE		uint32_t
+#define FW_VA_CMD_FAILED_FENCE_VALUE_MASK		(0xFFFFFFFF)
+#define FW_VA_CMD_FAILED_FENCE_VALUE_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_CMD_FAILED_FENCE_VALUE_OFFSET		(0x0004)
+#define FW_VA_CMD_FAILED_FENCE_VALUE_SHIFT		(0)
+
+// FW_VA_CMD_FAILED     IRQSTATUS
+#define FW_VA_CMD_FAILED_IRQSTATUS_ALIGNMENT		(4)
+#define FW_VA_CMD_FAILED_IRQSTATUS_TYPE		uint32_t
+#define FW_VA_CMD_FAILED_IRQSTATUS_MASK		(0xFFFFFFFF)
+#define FW_VA_CMD_FAILED_IRQSTATUS_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_CMD_FAILED_IRQSTATUS_OFFSET		(0x0008)
+#define FW_VA_CMD_FAILED_IRQSTATUS_SHIFT		(0)
+
+#define FW_VA_DEBLOCK_REQUIRED_SIZE		(8)
+
+// FW_VA_DEBLOCK_REQUIRED     MSG_SIZE
+#define FW_VA_DEBLOCK_REQUIRED_MSG_SIZE_ALIGNMENT		(1)
+#define FW_VA_DEBLOCK_REQUIRED_MSG_SIZE_TYPE		uint8_t
+#define FW_VA_DEBLOCK_REQUIRED_MSG_SIZE_MASK		(0xFF)
+#define FW_VA_DEBLOCK_REQUIRED_MSG_SIZE_LSBMASK		(0xFF)
+#define FW_VA_DEBLOCK_REQUIRED_MSG_SIZE_OFFSET		(0x0000)
+#define FW_VA_DEBLOCK_REQUIRED_MSG_SIZE_SHIFT		(0)
+
+// FW_VA_DEBLOCK_REQUIRED     ID
+#define FW_VA_DEBLOCK_REQUIRED_ID_ALIGNMENT		(1)
+#define FW_VA_DEBLOCK_REQUIRED_ID_TYPE		uint8_t
+#define FW_VA_DEBLOCK_REQUIRED_ID_MASK		(0xFF)
+#define FW_VA_DEBLOCK_REQUIRED_ID_LSBMASK		(0xFF)
+#define FW_VA_DEBLOCK_REQUIRED_ID_OFFSET		(0x0001)
+#define FW_VA_DEBLOCK_REQUIRED_ID_SHIFT		(0)
+
+// FW_VA_DEBLOCK_REQUIRED     CONTEXT
+#define FW_VA_DEBLOCK_REQUIRED_CONTEXT_ALIGNMENT		(4)
+#define FW_VA_DEBLOCK_REQUIRED_CONTEXT_TYPE		uint32_t
+#define FW_VA_DEBLOCK_REQUIRED_CONTEXT_MASK		(0xFFFFFFFF)
+#define FW_VA_DEBLOCK_REQUIRED_CONTEXT_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_DEBLOCK_REQUIRED_CONTEXT_OFFSET		(0x0004)
+#define FW_VA_DEBLOCK_REQUIRED_CONTEXT_SHIFT		(0)
+
+#define FW_VA_HW_PANIC_SIZE		(12)
+
+// FW_VA_HW_PANIC     FLAGS
+#define FW_VA_HW_PANIC_FLAGS_ALIGNMENT		(2)
+#define FW_VA_HW_PANIC_FLAGS_TYPE		uint16_t
+#define FW_VA_HW_PANIC_FLAGS_MASK		(0xFFFF)
+#define FW_VA_HW_PANIC_FLAGS_LSBMASK		(0xFFFF)
+#define FW_VA_HW_PANIC_FLAGS_OFFSET		(0x0002)
+#define FW_VA_HW_PANIC_FLAGS_SHIFT		(0)
+
+// FW_VA_HW_PANIC     MSG_SIZE
+#define FW_VA_HW_PANIC_MSG_SIZE_ALIGNMENT		(1)
+#define FW_VA_HW_PANIC_MSG_SIZE_TYPE		uint8_t
+#define FW_VA_HW_PANIC_MSG_SIZE_MASK		(0xFF)
+#define FW_VA_HW_PANIC_MSG_SIZE_LSBMASK		(0xFF)
+#define FW_VA_HW_PANIC_MSG_SIZE_OFFSET		(0x0000)
+#define FW_VA_HW_PANIC_MSG_SIZE_SHIFT		(0)
+
+// FW_VA_HW_PANIC     ID
+#define FW_VA_HW_PANIC_ID_ALIGNMENT		(1)
+#define FW_VA_HW_PANIC_ID_TYPE		uint8_t
+#define FW_VA_HW_PANIC_ID_MASK		(0xFF)
+#define FW_VA_HW_PANIC_ID_LSBMASK		(0xFF)
+#define FW_VA_HW_PANIC_ID_OFFSET		(0x0001)
+#define FW_VA_HW_PANIC_ID_SHIFT		(0)
+
+// FW_VA_HW_PANIC     FENCE_VALUE
+#define FW_VA_HW_PANIC_FENCE_VALUE_ALIGNMENT		(4)
+#define FW_VA_HW_PANIC_FENCE_VALUE_TYPE		uint32_t
+#define FW_VA_HW_PANIC_FENCE_VALUE_MASK		(0xFFFFFFFF)
+#define FW_VA_HW_PANIC_FENCE_VALUE_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_HW_PANIC_FENCE_VALUE_OFFSET		(0x0004)
+#define FW_VA_HW_PANIC_FENCE_VALUE_SHIFT		(0)
+
+// FW_VA_HW_PANIC     IRQSTATUS
+#define FW_VA_HW_PANIC_IRQSTATUS_ALIGNMENT		(4)
+#define FW_VA_HW_PANIC_IRQSTATUS_TYPE		uint32_t
+#define FW_VA_HW_PANIC_IRQSTATUS_MASK		(0xFFFFFFFF)
+#define FW_VA_HW_PANIC_IRQSTATUS_LSBMASK		(0xFFFFFFFF)
+#define FW_VA_HW_PANIC_IRQSTATUS_OFFSET		(0x0008)
+#define FW_VA_HW_PANIC_IRQSTATUS_SHIFT		(0)
+
+#endif
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_msvdxinit.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_msvdxinit.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,625 @@
+/**
+ * file psb_msvdxinit.c
+ * MSVDX initialization and mtx-firmware upload
+ *
+ */
+
+/**************************************************************************
+ *
+ * Copyright (c) 2007 Intel Corporation, Hillsboro, OR, USA
+ * Copyright (c) Imagination Technologies Limited, UK
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "drmP.h"
+#include "drm.h"
+#include "psb_drv.h"
+#include "psb_msvdx.h"
+#include <linux/firmware.h>
+
+/*MSVDX FW header*/
+struct msvdx_fw
+{
+  uint32_t ver;
+  uint32_t text_size;
+  uint32_t data_size;
+  uint32_t data_location;
+};
+
+int
+psb_wait_for_register (struct drm_psb_private *dev_priv,
+		       uint32_t ui32Offset,
+		       uint32_t ui32Value, uint32_t ui32Enable)
+{
+  uint32_t ui32Temp;
+  uint32_t ui32PollCount = 1000;
+  while (ui32PollCount)
+    {
+      ui32Temp = PSB_RMSVDX32 (ui32Offset);
+      if (ui32Value == (ui32Temp & ui32Enable))	/* All the bits are reset   */
+	return 0;		/* So exit                      */
+
+      /* Wait a bit */
+      DRM_UDELAY (100);
+      ui32PollCount--;
+    }
+  PSB_DEBUG_GENERAL
+    ("MSVDX: Timeout while waiting for register %08x: expecting %08x (mask %08x), got %08x\n",
+     ui32Offset, ui32Value, ui32Enable, ui32Temp);
+  return 1;
+}
+
+int
+psb_poll_mtx_irq (struct drm_psb_private *dev_priv)
+{
+  int ret = 0;
+  uint32_t MtxInt = 0;
+  REGIO_WRITE_FIELD_LITE (MtxInt, MSVDX_INTERRUPT_STATUS, CR_MTX_IRQ, 1);
+
+  ret = psb_wait_for_register (dev_priv, MSVDX_INTERRUPT_STATUS, MtxInt,	/* Required value */
+			       MtxInt /* Enabled bits */ );
+  if (ret)
+    {
+      PSB_DEBUG_GENERAL
+	("MSVDX: Error Mtx did not return int within a resonable time\n");
+
+      return ret;
+    }
+
+  PSB_DEBUG_GENERAL ("MSVDX: Got MTX Int\n");
+
+  /* Got it so clear the bit */
+  PSB_WMSVDX32 (MtxInt, MSVDX_INTERRUPT_CLEAR);
+
+  return ret;
+}
+
+void
+psb_write_mtx_core_reg (struct drm_psb_private *dev_priv,
+			const uint32_t ui32CoreRegister,
+			const uint32_t ui32Val)
+{
+  uint32_t ui32Reg = 0;
+
+  /* Put data in MTX_RW_DATA */
+  PSB_WMSVDX32 (ui32Val, MSVDX_MTX_REGISTER_READ_WRITE_DATA);
+
+  /* DREADY is set to 0 and request a write */
+  ui32Reg = ui32CoreRegister;
+  REGIO_WRITE_FIELD_LITE (ui32Reg, MSVDX_MTX_REGISTER_READ_WRITE_REQUEST,
+			  MTX_RNW, 0);
+  REGIO_WRITE_FIELD_LITE (ui32Reg, MSVDX_MTX_REGISTER_READ_WRITE_REQUEST,
+			  MTX_DREADY, 0);
+  PSB_WMSVDX32 (ui32Reg, MSVDX_MTX_REGISTER_READ_WRITE_REQUEST);
+
+  psb_wait_for_register (dev_priv, MSVDX_MTX_REGISTER_READ_WRITE_REQUEST, MSVDX_MTX_REGISTER_READ_WRITE_REQUEST_MTX_DREADY_MASK,	/* Required Value */
+			 MSVDX_MTX_REGISTER_READ_WRITE_REQUEST_MTX_DREADY_MASK);
+}
+
+void
+psb_upload_fw (struct drm_psb_private *dev_priv, const uint32_t ui32DataMem,
+	       uint32_t ui32RamBankSize, uint32_t ui32Address,
+	       const unsigned int uiWords, const uint32_t * const pui32Data)
+{
+  uint32_t ui32Loop, ui32Ctrl, ui32RamId, ui32Addr, ui32CurrBank =
+    (uint32_t) ~ 0;
+  uint32_t ui32AccessControl;
+
+  /* Save the access control register... */
+  ui32AccessControl = PSB_RMSVDX32 (MSVDX_MTX_RAM_ACCESS_CONTROL);
+
+  /* Wait for MCMSTAT to become be idle 1 */
+  psb_wait_for_register (dev_priv, MSVDX_MTX_RAM_ACCESS_STATUS, 1,	/* Required Value */
+			 0xffffffff /* Enables */ );
+
+  for (ui32Loop = 0; ui32Loop < uiWords; ui32Loop++)
+    {
+      ui32RamId = ui32DataMem + (ui32Address / ui32RamBankSize);
+
+      if (ui32RamId != ui32CurrBank)
+	{
+	  ui32Addr = ui32Address >> 2;
+
+	  ui32Ctrl = 0;
+
+	  REGIO_WRITE_FIELD_LITE (ui32Ctrl,
+				  MSVDX_MTX_RAM_ACCESS_CONTROL,
+				  MTX_MCMID, ui32RamId);
+	  REGIO_WRITE_FIELD_LITE (ui32Ctrl,
+				  MSVDX_MTX_RAM_ACCESS_CONTROL,
+				  MTX_MCM_ADDR, ui32Addr);
+	  REGIO_WRITE_FIELD_LITE (ui32Ctrl,
+				  MSVDX_MTX_RAM_ACCESS_CONTROL, MTX_MCMAI, 1);
+
+	  PSB_WMSVDX32 (ui32Ctrl, MSVDX_MTX_RAM_ACCESS_CONTROL);
+
+	  ui32CurrBank = ui32RamId;
+	}
+      ui32Address += 4;
+
+      PSB_WMSVDX32 (pui32Data[ui32Loop], MSVDX_MTX_RAM_ACCESS_DATA_TRANSFER);
+
+      /* Wait for MCMSTAT to become be idle 1 */
+      psb_wait_for_register (dev_priv, MSVDX_MTX_RAM_ACCESS_STATUS, 1,	/* Required Value */
+			     0xffffffff /* Enables */ );
+    }
+  PSB_DEBUG_GENERAL ("MSVDX: Upload done\n");
+
+  /* Restore the access control register... */
+  PSB_WMSVDX32 (ui32AccessControl, MSVDX_MTX_RAM_ACCESS_CONTROL);
+}
+
+static int
+psb_verify_fw (struct drm_psb_private *dev_priv,
+	       const uint32_t ui32RamBankSize,
+	       const uint32_t ui32DataMem, uint32_t ui32Address,
+	       const uint32_t uiWords, const uint32_t * const pui32Data)
+{
+  uint32_t ui32Loop, ui32Ctrl, ui32RamId, ui32Addr, ui32CurrBank =
+    (uint32_t) ~ 0;
+  uint32_t ui32AccessControl;
+  int ret = 0;
+
+  /* Save the access control register... */
+  ui32AccessControl = PSB_RMSVDX32 (MSVDX_MTX_RAM_ACCESS_CONTROL);
+
+  /* Wait for MCMSTAT to become be idle 1 */
+  psb_wait_for_register (dev_priv, MSVDX_MTX_RAM_ACCESS_STATUS, 1,	/* Required Value */
+			 0xffffffff /* Enables */ );
+
+  for (ui32Loop = 0; ui32Loop < uiWords; ui32Loop++)
+    {
+      uint32_t ui32ReadBackVal;
+      ui32RamId = ui32DataMem + (ui32Address / ui32RamBankSize);
+
+      if (ui32RamId != ui32CurrBank)
+	{
+	  ui32Addr = ui32Address >> 2;
+	  ui32Ctrl = 0;
+	  REGIO_WRITE_FIELD_LITE (ui32Ctrl,
+				  MSVDX_MTX_RAM_ACCESS_CONTROL,
+				  MTX_MCMID, ui32RamId);
+	  REGIO_WRITE_FIELD_LITE (ui32Ctrl,
+				  MSVDX_MTX_RAM_ACCESS_CONTROL,
+				  MTX_MCM_ADDR, ui32Addr);
+	  REGIO_WRITE_FIELD_LITE (ui32Ctrl,
+				  MSVDX_MTX_RAM_ACCESS_CONTROL, MTX_MCMAI, 1);
+	  REGIO_WRITE_FIELD_LITE (ui32Ctrl,
+				  MSVDX_MTX_RAM_ACCESS_CONTROL, MTX_MCMR, 1);
+
+	  PSB_WMSVDX32 (ui32Ctrl, MSVDX_MTX_RAM_ACCESS_CONTROL);
+
+	  ui32CurrBank = ui32RamId;
+	}
+      ui32Address += 4;
+
+      /* Wait for MCMSTAT to become be idle 1 */
+      psb_wait_for_register (dev_priv, MSVDX_MTX_RAM_ACCESS_STATUS, 1,	/* Required Value */
+			     0xffffffff /* Enables */ );
+
+      ui32ReadBackVal = PSB_RMSVDX32 (MSVDX_MTX_RAM_ACCESS_DATA_TRANSFER);
+      if (pui32Data[ui32Loop] != ui32ReadBackVal)
+	{
+	  DRM_ERROR
+	    ("psb: Firmware validation fails at index=%08x\n", ui32Loop);
+	  ret = 1;
+	  break;
+	}
+    }
+
+  /* Restore the access control register... */
+  PSB_WMSVDX32 (ui32AccessControl, MSVDX_MTX_RAM_ACCESS_CONTROL);
+
+  return ret;
+}
+
+static uint32_t *
+msvdx_get_fw (struct drm_device *dev,
+	      const struct firmware **raw, uint8_t * name)
+{
+  int rc;
+  int *ptr = NULL;
+
+  rc = request_firmware (raw, name, &dev->pdev->dev);
+  if (rc < 0)
+    {
+      DRM_ERROR ("MSVDX: %s request_firmware failed: Reason %d\n", name, rc);
+      return NULL;
+    }
+
+  if ((*raw)->size < sizeof (struct msvdx_fw))
+    {
+      PSB_DEBUG_GENERAL ("MSVDX: %s is is not correct size(%zd)\n",
+			 name, (*raw)->size);
+      return NULL;
+    }
+
+  ptr = (int *) ((*raw))->data;
+
+  if (!ptr)
+    {
+      PSB_DEBUG_GENERAL ("MSVDX: Failed to load %s\n", name);
+      return NULL;
+    }
+  /*another sanity check... */
+  if ((*raw)->size !=
+      (sizeof (struct msvdx_fw) +
+       sizeof (uint32_t) * ((struct msvdx_fw *) ptr)->text_size +
+       sizeof (uint32_t) * ((struct msvdx_fw *) ptr)->data_size))
+    {
+      PSB_DEBUG_GENERAL ("MSVDX: %s is is not correct size(%zd)\n",
+			 name, (*raw)->size);
+      return NULL;
+    }
+  return ptr;
+}
+
+static int
+psb_setup_fw (struct drm_device *dev)
+{
+  struct drm_psb_private *dev_priv = dev->dev_private;
+  int ret = 0;
+
+  uint32_t ram_bank_size;
+  struct msvdx_fw *fw;
+  uint32_t *fw_ptr = NULL;
+  uint32_t *text_ptr = NULL;
+  uint32_t *data_ptr = NULL;
+  const struct firmware *raw = NULL;
+  /* todo : Assert the clock is on - if not turn it on to upload code */
+
+  PSB_DEBUG_GENERAL ("MSVDX: psb_setup_fw\n");
+
+  /* Reset MTX */
+  PSB_WMSVDX32 (MSVDX_MTX_SOFT_RESET_MTX_RESET_MASK, MSVDX_MTX_SOFT_RESET);
+
+  /* Initialses Communication controll area to 0 */
+  if(dev_priv->psb_rev_id >= POULSBO_D1)
+   {
+	PSB_DEBUG_GENERAL("MSVDX: Detected Poulsbo D1 or later revision.\n");
+	PSB_WMSVDX32 (MSVDX_DEVICE_NODE_FLAGS_DEFAULT_D1, MSVDX_COMMS_OFFSET_FLAGS);
+   }
+  else
+   {
+	PSB_DEBUG_GENERAL("MSVDX: Detected Poulsbo D0 or earlier revision.\n");
+        PSB_WMSVDX32 (MSVDX_DEVICE_NODE_FLAGS_DEFAULT_D0, MSVDX_COMMS_OFFSET_FLAGS);
+   }
+
+  PSB_WMSVDX32 (0, MSVDX_COMMS_MSG_COUNTER);
+  PSB_WMSVDX32 (0, MSVDX_COMMS_SIGNATURE);
+  PSB_WMSVDX32 (0, MSVDX_COMMS_TO_HOST_RD_INDEX);
+  PSB_WMSVDX32 (0, MSVDX_COMMS_TO_HOST_WRT_INDEX);
+  PSB_WMSVDX32 (0, MSVDX_COMMS_TO_MTX_RD_INDEX);
+  PSB_WMSVDX32 (0, MSVDX_COMMS_TO_MTX_WRT_INDEX);
+  PSB_WMSVDX32 (0, MSVDX_COMMS_FW_STATUS);
+
+  /* read register bank size */
+  {
+    uint32_t ui32BankSize, ui32Reg;
+    ui32Reg = PSB_RMSVDX32 (MSVDX_MTX_RAM_BANK);
+    ui32BankSize =
+      REGIO_READ_FIELD (ui32Reg, MSVDX_MTX_RAM_BANK, CR_MTX_RAM_BANK_SIZE);
+    ram_bank_size = (uint32_t) (1 << (ui32BankSize + 2));
+  }
+
+  PSB_DEBUG_GENERAL ("MSVDX: RAM bank size = %d bytes\n", ram_bank_size);
+
+  fw_ptr = msvdx_get_fw (dev, &raw, "msvdx_fw.bin");
+
+  if (!fw_ptr)
+    {
+      DRM_ERROR ("psb: No valid msvdx_fw.bin firmware found.\n");
+      ret = 1;
+      goto out;
+    }
+
+  fw = (struct msvdx_fw *) fw_ptr;
+  if (fw->ver != 0x02)
+    {
+      DRM_ERROR
+	("psb: msvdx_fw.bin firmware version mismatch, got version=%02x expected version=%02x\n",
+	 fw->ver, 0x02);
+      ret = 1;
+      goto out;
+    }
+
+  text_ptr = (uint32_t *) ((uint8_t *) fw_ptr + sizeof (struct msvdx_fw));
+  data_ptr = text_ptr + fw->text_size;
+
+  PSB_DEBUG_GENERAL ("MSVDX: Retrieved pointers for firmware\n");
+  PSB_DEBUG_GENERAL ("MSVDX: text_size: %d\n", fw->text_size);
+  PSB_DEBUG_GENERAL ("MSVDX: data_size: %d\n", fw->data_size);
+  PSB_DEBUG_GENERAL ("MSVDX: data_location: 0x%x\n", fw->data_location);
+  PSB_DEBUG_GENERAL ("MSVDX: First 4 bytes of text: 0x%x\n", *text_ptr);
+  PSB_DEBUG_GENERAL ("MSVDX: First 4 bytes of data: 0x%x\n", *data_ptr);
+
+  PSB_DEBUG_GENERAL ("MSVDX: Uploading firmware\n");
+  psb_upload_fw (dev_priv, MTX_CORE_CODE_MEM, ram_bank_size,
+		 PC_START_ADDRESS - MTX_CODE_BASE, fw->text_size, text_ptr);
+  psb_upload_fw (dev_priv, MTX_CORE_DATA_MEM, ram_bank_size,
+		 fw->data_location - MTX_DATA_BASE, fw->data_size, data_ptr);
+
+  /*todo :  Verify code upload possibly only in debug */
+  if (psb_verify_fw
+      (dev_priv, ram_bank_size, MTX_CORE_CODE_MEM,
+       PC_START_ADDRESS - MTX_CODE_BASE, fw->text_size, text_ptr))
+    {
+      /* Firmware code upload failed */
+      ret = 1;
+      goto out;
+    }
+  if (psb_verify_fw
+      (dev_priv, ram_bank_size, MTX_CORE_DATA_MEM,
+       fw->data_location - MTX_DATA_BASE, fw->data_size, data_ptr))
+    {
+      /* Firmware data upload failed */
+      ret = 1;
+      goto out;
+    }
+
+  /*      -- Set starting PC address      */
+  psb_write_mtx_core_reg (dev_priv, MTX_PC, PC_START_ADDRESS);
+
+  /*      -- Turn on the thread   */
+  PSB_WMSVDX32 (MSVDX_MTX_ENABLE_MTX_ENABLE_MASK, MSVDX_MTX_ENABLE);
+
+  /* Wait for the signature value to be written back */
+  ret = psb_wait_for_register (dev_priv, MSVDX_COMMS_SIGNATURE, MSVDX_COMMS_SIGNATURE_VALUE,	/* Required value */
+			       0xffffffff /* Enabled bits */ );
+  if (ret)
+    {
+      DRM_ERROR ("psb: MSVDX firmware fails to initialize.\n");
+      goto out;
+    }
+
+  PSB_DEBUG_GENERAL ("MSVDX: MTX Initial indications OK\n");
+  PSB_DEBUG_GENERAL ("MSVDX: MSVDX_COMMS_AREA_ADDR = %08x\n",
+		     MSVDX_COMMS_AREA_ADDR);
+out:
+  if (raw)
+    {
+      PSB_DEBUG_GENERAL ("MSVDX releasing firmware resouces....\n");
+      release_firmware (raw);
+    }
+  return ret;
+}
+
+static void
+psb_free_ccb (struct drm_buffer_object **ccb)
+{
+  drm_bo_usage_deref_unlocked (ccb);
+  *ccb = NULL;
+}
+
+/*******************************************************************************
+
+ @Function	psb_msvdx_reset
+
+ @Description
+
+ Reset chip and disable interrupts.
+
+ @Input psDeviceNode - device info. structure
+
+ @Return  0 - Success
+	  1 - Failure
+
+******************************************************************************/
+int
+psb_msvdx_reset (struct drm_psb_private *dev_priv)
+{
+  int ret = 0;
+
+  /* Issue software reset */
+  PSB_WMSVDX32 (msvdx_sw_reset_all, MSVDX_CONTROL);
+
+  ret = psb_wait_for_register (dev_priv, MSVDX_CONTROL, 0,	/* Required value */
+			       MSVDX_CONTROL_CR_MSVDX_SOFT_RESET_MASK
+			       /* Enabled bits */ );
+
+  if (!ret)
+    {
+      /* Clear interrupt enabled flag */
+      PSB_WMSVDX32 (0, MSVDX_HOST_INTERRUPT_ENABLE);
+
+      /* Clear any pending interrupt flags                                                                                    */
+      PSB_WMSVDX32 (0xFFFFFFFF, MSVDX_INTERRUPT_CLEAR);
+    }
+
+  mutex_destroy (&dev_priv->msvdx_mutex);
+
+  return ret;
+}
+
+static int
+psb_allocate_ccb (struct drm_device *dev,
+		  struct drm_buffer_object **ccb,
+		  uint32_t * base_addr, int size)
+{
+  int ret;
+  struct drm_bo_kmap_obj tmp_kmap;
+  int is_iomem;
+
+  ret = drm_buffer_object_create (dev, size,
+				  drm_bo_type_kernel,
+				  DRM_BO_FLAG_READ |
+				  DRM_PSB_FLAG_MEM_KERNEL |
+				  DRM_BO_FLAG_NO_EVICT,
+				  DRM_BO_HINT_DONT_FENCE, 0, 0, ccb);
+  if (ret)
+    {
+      PSB_DEBUG_GENERAL ("Failed to allocate CCB.\n");
+      *ccb = NULL;
+      return 1;
+    }
+
+  ret = drm_bo_kmap (*ccb, 0, (*ccb)->num_pages, &tmp_kmap);
+  if (ret)
+    {
+      PSB_DEBUG_GENERAL ("drm_bo_kmap failed ret: %d\n", ret);
+      drm_bo_usage_deref_unlocked (ccb);
+      *ccb = NULL;
+      return 1;
+    }
+
+  memset (drm_bmo_virtual (&tmp_kmap, &is_iomem), 0, size);
+  drm_bo_kunmap (&tmp_kmap);
+
+  *base_addr = (*ccb)->offset;
+  return 0;
+}
+
+int
+psb_msvdx_init (struct drm_device *dev)
+{
+  struct drm_psb_private *dev_priv = dev->dev_private;
+  uint32_t ui32Cmd;
+  int ret;
+
+  PSB_DEBUG_GENERAL ("MSVDX: psb_msvdx_init\n");
+
+  /*Initialize command msvdx queueing */
+  INIT_LIST_HEAD (&dev_priv->msvdx_queue);
+  mutex_init (&dev_priv->msvdx_mutex);
+  spin_lock_init (&dev_priv->msvdx_lock);
+  dev_priv->msvdx_busy = 0;
+
+  /*figure out the stepping*/
+  pci_read_config_byte(dev->pdev, PSB_REVID_OFFSET, &dev_priv->psb_rev_id );
+
+  /* Enable Clocks */
+  PSB_DEBUG_GENERAL ("Enabling clocks\n");
+  PSB_WMSVDX32 (clk_enable_all, MSVDX_MAN_CLK_ENABLE);
+
+  /* Enable MMU by removing all bypass bits */
+  PSB_WMSVDX32 (0, MSVDX_MMU_CONTROL0);
+
+  PSB_DEBUG_GENERAL ("MSVDX: Setting up RENDEC\n");
+  /* Allocate device virtual memory as required by rendec.... */
+  if (!dev_priv->ccb0)
+    {
+      ret =
+	psb_allocate_ccb (dev, &dev_priv->ccb0,
+			  &dev_priv->base_addr0, RENDEC_A_SIZE);
+      if (ret)
+	goto err_exit;
+    }
+
+  if (!dev_priv->ccb1)
+    {
+      ret =
+	psb_allocate_ccb (dev, &dev_priv->ccb1,
+			  &dev_priv->base_addr1, RENDEC_B_SIZE);
+      if (ret)
+	goto err_exit;
+    }
+
+  PSB_DEBUG_GENERAL ("MSVDX: RENDEC A: %08x RENDEC B: %08x\n",
+		     dev_priv->base_addr0, dev_priv->base_addr1);
+
+  PSB_WMSVDX32 (dev_priv->base_addr0, MSVDX_RENDEC_BASE_ADDR0);
+  PSB_WMSVDX32 (dev_priv->base_addr1, MSVDX_RENDEC_BASE_ADDR1);
+
+  ui32Cmd = 0;
+  REGIO_WRITE_FIELD (ui32Cmd, MSVDX_RENDEC_BUFFER_SIZE,
+		     RENDEC_BUFFER_SIZE0, RENDEC_A_SIZE / 4096);
+  REGIO_WRITE_FIELD (ui32Cmd, MSVDX_RENDEC_BUFFER_SIZE,
+		     RENDEC_BUFFER_SIZE1, RENDEC_B_SIZE / 4096);
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_BUFFER_SIZE);
+
+  ui32Cmd = 0;
+  REGIO_WRITE_FIELD (ui32Cmd, MSVDX_RENDEC_CONTROL1,
+		     RENDEC_DECODE_START_SIZE, 0);
+  REGIO_WRITE_FIELD (ui32Cmd, MSVDX_RENDEC_CONTROL1, RENDEC_BURST_SIZE_W, 1);
+  REGIO_WRITE_FIELD (ui32Cmd, MSVDX_RENDEC_CONTROL1, RENDEC_BURST_SIZE_R, 1);
+  REGIO_WRITE_FIELD (ui32Cmd, MSVDX_RENDEC_CONTROL1,
+		     RENDEC_EXTERNAL_MEMORY, 1);
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_CONTROL1);
+
+  ui32Cmd = 0x00101010;
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_CONTEXT0);
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_CONTEXT1);
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_CONTEXT2);
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_CONTEXT3);
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_CONTEXT4);
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_CONTEXT5);
+
+  ui32Cmd = 0;
+  REGIO_WRITE_FIELD (ui32Cmd, MSVDX_RENDEC_CONTROL0, RENDEC_INITIALISE, 1);
+  PSB_WMSVDX32 (ui32Cmd, MSVDX_RENDEC_CONTROL0);
+
+  ret = psb_setup_fw (dev);
+  if (ret)
+    goto err_exit;
+
+  PSB_WMSVDX32 (clk_enable_minimal, MSVDX_MAN_CLK_ENABLE);
+
+  return 0;
+
+err_exit:
+  if (dev_priv->ccb0)
+    psb_free_ccb (&dev_priv->ccb0);
+  if (dev_priv->ccb1)
+    psb_free_ccb (&dev_priv->ccb1);
+
+  return 1;
+}
+
+int
+psb_msvdx_uninit (struct drm_device *dev)
+{
+  struct drm_psb_private *dev_priv = dev->dev_private;
+
+  /*Reset MSVDX chip */
+  psb_msvdx_reset (dev_priv);
+
+//  PSB_WMSVDX32 (clk_enable_minimal, MSVDX_MAN_CLK_ENABLE);
+    printk("set the msvdx clock to 0 in the %s\n", __FUNCTION__);
+    PSB_WMSVDX32 (0, MSVDX_MAN_CLK_ENABLE);
+
+  /*Clean up resources...*/
+  if (dev_priv->ccb0)
+    psb_free_ccb (&dev_priv->ccb0);
+  if (dev_priv->ccb1)
+    psb_free_ccb (&dev_priv->ccb1);
+
+  return 0;
+}
+
+int psb_hw_info_ioctl(struct drm_device *dev, void *data,
+                            struct drm_file *file_priv)
+{
+    struct drm_psb_private *dev_priv = dev->dev_private;
+    struct drm_psb_hw_info *hw_info = data;
+    struct pci_dev * pci_root = pci_get_bus_and_slot(0, 0);
+
+    hw_info->rev_id = dev_priv->psb_rev_id;
+
+    /*read the fuse info to determine the caps*/
+    pci_write_config_dword(pci_root, 0xD0, PCI_PORT5_REG80_FFUSE);
+    pci_read_config_dword(pci_root, 0xD4, &hw_info->caps);
+
+    PSB_DEBUG_GENERAL("MSVDX: PSB caps: 0x%x\n", hw_info->caps);
+    return 0;
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_reg.h
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_reg.h	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,562 @@
+/**************************************************************************
+ *
+ * Copyright (c) (2005-2007) Imagination Technologies Limited.
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ */
+#ifndef _PSB_REG_H_
+#define _PSB_REG_H_
+
+#define PSB_CR_CLKGATECTL                0x0000
+#define _PSB_C_CLKGATECTL_AUTO_MAN_REG   (1 << 24)
+#define _PSB_C_CLKGATECTL_USE_CLKG_SHIFT (20)
+#define _PSB_C_CLKGATECTL_USE_CLKG_MASK  (0x3 << 20)
+#define _PSB_C_CLKGATECTL_DPM_CLKG_SHIFT (16)
+#define _PSB_C_CLKGATECTL_DPM_CLKG_MASK  (0x3 << 16)
+#define _PSB_C_CLKGATECTL_TA_CLKG_SHIFT  (12)
+#define _PSB_C_CLKGATECTL_TA_CLKG_MASK   (0x3 << 12)
+#define _PSB_C_CLKGATECTL_TSP_CLKG_SHIFT (8)
+#define _PSB_C_CLKGATECTL_TSP_CLKG_MASK  (0x3 << 8)
+#define _PSB_C_CLKGATECTL_ISP_CLKG_SHIFT (4)
+#define _PSB_C_CLKGATECTL_ISP_CLKG_MASK  (0x3 << 4)
+#define _PSB_C_CLKGATECTL_2D_CLKG_SHIFT  (0)
+#define _PSB_C_CLKGATECTL_2D_CLKG_MASK   (0x3 << 0)
+#define _PSB_C_CLKGATECTL_CLKG_ENABLED   (0)
+#define _PSB_C_CLKGATECTL_CLKG_DISABLED  (1)
+#define _PSB_C_CLKGATECTL_CLKG_AUTO      (2)
+
+#define PSB_CR_CORE_ID                   0x0010
+#define _PSB_CC_ID_ID_SHIFT              (16)
+#define _PSB_CC_ID_ID_MASK               (0xFFFF << 16)
+#define _PSB_CC_ID_CONFIG_SHIFT          (0)
+#define _PSB_CC_ID_CONFIG_MASK           (0xFFFF << 0)
+
+#define PSB_CR_CORE_REVISION               0x0014
+#define _PSB_CC_REVISION_DESIGNER_SHIFT    (24)
+#define _PSB_CC_REVISION_DESIGNER_MASK     (0xFF << 24)
+#define _PSB_CC_REVISION_MAJOR_SHIFT       (16)
+#define _PSB_CC_REVISION_MAJOR_MASK        (0xFF << 16)
+#define _PSB_CC_REVISION_MINOR_SHIFT       (8)
+#define _PSB_CC_REVISION_MINOR_MASK        (0xFF << 8)
+#define _PSB_CC_REVISION_MAINTENANCE_SHIFT (0)
+#define _PSB_CC_REVISION_MAINTENANCE_MASK  (0xFF << 0)
+
+#define PSB_CR_DESIGNER_REV_FIELD1       0x0018
+
+#define PSB_CR_SOFT_RESET                0x0080
+#define _PSB_CS_RESET_TSP_RESET          (1 << 6)
+#define _PSB_CS_RESET_ISP_RESET          (1 << 5)
+#define _PSB_CS_RESET_USE_RESET          (1 << 4)
+#define _PSB_CS_RESET_TA_RESET           (1 << 3)
+#define _PSB_CS_RESET_DPM_RESET          (1 << 2)
+#define _PSB_CS_RESET_TWOD_RESET         (1 << 1)
+#define _PSB_CS_RESET_BIF_RESET          (1 << 0)
+
+#define PSB_CR_DESIGNER_REV_FIELD2       0x001C
+
+#define PSB_CR_EVENT_HOST_ENABLE2        0x0110
+
+#define PSB_CR_EVENT_STATUS2             0x0118
+
+#define PSB_CR_EVENT_HOST_CLEAR2         0x0114
+#define _PSB_CE2_BIF_REQUESTER_FAULT     (1 << 4)
+
+#define PSB_CR_EVENT_STATUS              0x012C
+
+#define PSB_CR_EVENT_HOST_ENABLE         0x0130
+
+#define PSB_CR_EVENT_HOST_CLEAR          0x0134
+#define _PSB_CE_MASTER_INTERRUPT         (1 << 31)
+#define _PSB_CE_TA_DPM_FAULT             (1 << 28)
+#define _PSB_CE_TWOD_COMPLETE            (1 << 27)
+#define _PSB_CE_DPM_OUT_OF_MEMORY_ZLS    (1 << 25)
+#define _PSB_CE_DPM_TA_MEM_FREE          (1 << 24)
+#define _PSB_CE_PIXELBE_END_RENDER       (1 << 18)
+#define _PSB_CE_SW_EVENT                 (1 << 14)
+#define _PSB_CE_TA_FINISHED              (1 << 13)
+#define _PSB_CE_TA_TERMINATE             (1 << 12)
+#define _PSB_CE_DPM_REACHED_MEM_THRESH   (1 << 3)
+#define _PSB_CE_DPM_OUT_OF_MEMORY_GBL    (1 << 2)
+#define _PSB_CE_DPM_OUT_OF_MEMORY_MT     (1 << 1)
+#define _PSB_CE_DPM_3D_MEM_FREE          (1 << 0)
+
+
+#define PSB_USE_OFFSET_MASK              0x0007FFFF
+#define PSB_USE_OFFSET_SIZE              (PSB_USE_OFFSET_MASK + 1)
+#define PSB_CR_USE_CODE_BASE0            0x0A0C
+#define PSB_CR_USE_CODE_BASE1            0x0A10
+#define PSB_CR_USE_CODE_BASE2            0x0A14
+#define PSB_CR_USE_CODE_BASE3            0x0A18
+#define PSB_CR_USE_CODE_BASE4            0x0A1C
+#define PSB_CR_USE_CODE_BASE5            0x0A20
+#define PSB_CR_USE_CODE_BASE6            0x0A24
+#define PSB_CR_USE_CODE_BASE7            0x0A28
+#define PSB_CR_USE_CODE_BASE8            0x0A2C
+#define PSB_CR_USE_CODE_BASE9            0x0A30
+#define PSB_CR_USE_CODE_BASE10           0x0A34
+#define PSB_CR_USE_CODE_BASE11           0x0A38
+#define PSB_CR_USE_CODE_BASE12           0x0A3C
+#define PSB_CR_USE_CODE_BASE13           0x0A40
+#define PSB_CR_USE_CODE_BASE14           0x0A44
+#define PSB_CR_USE_CODE_BASE15           0x0A48
+#define PSB_CR_USE_CODE_BASE(_i) (0x0A0C + ((_i) << 2))
+#define _PSB_CUC_BASE_DM_SHIFT           (25)
+#define _PSB_CUC_BASE_DM_MASK            (0x3 << 25)
+#define _PSB_CUC_BASE_ADDR_SHIFT         (0) // 1024-bit aligned address?
+#define _PSB_CUC_BASE_ADDR_ALIGNSHIFT    (7)
+#define _PSB_CUC_BASE_ADDR_MASK          (0x1FFFFFF << 0)
+#define _PSB_CUC_DM_VERTEX		 (0)
+#define _PSB_CUC_DM_PIXEL		 (1)
+#define _PSB_CUC_DM_RESERVED		 (2)
+#define _PSB_CUC_DM_EDM	                 (3)
+
+#define PSB_CR_PDS_EXEC_BASE             0x0AB8
+#define _PSB_CR_PDS_EXEC_BASE_ADDR_SHIFT (20) // 1MB aligned address
+#define _PSB_CR_PDS_EXEC_BASE_ADDR_ALIGNSHIFT (20)
+
+#define PSB_CR_EVENT_KICKER              0x0AC4
+#define _PSB_CE_KICKER_ADDRESS_SHIFT     (4) // 128-bit aligned address
+
+#define PSB_CR_EVENT_KICK                0x0AC8
+#define _PSB_CE_KICK_NOW                 (1 << 0)
+
+
+#define PSB_CR_BIF_DIR_LIST_BASE1        0x0C38
+
+#define PSB_CR_BIF_CTRL                  0x0C00
+#define _PSB_CB_CTRL_CLEAR_FAULT         (1 << 4)
+#define _PSB_CB_CTRL_INVALDC             (1 << 3)
+#define _PSB_CB_CTRL_FLUSH               (1 << 2)
+
+#define PSB_CR_BIF_INT_STAT              0x0C04
+
+#define PSB_CR_BIF_FAULT                 0x0C08
+#define _PSB_CBI_STAT_PF_N_RW            (1 << 14)
+#define _PSB_CBI_STAT_FAULT_SHIFT        (0)
+#define _PSB_CBI_STAT_FAULT_MASK         (0x3FFF << 0)
+#define _PSB_CBI_STAT_FAULT_CACHE        (1 << 1)
+#define _PSB_CBI_STAT_FAULT_TA           (1 << 2)
+#define _PSB_CBI_STAT_FAULT_VDM          (1 << 3)
+#define _PSB_CBI_STAT_FAULT_2D           (1 << 4)
+#define _PSB_CBI_STAT_FAULT_PBE          (1 << 5)
+#define _PSB_CBI_STAT_FAULT_TSP          (1 << 6)
+#define _PSB_CBI_STAT_FAULT_ISP          (1 << 7)
+#define _PSB_CBI_STAT_FAULT_USSEPDS      (1 << 8)
+#define _PSB_CBI_STAT_FAULT_HOST         (1 << 9)
+
+#define PSB_CR_BIF_BANK0                 0x0C78
+
+#define PSB_CR_BIF_BANK1                 0x0C7C
+
+#define PSB_CR_BIF_DIR_LIST_BASE0        0x0C84
+
+#define PSB_CR_BIF_TWOD_REQ_BASE         0x0C88
+#define PSB_CR_BIF_3D_REQ_BASE           0x0CAC
+
+#define PSB_CR_2D_SOCIF                  0x0E18
+#define _PSB_C2_SOCIF_FREESPACE_SHIFT    (0)
+#define _PSB_C2_SOCIF_FREESPACE_MASK     (0xFF << 0)
+#define _PSB_C2_SOCIF_EMPTY              (0x80 << 0)
+
+#define PSB_CR_2D_BLIT_STATUS            0x0E04
+#define _PSB_C2B_STATUS_BUSY             (1 << 24)
+#define _PSB_C2B_STATUS_COMPLETE_SHIFT   (0)
+#define _PSB_C2B_STATUS_COMPLETE_MASK    (0xFFFFFF << 0)
+
+/*
+ * 2D defs.
+ */
+
+/*
+ * 2D Slave Port Data : Block Header's Object Type
+ */
+
+#define	PSB_2D_CLIP_BH                   (0x00000000)
+#define	PSB_2D_PAT_BH                    (0x10000000)
+#define	PSB_2D_CTRL_BH                   (0x20000000)
+#define	PSB_2D_SRC_OFF_BH                (0x30000000)
+#define	PSB_2D_MASK_OFF_BH               (0x40000000)
+#define	PSB_2D_RESERVED1_BH              (0x50000000)
+#define	PSB_2D_RESERVED2_BH              (0x60000000)
+#define	PSB_2D_FENCE_BH                  (0x70000000)
+#define	PSB_2D_BLIT_BH                   (0x80000000)
+#define	PSB_2D_SRC_SURF_BH               (0x90000000)
+#define	PSB_2D_DST_SURF_BH               (0xA0000000)
+#define	PSB_2D_PAT_SURF_BH               (0xB0000000)
+#define	PSB_2D_SRC_PAL_BH                (0xC0000000)
+#define	PSB_2D_PAT_PAL_BH                (0xD0000000)
+#define	PSB_2D_MASK_SURF_BH              (0xE0000000)
+#define	PSB_2D_FLUSH_BH                  (0xF0000000)
+
+/*
+ * Clip Definition block (PSB_2D_CLIP_BH)
+ */
+#define PSB_2D_CLIPCOUNT_MAX             (1)
+#define PSB_2D_CLIPCOUNT_MASK            (0x00000000)
+#define PSB_2D_CLIPCOUNT_CLRMASK         (0xFFFFFFFF)
+#define PSB_2D_CLIPCOUNT_SHIFT           (0)
+// clip rectangle min & max
+#define PSB_2D_CLIP_XMAX_MASK            (0x00FFF000)
+#define PSB_2D_CLIP_XMAX_CLRMASK         (0xFF000FFF)
+#define PSB_2D_CLIP_XMAX_SHIFT           (12)
+#define PSB_2D_CLIP_XMIN_MASK            (0x00000FFF)
+#define PSB_2D_CLIP_XMIN_CLRMASK         (0x00FFF000)
+#define PSB_2D_CLIP_XMIN_SHIFT           (0)
+// clip rectangle offset
+#define PSB_2D_CLIP_YMAX_MASK            (0x00FFF000)
+#define PSB_2D_CLIP_YMAX_CLRMASK         (0xFF000FFF)
+#define PSB_2D_CLIP_YMAX_SHIFT           (12)
+#define PSB_2D_CLIP_YMIN_MASK            (0x00000FFF)
+#define PSB_2D_CLIP_YMIN_CLRMASK         (0x00FFF000)
+#define PSB_2D_CLIP_YMIN_SHIFT           (0)
+
+/*
+ * Pattern Control (PSB_2D_PAT_BH)
+ */
+#define PSB_2D_PAT_HEIGHT_MASK           (0x0000001F)
+#define PSB_2D_PAT_HEIGHT_SHIFT          (0)
+#define PSB_2D_PAT_WIDTH_MASK            (0x000003E0)
+#define PSB_2D_PAT_WIDTH_SHIFT           (5)
+#define PSB_2D_PAT_YSTART_MASK           (0x00007C00)
+#define PSB_2D_PAT_YSTART_SHIFT          (10)
+#define PSB_2D_PAT_XSTART_MASK           (0x000F8000)
+#define PSB_2D_PAT_XSTART_SHIFT          (15)
+
+/*
+ * 2D Control block (PSB_2D_CTRL_BH)
+ */
+// Present Flags
+#define PSB_2D_SRCCK_CTRL                (0x00000001)
+#define PSB_2D_DSTCK_CTRL                (0x00000002)
+#define PSB_2D_ALPHA_CTRL                (0x00000004)
+// Colour Key Colour (SRC/DST)
+#define PSB_2D_CK_COL_MASK               (0xFFFFFFFF)
+#define PSB_2D_CK_COL_CLRMASK            (0x00000000)
+#define PSB_2D_CK_COL_SHIFT              (0)
+// Colour Key Mask (SRC/DST)
+#define PSB_2D_CK_MASK_MASK              (0xFFFFFFFF)
+#define PSB_2D_CK_MASK_CLRMASK           (0x00000000)
+#define PSB_2D_CK_MASK_SHIFT             (0)
+// Alpha Control (Alpha/RGB)
+#define PSB_2D_GBLALPHA_MASK             (0x000FF000)
+#define PSB_2D_GBLALPHA_CLRMASK          (0xFFF00FFF)
+#define PSB_2D_GBLALPHA_SHIFT            (12)
+#define PSB_2D_SRCALPHA_OP_MASK          (0x00700000)
+#define PSB_2D_SRCALPHA_OP_CLRMASK       (0xFF8FFFFF)
+#define PSB_2D_SRCALPHA_OP_SHIFT         (20)
+#define PSB_2D_SRCALPHA_OP_ONE           (0x00000000)
+#define PSB_2D_SRCALPHA_OP_SRC           (0x00100000)
+#define PSB_2D_SRCALPHA_OP_DST           (0x00200000)
+#define PSB_2D_SRCALPHA_OP_SG            (0x00300000)
+#define PSB_2D_SRCALPHA_OP_DG            (0x00400000)
+#define PSB_2D_SRCALPHA_OP_GBL           (0x00500000)
+#define PSB_2D_SRCALPHA_OP_ZERO          (0x00600000)
+#define PSB_2D_SRCALPHA_INVERT           (0x00800000)
+#define PSB_2D_SRCALPHA_INVERT_CLR       (0xFF7FFFFF)
+#define PSB_2D_DSTALPHA_OP_MASK          (0x07000000)
+#define PSB_2D_DSTALPHA_OP_CLRMASK       (0xF8FFFFFF)
+#define PSB_2D_DSTALPHA_OP_SHIFT         (24)
+#define PSB_2D_DSTALPHA_OP_ONE           (0x00000000)
+#define PSB_2D_DSTALPHA_OP_SRC           (0x01000000)
+#define PSB_2D_DSTALPHA_OP_DST           (0x02000000)
+#define PSB_2D_DSTALPHA_OP_SG            (0x03000000)
+#define PSB_2D_DSTALPHA_OP_DG            (0x04000000)
+#define PSB_2D_DSTALPHA_OP_GBL           (0x05000000)
+#define PSB_2D_DSTALPHA_OP_ZERO          (0x06000000)
+#define PSB_2D_DSTALPHA_INVERT           (0x08000000)
+#define PSB_2D_DSTALPHA_INVERT_CLR       (0xF7FFFFFF)
+
+#define PSB_2D_PRE_MULTIPLICATION_ENABLE  (0x10000000)
+#define PSB_2D_PRE_MULTIPLICATION_CLRMASK (0xEFFFFFFF)
+#define PSB_2D_ZERO_SOURCE_ALPHA_ENABLE   (0x20000000)
+#define PSB_2D_ZERO_SOURCE_ALPHA_CLRMASK  (0xDFFFFFFF)
+
+/*
+ *Source Offset (PSB_2D_SRC_OFF_BH)
+ */
+#define PSB_2D_SRCOFF_XSTART_MASK        ((0x00000FFF) << 12)
+#define PSB_2D_SRCOFF_XSTART_SHIFT       (12)
+#define PSB_2D_SRCOFF_YSTART_MASK        (0x00000FFF)
+#define PSB_2D_SRCOFF_YSTART_SHIFT       (0)
+
+/*
+ * Mask Offset (PSB_2D_MASK_OFF_BH)
+ */
+#define PSB_2D_MASKOFF_XSTART_MASK       ((0x00000FFF) << 12)
+#define PSB_2D_MASKOFF_XSTART_SHIFT      (12)
+#define PSB_2D_MASKOFF_YSTART_MASK       (0x00000FFF)
+#define PSB_2D_MASKOFF_YSTART_SHIFT      (0)
+
+/*
+ * 2D Fence (see PSB_2D_FENCE_BH): bits 0:27 are ignored
+ */
+
+/*
+ *Blit Rectangle (PSB_2D_BLIT_BH)
+ */
+
+#define PSB_2D_ROT_MASK                  (3<<25)
+#define PSB_2D_ROT_CLRMASK               (~PSB_2D_ROT_MASK)
+#define PSB_2D_ROT_NONE                  (0<<25)
+#define PSB_2D_ROT_90DEGS                (1<<25)
+#define PSB_2D_ROT_180DEGS               (2<<25)
+#define PSB_2D_ROT_270DEGS               (3<<25)
+
+#define PSB_2D_COPYORDER_MASK            (3<<23)
+#define PSB_2D_COPYORDER_CLRMASK         (~PSB_2D_COPYORDER_MASK)
+#define PSB_2D_COPYORDER_TL2BR           (0<<23)
+#define PSB_2D_COPYORDER_BR2TL           (1<<23)
+#define PSB_2D_COPYORDER_TR2BL           (2<<23)
+#define PSB_2D_COPYORDER_BL2TR           (3<<23)
+
+#define PSB_2D_DSTCK_CLRMASK             (0xFF9FFFFF)
+#define PSB_2D_DSTCK_DISABLE             (0x00000000)
+#define PSB_2D_DSTCK_PASS                (0x00200000)
+#define PSB_2D_DSTCK_REJECT              (0x00400000)
+
+#define PSB_2D_SRCCK_CLRMASK             (0xFFE7FFFF)
+#define PSB_2D_SRCCK_DISABLE             (0x00000000)
+#define PSB_2D_SRCCK_PASS                (0x00080000)
+#define PSB_2D_SRCCK_REJECT              (0x00100000)
+
+#define PSB_2D_CLIP_ENABLE               (0x00040000)
+
+#define PSB_2D_ALPHA_ENABLE              (0x00020000)
+
+#define PSB_2D_PAT_CLRMASK               (0xFFFEFFFF)
+#define PSB_2D_PAT_MASK                  (0x00010000)
+#define PSB_2D_USE_PAT                   (0x00010000)
+#define PSB_2D_USE_FILL                  (0x00000000)
+/*
+ * Tungsten Graphics note on rop codes: If rop A and rop B are
+ * identical, the mask surface will not be read and need not be
+ * set up.
+ */
+
+#define PSB_2D_ROP3B_MASK                (0x0000FF00)
+#define PSB_2D_ROP3B_CLRMASK             (0xFFFF00FF)
+#define PSB_2D_ROP3B_SHIFT               (8)
+// rop code A
+#define PSB_2D_ROP3A_MASK                (0x000000FF)
+#define PSB_2D_ROP3A_CLRMASK             (0xFFFFFF00)
+#define PSB_2D_ROP3A_SHIFT               (0)
+
+#define PSB_2D_ROP4_MASK                 (0x0000FFFF)
+/*
+ *	DWORD0:	(Only pass if Pattern control == Use Fill Colour)
+ *	Fill Colour RGBA8888
+ */
+#define PSB_2D_FILLCOLOUR_MASK           (0xFFFFFFFF)
+#define PSB_2D_FILLCOLOUR_SHIFT          (0)
+/*
+ *	DWORD1: (Always Present)
+ *	X Start (Dest)
+ *	Y Start (Dest)
+ */
+#define PSB_2D_DST_XSTART_MASK           (0x00FFF000)
+#define PSB_2D_DST_XSTART_CLRMASK        (0xFF000FFF)
+#define PSB_2D_DST_XSTART_SHIFT          (12)
+#define PSB_2D_DST_YSTART_MASK           (0x00000FFF)
+#define PSB_2D_DST_YSTART_CLRMASK        (0xFFFFF000)
+#define PSB_2D_DST_YSTART_SHIFT          (0)
+/*
+ *	DWORD2: (Always Present)
+ *	X Size (Dest)
+ *	Y Size (Dest)
+ */
+#define PSB_2D_DST_XSIZE_MASK            (0x00FFF000)
+#define PSB_2D_DST_XSIZE_CLRMASK         (0xFF000FFF)
+#define PSB_2D_DST_XSIZE_SHIFT           (12)
+#define PSB_2D_DST_YSIZE_MASK            (0x00000FFF)
+#define PSB_2D_DST_YSIZE_CLRMASK         (0xFFFFF000)
+#define PSB_2D_DST_YSIZE_SHIFT           (0)
+
+/*
+ * Source Surface (PSB_2D_SRC_SURF_BH)
+ */
+/*
+ *      WORD 0
+ */
+
+#define PSB_2D_SRC_FORMAT_MASK           (0x00078000)
+#define PSB_2D_SRC_1_PAL                 (0x00000000)
+#define PSB_2D_SRC_2_PAL                 (0x00008000)
+#define PSB_2D_SRC_4_PAL                 (0x00010000)
+#define PSB_2D_SRC_8_PAL                 (0x00018000)
+#define PSB_2D_SRC_8_ALPHA               (0x00020000)
+#define PSB_2D_SRC_4_ALPHA               (0x00028000)
+#define PSB_2D_SRC_332RGB                (0x00030000)
+#define PSB_2D_SRC_4444ARGB              (0x00038000)
+#define PSB_2D_SRC_555RGB                (0x00040000)
+#define PSB_2D_SRC_1555ARGB              (0x00048000)
+#define PSB_2D_SRC_565RGB                (0x00050000)
+#define PSB_2D_SRC_0888ARGB              (0x00058000)
+#define PSB_2D_SRC_8888ARGB              (0x00060000)
+#define PSB_2D_SRC_8888UYVY              (0x00068000)
+#define PSB_2D_SRC_RESERVED              (0x00070000)
+#define PSB_2D_SRC_1555ARGB_LOOKUP       (0x00078000)
+
+
+#define PSB_2D_SRC_STRIDE_MASK           (0x00007FFF)
+#define PSB_2D_SRC_STRIDE_CLRMASK        (0xFFFF8000)
+#define PSB_2D_SRC_STRIDE_SHIFT          (0)
+/*
+ *  WORD 1 - Base Address
+ */
+#define PSB_2D_SRC_ADDR_MASK             (0x0FFFFFFC)
+#define PSB_2D_SRC_ADDR_CLRMASK          (0x00000003)
+#define PSB_2D_SRC_ADDR_SHIFT            (2)
+#define PSB_2D_SRC_ADDR_ALIGNSHIFT       (2)
+
+/*
+ * Pattern Surface (PSB_2D_PAT_SURF_BH)
+ */
+/*
+ *  WORD 0
+ */
+
+#define PSB_2D_PAT_FORMAT_MASK           (0x00078000)
+#define PSB_2D_PAT_1_PAL                 (0x00000000)
+#define PSB_2D_PAT_2_PAL                 (0x00008000)
+#define PSB_2D_PAT_4_PAL                 (0x00010000)
+#define PSB_2D_PAT_8_PAL                 (0x00018000)
+#define PSB_2D_PAT_8_ALPHA               (0x00020000)
+#define PSB_2D_PAT_4_ALPHA               (0x00028000)
+#define PSB_2D_PAT_332RGB                (0x00030000)
+#define PSB_2D_PAT_4444ARGB              (0x00038000)
+#define PSB_2D_PAT_555RGB                (0x00040000)
+#define PSB_2D_PAT_1555ARGB              (0x00048000)
+#define PSB_2D_PAT_565RGB                (0x00050000)
+#define PSB_2D_PAT_0888ARGB              (0x00058000)
+#define PSB_2D_PAT_8888ARGB              (0x00060000)
+
+#define PSB_2D_PAT_STRIDE_MASK           (0x00007FFF)
+#define PSB_2D_PAT_STRIDE_CLRMASK        (0xFFFF8000)
+#define PSB_2D_PAT_STRIDE_SHIFT          (0)
+/*
+ *  WORD 1 - Base Address
+ */
+#define PSB_2D_PAT_ADDR_MASK             (0x0FFFFFFC)
+#define PSB_2D_PAT_ADDR_CLRMASK          (0x00000003)
+#define PSB_2D_PAT_ADDR_SHIFT            (2)
+#define PSB_2D_PAT_ADDR_ALIGNSHIFT       (2)
+
+/*
+ * Destination Surface (PSB_2D_DST_SURF_BH)
+ */
+/*
+ * WORD 0
+ */
+
+#define PSB_2D_DST_FORMAT_MASK           (0x00078000)
+#define PSB_2D_DST_332RGB                (0x00030000)
+#define PSB_2D_DST_4444ARGB              (0x00038000)
+#define PSB_2D_DST_555RGB                (0x00040000)
+#define PSB_2D_DST_1555ARGB              (0x00048000)
+#define PSB_2D_DST_565RGB                (0x00050000)
+#define PSB_2D_DST_0888ARGB              (0x00058000)
+#define PSB_2D_DST_8888ARGB              (0x00060000)
+#define PSB_2D_DST_8888AYUV              (0x00070000)
+
+#define PSB_2D_DST_STRIDE_MASK           (0x00007FFF)
+#define PSB_2D_DST_STRIDE_CLRMASK        (0xFFFF8000)
+#define PSB_2D_DST_STRIDE_SHIFT          (0)
+/*
+ * WORD 1 - Base Address
+ */
+#define PSB_2D_DST_ADDR_MASK             (0x0FFFFFFC)
+#define PSB_2D_DST_ADDR_CLRMASK          (0x00000003)
+#define PSB_2D_DST_ADDR_SHIFT            (2)
+#define PSB_2D_DST_ADDR_ALIGNSHIFT       (2)
+
+/*
+ * Mask Surface (PSB_2D_MASK_SURF_BH)
+ */
+/*
+ * WORD 0
+ */
+#define PSB_2D_MASK_STRIDE_MASK          (0x00007FFF)
+#define PSB_2D_MASK_STRIDE_CLRMASK       (0xFFFF8000)
+#define PSB_2D_MASK_STRIDE_SHIFT         (0)
+/*
+ *  WORD 1 - Base Address
+ */
+#define PSB_2D_MASK_ADDR_MASK            (0x0FFFFFFC)
+#define PSB_2D_MASK_ADDR_CLRMASK         (0x00000003)
+#define PSB_2D_MASK_ADDR_SHIFT           (2)
+#define PSB_2D_MASK_ADDR_ALIGNSHIFT      (2)
+
+/*
+ * Source Palette (PSB_2D_SRC_PAL_BH)
+ */
+
+#define PSB_2D_SRCPAL_ADDR_SHIFT         (0)
+#define PSB_2D_SRCPAL_ADDR_CLRMASK       (0xF0000007)
+#define PSB_2D_SRCPAL_ADDR_MASK          (0x0FFFFFF8)
+#define PSB_2D_SRCPAL_BYTEALIGN          (1024)
+
+/*
+ * Pattern Palette (PSB_2D_PAT_PAL_BH)
+ */
+
+#define PSB_2D_PATPAL_ADDR_SHIFT         (0)
+#define PSB_2D_PATPAL_ADDR_CLRMASK       (0xF0000007)
+#define PSB_2D_PATPAL_ADDR_MASK          (0x0FFFFFF8)
+#define PSB_2D_PATPAL_BYTEALIGN          (1024)
+
+/*
+ * Rop3 Codes (2 LS bytes)
+ */
+
+#define PSB_2D_ROP3_SRCCOPY              (0xCCCC)
+#define PSB_2D_ROP3_PATCOPY              (0xF0F0)
+#define PSB_2D_ROP3_WHITENESS            (0xFFFF)
+#define PSB_2D_ROP3_BLACKNESS            (0x0000)
+#define PSB_2D_ROP3_SRC                  (0xCC)
+#define PSB_2D_ROP3_PAT                  (0xF0)
+#define PSB_2D_ROP3_DST                  (0xAA)
+
+
+/*
+ * Sizes.
+ */
+
+#define PSB_SCENE_HW_COOKIE_SIZE 16
+#define PSB_TA_MEM_HW_COOKIE_SIZE 16
+
+/*
+ * Scene stuff.
+ */
+
+#define PSB_NUM_HW_SCENES          2
+
+/*
+ * Scheduler completion actions.
+ */
+
+#define PSB_RASTER_BLOCK 0
+#define PSB_RASTER       1
+#define PSB_RETURN       2
+#define PSB_TA       3
+
+
+#endif
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_regman.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_regman.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,175 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ */
+
+#include "drmP.h"
+#include "psb_drv.h"
+
+struct psb_use_reg {
+	struct drm_reg reg;
+	struct drm_psb_private *dev_priv;
+	uint32_t reg_seq;
+	uint32_t base;
+	uint32_t data_master;
+};
+
+struct psb_use_reg_data {
+	uint32_t base;
+	uint32_t size;
+	uint32_t data_master;
+};
+
+static int psb_use_reg_reusable(const struct drm_reg *reg, const void *data)
+{
+	struct psb_use_reg *use_reg =
+	    container_of(reg, struct psb_use_reg, reg);
+	struct psb_use_reg_data *use_data = (struct psb_use_reg_data *)data;
+
+	return ((use_reg->base <= use_data->base) &&
+		(use_reg->base + PSB_USE_OFFSET_SIZE >
+		 use_data->base + use_data->size) &&
+		use_reg->data_master == use_data->data_master);
+}
+
+static int psb_use_reg_set(struct psb_use_reg *use_reg,
+			   const struct psb_use_reg_data *use_data)
+{
+	struct drm_psb_private *dev_priv = use_reg->dev_priv;
+
+	if (use_reg->reg.fence == NULL)
+		use_reg->data_master = use_data->data_master;
+
+	if (use_reg->reg.fence == NULL &&
+	    !psb_use_reg_reusable(&use_reg->reg, (const void *)use_data)) {
+
+		use_reg->base = use_data->base & ~PSB_USE_OFFSET_MASK;
+		use_reg->data_master = use_data->data_master;
+
+		if (!psb_use_reg_reusable(&use_reg->reg,
+					  (const void *)use_data)) {
+			DRM_ERROR("USE base mechanism didn't support "
+				  "buffer size or alignment\n");
+			return -EINVAL;
+		}
+
+		PSB_WSGX32(PSB_ALPL(use_reg->base, _PSB_CUC_BASE_ADDR) |
+			   (use_reg->data_master << _PSB_CUC_BASE_DM_SHIFT),
+			   PSB_CR_USE_CODE_BASE(use_reg->reg_seq));
+	}
+	return 0;
+
+}
+
+int psb_grab_use_base(struct drm_psb_private *dev_priv,
+		      unsigned long base,
+		      unsigned long size,
+		      unsigned int data_master,
+		      uint32_t fence_class,
+		      uint32_t fence_type,
+		      int no_wait,
+		      int interruptible, int *r_reg, uint32_t * r_offset)
+{
+	struct psb_use_reg_data use_data = {
+		.base = base,
+		.size = size,
+		.data_master = data_master
+	};
+	int ret;
+
+	struct drm_reg *reg;
+	struct psb_use_reg *use_reg;
+
+	ret = drm_regs_alloc(&dev_priv->use_manager,
+			     (const void *)&use_data,
+			     fence_class,
+			     fence_type, interruptible, no_wait, &reg);
+	if (ret)
+		return ret;
+
+	use_reg = container_of(reg, struct psb_use_reg, reg);
+	ret = psb_use_reg_set(use_reg, &use_data);
+
+	if (ret)
+		return ret;
+
+	*r_reg = use_reg->reg_seq;
+	*r_offset = base - use_reg->base;
+
+	return 0;
+};
+
+static void psb_use_reg_destroy(struct drm_reg *reg)
+{
+	struct psb_use_reg *use_reg =
+	    container_of(reg, struct psb_use_reg, reg);
+	struct drm_psb_private *dev_priv = use_reg->dev_priv;
+
+	PSB_WSGX32(PSB_ALPL(0, _PSB_CUC_BASE_ADDR),
+		   PSB_CR_USE_CODE_BASE(use_reg->reg_seq));
+
+	drm_free(use_reg, sizeof(*use_reg), DRM_MEM_DRIVER);
+}
+
+int psb_init_use_base(struct drm_psb_private *dev_priv,
+		      unsigned int reg_start, unsigned int reg_num)
+{
+	struct psb_use_reg *use_reg;
+	int i;
+	int ret = 0;
+
+	mutex_lock(&dev_priv->cmdbuf_mutex);
+
+	drm_regs_init(&dev_priv->use_manager,
+		      &psb_use_reg_reusable, &psb_use_reg_destroy);
+
+	for (i = reg_start; i < reg_start + reg_num; ++i) {
+		use_reg = drm_calloc(1, sizeof(*use_reg), DRM_MEM_DRIVER);
+		if (!use_reg) {
+			ret = -ENOMEM;
+			goto out;
+		}
+
+		use_reg->dev_priv = dev_priv;
+		use_reg->reg_seq = i;
+		use_reg->base = 0;
+		use_reg->data_master = _PSB_CUC_DM_PIXEL;
+
+		PSB_WSGX32(PSB_ALPL(use_reg->base, _PSB_CUC_BASE_ADDR) |
+			   (use_reg->data_master << _PSB_CUC_BASE_DM_SHIFT),
+			   PSB_CR_USE_CODE_BASE(use_reg->reg_seq));
+
+		drm_regs_add(&dev_priv->use_manager, &use_reg->reg);
+	}
+      out:
+	mutex_unlock(&dev_priv->cmdbuf_mutex);
+
+	return ret;
+
+}
+
+void psb_takedown_use_base(struct drm_psb_private *dev_priv)
+{
+	mutex_lock(&dev_priv->cmdbuf_mutex);
+	drm_regs_free(&dev_priv->use_manager);
+	mutex_unlock(&dev_priv->cmdbuf_mutex);
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_reset.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_reset.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,374 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Authors:
+ * Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
+ */
+
+#include "drmP.h"
+#include "psb_drv.h"
+#include "psb_reg.h"
+#include "psb_scene.h"
+#include "psb_msvdx.h"
+
+#define PSB_2D_TIMEOUT_MSEC 100
+
+void psb_reset(struct drm_psb_private *dev_priv, int reset_2d)
+{
+	uint32_t val;
+
+	val = _PSB_CS_RESET_BIF_RESET |
+	    _PSB_CS_RESET_DPM_RESET |
+	    _PSB_CS_RESET_TA_RESET |
+	    _PSB_CS_RESET_USE_RESET |
+	    _PSB_CS_RESET_ISP_RESET | _PSB_CS_RESET_TSP_RESET;
+
+	if (reset_2d)
+		val |= _PSB_CS_RESET_TWOD_RESET;
+
+	PSB_WSGX32(val, PSB_CR_SOFT_RESET);
+	(void)PSB_RSGX32(PSB_CR_SOFT_RESET);
+
+	msleep(1);
+
+	PSB_WSGX32(0, PSB_CR_SOFT_RESET);
+	wmb();
+	PSB_WSGX32(PSB_RSGX32(PSB_CR_BIF_CTRL) | _PSB_CB_CTRL_CLEAR_FAULT,
+		   PSB_CR_BIF_CTRL);
+	wmb();
+	(void)PSB_RSGX32(PSB_CR_BIF_CTRL);
+
+	msleep(1);
+	PSB_WSGX32(PSB_RSGX32(PSB_CR_BIF_CTRL) & ~_PSB_CB_CTRL_CLEAR_FAULT,
+		   PSB_CR_BIF_CTRL);
+	(void)PSB_RSGX32(PSB_CR_BIF_CTRL);
+}
+
+void psb_print_pagefault(struct drm_psb_private *dev_priv)
+{
+	uint32_t val;
+	uint32_t addr;
+
+	val = PSB_RSGX32(PSB_CR_BIF_INT_STAT);
+	addr = PSB_RSGX32(PSB_CR_BIF_FAULT);
+
+	if (val) {
+		if (val & _PSB_CBI_STAT_PF_N_RW)
+			DRM_ERROR("Poulsbo MMU page fault:\n");
+		else
+			DRM_ERROR("Poulsbo MMU read / write "
+				  "protection fault:\n");
+
+		if (val & _PSB_CBI_STAT_FAULT_CACHE)
+			DRM_ERROR("\tCache requestor.\n");
+		if (val & _PSB_CBI_STAT_FAULT_TA)
+			DRM_ERROR("\tTA requestor.\n");
+		if (val & _PSB_CBI_STAT_FAULT_VDM)
+			DRM_ERROR("\tVDM requestor.\n");
+		if (val & _PSB_CBI_STAT_FAULT_2D)
+			DRM_ERROR("\t2D requestor.\n");
+		if (val & _PSB_CBI_STAT_FAULT_PBE)
+			DRM_ERROR("\tPBE requestor.\n");
+		if (val & _PSB_CBI_STAT_FAULT_TSP)
+			DRM_ERROR("\tTSP requestor.\n");
+		if (val & _PSB_CBI_STAT_FAULT_ISP)
+			DRM_ERROR("\tISP requestor.\n");
+		if (val & _PSB_CBI_STAT_FAULT_USSEPDS)
+			DRM_ERROR("\tUSSEPDS requestor.\n");
+		if (val & _PSB_CBI_STAT_FAULT_HOST)
+			DRM_ERROR("\tHost requestor.\n");
+
+		DRM_ERROR("\tMMU failing address is 0x%08x.\n", (unsigned)addr);
+	}
+}
+
+void psb_schedule_watchdog(struct drm_psb_private *dev_priv)
+{
+	struct timer_list *wt = &dev_priv->watchdog_timer;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&dev_priv->watchdog_lock, irq_flags);
+	if (dev_priv->timer_available && !timer_pending(wt)) {
+		wt->expires = jiffies + PSB_WATCHDOG_DELAY;
+		add_timer(wt);
+	}
+	spin_unlock_irqrestore(&dev_priv->watchdog_lock, irq_flags);
+}
+
+#if 0
+static void psb_seq_lockup_idle(struct drm_psb_private *dev_priv,
+				unsigned int engine, int *lockup, int *idle)
+{
+	uint32_t received_seq;
+
+	received_seq = dev_priv->comm[engine << 4];
+	spin_lock(&dev_priv->sequence_lock);
+	*idle = (received_seq == dev_priv->sequence[engine]);
+	spin_unlock(&dev_priv->sequence_lock);
+
+	if (*idle) {
+		dev_priv->idle[engine] = 1;
+		*lockup = 0;
+		return;
+	}
+
+	if (dev_priv->idle[engine]) {
+		dev_priv->idle[engine] = 0;
+		dev_priv->last_sequence[engine] = received_seq;
+		*lockup = 0;
+		return;
+	}
+
+	*lockup = (dev_priv->last_sequence[engine] == received_seq);
+}
+
+#endif
+static void psb_watchdog_func(unsigned long data)
+{
+	struct drm_psb_private *dev_priv = (struct drm_psb_private *)data;
+	int lockup;
+	int msvdx_lockup;
+	int msvdx_idle;
+	int lockup_2d;
+	int idle_2d;
+	int idle;
+	unsigned long irq_flags;
+
+	psb_scheduler_lockup(dev_priv, &lockup, &idle);
+	psb_msvdx_lockup(dev_priv, &msvdx_lockup, &msvdx_idle);
+#if 0
+	psb_seq_lockup_idle(dev_priv, PSB_ENGINE_2D, &lockup_2d, &idle_2d);
+#else
+	lockup_2d = 0;
+	idle_2d = 1;
+#endif
+	if (lockup || msvdx_lockup || lockup_2d) {
+		spin_lock_irqsave(&dev_priv->watchdog_lock, irq_flags);
+		dev_priv->timer_available = 0;
+		spin_unlock_irqrestore(&dev_priv->watchdog_lock, irq_flags);
+		if (lockup) {
+			psb_print_pagefault(dev_priv);
+			schedule_work(&dev_priv->watchdog_wq);
+		}
+		if (msvdx_lockup)
+			schedule_work(&dev_priv->msvdx_watchdog_wq);
+	}
+	if (!idle || !msvdx_idle || !idle_2d)
+		psb_schedule_watchdog(dev_priv);
+}
+
+void psb_msvdx_flush_cmd_queue(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	struct psb_msvdx_cmd_queue *msvdx_cmd;
+	struct list_head *list, *next;
+	/*Flush the msvdx cmd queue and signal all fences in the queue */
+	list_for_each_safe(list, next, &dev_priv->msvdx_queue) {
+		msvdx_cmd = list_entry(list, struct psb_msvdx_cmd_queue, head);
+		PSB_DEBUG_GENERAL("MSVDXQUE: flushing sequence:%d\n",
+				  msvdx_cmd->sequence);
+		dev_priv->msvdx_current_sequence = msvdx_cmd->sequence;
+		psb_fence_error(dev, PSB_ENGINE_VIDEO,
+				dev_priv->msvdx_current_sequence,
+				DRM_FENCE_TYPE_EXE, DRM_CMD_HANG);
+		list_del(list);
+		kfree(msvdx_cmd->cmd);
+		drm_free(msvdx_cmd, sizeof(struct psb_msvdx_cmd_queue),
+			 DRM_MEM_DRIVER);
+	}
+}
+
+static void psb_msvdx_reset_wq(struct work_struct *work)
+{
+	struct drm_psb_private *dev_priv =
+	    container_of(work, struct drm_psb_private, msvdx_watchdog_wq);
+
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+
+	mutex_lock(&dev_priv->msvdx_mutex);
+	dev_priv->msvdx_needs_reset = 1;
+	dev_priv->msvdx_current_sequence++;
+	PSB_DEBUG_GENERAL
+	    ("MSVDXFENCE: incremented msvdx_current_sequence to :%d\n",
+	     dev_priv->msvdx_current_sequence);
+
+	psb_fence_error(scheduler->dev, PSB_ENGINE_VIDEO,
+			dev_priv->msvdx_current_sequence, DRM_FENCE_TYPE_EXE,
+			DRM_CMD_HANG);
+
+	spin_lock_irqsave(&dev_priv->watchdog_lock, irq_flags);
+	dev_priv->timer_available = 1;
+	spin_unlock_irqrestore(&dev_priv->watchdog_lock, irq_flags);
+
+	spin_lock_irqsave(&dev_priv->msvdx_lock, irq_flags);
+	psb_msvdx_flush_cmd_queue(scheduler->dev);
+	spin_unlock_irqrestore(&dev_priv->msvdx_lock, irq_flags);
+
+	psb_schedule_watchdog(dev_priv);
+	mutex_unlock(&dev_priv->msvdx_mutex);
+}
+
+static int psb_xhw_mmu_reset(struct drm_psb_private *dev_priv)
+{
+	struct psb_xhw_buf buf;
+	uint32_t bif_ctrl;
+
+	INIT_LIST_HEAD(&buf.head);
+	psb_mmu_set_pd_context(psb_mmu_get_default_pd(dev_priv->mmu), 0);
+	bif_ctrl = PSB_RSGX32(PSB_CR_BIF_CTRL);
+	PSB_WSGX32(bif_ctrl |
+		   _PSB_CB_CTRL_CLEAR_FAULT |
+		   _PSB_CB_CTRL_INVALDC, PSB_CR_BIF_CTRL);
+	(void)PSB_RSGX32(PSB_CR_BIF_CTRL);
+	msleep(1);
+	PSB_WSGX32(bif_ctrl, PSB_CR_BIF_CTRL);
+	(void)PSB_RSGX32(PSB_CR_BIF_CTRL);
+	return psb_xhw_reset_dpm(dev_priv, &buf);
+}
+
+/*
+ * Block command submission and reset hardware and schedulers.
+ */
+
+static void psb_reset_wq(struct work_struct *work)
+{
+	struct drm_psb_private *dev_priv =
+	    container_of(work, struct drm_psb_private, watchdog_wq);
+	int lockup_2d;
+	int idle_2d;
+	unsigned long irq_flags;
+	int ret;
+	int reset_count = 0;
+	struct psb_xhw_buf buf;
+	uint32_t xhw_lockup;
+
+	/*
+	 * Block command submission.
+	 */
+
+	mutex_lock(&dev_priv->reset_mutex);
+
+	INIT_LIST_HEAD(&buf.head);
+	if (psb_xhw_check_lockup(dev_priv, &buf, &xhw_lockup) == 0) {
+		if (xhw_lockup == 0 && psb_extend_raster_timeout(dev_priv) == 0) {
+			/*
+			 * no lockup, just re-schedule
+			 */
+			spin_lock_irqsave(&dev_priv->watchdog_lock, irq_flags);
+			dev_priv->timer_available = 1;
+			spin_unlock_irqrestore(&dev_priv->watchdog_lock,
+					       irq_flags);
+			psb_schedule_watchdog(dev_priv);
+			mutex_unlock(&dev_priv->reset_mutex);
+			return;
+		}
+	}
+#if 0
+	msleep(PSB_2D_TIMEOUT_MSEC);
+
+	psb_seq_lockup_idle(dev_priv, PSB_ENGINE_2D, &lockup_2d, &idle_2d);
+
+	if (lockup_2d) {
+		uint32_t seq_2d;
+		spin_lock(&dev_priv->sequence_lock);
+		seq_2d = dev_priv->sequence[PSB_ENGINE_2D];
+		spin_unlock(&dev_priv->sequence_lock);
+		psb_fence_error(dev_priv->scheduler.dev,
+				PSB_ENGINE_2D,
+				seq_2d, DRM_FENCE_TYPE_EXE, -EBUSY);
+		DRM_INFO("Resetting 2D engine.\n");
+	}
+
+	psb_reset(dev_priv, lockup_2d);
+#else
+	(void)lockup_2d;
+	(void)idle_2d;
+	psb_reset(dev_priv, 0);
+#endif
+	(void)psb_xhw_mmu_reset(dev_priv);
+	DRM_INFO("Resetting scheduler.\n");
+	psb_scheduler_pause(dev_priv);
+	psb_scheduler_reset(dev_priv, -EBUSY);
+	psb_scheduler_ta_mem_check(dev_priv);
+
+	while (dev_priv->ta_mem &&
+	       !dev_priv->force_ta_mem_load && ++reset_count < 10) {
+
+		/*
+		 * TA memory is currently fenced so offsets
+		 * are valid. Reload offsets into the dpm now.
+		 */
+
+		struct psb_xhw_buf buf;
+		INIT_LIST_HEAD(&buf.head);
+
+		msleep(100);
+		DRM_INFO("Trying to reload TA memory.\n");
+		ret = psb_xhw_ta_mem_load(dev_priv, &buf,
+					  PSB_TA_MEM_FLAG_TA |
+					  PSB_TA_MEM_FLAG_RASTER |
+					  PSB_TA_MEM_FLAG_HOSTA |
+					  PSB_TA_MEM_FLAG_HOSTD |
+					  PSB_TA_MEM_FLAG_INIT,
+					  dev_priv->ta_mem->ta_memory->offset,
+					  dev_priv->ta_mem->hw_data->offset,
+					  dev_priv->ta_mem->hw_cookie);
+		if (!ret)
+			break;
+
+		psb_reset(dev_priv, 0);
+		(void)psb_xhw_mmu_reset(dev_priv);
+	}
+
+	psb_scheduler_restart(dev_priv);
+	spin_lock_irqsave(&dev_priv->watchdog_lock, irq_flags);
+	dev_priv->timer_available = 1;
+	spin_unlock_irqrestore(&dev_priv->watchdog_lock, irq_flags);
+	mutex_unlock(&dev_priv->reset_mutex);
+}
+
+void psb_watchdog_init(struct drm_psb_private *dev_priv)
+{
+	struct timer_list *wt = &dev_priv->watchdog_timer;
+	unsigned long irq_flags;
+
+	dev_priv->watchdog_lock = SPIN_LOCK_UNLOCKED;
+	spin_lock_irqsave(&dev_priv->watchdog_lock, irq_flags);
+	init_timer(wt);
+	INIT_WORK(&dev_priv->watchdog_wq, &psb_reset_wq);
+	INIT_WORK(&dev_priv->msvdx_watchdog_wq, &psb_msvdx_reset_wq);
+	wt->data = (unsigned long)dev_priv;
+	wt->function = &psb_watchdog_func;
+	dev_priv->timer_available = 1;
+	spin_unlock_irqrestore(&dev_priv->watchdog_lock, irq_flags);
+}
+
+void psb_watchdog_takedown(struct drm_psb_private *dev_priv)
+{
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&dev_priv->watchdog_lock, irq_flags);
+	dev_priv->timer_available = 0;
+	spin_unlock_irqrestore(&dev_priv->watchdog_lock, irq_flags);
+	(void)del_timer_sync(&dev_priv->watchdog_timer);
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_scene.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_scene.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,531 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thomas-at-tungstengraphics.com>
+ */
+
+#include "drmP.h"
+#include "psb_drv.h"
+#include "psb_scene.h"
+
+void psb_clear_scene_atomic(struct psb_scene *scene)
+{
+	int i;
+	struct page *page;
+	void *v;
+
+	for (i = 0; i < scene->clear_num_pages; ++i) {
+		page = drm_ttm_get_page(scene->hw_data->ttm,
+					scene->clear_p_start + i);
+		if (in_irq())
+			v = kmap_atomic(page, KM_IRQ0);
+		else
+			v = kmap_atomic(page, KM_USER0);
+
+		memset(v, 0, PAGE_SIZE);
+
+		if (in_irq())
+			kunmap_atomic(v, KM_IRQ0);
+		else
+			kunmap_atomic(v, KM_USER0);
+	}
+}
+
+int psb_clear_scene(struct psb_scene *scene)
+{
+	struct drm_bo_kmap_obj bmo;
+	int is_iomem;
+	void *addr;
+
+	int ret = drm_bo_kmap(scene->hw_data, scene->clear_p_start,
+			      scene->clear_num_pages, &bmo);
+
+	PSB_DEBUG_RENDER("Scene clear\n");
+	if (ret)
+		return ret;
+
+	addr = drm_bmo_virtual(&bmo, &is_iomem);
+	BUG_ON(is_iomem);
+	memset(addr, 0, scene->clear_num_pages << PAGE_SHIFT);
+	drm_bo_kunmap(&bmo);
+
+	return 0;
+}
+
+static void psb_destroy_scene_devlocked(struct psb_scene *scene)
+{
+	if (!scene)
+		return;
+
+	PSB_DEBUG_RENDER("Scene destroy\n");
+	drm_bo_usage_deref_locked(&scene->hw_data);
+	drm_free(scene, sizeof(*scene), DRM_MEM_DRIVER);
+}
+
+void psb_scene_unref_devlocked(struct psb_scene **scene)
+{
+	struct psb_scene *tmp_scene = *scene;
+
+	PSB_DEBUG_RENDER("Scene unref\n");
+	*scene = NULL;
+	if (atomic_dec_and_test(&tmp_scene->ref_count)) {
+		psb_scheduler_remove_scene_refs(tmp_scene);
+		psb_destroy_scene_devlocked(tmp_scene);
+	}
+}
+
+struct psb_scene *psb_scene_ref(struct psb_scene *src)
+{
+	PSB_DEBUG_RENDER("Scene ref\n");
+	atomic_inc(&src->ref_count);
+	return src;
+}
+
+static struct psb_scene *psb_alloc_scene(struct drm_device *dev,
+					 uint32_t w, uint32_t h)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	int ret = -EINVAL;
+	struct psb_scene *scene;
+	uint32_t bo_size;
+	struct psb_xhw_buf buf;
+
+	PSB_DEBUG_RENDER("Alloc scene w %u h %u\n", w, h);
+
+	scene = drm_calloc(1, sizeof(*scene), DRM_MEM_DRIVER);
+
+	if (!scene) {
+		DRM_ERROR("Out of memory allocating scene object.\n");
+		return NULL;
+	}
+
+	scene->dev = dev;
+	scene->w = w;
+	scene->h = h;
+	scene->hw_scene = NULL;
+	atomic_set(&scene->ref_count, 1);
+
+	INIT_LIST_HEAD(&buf.head);
+	ret = psb_xhw_scene_info(dev_priv, &buf, scene->w, scene->h,
+				 scene->hw_cookie, &bo_size,
+				 &scene->clear_p_start,
+				 &scene->clear_num_pages);
+	if (ret)
+		goto out_err;
+
+	ret = drm_buffer_object_create(dev, bo_size, drm_bo_type_kernel,
+				       DRM_PSB_FLAG_MEM_MMU |
+				       DRM_BO_FLAG_READ |
+				       DRM_BO_FLAG_CACHED |
+				       PSB_BO_FLAG_SCENE |
+				       DRM_BO_FLAG_WRITE,
+				       DRM_BO_HINT_DONT_FENCE,
+				       0, 0, &scene->hw_data);
+	if (ret)
+		goto out_err;
+
+	return scene;
+      out_err:
+	drm_free(scene, sizeof(*scene), DRM_MEM_DRIVER);
+	return NULL;
+}
+
+int psb_validate_scene_pool(struct psb_scene_pool *pool, uint64_t flags,
+			    uint64_t mask,
+			    uint32_t hint,
+			    uint32_t w,
+			    uint32_t h,
+			    int final_pass, struct psb_scene **scene_p)
+{
+	struct drm_device *dev = pool->dev;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct psb_scene *scene = pool->scenes[pool->cur_scene];
+	int ret;
+	unsigned long irq_flags;
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	uint32_t bin_pt_offset;
+	uint32_t bin_param_offset;
+
+	PSB_DEBUG_RENDER("Validate scene pool. Scene %u\n", pool->cur_scene);
+
+	if (unlikely(!dev_priv->ta_mem)) {
+		dev_priv->ta_mem =
+		    psb_alloc_ta_mem(dev, dev_priv->ta_mem_pages);
+		if (!dev_priv->ta_mem)
+			return -ENOMEM;
+
+		bin_pt_offset = ~0;
+		bin_param_offset = ~0;
+	} else {
+		bin_pt_offset = dev_priv->ta_mem->hw_data->offset;
+		bin_param_offset = dev_priv->ta_mem->ta_memory->offset;
+	}
+
+	pool->w = w;
+	pool->h = h;
+	if (scene && (scene->w != pool->w || scene->h != pool->h)) {
+		spin_lock_irqsave(&scheduler->lock, irq_flags);
+		if (scene->flags & PSB_SCENE_FLAG_DIRTY) {
+			spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+			DRM_ERROR("Trying to resize a dirty scene.\n");
+			return -EINVAL;
+		}
+		spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+		mutex_lock(&dev->struct_mutex);
+		psb_scene_unref_devlocked(&pool->scenes[pool->cur_scene]);
+		mutex_unlock(&dev->struct_mutex);
+		scene = NULL;
+	}
+
+	if (!scene) {
+		pool->scenes[pool->cur_scene] = scene =
+		    psb_alloc_scene(pool->dev, pool->w, pool->h);
+
+		if (!scene)
+			return -ENOMEM;
+
+		scene->flags = PSB_SCENE_FLAG_CLEARED;
+	}
+
+	/*
+	 * FIXME: We need atomic bit manipulation here for the
+	 * scheduler. For now use the spinlock.
+	 */
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	if (!(scene->flags & PSB_SCENE_FLAG_CLEARED)) {
+		spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+		PSB_DEBUG_RENDER("Waiting to clear scene memory.\n");
+		mutex_lock(&scene->hw_data->mutex);
+		ret = drm_bo_wait(scene->hw_data, 0, 0, 0);
+		mutex_unlock(&scene->hw_data->mutex);
+		if (ret)
+			return ret;
+
+		ret = psb_clear_scene(scene);
+
+		if (ret)
+			return ret;
+		spin_lock_irqsave(&scheduler->lock, irq_flags);
+		scene->flags |= PSB_SCENE_FLAG_CLEARED;
+	}
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+
+	ret = drm_bo_do_validate(scene->hw_data, flags, mask, hint,
+				 PSB_ENGINE_TA, 0, NULL);
+	if (ret)
+		return ret;
+	ret = drm_bo_do_validate(dev_priv->ta_mem->hw_data, 0, 0, 0,
+				 PSB_ENGINE_TA, 0, NULL);
+	if (ret)
+		return ret;
+	ret = drm_bo_do_validate(dev_priv->ta_mem->ta_memory, 0, 0, 0,
+				 PSB_ENGINE_TA, 0, NULL);
+	if (ret)
+		return ret;
+
+	if (unlikely(bin_param_offset !=
+		     dev_priv->ta_mem->ta_memory->offset ||
+		     bin_pt_offset !=
+		     dev_priv->ta_mem->hw_data->offset ||
+		     dev_priv->force_ta_mem_load)) {
+
+		struct psb_xhw_buf buf;
+
+		INIT_LIST_HEAD(&buf.head);
+		ret = psb_xhw_ta_mem_load(dev_priv, &buf,
+					  PSB_TA_MEM_FLAG_TA |
+					  PSB_TA_MEM_FLAG_RASTER |
+					  PSB_TA_MEM_FLAG_HOSTA |
+					  PSB_TA_MEM_FLAG_HOSTD |
+					  PSB_TA_MEM_FLAG_INIT,
+					  dev_priv->ta_mem->ta_memory->offset,
+					  dev_priv->ta_mem->hw_data->offset,
+					  dev_priv->ta_mem->hw_cookie);
+		if (ret)
+			return ret;
+
+		dev_priv->force_ta_mem_load = 0;
+	}
+
+	if (final_pass) {
+
+		/*
+		 * Clear the scene on next use. Advance the scene counter.
+		 */
+
+		spin_lock_irqsave(&scheduler->lock, irq_flags);
+		scene->flags &= ~PSB_SCENE_FLAG_CLEARED;
+		spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+		pool->cur_scene = (pool->cur_scene + 1) % pool->num_scenes;
+	}
+
+	*scene_p = psb_scene_ref(scene);
+	return 0;
+}
+
+static void psb_scene_pool_destroy_devlocked(struct psb_scene_pool *pool)
+{
+	int i;
+
+	if (!pool)
+		return;
+
+	PSB_DEBUG_RENDER("Scene pool destroy.\n");
+	for (i = 0; i < pool->num_scenes; ++i) {
+		PSB_DEBUG_RENDER("scenes %d is 0x%08lx\n", i,
+				 (unsigned long)pool->scenes[i]);
+		if (pool->scenes[i])
+			psb_scene_unref_devlocked(&pool->scenes[i]);
+	}
+	drm_free(pool, sizeof(*pool), DRM_MEM_DRIVER);
+}
+
+void psb_scene_pool_unref_devlocked(struct psb_scene_pool **pool)
+{
+	struct psb_scene_pool *tmp_pool = *pool;
+	struct drm_device *dev = tmp_pool->dev;
+
+	PSB_DEBUG_RENDER("Scene pool unref\n");
+	(void)dev;
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+	*pool = NULL;
+	if (--tmp_pool->ref_count == 0)
+		psb_scene_pool_destroy_devlocked(tmp_pool);
+}
+
+struct psb_scene_pool *psb_scene_pool_ref_devlocked(struct psb_scene_pool *src)
+{
+	++src->ref_count;
+	return src;
+}
+
+/*
+ * Callback for user object manager.
+ */
+
+static void psb_scene_pool_destroy(struct drm_file *priv,
+				   struct drm_user_object *base)
+{
+	struct psb_scene_pool *pool =
+	    drm_user_object_entry(base, struct psb_scene_pool, user);
+
+	psb_scene_pool_unref_devlocked(&pool);
+}
+
+struct psb_scene_pool *psb_scene_pool_lookup_devlocked(struct drm_file *priv,
+						       uint32_t handle,
+						       int check_owner)
+{
+	struct drm_user_object *uo;
+	struct psb_scene_pool *pool;
+
+	uo = drm_lookup_user_object(priv, handle);
+	if (!uo || (uo->type != PSB_USER_OBJECT_SCENE_POOL)) {
+		DRM_ERROR("Could not find scene pool object 0x%08x\n", handle);
+		return NULL;
+	}
+
+	if (check_owner && priv != uo->owner) {
+		if (!drm_lookup_ref_object(priv, uo, _DRM_REF_USE))
+			return NULL;
+	}
+
+	pool = drm_user_object_entry(uo, struct psb_scene_pool, user);
+	return psb_scene_pool_ref_devlocked(pool);
+}
+
+struct psb_scene_pool *psb_scene_pool_alloc(struct drm_file *priv,
+					    int shareable,
+					    uint32_t num_scenes,
+					    uint32_t w, uint32_t h)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct psb_scene_pool *pool;
+	int ret;
+
+	PSB_DEBUG_RENDER("Scene pool alloc\n");
+	pool = drm_calloc(1, sizeof(*pool), DRM_MEM_DRIVER);
+	if (!pool) {
+		DRM_ERROR("Out of memory allocating scene pool object.\n");
+		return NULL;
+	}
+	pool->w = w;
+	pool->h = h;
+	pool->dev = dev;
+	pool->num_scenes = num_scenes;
+
+	mutex_lock(&dev->struct_mutex);
+	ret = drm_add_user_object(priv, &pool->user, shareable);
+	if (ret)
+		goto out_err;
+
+	pool->user.type = PSB_USER_OBJECT_SCENE_POOL;
+	pool->user.remove = &psb_scene_pool_destroy;
+	pool->ref_count = 2;
+	mutex_unlock(&dev->struct_mutex);
+	return pool;
+      out_err:
+	drm_free(pool, sizeof(*pool), DRM_MEM_DRIVER);
+	return NULL;
+}
+
+/*
+ * Code to support multiple ta memory buffers.
+ */
+
+static void psb_destroy_ta_mem_devlocked(struct psb_ta_mem *ta_mem)
+{
+	if (!ta_mem)
+		return;
+
+	drm_bo_usage_deref_locked(&ta_mem->hw_data);
+	drm_bo_usage_deref_locked(&ta_mem->ta_memory);
+	drm_free(ta_mem, sizeof(*ta_mem), DRM_MEM_DRIVER);
+}
+
+void psb_ta_mem_unref_devlocked(struct psb_ta_mem **ta_mem)
+{
+	struct psb_ta_mem *tmp_ta_mem = *ta_mem;
+	struct drm_device *dev = tmp_ta_mem->dev;
+
+	(void)dev;
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+	*ta_mem = NULL;
+	if (--tmp_ta_mem->ref_count == 0)
+		psb_destroy_ta_mem_devlocked(tmp_ta_mem);
+}
+
+void psb_ta_mem_ref_devlocked(struct psb_ta_mem **dst, struct psb_ta_mem *src)
+{
+	struct drm_device *dev = src->dev;
+
+	(void)dev;
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+	*dst = src;
+	++src->ref_count;
+}
+
+struct psb_ta_mem *psb_alloc_ta_mem(struct drm_device *dev, uint32_t pages)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	int ret = -EINVAL;
+	struct psb_ta_mem *ta_mem;
+	uint32_t bo_size;
+	struct psb_xhw_buf buf;
+
+	INIT_LIST_HEAD(&buf.head);
+
+	ta_mem = drm_calloc(1, sizeof(*ta_mem), DRM_MEM_DRIVER);
+
+	if (!ta_mem) {
+		DRM_ERROR("Out of memory allocating parameter memory.\n");
+		return NULL;
+	}
+
+	ret = psb_xhw_ta_mem_info(dev_priv, &buf, pages,
+				  ta_mem->hw_cookie, &bo_size);
+	if (ret == -ENOMEM) {
+		DRM_ERROR("Parameter memory size is too small.\n");
+		DRM_INFO("Attempted to use %u kiB of parameter memory.\n",
+			 (unsigned int)(pages * (PAGE_SIZE / 1024)));
+		DRM_INFO("The Xpsb driver thinks this is too small and\n");
+		DRM_INFO("suggests %u kiB. Check the psb DRM\n",
+			 (unsigned int)(bo_size / 1024));
+		DRM_INFO("\"ta_mem_size\" parameter!\n");
+	}
+	if (ret)
+		goto out_err0;
+
+	bo_size = pages * PAGE_SIZE;
+	ta_mem->dev = dev;
+	ret = drm_buffer_object_create(dev, bo_size, drm_bo_type_kernel,
+				       DRM_PSB_FLAG_MEM_MMU | DRM_BO_FLAG_READ |
+				       DRM_BO_FLAG_WRITE |
+				       PSB_BO_FLAG_SCENE,
+				       DRM_BO_HINT_DONT_FENCE, 0, 0,
+				       &ta_mem->hw_data);
+	if (ret)
+		goto out_err0;
+
+	ret =
+	    drm_buffer_object_create(dev, pages << PAGE_SHIFT,
+				     drm_bo_type_kernel,
+				     DRM_PSB_FLAG_MEM_RASTGEOM |
+				     DRM_BO_FLAG_READ |
+				     DRM_BO_FLAG_WRITE |
+				     PSB_BO_FLAG_SCENE,
+				     DRM_BO_HINT_DONT_FENCE, 0,
+				     1024 * 1024 >> PAGE_SHIFT,
+				     &ta_mem->ta_memory);
+	if (ret)
+		goto out_err1;
+
+	ta_mem->ref_count = 1;
+	return ta_mem;
+      out_err1:
+	drm_bo_usage_deref_unlocked(&ta_mem->hw_data);
+      out_err0:
+	drm_free(ta_mem, sizeof(*ta_mem), DRM_MEM_DRIVER);
+	return NULL;
+}
+
+int drm_psb_scene_unref_ioctl(struct drm_device *dev,
+			      void *data, struct drm_file *file_priv)
+{
+	struct drm_psb_scene *scene = (struct drm_psb_scene *)data;
+	struct drm_user_object *uo;
+	struct drm_ref_object *ro;
+	int ret = 0;
+
+	mutex_lock(&dev->struct_mutex);
+	if (!scene->handle_valid)
+		goto out_unlock;
+
+	uo = drm_lookup_user_object(file_priv, scene->handle);
+	if (!uo) {
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+	if (uo->type != PSB_USER_OBJECT_SCENE_POOL) {
+		DRM_ERROR("Not a scene pool object.\n");
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+	if (uo->owner != file_priv) {
+		DRM_ERROR("Not owner of scene pool object.\n");
+		ret = -EPERM;
+		goto out_unlock;
+	}
+
+	scene->handle_valid = 0;
+	ro = drm_lookup_ref_object(file_priv, uo, _DRM_REF_USE);
+	BUG_ON(!ro);
+	drm_remove_ref_object(file_priv, ro);
+
+      out_unlock:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_scene.h
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_scene.h	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,112 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thomas-at-tungstengraphics.com>
+ */
+
+#ifndef _PSB_SCENE_H_
+#define _PSB_SCENE_H_
+
+#define PSB_USER_OBJECT_SCENE_POOL    drm_driver_type0
+#define PSB_USER_OBJECT_TA_MEM       drm_driver_type1
+#define PSB_MAX_NUM_SCENES            8
+
+struct psb_hw_scene;
+struct psb_hw_ta_mem;
+
+struct psb_scene_pool {
+	struct drm_device *dev;
+	struct drm_user_object user;
+	uint32_t ref_count;
+	uint32_t w;
+	uint32_t h;
+	uint32_t cur_scene;
+	struct psb_scene *scenes[PSB_MAX_NUM_SCENES];
+	uint32_t num_scenes;
+};
+
+struct psb_scene {
+	struct drm_device *dev;
+	atomic_t ref_count;
+	uint32_t hw_cookie[PSB_SCENE_HW_COOKIE_SIZE];
+	uint32_t bo_size;
+	uint32_t w;
+	uint32_t h;
+	struct psb_ta_mem *ta_mem;
+	struct psb_hw_scene *hw_scene;
+	struct drm_buffer_object *hw_data;
+	uint32_t flags;
+	uint32_t clear_p_start;
+	uint32_t clear_num_pages;
+};
+
+struct psb_scene_entry {
+	struct list_head head;
+	struct psb_scene *scene;
+};
+
+struct psb_user_scene {
+	struct drm_device *dev;
+	struct drm_user_object user;
+};
+
+struct psb_ta_mem {
+	struct drm_device *dev;
+	struct drm_user_object user;
+	uint32_t ref_count;
+	uint32_t hw_cookie[PSB_TA_MEM_HW_COOKIE_SIZE];
+	uint32_t bo_size;
+	struct drm_buffer_object *ta_memory;
+	struct drm_buffer_object *hw_data;
+	int is_deallocating;
+	int deallocating_scheduled;
+};
+
+extern struct psb_scene_pool *psb_scene_pool_alloc(struct drm_file *priv,
+						   int shareable,
+						   uint32_t num_scenes,
+						   uint32_t w, uint32_t h);
+extern void psb_scene_pool_unref_devlocked(struct psb_scene_pool **pool);
+extern struct psb_scene_pool *psb_scene_pool_lookup_devlocked(struct drm_file
+							      *priv,
+							      uint32_t handle,
+							      int check_owner);
+extern int psb_validate_scene_pool(struct psb_scene_pool *pool, uint64_t flags,
+				   uint64_t mask, uint32_t hint, uint32_t w,
+				   uint32_t h, int final_pass,
+				   struct psb_scene **scene_p);
+extern void psb_scene_unref_devlocked(struct psb_scene **scene);
+extern struct psb_scene *psb_scene_ref(struct psb_scene *src);
+extern int drm_psb_scene_unref_ioctl(struct drm_device *dev,
+				     void *data, struct drm_file *file_priv);
+
+static inline uint32_t psb_scene_pool_handle(struct psb_scene_pool *pool)
+{
+	return pool->user.hash.key;
+}
+extern struct psb_ta_mem *psb_alloc_ta_mem(struct drm_device *dev,
+					   uint32_t pages);
+extern void psb_ta_mem_ref_devlocked(struct psb_ta_mem **dst,
+				     struct psb_ta_mem *src);
+extern void psb_ta_mem_unref_devlocked(struct psb_ta_mem **ta_mem);
+
+#endif
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_schedule.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_schedule.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,1445 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thomas-at-tungstengraphics.com>
+ */
+
+#include "drmP.h"
+#include "psb_drm.h"
+#include "psb_drv.h"
+#include "psb_reg.h"
+#include "psb_scene.h"
+
+#define PSB_ALLOWED_RASTER_RUNTIME (DRM_HZ * 20)
+#define PSB_RASTER_TIMEOUT (DRM_HZ / 2)
+#define PSB_TA_TIMEOUT (DRM_HZ / 5)
+
+#undef PSB_SOFTWARE_WORKAHEAD
+
+#ifdef PSB_STABLE_SETTING
+
+/*
+ * Software blocks completely while the engines are working so there can be no
+ * overlap.
+ */
+
+#define PSB_WAIT_FOR_RASTER_COMPLETION
+#define PSB_WAIT_FOR_TA_COMPLETION
+
+#elif defined(PSB_PARANOID_SETTING)
+/*
+ * Software blocks "almost" while the engines are working so there can be no
+ * overlap.
+ */
+
+#define PSB_WAIT_FOR_RASTER_COMPLETION
+#define PSB_WAIT_FOR_TA_COMPLETION
+#define PSB_BE_PARANOID
+
+#elif defined(PSB_SOME_OVERLAP_BUT_LOCKUP)
+/*
+ * Software leaps ahead while the rasterizer is running and prepares
+ * a new ta job that can be scheduled before the rasterizer has
+ * finished.
+ */
+
+#define PSB_WAIT_FOR_TA_COMPLETION
+
+#elif defined(PSB_SOFTWARE_WORKAHEAD)
+/*
+ * Don't sync, but allow software to work ahead. and queue a number of jobs.
+ * But block overlapping in the scheduler.
+ */
+
+#define PSB_BLOCK_OVERLAP
+#define ONLY_ONE_JOB_IN_RASTER_QUEUE
+
+#endif
+
+/*
+ * Avoid pixelbe pagefaults on C0.
+ */
+#if 0
+#define PSB_BLOCK_OVERLAP
+#endif
+
+static void psb_dispatch_ta(struct drm_psb_private *dev_priv,
+			    struct psb_scheduler *scheduler,
+			    uint32_t reply_flag);
+static void psb_dispatch_raster(struct drm_psb_private *dev_priv,
+				struct psb_scheduler *scheduler,
+				uint32_t reply_flag);
+
+#ifdef FIX_TG_16
+
+static void psb_2d_atomic_unlock(struct drm_psb_private *dev_priv);
+static int psb_2d_trylock(struct drm_psb_private *dev_priv);
+static int psb_check_2d_idle(struct drm_psb_private *dev_priv);
+
+#endif
+
+void psb_scheduler_lockup(struct drm_psb_private *dev_priv,
+			  int *lockup, int *idle)
+{
+	unsigned long irq_flags;
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+
+	*lockup = 0;
+	*idle = 1;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+
+	if (scheduler->current_task[PSB_SCENE_ENGINE_TA] != NULL &&
+	    time_after_eq(jiffies, scheduler->ta_end_jiffies)) {
+		*lockup = 1;
+	}
+	if (!*lockup
+	    && (scheduler->current_task[PSB_SCENE_ENGINE_RASTER] != NULL)
+	    && time_after_eq(jiffies, scheduler->raster_end_jiffies)) {
+		*lockup = 1;
+	}
+	if (!*lockup)
+		*idle = scheduler->idle;
+
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+}
+
+static inline void psb_set_idle(struct psb_scheduler *scheduler)
+{
+	scheduler->idle =
+	    (scheduler->current_task[PSB_SCENE_ENGINE_RASTER] == NULL) &&
+	    (scheduler->current_task[PSB_SCENE_ENGINE_TA] == NULL);
+	if (scheduler->idle)
+		wake_up(&scheduler->idle_queue);
+}
+
+/*
+ * Call with the scheduler spinlock held.
+ * Assigns a scene context to either the ta or the rasterizer,
+ * flushing out other scenes to memory if necessary.
+ */
+
+static int psb_set_scene_fire(struct psb_scheduler *scheduler,
+			      struct psb_scene *scene,
+			      int engine, struct psb_task *task)
+{
+	uint32_t flags = 0;
+	struct psb_hw_scene *hw_scene;
+	struct drm_device *dev = scene->dev;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+
+	hw_scene = scene->hw_scene;
+	if (hw_scene && hw_scene->last_scene == scene) {
+
+		/*
+		 * Reuse the last hw scene context and delete it from the
+		 * free list.
+		 */
+
+		PSB_DEBUG_RENDER("Reusing hw scene %d.\n",
+				 hw_scene->context_number);
+		if (scene->flags & PSB_SCENE_FLAG_DIRTY) {
+
+			/*
+			 * No hw context initialization to be done.
+			 */
+
+			flags |= PSB_SCENE_FLAG_SETUP_ONLY;
+		}
+
+		list_del_init(&hw_scene->head);
+
+	} else {
+		struct list_head *list;
+		hw_scene = NULL;
+
+		/*
+		 * Grab a new hw scene context.
+		 */
+
+		list_for_each(list, &scheduler->hw_scenes) {
+			hw_scene = list_entry(list, struct psb_hw_scene, head);
+			break;
+		}
+		BUG_ON(!hw_scene);
+		PSB_DEBUG_RENDER("New hw scene %d.\n",
+				 hw_scene->context_number);
+
+		list_del_init(list);
+	}
+	scene->hw_scene = hw_scene;
+	hw_scene->last_scene = scene;
+
+	flags |= PSB_SCENE_FLAG_SETUP;
+
+	/*
+	 * Switch context and setup the engine.
+	 */
+
+	return psb_xhw_scene_bind_fire(dev_priv,
+				       &task->buf,
+				       task->flags,
+				       hw_scene->context_number,
+				       scene->hw_cookie,
+				       task->oom_cmds,
+				       task->oom_cmd_size,
+				       scene->hw_data->offset,
+				       engine, flags | scene->flags);
+}
+
+static inline void psb_report_fence(struct psb_scheduler *scheduler,
+				    uint32_t class,
+				    uint32_t sequence,
+				    uint32_t type, int call_handler)
+{
+	struct psb_scheduler_seq *seq = &scheduler->seq[type];
+
+	seq->sequence = sequence;
+	seq->reported = 0;
+	if (call_handler)
+		psb_fence_handler(scheduler->dev, class);
+}
+
+static void psb_schedule_raster(struct drm_psb_private *dev_priv,
+				struct psb_scheduler *scheduler);
+
+static void psb_schedule_ta(struct drm_psb_private *dev_priv,
+			    struct psb_scheduler *scheduler)
+{
+	struct psb_task *task = NULL;
+	struct list_head *list, *next;
+	int pushed_raster_task = 0;
+
+	PSB_DEBUG_RENDER("schedule ta\n");
+
+	if (scheduler->idle_count != 0)
+		return;
+
+	if (scheduler->current_task[PSB_SCENE_ENGINE_TA] != NULL)
+		return;
+
+	if (scheduler->ta_state)
+		return;
+
+	/*
+	 * Skip the ta stage for rasterization-only
+	 * tasks. They arrive here to make sure we're rasterizing
+	 * tasks in the correct order.
+	 */
+
+	list_for_each_safe(list, next, &scheduler->ta_queue) {
+		task = list_entry(list, struct psb_task, head);
+		if (task->task_type != psb_raster_task)
+			break;
+
+		list_del_init(list);
+		list_add_tail(list, &scheduler->raster_queue);
+		psb_report_fence(scheduler, task->engine, task->sequence,
+				 _PSB_FENCE_TA_DONE_SHIFT, 1);
+		task = NULL;
+		pushed_raster_task = 1;
+	}
+
+	if (pushed_raster_task)
+		psb_schedule_raster(dev_priv, scheduler);
+
+	if (!task)
+		return;
+
+	/*
+	 * Still waiting for a vistest?
+	 */
+
+	if (scheduler->feedback_task == task)
+		return;
+
+#ifdef ONLY_ONE_JOB_IN_RASTER_QUEUE
+
+	/*
+	 * Block ta from trying to use both hardware contexts
+	 * without the rasterizer starting to render from one of them.
+	 */
+
+	if (!list_empty(&scheduler->raster_queue)) {
+		return;
+	}
+#endif
+
+#ifdef PSB_BLOCK_OVERLAP
+	/*
+	 * Make sure rasterizer isn't doing anything.
+	 */
+	if (scheduler->current_task[PSB_SCENE_ENGINE_RASTER] != NULL)
+		return;
+#endif
+	if (list_empty(&scheduler->hw_scenes))
+		return;
+
+#ifdef FIX_TG_16
+	if (psb_check_2d_idle(dev_priv))
+		return;
+#endif
+
+	list_del_init(&task->head);
+	if (task->flags & PSB_FIRE_FLAG_XHW_OOM)
+		scheduler->ta_state = 1;
+
+	scheduler->current_task[PSB_SCENE_ENGINE_TA] = task;
+	scheduler->idle = 0;
+	scheduler->ta_end_jiffies = jiffies + PSB_TA_TIMEOUT;
+
+	task->reply_flags = (task->flags & PSB_FIRE_FLAG_XHW_OOM) ?
+	    0x00000000 : PSB_RF_FIRE_TA;
+
+	(void)psb_reg_submit(dev_priv, task->ta_cmds, task->ta_cmd_size);
+	psb_set_scene_fire(scheduler, task->scene, PSB_SCENE_ENGINE_TA, task);
+	psb_schedule_watchdog(dev_priv);
+}
+
+static int psb_fire_raster(struct psb_scheduler *scheduler,
+			   struct psb_task *task)
+{
+	struct drm_device *dev = scheduler->dev;
+	struct drm_psb_private *dev_priv = (struct drm_psb_private *)
+	    dev->dev_private;
+
+	PSB_DEBUG_RENDER("Fire raster %d\n", task->sequence);
+
+	return psb_xhw_fire_raster(dev_priv, &task->buf, task->flags);
+}
+
+/*
+ * Take the first rasterization task from the hp raster queue or from the
+ * raster queue and fire the rasterizer.
+ */
+
+static void psb_schedule_raster(struct drm_psb_private *dev_priv,
+				struct psb_scheduler *scheduler)
+{
+	struct psb_task *task;
+	struct list_head *list;
+
+	if (scheduler->idle_count != 0)
+		return;
+
+	if (scheduler->current_task[PSB_SCENE_ENGINE_RASTER] != NULL) {
+		PSB_DEBUG_RENDER("Raster busy.\n");
+		return;
+	}
+#ifdef PSB_BLOCK_OVERLAP
+	if (scheduler->current_task[PSB_SCENE_ENGINE_TA] != NULL) {
+		PSB_DEBUG_RENDER("TA busy.\n");
+		return;
+	}
+#endif
+
+	if (!list_empty(&scheduler->hp_raster_queue))
+		list = scheduler->hp_raster_queue.next;
+	else if (!list_empty(&scheduler->raster_queue))
+		list = scheduler->raster_queue.next;
+	else {
+		PSB_DEBUG_RENDER("Nothing in list\n");
+		return;
+	}
+
+	task = list_entry(list, struct psb_task, head);
+
+	/*
+	 * Sometimes changing ZLS format requires an ISP reset.
+	 * Doesn't seem to consume too much time.
+	 */
+
+	if (task->scene)
+		PSB_WSGX32(_PSB_CS_RESET_ISP_RESET, PSB_CR_SOFT_RESET);
+
+	scheduler->current_task[PSB_SCENE_ENGINE_RASTER] = task;
+
+	list_del_init(list);
+	scheduler->idle = 0;
+	scheduler->raster_end_jiffies = jiffies + PSB_RASTER_TIMEOUT;
+	scheduler->total_raster_jiffies = 0;
+
+	if (task->scene)
+		PSB_WSGX32(0, PSB_CR_SOFT_RESET);
+
+	(void)psb_reg_submit(dev_priv, task->raster_cmds,
+			     task->raster_cmd_size);
+
+	if (task->scene) {
+		task->reply_flags = (task->flags & PSB_FIRE_FLAG_XHW_OOM) ?
+		    0x00000000 : PSB_RF_FIRE_RASTER;
+		psb_set_scene_fire(scheduler,
+				   task->scene, PSB_SCENE_ENGINE_RASTER, task);
+	} else {
+		task->reply_flags = PSB_RF_DEALLOC | PSB_RF_FIRE_RASTER;
+		psb_fire_raster(scheduler, task);
+	}
+	psb_schedule_watchdog(dev_priv);
+}
+
+int psb_extend_raster_timeout(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+	int ret;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	scheduler->total_raster_jiffies +=
+	    jiffies - scheduler->raster_end_jiffies + PSB_RASTER_TIMEOUT;
+	scheduler->raster_end_jiffies = jiffies + PSB_RASTER_TIMEOUT;
+	ret = (scheduler->total_raster_jiffies > PSB_ALLOWED_RASTER_RUNTIME) ?
+	    -EBUSY : 0;
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+	return ret;
+}
+
+/*
+ * TA done handler.
+ */
+
+static void psb_ta_done(struct drm_psb_private *dev_priv,
+			struct psb_scheduler *scheduler)
+{
+	struct psb_task *task = scheduler->current_task[PSB_SCENE_ENGINE_TA];
+	struct psb_scene *scene = task->scene;
+
+	PSB_DEBUG_RENDER("TA done %u\n", task->sequence);
+
+	switch (task->ta_complete_action) {
+	case PSB_RASTER_BLOCK:
+		scheduler->ta_state = 1;
+		scene->flags |=
+		    (PSB_SCENE_FLAG_DIRTY | PSB_SCENE_FLAG_COMPLETE);
+		list_add_tail(&task->head, &scheduler->raster_queue);
+		break;
+	case PSB_RASTER:
+		scene->flags |=
+		    (PSB_SCENE_FLAG_DIRTY | PSB_SCENE_FLAG_COMPLETE);
+		list_add_tail(&task->head, &scheduler->raster_queue);
+		break;
+	case PSB_RETURN:
+		scheduler->ta_state = 0;
+		scene->flags |= PSB_SCENE_FLAG_DIRTY;
+		list_add_tail(&scene->hw_scene->head, &scheduler->hw_scenes);
+
+		break;
+	}
+
+	scheduler->current_task[PSB_SCENE_ENGINE_TA] = NULL;
+
+#ifdef FIX_TG_16
+	psb_2d_atomic_unlock(dev_priv);
+#endif
+
+	if (task->ta_complete_action != PSB_RASTER_BLOCK)
+		psb_report_fence(scheduler, task->engine, task->sequence,
+				 _PSB_FENCE_TA_DONE_SHIFT, 1);
+
+	psb_schedule_raster(dev_priv, scheduler);
+	psb_schedule_ta(dev_priv, scheduler);
+	psb_set_idle(scheduler);
+
+	if (task->ta_complete_action != PSB_RETURN)
+		return;
+
+	list_add_tail(&task->head, &scheduler->task_done_queue);
+	schedule_delayed_work(&scheduler->wq, 1);
+}
+
+/*
+ * Rasterizer done handler.
+ */
+
+static void psb_raster_done(struct drm_psb_private *dev_priv,
+			    struct psb_scheduler *scheduler)
+{
+	struct psb_task *task =
+	    scheduler->current_task[PSB_SCENE_ENGINE_RASTER];
+	struct psb_scene *scene = task->scene;
+	uint32_t complete_action = task->raster_complete_action;
+
+	PSB_DEBUG_RENDER("Raster done %u\n", task->sequence);
+
+	scheduler->current_task[PSB_SCENE_ENGINE_RASTER] = NULL;
+
+	if (complete_action != PSB_RASTER)
+		psb_schedule_raster(dev_priv, scheduler);
+
+	if (scene) {
+		if (task->feedback.page) {
+			if (unlikely(scheduler->feedback_task)) {
+				/*
+				 * This should never happen, since the previous
+				 * feedback query will return before the next
+				 * raster task is fired.
+				 */
+				DRM_ERROR("Feedback task busy.\n");
+			}
+			scheduler->feedback_task = task;
+			psb_xhw_vistest(dev_priv, &task->buf);
+		}
+		switch (complete_action) {
+		case PSB_RETURN:
+			scene->flags &=
+			    ~(PSB_SCENE_FLAG_DIRTY | PSB_SCENE_FLAG_COMPLETE);
+			list_add_tail(&scene->hw_scene->head,
+				      &scheduler->hw_scenes);
+			psb_report_fence(scheduler, task->engine,
+					 task->sequence,
+					 _PSB_FENCE_SCENE_DONE_SHIFT, 1);
+			if (task->flags & PSB_FIRE_FLAG_XHW_OOM) {
+				scheduler->ta_state = 0;
+			}
+			break;
+		case PSB_RASTER:
+			list_add(&task->head, &scheduler->raster_queue);
+			task->raster_complete_action = PSB_RETURN;
+			psb_schedule_raster(dev_priv, scheduler);
+			break;
+		case PSB_TA:
+			list_add(&task->head, &scheduler->ta_queue);
+			scheduler->ta_state = 0;
+			task->raster_complete_action = PSB_RETURN;
+			task->ta_complete_action = PSB_RASTER;
+			break;
+
+		}
+	}
+	psb_schedule_ta(dev_priv, scheduler);
+	psb_set_idle(scheduler);
+
+	if (complete_action == PSB_RETURN) {
+		if (task->scene == NULL) {
+			psb_report_fence(scheduler, task->engine,
+					 task->sequence,
+					 _PSB_FENCE_RASTER_DONE_SHIFT, 1);
+		}
+		if (!task->feedback.page) {
+			list_add_tail(&task->head, &scheduler->task_done_queue);
+			schedule_delayed_work(&scheduler->wq, 1);
+		}
+	}
+}
+
+void psb_scheduler_pause(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	scheduler->idle_count++;
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+}
+
+void psb_scheduler_restart(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	if (--scheduler->idle_count == 0) {
+		psb_schedule_ta(dev_priv, scheduler);
+		psb_schedule_raster(dev_priv, scheduler);
+	}
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+}
+
+int psb_scheduler_idle(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+	int ret;
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	ret = scheduler->idle_count != 0 && scheduler->idle;
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+	return ret;
+}
+
+int psb_scheduler_finished(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+	int ret;
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	ret = (scheduler->idle &&
+	       list_empty(&scheduler->raster_queue) &&
+	       list_empty(&scheduler->ta_queue) &&
+	       list_empty(&scheduler->hp_raster_queue));
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+	return ret;
+}
+
+static void psb_ta_oom(struct drm_psb_private *dev_priv,
+		       struct psb_scheduler *scheduler)
+{
+
+	struct psb_task *task = scheduler->current_task[PSB_SCENE_ENGINE_TA];
+	if (!task)
+		return;
+
+	if (task->aborting)
+		return;
+	task->aborting = 1;
+
+	DRM_INFO("Info: TA out of parameter memory.\n");
+
+	(void)psb_xhw_ta_oom(dev_priv, &task->buf, task->scene->hw_cookie);
+}
+
+static void psb_ta_oom_reply(struct drm_psb_private *dev_priv,
+			     struct psb_scheduler *scheduler)
+{
+
+	struct psb_task *task = scheduler->current_task[PSB_SCENE_ENGINE_TA];
+	uint32_t flags;
+	if (!task)
+		return;
+
+	psb_xhw_ta_oom_reply(dev_priv, &task->buf,
+			     task->scene->hw_cookie,
+			     &task->ta_complete_action,
+			     &task->raster_complete_action, &flags);
+	task->flags |= flags;
+	task->aborting = 0;
+	psb_dispatch_ta(dev_priv, scheduler, PSB_RF_OOM_REPLY);
+}
+
+static void psb_ta_hw_scene_freed(struct drm_psb_private *dev_priv,
+				  struct psb_scheduler *scheduler)
+{
+	DRM_ERROR("TA hw scene freed.\n");
+}
+
+static void psb_vistest_reply(struct drm_psb_private *dev_priv,
+			      struct psb_scheduler *scheduler)
+{
+	struct psb_task *task = scheduler->feedback_task;
+	uint8_t *feedback_map;
+	uint32_t add;
+	uint32_t cur;
+	struct drm_psb_vistest *vistest;
+	int i;
+
+	scheduler->feedback_task = NULL;
+	if (!task) {
+		DRM_ERROR("No Poulsbo feedback task.\n");
+		return;
+	}
+	if (!task->feedback.page) {
+		DRM_ERROR("No Poulsbo feedback page.\n");
+		goto out;
+	}
+
+	if (in_irq())
+		feedback_map = kmap_atomic(task->feedback.page, KM_IRQ0);
+	else
+		feedback_map = kmap_atomic(task->feedback.page, KM_USER0);
+
+	/*
+	 * Loop over all requested vistest components here.
+	 * Only one (vistest) currently.
+	 */
+
+	vistest = (struct drm_psb_vistest *)
+	    (feedback_map + task->feedback.offset);
+
+	for (i = 0; i < PSB_HW_FEEDBACK_SIZE; ++i) {
+		add = task->buf.arg.arg.feedback[i];
+		cur = vistest->vt[i];
+
+		/*
+		 * Vistest saturates.
+		 */
+
+		vistest->vt[i] = (cur + add < cur) ? ~0 : cur + add;
+	}
+	if (in_irq())
+		kunmap_atomic(feedback_map, KM_IRQ0);
+	else
+		kunmap_atomic(feedback_map, KM_USER0);
+      out:
+	psb_report_fence(scheduler, task->engine, task->sequence,
+			 _PSB_FENCE_FEEDBACK_SHIFT, 1);
+
+	if (list_empty(&task->head)) {
+		list_add_tail(&task->head, &scheduler->task_done_queue);
+		schedule_delayed_work(&scheduler->wq, 1);
+	} else
+		psb_schedule_ta(dev_priv, scheduler);
+}
+
+static void psb_ta_fire_reply(struct drm_psb_private *dev_priv,
+			      struct psb_scheduler *scheduler)
+{
+	struct psb_task *task = scheduler->current_task[PSB_SCENE_ENGINE_TA];
+
+	psb_xhw_fire_reply(dev_priv, &task->buf, task->scene->hw_cookie);
+
+	psb_dispatch_ta(dev_priv, scheduler, PSB_RF_FIRE_TA);
+}
+
+static void psb_raster_fire_reply(struct drm_psb_private *dev_priv,
+				  struct psb_scheduler *scheduler)
+{
+	struct psb_task *task =
+	    scheduler->current_task[PSB_SCENE_ENGINE_RASTER];
+	uint32_t reply_flags;
+
+	if (!task) {
+		DRM_ERROR("Null task.\n");
+		return;
+	}
+
+	task->raster_complete_action = task->buf.arg.arg.sb.rca;
+	psb_xhw_fire_reply(dev_priv, &task->buf, task->scene->hw_cookie);
+
+	reply_flags = PSB_RF_FIRE_RASTER;
+	if (task->raster_complete_action == PSB_RASTER)
+		reply_flags |= PSB_RF_DEALLOC;
+
+	psb_dispatch_raster(dev_priv, scheduler, reply_flags);
+}
+
+static int psb_user_interrupt(struct drm_psb_private *dev_priv,
+			      struct psb_scheduler *scheduler)
+{
+	uint32_t type;
+	int ret;
+	unsigned long irq_flags;
+
+	/*
+	 * Xhw cannot write directly to the comm page, so
+	 * do it here. Firmware would have written directly.
+	 */
+
+	ret = psb_xhw_handler(dev_priv);
+	if (unlikely(ret))
+		return ret;
+
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	type = dev_priv->comm[PSB_COMM_USER_IRQ];
+	dev_priv->comm[PSB_COMM_USER_IRQ] = 0;
+	if (dev_priv->comm[PSB_COMM_USER_IRQ_LOST]) {
+		dev_priv->comm[PSB_COMM_USER_IRQ_LOST] = 0;
+		DRM_ERROR("Lost Poulsbo hardware event.\n");
+	}
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+
+	if (type == 0)
+		return 0;
+
+	switch (type) {
+	case PSB_UIRQ_VISTEST:
+		psb_vistest_reply(dev_priv, scheduler);
+		break;
+	case PSB_UIRQ_OOM_REPLY:
+		psb_ta_oom_reply(dev_priv, scheduler);
+		break;
+	case PSB_UIRQ_FIRE_TA_REPLY:
+		psb_ta_fire_reply(dev_priv, scheduler);
+		break;
+	case PSB_UIRQ_FIRE_RASTER_REPLY:
+		psb_raster_fire_reply(dev_priv, scheduler);
+		break;
+	default:
+		DRM_ERROR("Unknown Poulsbo hardware event. %d\n", type);
+	}
+	return 0;
+}
+
+int psb_forced_user_interrupt(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+	int ret;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	ret = psb_user_interrupt(dev_priv, scheduler);
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+	return ret;
+}
+
+static void psb_dispatch_ta(struct drm_psb_private *dev_priv,
+			    struct psb_scheduler *scheduler,
+			    uint32_t reply_flag)
+{
+	struct psb_task *task = scheduler->current_task[PSB_SCENE_ENGINE_TA];
+	uint32_t flags;
+	uint32_t mask;
+
+	task->reply_flags |= reply_flag;
+	flags = task->reply_flags;
+	mask = PSB_RF_FIRE_TA;
+
+	if (!(flags & mask))
+		return;
+
+	mask = PSB_RF_TA_DONE;
+	if ((flags & mask) == mask) {
+		task->reply_flags &= ~mask;
+		psb_ta_done(dev_priv, scheduler);
+	}
+
+	mask = PSB_RF_OOM;
+	if ((flags & mask) == mask) {
+		task->reply_flags &= ~mask;
+		psb_ta_oom(dev_priv, scheduler);
+	}
+
+	mask = (PSB_RF_OOM_REPLY | PSB_RF_TERMINATE);
+	if ((flags & mask) == mask) {
+		task->reply_flags &= ~mask;
+		psb_ta_done(dev_priv, scheduler);
+	}
+}
+
+static void psb_dispatch_raster(struct drm_psb_private *dev_priv,
+				struct psb_scheduler *scheduler,
+				uint32_t reply_flag)
+{
+	struct psb_task *task =
+	    scheduler->current_task[PSB_SCENE_ENGINE_RASTER];
+	uint32_t flags;
+	uint32_t mask;
+
+	task->reply_flags |= reply_flag;
+	flags = task->reply_flags;
+	mask = PSB_RF_FIRE_RASTER;
+
+	if (!(flags & mask))
+		return;
+
+	/*
+	 * For rasterizer-only tasks, don't report fence done here,
+	 * as this is time consuming and the rasterizer wants a new
+	 * task immediately. For other tasks, the hardware is probably
+	 * still busy deallocating TA memory, so we can report
+	 * fence done in parallel.
+	 */
+
+	if (task->raster_complete_action == PSB_RETURN &&
+	    (reply_flag & PSB_RF_RASTER_DONE) && task->scene != NULL) {
+		psb_report_fence(scheduler, task->engine, task->sequence,
+				 _PSB_FENCE_RASTER_DONE_SHIFT, 1);
+	}
+
+	mask = PSB_RF_RASTER_DONE | PSB_RF_DEALLOC;
+	if ((flags & mask) == mask) {
+		task->reply_flags &= ~mask;
+		psb_raster_done(dev_priv, scheduler);
+	}
+}
+
+void psb_scheduler_handler(struct drm_psb_private *dev_priv, uint32_t status)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+
+	spin_lock(&scheduler->lock);
+
+	if (status & _PSB_CE_PIXELBE_END_RENDER) {
+		psb_dispatch_raster(dev_priv, scheduler, PSB_RF_RASTER_DONE);
+	}
+	if (status & _PSB_CE_DPM_3D_MEM_FREE) {
+		psb_dispatch_raster(dev_priv, scheduler, PSB_RF_DEALLOC);
+	}
+	if (status & _PSB_CE_TA_FINISHED) {
+		psb_dispatch_ta(dev_priv, scheduler, PSB_RF_TA_DONE);
+	}
+	if (status & _PSB_CE_TA_TERMINATE) {
+		psb_dispatch_ta(dev_priv, scheduler, PSB_RF_TERMINATE);
+	}
+	if (status & (_PSB_CE_DPM_REACHED_MEM_THRESH |
+		      _PSB_CE_DPM_OUT_OF_MEMORY_GBL |
+		      _PSB_CE_DPM_OUT_OF_MEMORY_MT)) {
+		psb_dispatch_ta(dev_priv, scheduler, PSB_RF_OOM);
+	}
+	if (status & _PSB_CE_DPM_TA_MEM_FREE) {
+		psb_ta_hw_scene_freed(dev_priv, scheduler);
+	}
+	if (status & _PSB_CE_SW_EVENT) {
+		psb_user_interrupt(dev_priv, scheduler);
+	}
+	spin_unlock(&scheduler->lock);
+}
+
+static void psb_free_task_wq(struct work_struct *work)
+{
+	struct psb_scheduler *scheduler =
+	    container_of(work, struct psb_scheduler, wq.work);
+
+	struct drm_device *dev = scheduler->dev;
+	struct list_head *list, *next;
+	unsigned long irq_flags;
+	struct psb_task *task;
+
+	if (!mutex_trylock(&scheduler->task_wq_mutex))
+		return;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	list_for_each_safe(list, next, &scheduler->task_done_queue) {
+		task = list_entry(list, struct psb_task, head);
+		list_del_init(list);
+		spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+
+		PSB_DEBUG_RENDER("Checking Task %d: Scene 0x%08lx, "
+				 "Feedback bo 0x%08lx, done %d\n",
+				 task->sequence, (unsigned long)task->scene,
+				 (unsigned long)task->feedback.bo,
+				 atomic_read(&task->buf.done));
+
+		if (task->scene) {
+			mutex_lock(&dev->struct_mutex);
+			PSB_DEBUG_RENDER("Unref scene %d\n", task->sequence);
+			psb_scene_unref_devlocked(&task->scene);
+			if (task->feedback.bo) {
+				PSB_DEBUG_RENDER("Unref feedback bo %d\n",
+						 task->sequence);
+				drm_bo_usage_deref_locked(&task->feedback.bo);
+			}
+			mutex_unlock(&dev->struct_mutex);
+		}
+
+		if (atomic_read(&task->buf.done)) {
+			PSB_DEBUG_RENDER("Deleting task %d\n", task->sequence);
+			drm_free(task, sizeof(*task), DRM_MEM_DRIVER);
+			task = NULL;
+		}
+		spin_lock_irqsave(&scheduler->lock, irq_flags);
+		if (task != NULL)
+			list_add(list, &scheduler->task_done_queue);
+	}
+	if (!list_empty(&scheduler->task_done_queue)) {
+		PSB_DEBUG_RENDER("Rescheduling wq\n");
+		schedule_delayed_work(&scheduler->wq, 1);
+	}
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+
+	mutex_unlock(&scheduler->task_wq_mutex);
+}
+
+/*
+ * Check if any of the tasks in the queues is using a scene.
+ * In that case we know the TA memory buffer objects are
+ * fenced and will not be evicted until that fence is signaled.
+ */
+
+void psb_scheduler_ta_mem_check(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+	struct psb_task *task;
+	struct psb_task *next_task;
+
+	dev_priv->force_ta_mem_load = 1;
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	list_for_each_entry_safe(task, next_task, &scheduler->ta_queue, head) {
+		if (task->scene) {
+			dev_priv->force_ta_mem_load = 0;
+			break;
+		}
+	}
+	list_for_each_entry_safe(task, next_task, &scheduler->raster_queue,
+				 head) {
+		if (task->scene) {
+			dev_priv->force_ta_mem_load = 0;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+}
+
+void psb_scheduler_reset(struct drm_psb_private *dev_priv, int error_condition)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long wait_jiffies;
+	unsigned long cur_jiffies;
+	struct psb_task *task;
+	struct psb_task *next_task;
+	unsigned long irq_flags;
+
+	psb_scheduler_pause(dev_priv);
+	if (!psb_scheduler_idle(dev_priv)) {
+		spin_lock_irqsave(&scheduler->lock, irq_flags);
+
+		cur_jiffies = jiffies;
+		wait_jiffies = cur_jiffies;
+		if (scheduler->current_task[PSB_SCENE_ENGINE_TA] &&
+		    time_after_eq(scheduler->ta_end_jiffies, wait_jiffies))
+			wait_jiffies = scheduler->ta_end_jiffies;
+		if (scheduler->current_task[PSB_SCENE_ENGINE_RASTER] &&
+		    time_after_eq(scheduler->raster_end_jiffies, wait_jiffies))
+			wait_jiffies = scheduler->raster_end_jiffies;
+
+		wait_jiffies -= cur_jiffies;
+		spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+
+		(void)wait_event_timeout(scheduler->idle_queue,
+					 psb_scheduler_idle(dev_priv),
+					 wait_jiffies);
+	}
+
+	if (!psb_scheduler_idle(dev_priv)) {
+		spin_lock_irqsave(&scheduler->lock, irq_flags);
+		task = scheduler->current_task[PSB_SCENE_ENGINE_RASTER];
+		if (task) {
+			DRM_ERROR("Detected Poulsbo rasterizer lockup.\n");
+			if (task->engine == PSB_ENGINE_HPRAST) {
+				psb_fence_error(scheduler->dev,
+						PSB_ENGINE_HPRAST,
+						task->sequence,
+						_PSB_FENCE_TYPE_RASTER_DONE,
+						error_condition);
+
+				list_del(&task->head);
+				psb_xhw_clean_buf(dev_priv, &task->buf);
+				list_add_tail(&task->head,
+					      &scheduler->task_done_queue);
+			} else {
+				list_add(&task->head, &scheduler->raster_queue);
+			}
+		}
+		scheduler->current_task[PSB_SCENE_ENGINE_RASTER] = NULL;
+		task = scheduler->current_task[PSB_SCENE_ENGINE_TA];
+		if (task) {
+			DRM_ERROR("Detected Poulsbo ta lockup.\n");
+			list_add_tail(&task->head, &scheduler->raster_queue);
+#ifdef FIX_TG_16
+			psb_2d_atomic_unlock(dev_priv);
+#endif
+		}
+		scheduler->current_task[PSB_SCENE_ENGINE_TA] = NULL;
+		scheduler->ta_state = 0;
+
+#ifdef FIX_TG_16
+		atomic_set(&dev_priv->ta_wait_2d, 0);
+		atomic_set(&dev_priv->ta_wait_2d_irq, 0);
+		wake_up(&dev_priv->queue_2d);
+#endif
+		spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+	}
+
+	/*
+	 * Empty raster queue.
+	 */
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	list_for_each_entry_safe(task, next_task, &scheduler->raster_queue,
+				 head) {
+		struct psb_scene *scene = task->scene;
+
+		psb_fence_error(scheduler->dev,
+				task->engine,
+				task->sequence,
+				_PSB_FENCE_TYPE_TA_DONE |
+				_PSB_FENCE_TYPE_RASTER_DONE |
+				_PSB_FENCE_TYPE_SCENE_DONE |
+				_PSB_FENCE_TYPE_FEEDBACK, error_condition);
+		if (scene) {
+			scene->flags = 0;
+			if (scene->hw_scene) {
+				list_add_tail(&scene->hw_scene->head,
+					      &scheduler->hw_scenes);
+				scene->hw_scene = NULL;
+			}
+		}
+
+		psb_xhw_clean_buf(dev_priv, &task->buf);
+		list_del(&task->head);
+		list_add_tail(&task->head, &scheduler->task_done_queue);
+	}
+
+	schedule_delayed_work(&scheduler->wq, 1);
+	scheduler->idle = 1;
+	wake_up(&scheduler->idle_queue);
+
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+	psb_scheduler_restart(dev_priv);
+
+}
+
+int psb_scheduler_init(struct drm_device *dev, struct psb_scheduler *scheduler)
+{
+	struct psb_hw_scene *hw_scene;
+	int i;
+
+	memset(scheduler, 0, sizeof(*scheduler));
+	scheduler->dev = dev;
+	mutex_init(&scheduler->task_wq_mutex);
+	scheduler->lock = SPIN_LOCK_UNLOCKED;
+	scheduler->idle = 1;
+
+	INIT_LIST_HEAD(&scheduler->ta_queue);
+	INIT_LIST_HEAD(&scheduler->raster_queue);
+	INIT_LIST_HEAD(&scheduler->hp_raster_queue);
+	INIT_LIST_HEAD(&scheduler->hw_scenes);
+	INIT_LIST_HEAD(&scheduler->task_done_queue);
+	INIT_DELAYED_WORK(&scheduler->wq, &psb_free_task_wq);
+	init_waitqueue_head(&scheduler->idle_queue);
+
+	for (i = 0; i < PSB_NUM_HW_SCENES; ++i) {
+		hw_scene = &scheduler->hs[i];
+		hw_scene->context_number = i;
+		list_add_tail(&hw_scene->head, &scheduler->hw_scenes);
+	}
+
+	for (i = 0; i < _PSB_ENGINE_TA_FENCE_TYPES; ++i) {
+		scheduler->seq[i].reported = 0;
+	}
+
+	return 0;
+}
+
+/*
+ * Scene references maintained by the scheduler are not refcounted.
+ * Remove all references to a particular scene here.
+ */
+
+void psb_scheduler_remove_scene_refs(struct psb_scene *scene)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)scene->dev->dev_private;
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	struct psb_hw_scene *hw_scene;
+	unsigned long irq_flags;
+	unsigned int i;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	for (i = 0; i < PSB_NUM_HW_SCENES; ++i) {
+		hw_scene = &scheduler->hs[i];
+		if (hw_scene->last_scene == scene) {
+			BUG_ON(list_empty(&hw_scene->head));
+			hw_scene->last_scene = NULL;
+		}
+	}
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+}
+
+void psb_scheduler_takedown(struct psb_scheduler *scheduler)
+{
+	flush_scheduled_work();
+}
+
+static int psb_setup_task_devlocked(struct drm_device *dev,
+				    struct drm_psb_cmdbuf_arg *arg,
+				    struct drm_buffer_object *raster_cmd_buffer,
+				    struct drm_buffer_object *ta_cmd_buffer,
+				    struct drm_buffer_object *oom_cmd_buffer,
+				    struct psb_scene *scene,
+				    enum psb_task_type task_type,
+				    uint32_t engine,
+				    uint32_t flags, struct psb_task **task_p)
+{
+	struct psb_task *task;
+	int ret;
+
+	if (ta_cmd_buffer && arg->ta_size > PSB_MAX_TA_CMDS) {
+		DRM_ERROR("Too many ta cmds %d.\n", arg->ta_size);
+		return -EINVAL;
+	}
+	if (raster_cmd_buffer && arg->cmdbuf_size > PSB_MAX_RASTER_CMDS) {
+		DRM_ERROR("Too many raster cmds %d.\n", arg->cmdbuf_size);
+		return -EINVAL;
+	}
+	if (oom_cmd_buffer && arg->oom_size > PSB_MAX_OOM_CMDS) {
+		DRM_ERROR("Too many raster cmds %d.\n", arg->oom_size);
+		return -EINVAL;
+	}
+
+	task = drm_calloc(1, sizeof(*task), DRM_MEM_DRIVER);
+	if (!task)
+		return -ENOMEM;
+
+	atomic_set(&task->buf.done, 1);
+	task->engine = engine;
+	INIT_LIST_HEAD(&task->head);
+	INIT_LIST_HEAD(&task->buf.head);
+	if (ta_cmd_buffer && arg->ta_size != 0) {
+		task->ta_cmd_size = arg->ta_size;
+		ret = psb_submit_copy_cmdbuf(dev, ta_cmd_buffer,
+					     arg->ta_offset,
+					     arg->ta_size,
+					     PSB_ENGINE_TA, task->ta_cmds);
+		if (ret)
+			goto out_err;
+	}
+	if (raster_cmd_buffer) {
+		task->raster_cmd_size = arg->cmdbuf_size;
+		ret = psb_submit_copy_cmdbuf(dev, raster_cmd_buffer,
+					     arg->cmdbuf_offset,
+					     arg->cmdbuf_size,
+					     PSB_ENGINE_TA, task->raster_cmds);
+		if (ret)
+			goto out_err;
+	}
+	if (oom_cmd_buffer && arg->oom_size != 0) {
+		task->oom_cmd_size = arg->oom_size;
+		ret = psb_submit_copy_cmdbuf(dev, oom_cmd_buffer,
+					     arg->oom_offset,
+					     arg->oom_size,
+					     PSB_ENGINE_TA, task->oom_cmds);
+		if (ret)
+			goto out_err;
+	}
+	task->task_type = task_type;
+	task->flags = flags;
+	if (scene)
+		task->scene = psb_scene_ref(scene);
+
+	*task_p = task;
+	return 0;
+      out_err:
+	drm_free(task, sizeof(*task), DRM_MEM_DRIVER);
+	*task_p = NULL;
+	return ret;
+}
+
+int psb_cmdbuf_ta(struct drm_file *priv,
+		  struct drm_psb_cmdbuf_arg *arg,
+		  struct drm_buffer_object *cmd_buffer,
+		  struct drm_buffer_object *ta_buffer,
+		  struct drm_buffer_object *oom_buffer,
+		  struct psb_scene *scene,
+		  struct psb_feedback_info *feedback,
+		  struct drm_fence_arg *fence_arg)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	struct drm_fence_object *fence = NULL;
+	struct psb_task *task = NULL;
+	int ret;
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+
+	PSB_DEBUG_RENDER("Cmdbuf ta\n");
+
+	ret = mutex_lock_interruptible(&dev_priv->reset_mutex);
+	if (ret)
+		return -EAGAIN;
+
+	mutex_lock(&dev->struct_mutex);
+	ret = psb_setup_task_devlocked(dev, arg, cmd_buffer, ta_buffer,
+				       oom_buffer, scene,
+				       psb_ta_task, PSB_ENGINE_TA,
+				       PSB_FIRE_FLAG_RASTER_DEALLOC, &task);
+	mutex_unlock(&dev->struct_mutex);
+
+	if (ret)
+		goto out_err;
+
+	task->feedback = *feedback;
+
+	/*
+	 * Hand the task over to the scheduler.
+	 */
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	task->sequence = psb_fence_advance_sequence(dev, PSB_ENGINE_TA);
+
+	psb_report_fence(scheduler, PSB_ENGINE_TA, task->sequence, 0, 1);
+
+	task->ta_complete_action = PSB_RASTER;
+	task->raster_complete_action = PSB_RETURN;
+
+	list_add_tail(&task->head, &scheduler->ta_queue);
+	PSB_DEBUG_RENDER("queued ta %u\n", task->sequence);
+
+	psb_schedule_ta(dev_priv, scheduler);
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+
+	psb_fence_or_sync(priv, PSB_ENGINE_TA, arg, fence_arg, &fence);
+	drm_regs_fence(&dev_priv->use_manager, fence);
+	if (fence)
+	  fence_arg->signaled |= 0x1;
+
+      out_err:
+	if (ret && ret != -EAGAIN)
+		DRM_ERROR("TA task queue job failed.\n");
+
+	if (fence) {
+#ifdef PSB_WAIT_FOR_TA_COMPLETION
+		drm_fence_object_wait(fence, 1, 1, DRM_FENCE_TYPE_EXE |
+				      _PSB_FENCE_TYPE_TA_DONE);
+#ifdef PSB_BE_PARANOID
+		drm_fence_object_wait(fence, 1, 1, DRM_FENCE_TYPE_EXE |
+				      _PSB_FENCE_TYPE_SCENE_DONE);
+#endif
+#endif
+		drm_fence_usage_deref_unlocked(&fence);
+	}
+	mutex_unlock(&dev_priv->reset_mutex);
+
+	return ret;
+}
+
+int psb_cmdbuf_raster(struct drm_file *priv,
+		      struct drm_psb_cmdbuf_arg *arg,
+		      struct drm_buffer_object *cmd_buffer,
+		      struct drm_fence_arg *fence_arg)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	struct drm_fence_object *fence = NULL;
+	struct psb_task *task = NULL;
+	int ret;
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+
+	PSB_DEBUG_RENDER("Cmdbuf Raster\n");
+
+	ret = mutex_lock_interruptible(&dev_priv->reset_mutex);
+	if (ret)
+		return -EAGAIN;
+
+	mutex_lock(&dev->struct_mutex);
+	ret = psb_setup_task_devlocked(dev, arg, cmd_buffer, NULL, NULL,
+				       NULL, psb_raster_task,
+				       PSB_ENGINE_TA, 0, &task);
+	mutex_unlock(&dev->struct_mutex);
+
+	if (ret)
+		goto out_err;
+
+	/*
+	 * Hand the task over to the scheduler.
+	 */
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	task->sequence = psb_fence_advance_sequence(dev, PSB_ENGINE_TA);
+	psb_report_fence(scheduler, PSB_ENGINE_TA, task->sequence, 0, 1);
+	task->ta_complete_action = PSB_RASTER;
+	task->raster_complete_action = PSB_RETURN;
+
+	list_add_tail(&task->head, &scheduler->ta_queue);
+	PSB_DEBUG_RENDER("queued raster %u\n", task->sequence);
+	psb_schedule_ta(dev_priv, scheduler);
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+
+	psb_fence_or_sync(priv, PSB_ENGINE_TA, arg, fence_arg, &fence);
+	drm_regs_fence(&dev_priv->use_manager, fence);
+	if (fence)
+	  fence_arg->signaled |= 0x1;
+      out_err:
+	if (ret && ret != -EAGAIN)
+		DRM_ERROR("Raster task queue job failed.\n");
+
+	if (fence) {
+#ifdef PSB_WAIT_FOR_RASTER_COMPLETION
+		drm_fence_object_wait(fence, 1, 1, fence->type);
+#endif
+		drm_fence_usage_deref_unlocked(&fence);
+	}
+
+	mutex_unlock(&dev_priv->reset_mutex);
+
+	return ret;
+}
+
+#ifdef FIX_TG_16
+
+static int psb_check_2d_idle(struct drm_psb_private *dev_priv)
+{
+	if (psb_2d_trylock(dev_priv)) {
+		if ((PSB_RSGX32(PSB_CR_2D_SOCIF) == _PSB_C2_SOCIF_EMPTY) &&
+		    !((PSB_RSGX32(PSB_CR_2D_BLIT_STATUS) &
+		       _PSB_C2B_STATUS_BUSY))) {
+			return 0;
+		}
+		if (atomic_cmpxchg(&dev_priv->ta_wait_2d_irq, 0, 1) == 0)
+			psb_2D_irq_on(dev_priv);
+
+		PSB_WSGX32(PSB_2D_FENCE_BH, PSB_SGX_2D_SLAVE_PORT);
+		PSB_WSGX32(PSB_2D_FLUSH_BH, PSB_SGX_2D_SLAVE_PORT);
+		(void)PSB_RSGX32(PSB_SGX_2D_SLAVE_PORT);
+
+		psb_2d_atomic_unlock(dev_priv);
+	}
+
+	atomic_set(&dev_priv->ta_wait_2d, 1);
+	return -EBUSY;
+}
+
+static void psb_atomic_resume_ta_2d_idle(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+
+	if (atomic_cmpxchg(&dev_priv->ta_wait_2d, 1, 0) == 1) {
+		psb_schedule_ta(dev_priv, scheduler);
+		if (atomic_read(&dev_priv->waiters_2d) != 0)
+			wake_up(&dev_priv->queue_2d);
+	}
+}
+
+void psb_resume_ta_2d_idle(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	if (atomic_cmpxchg(&dev_priv->ta_wait_2d_irq, 1, 0) == 1) {
+		atomic_set(&dev_priv->ta_wait_2d, 0);
+		psb_2D_irq_off(dev_priv);
+		psb_schedule_ta(dev_priv, scheduler);
+		if (atomic_read(&dev_priv->waiters_2d) != 0)
+			wake_up(&dev_priv->queue_2d);
+	}
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+}
+
+/*
+ * 2D locking functions. Can't use a mutex since the trylock() and
+ * unlock() methods need to be accessible from interrupt context.
+ */
+
+static int psb_2d_trylock(struct drm_psb_private *dev_priv)
+{
+	return (atomic_cmpxchg(&dev_priv->lock_2d, 0, 1) == 0);
+}
+
+static void psb_2d_atomic_unlock(struct drm_psb_private *dev_priv)
+{
+	atomic_set(&dev_priv->lock_2d, 0);
+	if (atomic_read(&dev_priv->waiters_2d) != 0)
+		wake_up(&dev_priv->queue_2d);
+}
+
+void psb_2d_unlock(struct drm_psb_private *dev_priv)
+{
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&scheduler->lock, irq_flags);
+	psb_2d_atomic_unlock(dev_priv);
+	if (atomic_read(&dev_priv->ta_wait_2d) != 0)
+		psb_atomic_resume_ta_2d_idle(dev_priv);
+	spin_unlock_irqrestore(&scheduler->lock, irq_flags);
+}
+
+void psb_2d_lock(struct drm_psb_private *dev_priv)
+{
+	atomic_inc(&dev_priv->waiters_2d);
+	wait_event(dev_priv->queue_2d, atomic_read(&dev_priv->ta_wait_2d) == 0);
+	wait_event(dev_priv->queue_2d, psb_2d_trylock(dev_priv));
+	atomic_dec(&dev_priv->waiters_2d);
+}
+
+#endif
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_schedule.h
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_schedule.h	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,170 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thomas-at-tungstengraphics.com>
+ */
+
+#ifndef _PSB_SCHEDULE_H_
+#define _PSB_SCHEDULE_H_
+
+#include "drmP.h"
+
+enum psb_task_type {
+	psb_ta_midscene_task,
+	psb_ta_task,
+	psb_raster_task,
+	psb_freescene_task
+};
+
+#define PSB_MAX_TA_CMDS 60
+#define PSB_MAX_RASTER_CMDS 60
+#define PSB_MAX_OOM_CMDS 6
+
+struct psb_xhw_buf {
+	struct list_head head;
+	int copy_back;
+	atomic_t done;
+	struct drm_psb_xhw_arg arg;
+
+};
+
+struct psb_feedback_info {
+	struct drm_buffer_object *bo;
+	struct page *page;
+	uint32_t offset;
+};
+
+struct psb_task {
+	struct list_head head;
+	struct psb_scene *scene;
+	struct psb_feedback_info feedback;
+	enum psb_task_type task_type;
+	uint32_t engine;
+	uint32_t sequence;
+	uint32_t ta_cmds[PSB_MAX_TA_CMDS];
+	uint32_t raster_cmds[PSB_MAX_RASTER_CMDS];
+	uint32_t oom_cmds[PSB_MAX_OOM_CMDS];
+	uint32_t ta_cmd_size;
+	uint32_t raster_cmd_size;
+	uint32_t oom_cmd_size;
+	uint32_t feedback_offset;
+	uint32_t ta_complete_action;
+	uint32_t raster_complete_action;
+	uint32_t hw_cookie;
+	uint32_t flags;
+	uint32_t reply_flags;
+	uint32_t aborting;
+	struct psb_xhw_buf buf;
+};
+
+struct psb_hw_scene {
+	struct list_head head;
+	uint32_t context_number;
+
+	/*
+	 * This pointer does not refcount the last_scene_buffer,
+	 * so we must make sure it is set to NULL before destroying
+	 * the corresponding task.
+	 */
+
+	struct psb_scene *last_scene;
+};
+
+struct psb_scene;
+struct drm_psb_private;
+
+struct psb_scheduler_seq {
+	uint32_t sequence;
+	int reported;
+};
+
+struct psb_scheduler {
+	struct drm_device *dev;
+	struct psb_scheduler_seq seq[_PSB_ENGINE_TA_FENCE_TYPES];
+	struct psb_hw_scene hs[PSB_NUM_HW_SCENES];
+	struct mutex task_wq_mutex;
+	spinlock_t lock;
+	struct list_head hw_scenes;
+	struct list_head ta_queue;
+	struct list_head raster_queue;
+	struct list_head hp_raster_queue;
+	struct list_head task_done_queue;
+	struct psb_task *current_task[PSB_SCENE_NUM_ENGINES];
+	struct psb_task *feedback_task;
+	int ta_state;
+	struct psb_hw_scene *pending_hw_scene;
+	uint32_t pending_hw_scene_seq;
+	struct delayed_work wq;
+	struct psb_scene_pool *pool;
+	uint32_t idle_count;
+	int idle;
+	wait_queue_head_t idle_queue;
+	unsigned long ta_end_jiffies;
+	unsigned long raster_end_jiffies;
+	unsigned long total_raster_jiffies;
+};
+
+#define PSB_RF_FIRE_TA       (1 << 0)
+#define PSB_RF_OOM           (1 << 1)
+#define PSB_RF_OOM_REPLY     (1 << 2)
+#define PSB_RF_TERMINATE     (1 << 3)
+#define PSB_RF_TA_DONE       (1 << 4)
+#define PSB_RF_FIRE_RASTER   (1 << 5)
+#define PSB_RF_RASTER_DONE   (1 << 6)
+#define PSB_RF_DEALLOC       (1 << 7)
+
+extern struct psb_scene_pool *psb_alloc_scene_pool(struct drm_file *priv,
+						   int shareable, uint32_t w,
+						   uint32_t h);
+extern uint32_t psb_scene_handle(struct psb_scene *scene);
+extern int psb_scheduler_init(struct drm_device *dev,
+			      struct psb_scheduler *scheduler);
+extern void psb_scheduler_takedown(struct psb_scheduler *scheduler);
+extern int psb_cmdbuf_ta(struct drm_file *priv,
+			 struct drm_psb_cmdbuf_arg *arg,
+			 struct drm_buffer_object *cmd_buffer,
+			 struct drm_buffer_object *ta_buffer,
+			 struct drm_buffer_object *oom_buffer,
+			 struct psb_scene *scene,
+			 struct psb_feedback_info *feedback,
+			 struct drm_fence_arg *fence_arg);
+extern int psb_cmdbuf_raster(struct drm_file *priv,
+			     struct drm_psb_cmdbuf_arg *arg,
+			     struct drm_buffer_object *cmd_buffer,
+			     struct drm_fence_arg *fence_arg);
+extern void psb_scheduler_handler(struct drm_psb_private *dev_priv,
+				  uint32_t status);
+extern void psb_scheduler_pause(struct drm_psb_private *dev_priv);
+extern void psb_scheduler_restart(struct drm_psb_private *dev_priv);
+extern int psb_scheduler_idle(struct drm_psb_private *dev_priv);
+extern int psb_scheduler_finished(struct drm_psb_private *dev_priv);
+
+extern void psb_scheduler_lockup(struct drm_psb_private *dev_priv,
+				 int *lockup, int *idle);
+extern void psb_scheduler_reset(struct drm_psb_private *dev_priv,
+				int error_condition);
+extern int psb_forced_user_interrupt(struct drm_psb_private *dev_priv);
+extern void psb_scheduler_remove_scene_refs(struct psb_scene *scene);
+extern void psb_scheduler_ta_mem_check(struct drm_psb_private *dev_priv);
+extern int psb_extend_raster_timeout(struct drm_psb_private *dev_priv);
+
+#endif
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_sgx.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_sgx.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,1422 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ */
+
+#include "drmP.h"
+#include "psb_drv.h"
+#include "psb_drm.h"
+#include "psb_reg.h"
+#include "psb_scene.h"
+
+#include "psb_msvdx.h"
+
+int psb_submit_video_cmdbuf(struct drm_device *dev,
+			    struct drm_buffer_object *cmd_buffer,
+			    unsigned long cmd_offset, unsigned long cmd_size,
+			    struct drm_fence_object *fence);
+
+struct psb_dstbuf_cache {
+	unsigned int dst;
+	uint32_t *use_page;
+	unsigned int use_index;
+	uint32_t use_background;
+	struct drm_buffer_object *dst_buf;
+	unsigned long dst_offset;
+	uint32_t *dst_page;
+	unsigned int dst_page_offset;
+	struct drm_bo_kmap_obj dst_kmap;
+	int dst_is_iomem;
+};
+
+struct psb_buflist_item {
+	struct drm_buffer_object *bo;
+	void __user *data;
+	int ret;
+	int presumed_offset_correct;
+};
+
+
+#define PSB_REG_GRAN_SHIFT 2
+#define PSB_REG_GRANULARITY (1 << PSB_REG_GRAN_SHIFT)
+#define PSB_MAX_REG 0x1000
+
+static const uint32_t disallowed_ranges[][2] = {
+	{0x0000, 0x0200},
+	{0x0208, 0x0214},
+	{0x021C, 0x0224},
+	{0x0230, 0x0234},
+	{0x0248, 0x024C},
+	{0x0254, 0x0358},
+	{0x0428, 0x0428},
+	{0x0430, 0x043C},
+	{0x0498, 0x04B4},
+	{0x04CC, 0x04D8},
+	{0x04E0, 0x07FC},
+	{0x0804, 0x0A58},
+	{0x0A68, 0x0A80},
+	{0x0AA0, 0x0B1C},
+	{0x0B2C, 0x0CAC},
+	{0x0CB4, PSB_MAX_REG - PSB_REG_GRANULARITY}
+};
+
+static uint32_t psb_disallowed_regs[PSB_MAX_REG /
+				    (PSB_REG_GRANULARITY *
+				     (sizeof(uint32_t) << 3))];
+
+static inline int psb_disallowed(uint32_t reg)
+{
+	reg >>= PSB_REG_GRAN_SHIFT;
+	return ((psb_disallowed_regs[reg >> 5] & (1 << (reg & 31))) != 0);
+}
+
+void psb_init_disallowed(void)
+{
+	int i;
+	uint32_t reg, tmp;
+	static int initialized = 0;
+
+	if (initialized)
+		return;
+
+	initialized = 1;
+	memset(psb_disallowed_regs, 0, sizeof(psb_disallowed_regs));
+
+	for (i = 0; i < (sizeof(disallowed_ranges) / (2 * sizeof(uint32_t)));
+	     ++i) {
+		for (reg = disallowed_ranges[i][0];
+		     reg <= disallowed_ranges[i][1]; reg += 4) {
+			tmp = reg >> 2;
+			psb_disallowed_regs[tmp >> 5] |= (1 << (tmp & 31));
+		}
+	}
+}
+
+static int psb_memcpy_check(uint32_t * dst, const uint32_t * src, uint32_t size)
+{
+	size >>= 3;
+	while (size--) {
+		if (unlikely((*src >= 0x1000) || psb_disallowed(*src))) {
+			DRM_ERROR("Forbidden SGX register access: "
+				  "0x%04x.\n", *src);
+			return -EPERM;
+		}
+		*dst++ = *src++;
+		*dst++ = *src++;
+	}
+	return 0;
+}
+
+static int psb_2d_wait_available(struct drm_psb_private *dev_priv,
+				 unsigned size)
+{
+	uint32_t avail = PSB_RSGX32(PSB_CR_2D_SOCIF);
+	int ret = 0;
+
+      retry:
+	if (avail < size) {
+#if 0
+		/* We'd ideally
+		 * like to have an IRQ-driven event here.
+		 */
+
+		psb_2D_irq_on(dev_priv);
+		DRM_WAIT_ON(ret, dev_priv->event_2d_queue, DRM_HZ,
+			    ((avail = PSB_RSGX32(PSB_CR_2D_SOCIF)) >= size));
+		psb_2D_irq_off(dev_priv);
+		if (ret == 0)
+			return 0;
+		if (ret == -EINTR) {
+			ret = 0;
+			goto retry;
+		}
+#else
+		avail = PSB_RSGX32(PSB_CR_2D_SOCIF);
+		goto retry;
+#endif
+	}
+	return ret;
+}
+
+int psb_2d_submit(struct drm_psb_private *dev_priv, uint32_t * cmdbuf,
+		  unsigned size)
+{
+	int ret = 0;
+	int i;
+	unsigned submit_size;
+
+	while (size > 0) {
+		submit_size = (size < 0x60) ? size : 0x60;
+		size -= submit_size;
+		ret = psb_2d_wait_available(dev_priv, submit_size);
+		if (ret)
+			return ret;
+
+		submit_size <<= 2;
+
+		for (i = 0; i < submit_size; i += 4) {
+			PSB_WSGX32(*cmdbuf++, PSB_SGX_2D_SLAVE_PORT + i);
+		}
+		(void)PSB_RSGX32(PSB_SGX_2D_SLAVE_PORT + i - 4);
+	}
+	return 0;
+}
+
+int psb_blit_sequence(struct drm_psb_private *dev_priv, uint32_t sequence)
+{
+	uint32_t buffer[8];
+	uint32_t *bufp = buffer;
+	int ret;
+
+	*bufp++ = PSB_2D_FENCE_BH;
+
+	*bufp++ = PSB_2D_DST_SURF_BH |
+	    PSB_2D_DST_8888ARGB | (4 << PSB_2D_DST_STRIDE_SHIFT);
+	*bufp++ = dev_priv->comm_mmu_offset - dev_priv->mmu_2d_offset;
+
+	*bufp++ = PSB_2D_BLIT_BH |
+	    PSB_2D_ROT_NONE |
+	    PSB_2D_COPYORDER_TL2BR |
+	    PSB_2D_DSTCK_DISABLE |
+	    PSB_2D_SRCCK_DISABLE | PSB_2D_USE_FILL | PSB_2D_ROP3_PATCOPY;
+
+	*bufp++ = sequence << PSB_2D_FILLCOLOUR_SHIFT;
+	*bufp++ = (0 << PSB_2D_DST_XSTART_SHIFT) |
+	    (0 << PSB_2D_DST_YSTART_SHIFT);
+	*bufp++ = (1 << PSB_2D_DST_XSIZE_SHIFT) | (1 << PSB_2D_DST_YSIZE_SHIFT);
+
+	*bufp++ = PSB_2D_FLUSH_BH;
+
+	psb_2d_lock(dev_priv);
+	ret = psb_2d_submit(dev_priv, buffer, bufp - buffer);
+	psb_2d_unlock(dev_priv);
+
+	if (!ret)
+		psb_schedule_watchdog(dev_priv);
+	return ret;
+}
+
+int psb_emit_2d_copy_blit(struct drm_device *dev,
+			  uint32_t src_offset,
+			  uint32_t dst_offset, uint32_t pages, int direction)
+{
+	uint32_t cur_pages;
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	uint32_t buf[10];
+	uint32_t *bufp;
+	uint32_t xstart;
+	uint32_t ystart;
+	uint32_t blit_cmd;
+	uint32_t pg_add;
+	int ret = 0;
+
+	if (!dev_priv)
+		return 0;
+
+	if (direction) {
+		pg_add = (pages - 1) << PAGE_SHIFT;
+		src_offset += pg_add;
+		dst_offset += pg_add;
+	}
+
+	blit_cmd = PSB_2D_BLIT_BH |
+	    PSB_2D_ROT_NONE |
+	    PSB_2D_DSTCK_DISABLE |
+	    PSB_2D_SRCCK_DISABLE |
+	    PSB_2D_USE_PAT |
+	    PSB_2D_ROP3_SRCCOPY |
+	    (direction ? PSB_2D_COPYORDER_BR2TL : PSB_2D_COPYORDER_TL2BR);
+	xstart = (direction) ? ((PAGE_SIZE - 1) >> 2) : 0;
+
+	psb_2d_lock(dev_priv);
+	while (pages > 0) {
+		cur_pages = pages;
+		if (cur_pages > 2048)
+			cur_pages = 2048;
+		pages -= cur_pages;
+		ystart = (direction) ? cur_pages - 1 : 0;
+
+		bufp = buf;
+		*bufp++ = PSB_2D_FENCE_BH;
+
+		*bufp++ = PSB_2D_DST_SURF_BH | PSB_2D_DST_8888ARGB |
+		    (PAGE_SIZE << PSB_2D_DST_STRIDE_SHIFT);
+		*bufp++ = dst_offset;
+		*bufp++ = PSB_2D_SRC_SURF_BH | PSB_2D_SRC_8888ARGB |
+		    (PAGE_SIZE << PSB_2D_SRC_STRIDE_SHIFT);
+		*bufp++ = src_offset;
+		*bufp++ =
+		    PSB_2D_SRC_OFF_BH | (xstart << PSB_2D_SRCOFF_XSTART_SHIFT) |
+		    (ystart << PSB_2D_SRCOFF_YSTART_SHIFT);
+		*bufp++ = blit_cmd;
+		*bufp++ = (xstart << PSB_2D_DST_XSTART_SHIFT) |
+		    (ystart << PSB_2D_DST_YSTART_SHIFT);
+		*bufp++ = ((PAGE_SIZE >> 2) << PSB_2D_DST_XSIZE_SHIFT) |
+		    (cur_pages << PSB_2D_DST_YSIZE_SHIFT);
+
+		ret = psb_2d_submit(dev_priv, buf, bufp - buf);
+		if (ret)
+			goto out;
+		pg_add = (cur_pages << PAGE_SHIFT) * ((direction) ? -1 : 1);
+		src_offset += pg_add;
+		dst_offset += pg_add;
+	}
+      out:
+	psb_2d_unlock(dev_priv);
+	return ret;
+}
+
+void psb_init_2d(struct drm_psb_private *dev_priv)
+{
+	dev_priv->sequence_lock = SPIN_LOCK_UNLOCKED;
+	psb_reset(dev_priv, 1);
+	dev_priv->mmu_2d_offset = dev_priv->pg->gatt_start;
+	PSB_WSGX32(dev_priv->mmu_2d_offset, PSB_CR_BIF_TWOD_REQ_BASE);
+	(void)PSB_RSGX32(PSB_CR_BIF_TWOD_REQ_BASE);
+}
+
+int psb_idle_2d(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	unsigned long _end = jiffies + DRM_HZ;
+	int busy = 0;
+
+	/*
+	 * First idle the 2D engine.
+	 */
+
+	if (dev_priv->engine_lockup_2d)
+		return -EBUSY;
+
+	if ((PSB_RSGX32(PSB_CR_2D_SOCIF) == _PSB_C2_SOCIF_EMPTY) &&
+	    ((PSB_RSGX32(PSB_CR_2D_BLIT_STATUS) & _PSB_C2B_STATUS_BUSY) == 0))
+		goto out;
+
+	do {
+		busy = (PSB_RSGX32(PSB_CR_2D_SOCIF) != _PSB_C2_SOCIF_EMPTY);
+	} while (busy && !time_after_eq(jiffies, _end));
+
+	if (busy)
+		busy = (PSB_RSGX32(PSB_CR_2D_SOCIF) != _PSB_C2_SOCIF_EMPTY);
+	if (busy)
+		goto out;
+
+	do {
+		busy =
+		    ((PSB_RSGX32(PSB_CR_2D_BLIT_STATUS) & _PSB_C2B_STATUS_BUSY)
+		     != 0);
+	} while (busy && !time_after_eq(jiffies, _end));
+	if (busy)
+		busy =
+		    ((PSB_RSGX32(PSB_CR_2D_BLIT_STATUS) & _PSB_C2B_STATUS_BUSY)
+		     != 0);
+
+      out:
+	if (busy)
+		dev_priv->engine_lockup_2d = 1;
+
+	return (busy) ? -EBUSY : 0;
+}
+
+int psb_idle_3d(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	struct psb_scheduler *scheduler = &dev_priv->scheduler;
+	int ret;
+
+	ret = wait_event_timeout(scheduler->idle_queue,
+				 psb_scheduler_finished(dev_priv), DRM_HZ * 10);
+
+	return (ret < 1) ? -EBUSY : 0;
+}
+
+static void psb_dereference_buffers_locked(struct psb_buflist_item *buffers,
+					   unsigned num_buffers)
+{
+	while (num_buffers--)
+		drm_bo_usage_deref_locked(&((buffers++)->bo));
+
+}
+
+static int psb_check_presumed(struct drm_bo_op_arg *arg,
+			      struct drm_buffer_object *bo,
+			      uint32_t __user * data, int *presumed_ok)
+{
+	struct drm_bo_op_req *req = &arg->d.req;
+	uint32_t hint_offset;
+	uint32_t hint = req->bo_req.hint;
+
+	*presumed_ok = 0;
+
+	if (!(hint & DRM_BO_HINT_PRESUMED_OFFSET))
+		return 0;
+	if (bo->mem.mem_type == DRM_BO_MEM_LOCAL) {
+		*presumed_ok = 1;
+		return 0;
+	}
+	if (bo->offset == req->bo_req.presumed_offset) {
+		*presumed_ok = 1;
+		return 0;
+	}
+
+	/*
+	 * We need to turn off the HINT_PRESUMED_OFFSET for this buffer in
+	 * the user-space IOCTL argument list, since the buffer has moved,
+	 * we're about to apply relocations and we might subsequently
+	 * hit an -EAGAIN. In that case the argument list will be reused by
+	 * user-space, but the presumed offset is no longer valid.
+	 *
+	 * Needless to say, this is a bit ugly.
+	 */
+
+	hint_offset = (uint32_t *) & req->bo_req.hint - (uint32_t *) arg;
+	hint &= ~DRM_BO_HINT_PRESUMED_OFFSET;
+	return __put_user(hint, data + hint_offset);
+}
+
+static int psb_validate_buffer_list(struct drm_file *file_priv,
+				    unsigned fence_class,
+				    unsigned long data,
+				    struct psb_buflist_item *buffers,
+				    unsigned *num_buffers)
+{
+	struct drm_bo_op_arg arg;
+	struct drm_bo_op_req *req = &arg.d.req;
+	int ret = 0;
+	unsigned buf_count = 0;
+	struct psb_buflist_item *item = buffers;
+
+	do {
+		if (buf_count >= *num_buffers) {
+			DRM_ERROR("Buffer count exceeded %d\n.", *num_buffers);
+			ret = -EINVAL;
+			goto out_err;
+		}
+		item = buffers + buf_count;
+		item->bo = NULL;
+
+		if (copy_from_user(&arg, (void __user *)data, sizeof(arg))) {
+			ret = -EFAULT;
+			DRM_ERROR("Error copying validate list.\n"
+				  "\tbuffer %d, user addr 0x%08lx %d\n",
+				  buf_count, (unsigned long)data, sizeof(arg));
+			goto out_err;
+		}
+
+		ret = 0;
+		if (req->op != drm_bo_validate) {
+			DRM_ERROR
+			    ("Buffer object operation wasn't \"validate\".\n");
+			ret = -EINVAL;
+			goto out_err;
+		}
+
+		item->ret = 0;
+		item->data = (void *)__user data;
+		ret = drm_bo_handle_validate(file_priv,
+					     req->bo_req.handle,
+					     fence_class,
+					     req->bo_req.flags,
+					     req->bo_req.mask,
+					     req->bo_req.hint,
+					     0, NULL, &item->bo);
+		if (ret)
+			goto out_err;
+
+		PSB_DEBUG_GENERAL("Validated buffer at 0x%08lx\n",
+				  buffers[buf_count].bo->offset);
+
+		buf_count++;
+
+
+		ret = psb_check_presumed(&arg, item->bo,
+					 (uint32_t __user *)
+					 (unsigned long) data,
+					 &item->presumed_offset_correct);
+
+		if (ret)
+			goto out_err;
+
+		data = arg.next;
+	} while (data);
+
+	*num_buffers = buf_count;
+
+	return 0;
+      out_err:
+
+	*num_buffers = buf_count;
+	item->ret = (ret != -EAGAIN) ? ret : 0;
+	return ret;
+}
+
+int
+psb_reg_submit(struct drm_psb_private *dev_priv, uint32_t * regs,
+	       unsigned int cmds)
+{
+	int i;
+
+	/*
+	 * cmds is 32-bit words.
+	 */
+
+	cmds >>= 1;
+	for (i = 0; i < cmds; ++i) {
+		PSB_WSGX32(regs[1], regs[0]);
+		regs += 2;
+	}
+	wmb();
+	return 0;
+}
+
+/*
+ * Security: Block user-space writing to MMU mapping registers.
+ * This is important for security and brings Poulsbo DRM
+ * up to par with the other DRM drivers. Using this,
+ * user-space should not be able to map arbitrary memory
+ * pages to graphics memory, but all user-space processes
+ * basically have access to all buffer objects mapped to
+ * graphics memory.
+ */
+
+int
+psb_submit_copy_cmdbuf(struct drm_device *dev,
+		       struct drm_buffer_object *cmd_buffer,
+		       unsigned long cmd_offset,
+		       unsigned long cmd_size,
+		       int engine, uint32_t * copy_buffer)
+{
+	unsigned long cmd_end = cmd_offset + (cmd_size << 2);
+	struct drm_psb_private *dev_priv = dev->dev_private;
+	unsigned long cmd_page_offset = cmd_offset - (cmd_offset & PAGE_MASK);
+	unsigned long cmd_next;
+	struct drm_bo_kmap_obj cmd_kmap;
+	uint32_t *cmd_page;
+	unsigned cmds;
+	int is_iomem;
+	int ret = 0;
+
+	if (cmd_size == 0)
+		return 0;
+
+	if (engine == PSB_ENGINE_2D)
+		psb_2d_lock(dev_priv);
+
+	do {
+		cmd_next = drm_bo_offset_end(cmd_offset, cmd_end);
+		ret = drm_bo_kmap(cmd_buffer, cmd_offset >> PAGE_SHIFT,
+				  1, &cmd_kmap);
+
+		if (ret)
+			return ret;
+		cmd_page = drm_bmo_virtual(&cmd_kmap, &is_iomem);
+		cmd_page_offset = (cmd_offset & ~PAGE_MASK) >> 2;
+		cmds = (cmd_next - cmd_offset) >> 2;
+
+		switch (engine) {
+		case PSB_ENGINE_2D:
+			ret =
+			    psb_2d_submit(dev_priv, cmd_page + cmd_page_offset,
+					  cmds);
+			break;
+		case PSB_ENGINE_RASTERIZER:
+		case PSB_ENGINE_TA:
+		case PSB_ENGINE_HPRAST:
+			PSB_DEBUG_GENERAL("Reg copy.\n");
+			ret = psb_memcpy_check(copy_buffer,
+					       cmd_page + cmd_page_offset,
+					       cmds * sizeof(uint32_t));
+			copy_buffer += cmds;
+			break;
+		default:
+			ret = -EINVAL;
+		}
+		drm_bo_kunmap(&cmd_kmap);
+		if (ret)
+			break;
+	} while (cmd_offset = cmd_next, cmd_offset != cmd_end);
+
+	if (engine == PSB_ENGINE_2D)
+		psb_2d_unlock(dev_priv);
+
+	return ret;
+}
+
+static void psb_clear_dstbuf_cache(struct psb_dstbuf_cache *dst_cache)
+{
+	if (dst_cache->dst_page) {
+		drm_bo_kunmap(&dst_cache->dst_kmap);
+		dst_cache->dst_page = NULL;
+	}
+	dst_cache->dst_buf = NULL;
+	dst_cache->dst = ~0;
+	dst_cache->use_page = NULL;
+}
+
+static int psb_update_dstbuf_cache(struct psb_dstbuf_cache *dst_cache,
+				   struct psb_buflist_item *buffers,
+				   unsigned int dst, unsigned long dst_offset)
+{
+	int ret;
+
+	PSB_DEBUG_RELOC("Destination buffer is %d.\n", dst);
+
+	if (unlikely(dst != dst_cache->dst || NULL == dst_cache->dst_buf)) {
+		psb_clear_dstbuf_cache(dst_cache);
+		dst_cache->dst = dst;
+		dst_cache->dst_buf = buffers[dst].bo;
+	}
+
+	if (unlikely(dst_offset > dst_cache->dst_buf->num_pages * PAGE_SIZE)) {
+		DRM_ERROR("Relocation destination out of bounds.\n");
+		return -EINVAL;
+	}
+
+	if (!drm_bo_same_page(dst_cache->dst_offset, dst_offset) ||
+	    NULL == dst_cache->dst_page) {
+		if (NULL != dst_cache->dst_page) {
+			drm_bo_kunmap(&dst_cache->dst_kmap);
+			dst_cache->dst_page = NULL;
+		}
+
+		ret = drm_bo_kmap(dst_cache->dst_buf, dst_offset >> PAGE_SHIFT,
+				  1, &dst_cache->dst_kmap);
+		if (ret) {
+			DRM_ERROR("Could not map destination buffer for "
+				  "relocation.\n");
+			return ret;
+		}
+
+		dst_cache->dst_page = drm_bmo_virtual(&dst_cache->dst_kmap,
+						      &dst_cache->dst_is_iomem);
+		dst_cache->dst_offset = dst_offset & PAGE_MASK;
+		dst_cache->dst_page_offset = dst_cache->dst_offset >> 2;
+	}
+	return 0;
+}
+
+static int psb_apply_reloc(struct drm_psb_private *dev_priv,
+			   uint32_t fence_class,
+			   const struct drm_psb_reloc *reloc,
+			   struct psb_buflist_item *buffers,
+			   int num_buffers,
+			   struct psb_dstbuf_cache *dst_cache,
+			   int no_wait, int interruptible)
+{
+	int reg;
+	uint32_t val;
+	uint32_t background;
+	unsigned int index;
+	int ret;
+	unsigned int shift;
+	unsigned int align_shift;
+	uint32_t fence_type;
+	struct drm_buffer_object *reloc_bo;
+
+	PSB_DEBUG_RELOC("Reloc type %d\n"
+			  "\t where 0x%04x\n"
+			  "\t buffer 0x%04x\n"
+			  "\t mask 0x%08x\n"
+			  "\t shift 0x%08x\n"
+			  "\t pre_add 0x%08x\n"
+			  "\t background 0x%08x\n"
+			  "\t dst_buffer 0x%08x\n"
+			  "\t arg0 0x%08x\n"
+			  "\t arg1 0x%08x\n",
+			  reloc->reloc_op,
+			  reloc->where,
+			  reloc->buffer,
+			  reloc->mask,
+			  reloc->shift,
+			  reloc->pre_add,
+			  reloc->background,
+			  reloc->dst_buffer, reloc->arg0, reloc->arg1);
+
+	if (unlikely(reloc->buffer >= num_buffers)) {
+		DRM_ERROR("Illegal relocation buffer %d.\n", reloc->buffer);
+		return -EINVAL;
+	}
+
+	if (buffers[reloc->buffer].presumed_offset_correct)
+		return 0;
+
+	if (unlikely(reloc->dst_buffer >= num_buffers)) {
+		DRM_ERROR("Illegal destination buffer for relocation %d.\n",
+			  reloc->dst_buffer);
+		return -EINVAL;
+	}
+
+	ret = psb_update_dstbuf_cache(dst_cache, buffers, reloc->dst_buffer,
+				      reloc->where << 2);
+	if (ret)
+		return ret;
+
+	reloc_bo = buffers[reloc->buffer].bo;
+
+	if (unlikely(reloc->pre_add > (reloc_bo->num_pages << PAGE_SHIFT))) {
+		DRM_ERROR("Illegal relocation offset add.\n");
+		return -EINVAL;
+	}
+
+	switch (reloc->reloc_op) {
+	case PSB_RELOC_OP_OFFSET:
+		val = reloc_bo->offset + reloc->pre_add;
+		break;
+	case PSB_RELOC_OP_2D_OFFSET:
+		val = reloc_bo->offset + reloc->pre_add -
+		    dev_priv->mmu_2d_offset;
+		if (unlikely(val >= PSB_2D_SIZE)) {
+			DRM_ERROR("2D relocation out of bounds\n");
+			return -EINVAL;
+		}
+		break;
+	case PSB_RELOC_OP_PDS_OFFSET:
+		val = reloc_bo->offset + reloc->pre_add - PSB_MEM_PDS_START;
+		if (unlikely(val >= (PSB_MEM_MMU_START - PSB_MEM_PDS_START))) {
+			DRM_ERROR("PDS relocation out of bounds\n");
+			return -EINVAL;
+		}
+		break;
+	case PSB_RELOC_OP_USE_OFFSET:
+	case PSB_RELOC_OP_USE_REG:
+
+		/*
+		 * Security:
+		 * Only allow VERTEX or PIXEL data masters, as
+		 * shaders run under other data masters may in theory
+		 * alter MMU mappings.
+		 */
+
+		if (unlikely(reloc->arg1 != _PSB_CUC_DM_PIXEL &&
+			     reloc->arg1 != _PSB_CUC_DM_VERTEX)) {
+			DRM_ERROR("Invalid data master in relocation. %d\n",
+				  reloc->arg1);
+			return -EPERM;
+		}
+
+		fence_type = reloc_bo->fence_type;
+		ret = psb_grab_use_base(dev_priv,
+					reloc_bo->offset +
+					reloc->pre_add, reloc->arg0,
+					reloc->arg1, fence_class,
+					fence_type, no_wait,
+					interruptible, &reg, &val);
+		if (ret)
+			return ret;
+
+		val = (reloc->reloc_op == PSB_RELOC_OP_USE_REG) ? reg : val;
+		break;
+	default:
+		DRM_ERROR("Unimplemented relocation.\n");
+		return -EINVAL;
+	}
+
+	shift = (reloc->shift & PSB_RELOC_SHIFT_MASK) >> PSB_RELOC_SHIFT_SHIFT;
+	align_shift = (reloc->shift & PSB_RELOC_ALSHIFT_MASK) >>
+	    PSB_RELOC_ALSHIFT_SHIFT;
+
+	val = ((val >> align_shift) << shift);
+	index = reloc->where - dst_cache->dst_page_offset;
+
+	background = reloc->background;
+
+	if (reloc->reloc_op == PSB_RELOC_OP_USE_OFFSET) {
+		if (dst_cache->use_page == dst_cache->dst_page &&
+		    dst_cache->use_index == index)
+			background = dst_cache->use_background;
+		else
+			background = dst_cache->dst_page[index];
+	}
+#if 0
+	if (dst_cache->dst_page[index] != PSB_RELOC_MAGIC &&
+	    reloc->reloc_op != PSB_RELOC_OP_USE_OFFSET)
+		DRM_ERROR("Inconsistent relocation 0x%08lx.\n",
+			  (unsigned long)dst_cache->dst_page[index]);
+#endif
+
+	val = (background & ~reloc->mask) | (val & reloc->mask);
+	dst_cache->dst_page[index] = val;
+
+	if (reloc->reloc_op == PSB_RELOC_OP_USE_OFFSET ||
+	    reloc->reloc_op == PSB_RELOC_OP_USE_REG) {
+		dst_cache->use_page = dst_cache->dst_page;
+		dst_cache->use_index = index;
+		dst_cache->use_background = val;
+	}
+
+	PSB_DEBUG_RELOC("Reloc buffer %d index 0x%08x, value 0x%08x\n",
+			  reloc->dst_buffer, index, dst_cache->dst_page[index]);
+
+	return 0;
+}
+
+static int psb_ok_to_map_reloc(struct drm_psb_private *dev_priv,
+			       unsigned int num_pages)
+{
+	int ret = 0;
+
+	spin_lock(&dev_priv->reloc_lock);
+	if (dev_priv->rel_mapped_pages + num_pages <= PSB_MAX_RELOC_PAGES) {
+		dev_priv->rel_mapped_pages += num_pages;
+		ret = 1;
+	}
+	spin_unlock(&dev_priv->reloc_lock);
+	return ret;
+}
+
+static int psb_fixup_relocs(struct drm_file *file_priv,
+			    uint32_t fence_class,
+			    unsigned int num_relocs,
+			    unsigned int reloc_offset,
+			    uint32_t reloc_handle,
+			    struct psb_buflist_item *buffers,
+			    unsigned int num_buffers,
+			    int no_wait, int interruptible)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct drm_buffer_object *reloc_buffer = NULL;
+	unsigned int reloc_num_pages;
+	unsigned int reloc_first_page;
+	unsigned int reloc_last_page;
+	struct psb_dstbuf_cache dst_cache;
+	struct drm_psb_reloc *reloc;
+	struct drm_bo_kmap_obj reloc_kmap;
+	int reloc_is_iomem;
+	int count;
+	int ret = 0;
+	int registered = 0;
+	int short_circuit = 1;
+	int i;
+
+	if (num_relocs == 0)
+		return 0;
+
+	for (i=0; i<num_buffers; ++i) {
+		if (!buffers[i].presumed_offset_correct) {
+			short_circuit = 0;
+			break;
+		}
+	}
+
+	if (short_circuit)
+		return 0;
+
+	memset(&dst_cache, 0, sizeof(dst_cache));
+	memset(&reloc_kmap, 0, sizeof(reloc_kmap));
+
+	mutex_lock(&dev->struct_mutex);
+	reloc_buffer = drm_lookup_buffer_object(file_priv, reloc_handle, 1);
+	mutex_unlock(&dev->struct_mutex);
+	if (!reloc_buffer)
+		goto out;
+
+	reloc_first_page = reloc_offset >> PAGE_SHIFT;
+	reloc_last_page =
+	    (reloc_offset +
+	     num_relocs * sizeof(struct drm_psb_reloc)) >> PAGE_SHIFT;
+	reloc_num_pages = reloc_last_page - reloc_first_page + 1;
+	reloc_offset &= ~PAGE_MASK;
+
+	if (reloc_num_pages > PSB_MAX_RELOC_PAGES) {
+		DRM_ERROR("Relocation buffer is too large\n");
+		ret = -EINVAL;
+		goto out;
+	}
+
+	DRM_WAIT_ON(ret, dev_priv->rel_mapped_queue, 3 * DRM_HZ,
+		    (registered =
+		     psb_ok_to_map_reloc(dev_priv, reloc_num_pages)));
+
+	if (ret == -EINTR) {
+		ret = -EAGAIN;
+		goto out;
+	}
+	if (ret) {
+		DRM_ERROR("Error waiting for space to map "
+			  "relocation buffer.\n");
+		goto out;
+	}
+
+	ret = drm_bo_kmap(reloc_buffer, reloc_first_page,
+			  reloc_num_pages, &reloc_kmap);
+
+	if (ret) {
+		DRM_ERROR("Could not map relocation buffer.\n"
+			  "\tReloc buffer id 0x%08x.\n"
+			  "\tReloc first page %d.\n"
+			  "\tReloc num pages %d.\n",
+			  reloc_handle, reloc_first_page, reloc_num_pages);
+		goto out;
+	}
+
+	reloc = (struct drm_psb_reloc *)
+	    ((unsigned long)drm_bmo_virtual(&reloc_kmap, &reloc_is_iomem) +
+	     reloc_offset);
+
+	for (count = 0; count < num_relocs; ++count) {
+		ret = psb_apply_reloc(dev_priv, fence_class,
+				      reloc, buffers,
+				      num_buffers, &dst_cache,
+				      no_wait, interruptible);
+		if (ret)
+			goto out1;
+		reloc++;
+	}
+
+      out1:
+	drm_bo_kunmap(&reloc_kmap);
+      out:
+	if (registered) {
+		spin_lock(&dev_priv->reloc_lock);
+		dev_priv->rel_mapped_pages -= reloc_num_pages;
+		spin_unlock(&dev_priv->reloc_lock);
+		DRM_WAKEUP(&dev_priv->rel_mapped_queue);
+	}
+
+	psb_clear_dstbuf_cache(&dst_cache);
+	if (reloc_buffer)
+		drm_bo_usage_deref_unlocked(&reloc_buffer);
+	return ret;
+}
+
+static int psb_cmdbuf_2d(struct drm_file *priv,
+			 struct drm_psb_cmdbuf_arg *arg,
+			 struct drm_buffer_object *cmd_buffer,
+			 struct drm_fence_arg *fence_arg)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	int ret;
+
+	ret = mutex_lock_interruptible(&dev_priv->reset_mutex);
+	if (ret)
+		return -EAGAIN;
+
+	ret = psb_submit_copy_cmdbuf(dev, cmd_buffer, arg->cmdbuf_offset,
+				     arg->cmdbuf_size, PSB_ENGINE_2D, NULL);
+	if (ret)
+		goto out_unlock;
+
+	psb_fence_or_sync(priv, PSB_ENGINE_2D, arg, fence_arg, NULL);
+
+	mutex_lock(&cmd_buffer->mutex);
+	if (cmd_buffer->fence != NULL)
+		drm_fence_usage_deref_unlocked(&cmd_buffer->fence);
+	mutex_unlock(&cmd_buffer->mutex);
+      out_unlock:
+	mutex_unlock(&dev_priv->reset_mutex);
+	return ret;
+}
+
+#if 0
+static int psb_dump_page(struct drm_buffer_object *bo,
+			 unsigned int page_offset, unsigned int num)
+{
+	struct drm_bo_kmap_obj kmobj;
+	int is_iomem;
+	uint32_t *p;
+	int ret;
+	unsigned int i;
+
+	ret = drm_bo_kmap(bo, page_offset, 1, &kmobj);
+	if (ret)
+		return ret;
+
+	p = drm_bmo_virtual(&kmobj, &is_iomem);
+	for (i = 0; i < num; ++i)
+		PSB_DEBUG_GENERAL("0x%04x: 0x%08x\n", i, *p++);
+
+	drm_bo_kunmap(&kmobj);
+	return 0;
+}
+#endif
+
+static void psb_idle_engine(struct drm_device *dev, int engine)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	uint32_t dummy;
+
+	switch (engine) {
+	case PSB_ENGINE_2D:
+
+		/*
+		 * Make sure we flush 2D properly using a dummy
+		 * fence sequence emit.
+		 */
+
+		(void)psb_fence_emit_sequence(dev, PSB_ENGINE_2D, 0,
+					      &dummy, &dummy);
+		psb_2d_lock(dev_priv);
+		(void)psb_idle_2d(dev);
+		psb_2d_unlock(dev_priv);
+		break;
+	case PSB_ENGINE_TA:
+	case PSB_ENGINE_RASTERIZER:
+	case PSB_ENGINE_HPRAST:
+		(void)psb_idle_3d(dev);
+		break;
+	default:
+
+		/*
+		 * FIXME: Insert video engine idle command here.
+		 */
+
+		break;
+	}
+}
+
+void psb_fence_or_sync(struct drm_file *priv,
+		       int engine,
+		       struct drm_psb_cmdbuf_arg *arg,
+		       struct drm_fence_arg *fence_arg,
+		       struct drm_fence_object **fence_p)
+{
+	struct drm_device *dev = priv->minor->dev;
+	int ret;
+	struct drm_fence_object *fence;
+
+	ret = drm_fence_buffer_objects(dev, NULL, arg->fence_flags,
+				       NULL, &fence);
+
+	if (ret) {
+
+		/*
+		 * Fence creation failed.
+		 * Fall back to synchronous operation and idle the engine.
+		 */
+
+		psb_idle_engine(dev, engine);
+		if (!(arg->fence_flags & DRM_FENCE_FLAG_NO_USER)) {
+
+			/*
+			 * Communicate to user-space that
+			 * fence creation has failed and that
+			 * the engine is idle.
+			 */
+
+			fence_arg->handle = ~0;
+			fence_arg->error = ret;
+		}
+
+		drm_putback_buffer_objects(dev);
+		if (fence_p)
+			*fence_p = NULL;
+		return;
+	}
+
+	if (!(arg->fence_flags & DRM_FENCE_FLAG_NO_USER)) {
+
+		ret = drm_fence_add_user_object(priv, fence,
+						arg->fence_flags &
+						DRM_FENCE_FLAG_SHAREABLE);
+		if (!ret)
+			drm_fence_fill_arg(fence, fence_arg);
+		else {
+			/*
+			 * Fence user object creation failed.
+			 * We must idle the engine here as well, as user-
+			 * space expects a fence object to wait on. Since we
+			 * have a fence object we wait for it to signal
+			 * to indicate engine "sufficiently" idle.
+			 */
+
+			(void)drm_fence_object_wait(fence, 0, 1, fence->type);
+			drm_fence_usage_deref_unlocked(&fence);
+			fence_arg->handle = ~0;
+			fence_arg->error = ret;
+		}
+	}
+
+	if (fence_p)
+		*fence_p = fence;
+	else if (fence)
+		drm_fence_usage_deref_unlocked(&fence);
+}
+
+int psb_handle_copyback(struct drm_device *dev,
+			struct psb_buflist_item *buffers,
+			unsigned int num_buffers, int ret, void *data)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	struct drm_bo_op_arg arg;
+	struct psb_buflist_item *item = buffers;
+	struct drm_buffer_object *bo;
+	int err = ret;
+	int i;
+
+	/*
+	 * Clear the unfenced use base register lists and buffer lists.
+	 */
+
+	if (ret) {
+		drm_regs_fence(&dev_priv->use_manager, NULL);
+		drm_putback_buffer_objects(dev);
+	}
+
+	if (ret != -EAGAIN) {
+		for (i = 0; i < num_buffers; ++i) {
+			arg.handled = 1;
+			arg.d.rep.ret = item->ret;
+			bo = item->bo;
+			mutex_lock(&bo->mutex);
+			drm_bo_fill_rep_arg(bo, &arg.d.rep.bo_info);
+			mutex_unlock(&bo->mutex);
+			if (copy_to_user(item->data, &arg, sizeof(arg)))
+				err = -EFAULT;
+			++item;
+		}
+	}
+
+	return err;
+}
+
+static int psb_cmdbuf_video(struct drm_file *priv,
+			    struct drm_psb_cmdbuf_arg *arg,
+			    unsigned int num_buffers,
+			    struct drm_buffer_object *cmd_buffer,
+			    struct drm_fence_arg *fence_arg)
+{
+	struct drm_device *dev = priv->minor->dev;
+	struct drm_fence_object *fence;
+	int ret;
+
+	/*
+	 * Check this. Doesn't seem right. Have fencing done AFTER command
+	 * submission and make sure drm_psb_idle idles the MSVDX completely.
+	 */
+
+	psb_fence_or_sync(priv, PSB_ENGINE_VIDEO, arg, fence_arg, &fence);
+	ret = psb_submit_video_cmdbuf(dev, cmd_buffer, arg->cmdbuf_offset,
+				      arg->cmdbuf_size, fence);
+
+	if (ret)
+		return ret;
+
+	drm_fence_usage_deref_unlocked(&fence);
+	mutex_lock(&cmd_buffer->mutex);
+	if (cmd_buffer->fence != NULL)
+		drm_fence_usage_deref_unlocked(&cmd_buffer->fence);
+	mutex_unlock(&cmd_buffer->mutex);
+	return 0;
+}
+
+int psb_feedback_buf(struct drm_file *file_priv,
+		     uint32_t feedback_ops,
+		     uint32_t handle,
+		     uint32_t offset,
+		     uint32_t feedback_breakpoints,
+		     uint32_t feedback_size, struct psb_feedback_info *feedback)
+{
+	struct drm_buffer_object *bo;
+	struct page *page;
+	uint32_t page_no;
+	uint32_t page_offset;
+	int ret;
+
+	if (feedback_ops & ~PSB_FEEDBACK_OP_VISTEST) {
+		DRM_ERROR("Illegal feedback op.\n");
+		return -EINVAL;
+	}
+
+	if (feedback_breakpoints != 0) {
+		DRM_ERROR("Feedback breakpoints not implemented yet.\n");
+		return -EINVAL;
+	}
+
+	if (feedback_size < PSB_HW_FEEDBACK_SIZE * sizeof(uint32_t)) {
+		DRM_ERROR("Feedback buffer size too small.\n");
+		return -EINVAL;
+	}
+
+	page_offset = offset & ~PAGE_MASK;
+	if ((PAGE_SIZE - PSB_HW_FEEDBACK_SIZE * sizeof(uint32_t))
+	    < page_offset) {
+		DRM_ERROR("Illegal feedback buffer alignment.\n");
+		return -EINVAL;
+	}
+
+	ret = drm_bo_handle_validate(file_priv,
+				     handle,
+				     PSB_ENGINE_TA,
+				     DRM_BO_FLAG_MEM_LOCAL |
+				     DRM_BO_FLAG_CACHED |
+				     DRM_BO_FLAG_WRITE |
+				     PSB_BO_FLAG_FEEDBACK,
+				     DRM_BO_MASK_MEM |
+				     DRM_BO_FLAG_CACHED |
+				     DRM_BO_FLAG_WRITE |
+				     PSB_BO_FLAG_FEEDBACK, 0, 0, NULL, &bo);
+	if (ret)
+		return ret;
+
+	page_no = offset >> PAGE_SHIFT;
+	if (page_no >= bo->num_pages) {
+		ret = -EINVAL;
+		DRM_ERROR("Illegal feedback buffer offset.\n");
+		goto out_unref;
+	}
+
+	if (bo->ttm == NULL) {
+		ret = -EINVAL;
+		DRM_ERROR("Vistest buffer without TTM.\n");
+		goto out_unref;
+	}
+
+	page = drm_ttm_get_page(bo->ttm, page_no);
+	if (!page) {
+		ret = -ENOMEM;
+		goto out_unref;
+	}
+
+	feedback->page = page;
+	feedback->bo = bo;
+	feedback->offset = page_offset;
+	return 0;
+
+      out_unref:
+	drm_bo_usage_deref_unlocked(&bo);
+	return ret;
+}
+
+int psb_cmdbuf_ioctl(struct drm_device *dev, void *data,
+		     struct drm_file *file_priv)
+{
+	drm_psb_cmdbuf_arg_t *arg = data;
+	int ret = 0;
+	unsigned num_buffers;
+	struct drm_buffer_object *cmd_buffer = NULL;
+	struct drm_buffer_object *ta_buffer = NULL;
+	struct drm_buffer_object *oom_buffer = NULL;
+	struct drm_fence_arg fence_arg;
+	struct drm_psb_scene user_scene;
+	struct psb_scene_pool *pool = NULL;
+	struct psb_scene *scene = NULL;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)file_priv->minor->dev->dev_private;
+	int engine;
+	struct psb_feedback_info feedback;
+
+	if (!dev_priv)
+		return -EINVAL;
+
+	ret = drm_bo_read_lock(&dev->bm.bm_lock);
+	if (ret)
+		return ret;
+
+	num_buffers = PSB_NUM_VALIDATE_BUFFERS;
+
+	ret = mutex_lock_interruptible(&dev_priv->cmdbuf_mutex);
+	if (ret) {
+		drm_bo_read_unlock(&dev->bm.bm_lock);
+		return -EAGAIN;
+	}
+	if (unlikely(dev_priv->buffers == NULL)) {
+		dev_priv->buffers = vmalloc(PSB_NUM_VALIDATE_BUFFERS *
+					    sizeof(*dev_priv->buffers));
+		if (dev_priv->buffers == NULL) {
+			drm_bo_read_unlock(&dev->bm.bm_lock);
+			return -ENOMEM;
+		}
+	}
+
+
+	engine = (arg->engine == PSB_ENGINE_RASTERIZER) ?
+	    PSB_ENGINE_TA : arg->engine;
+
+	ret =
+	    psb_validate_buffer_list(file_priv, engine,
+				     (unsigned long)arg->buffer_list,
+				     dev_priv->buffers, &num_buffers);
+	if (ret)
+		goto out_err0;
+
+	ret = psb_fixup_relocs(file_priv, engine, arg->num_relocs,
+			       arg->reloc_offset, arg->reloc_handle,
+			       dev_priv->buffers, num_buffers, 0, 1);
+	if (ret)
+		goto out_err0;
+
+	mutex_lock(&dev->struct_mutex);
+	cmd_buffer = drm_lookup_buffer_object(file_priv, arg->cmdbuf_handle, 1);
+	mutex_unlock(&dev->struct_mutex);
+	if (!cmd_buffer) {
+		ret = -EINVAL;
+		goto out_err0;
+	}
+
+	switch (arg->engine) {
+	case PSB_ENGINE_2D:
+		ret = psb_cmdbuf_2d(file_priv, arg, cmd_buffer, &fence_arg);
+		if (ret)
+			goto out_err0;
+		break;
+	case PSB_ENGINE_VIDEO:
+		ret =
+		    psb_cmdbuf_video(file_priv, arg, num_buffers, cmd_buffer,
+				     &fence_arg);
+		if (ret)
+			goto out_err0;
+		break;
+	case PSB_ENGINE_RASTERIZER:
+		ret = psb_cmdbuf_raster(file_priv, arg, cmd_buffer, &fence_arg);
+		if (ret)
+			goto out_err0;
+		break;
+	case PSB_ENGINE_TA:
+		if (arg->ta_handle == arg->cmdbuf_handle) {
+			mutex_lock(&dev->struct_mutex);
+			atomic_inc(&cmd_buffer->usage);
+			ta_buffer = cmd_buffer;
+			mutex_unlock(&dev->struct_mutex);
+		} else {
+			mutex_lock(&dev->struct_mutex);
+			ta_buffer =
+			    drm_lookup_buffer_object(file_priv,
+						     arg->ta_handle, 1);
+			mutex_unlock(&dev->struct_mutex);
+			if (!ta_buffer) {
+				ret = -EINVAL;
+				goto out_err0;
+			}
+		}
+		if (arg->oom_size != 0) {
+			if (arg->oom_handle == arg->cmdbuf_handle) {
+				mutex_lock(&dev->struct_mutex);
+				atomic_inc(&cmd_buffer->usage);
+				oom_buffer = cmd_buffer;
+				mutex_unlock(&dev->struct_mutex);
+			} else {
+				mutex_lock(&dev->struct_mutex);
+				oom_buffer =
+				    drm_lookup_buffer_object(file_priv,
+							     arg->oom_handle,
+							     1);
+				mutex_unlock(&dev->struct_mutex);
+				if (!oom_buffer) {
+					ret = -EINVAL;
+					goto out_err0;
+				}
+			}
+		}
+
+		ret = copy_from_user(&user_scene, (void __user *)
+				     ((unsigned long)arg->scene_arg),
+				     sizeof(user_scene));
+		if (ret)
+			goto out_err0;
+
+		if (!user_scene.handle_valid) {
+			pool = psb_scene_pool_alloc(file_priv, 0,
+						    user_scene.num_buffers,
+						    user_scene.w, user_scene.h);
+			if (!pool) {
+				ret = -ENOMEM;
+				goto out_err0;
+			}
+
+			user_scene.handle = psb_scene_pool_handle(pool);
+			user_scene.handle_valid = 1;
+			ret = copy_to_user((void __user *)
+					   ((unsigned long)arg->scene_arg),
+					   &user_scene, sizeof(user_scene));
+
+			if (ret)
+				goto out_err0;
+		} else {
+			mutex_lock(&dev->struct_mutex);
+			pool = psb_scene_pool_lookup_devlocked(file_priv,
+							       user_scene.
+							       handle, 1);
+			mutex_unlock(&dev->struct_mutex);
+			if (!pool) {
+				ret = -EINVAL;
+				goto out_err0;
+			}
+		}
+
+		mutex_lock(&dev_priv->reset_mutex);
+		ret = psb_validate_scene_pool(pool, 0, 0, 0,
+					      user_scene.w,
+					      user_scene.h,
+					      arg->ta_flags &
+					      PSB_TA_FLAG_LASTPASS, &scene);
+		mutex_unlock(&dev_priv->reset_mutex);
+
+		if (ret)
+			goto out_err0;
+
+		memset(&feedback, 0, sizeof(feedback));
+		if (arg->feedback_ops) {
+			ret = psb_feedback_buf(file_priv,
+					       arg->feedback_ops,
+					       arg->feedback_handle,
+					       arg->feedback_offset,
+					       arg->feedback_breakpoints,
+					       arg->feedback_size, &feedback);
+			if (ret)
+				goto out_err0;
+		}
+		ret = psb_cmdbuf_ta(file_priv, arg, cmd_buffer, ta_buffer,
+				    oom_buffer, scene, &feedback, &fence_arg);
+		if (ret)
+			goto out_err0;
+		break;
+	default:
+		DRM_ERROR("Unimplemented command submission mechanism (%x).\n",
+			  arg->engine);
+		ret = -EINVAL;
+		goto out_err0;
+	}
+
+	if (!(arg->fence_flags & DRM_FENCE_FLAG_NO_USER)) {
+		ret = copy_to_user((void __user *)
+				   ((unsigned long)arg->fence_arg),
+				   &fence_arg, sizeof(fence_arg));
+	}
+
+      out_err0:
+	ret =
+	    psb_handle_copyback(dev, dev_priv->buffers, num_buffers, ret, data);
+	mutex_lock(&dev->struct_mutex);
+	if (scene)
+		psb_scene_unref_devlocked(&scene);
+	if (pool)
+		psb_scene_pool_unref_devlocked(&pool);
+	if (cmd_buffer)
+		drm_bo_usage_deref_locked(&cmd_buffer);
+	if (ta_buffer)
+		drm_bo_usage_deref_locked(&ta_buffer);
+	if (oom_buffer)
+		drm_bo_usage_deref_locked(&oom_buffer);
+
+	psb_dereference_buffers_locked(dev_priv->buffers, num_buffers);
+	mutex_unlock(&dev->struct_mutex);
+	mutex_unlock(&dev_priv->cmdbuf_mutex);
+
+	drm_bo_read_unlock(&dev->bm.bm_lock);
+	return ret;
+}
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_xhw.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_xhw.c	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,614 @@
+/**************************************************************************
+ * Copyright (c) 2007, Intel Corporation.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Intel funded Tungsten Graphics (http://www.tungstengraphics.com) to
+ * develop this driver.
+ *
+ **************************************************************************/
+/*
+ * Make calls into closed source X server code.
+ */
+
+#include "drmP.h"
+#include "psb_drv.h"
+
+void
+psb_xhw_clean_buf(struct drm_psb_private *dev_priv, struct psb_xhw_buf *buf)
+{
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	list_del_init(&buf->head);
+	if (dev_priv->xhw_cur_buf == buf)
+		dev_priv->xhw_cur_buf = NULL;
+	atomic_set(&buf->done, 1);
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+}
+
+static inline int psb_xhw_add(struct drm_psb_private *dev_priv,
+			      struct psb_xhw_buf *buf)
+{
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	atomic_set(&buf->done, 0);
+	if (unlikely(!dev_priv->xhw_submit_ok)) {
+		spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+		DRM_ERROR("No Xpsb 3D extension available.\n");
+		return -EINVAL;
+	}
+	if (!list_empty(&buf->head)) {
+		DRM_ERROR("Recursive list adding.\n");
+		goto out;
+	}
+	list_add_tail(&buf->head, &dev_priv->xhw_in);
+	wake_up_interruptible(&dev_priv->xhw_queue);
+      out:
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+	return 0;
+}
+
+int psb_xhw_scene_info(struct drm_psb_private *dev_priv,
+		       struct psb_xhw_buf *buf,
+		       uint32_t w,
+		       uint32_t h,
+		       uint32_t * hw_cookie,
+		       uint32_t * bo_size,
+		       uint32_t * clear_p_start, uint32_t * clear_num_pages)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+	int ret;
+
+	buf->copy_back = 1;
+	xa->op = PSB_XHW_SCENE_INFO;
+	xa->irq_op = 0;
+	xa->issue_irq = 0;
+	xa->arg.si.w = w;
+	xa->arg.si.h = h;
+
+	ret = psb_xhw_add(dev_priv, buf);
+	if (ret)
+		return ret;
+
+	(void)wait_event_timeout(dev_priv->xhw_caller_queue,
+				 atomic_read(&buf->done), DRM_HZ);
+
+	if (!atomic_read(&buf->done)) {
+		psb_xhw_clean_buf(dev_priv, buf);
+		return -EBUSY;
+	}
+
+	if (!xa->ret) {
+		memcpy(hw_cookie, xa->cookie, sizeof(xa->cookie));
+		*bo_size = xa->arg.si.size;
+		*clear_p_start = xa->arg.si.clear_p_start;
+		*clear_num_pages = xa->arg.si.clear_num_pages;
+	}
+	return xa->ret;
+}
+
+int psb_xhw_fire_raster(struct drm_psb_private *dev_priv,
+			struct psb_xhw_buf *buf, uint32_t fire_flags)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+
+	buf->copy_back = 0;
+	xa->op = PSB_XHW_FIRE_RASTER;
+	xa->issue_irq = 0;
+	xa->arg.sb.fire_flags = 0;
+
+	return psb_xhw_add(dev_priv, buf);
+}
+
+int psb_xhw_vistest(struct drm_psb_private *dev_priv, struct psb_xhw_buf *buf)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+
+	buf->copy_back = 1;
+	xa->op = PSB_XHW_VISTEST;
+	/*
+	 * Could perhaps decrease latency somewhat by
+	 * issuing an irq in this case.
+	 */
+	xa->issue_irq = 0;
+	xa->irq_op = PSB_UIRQ_VISTEST;
+	return psb_xhw_add(dev_priv, buf);
+}
+
+int psb_xhw_scene_bind_fire(struct drm_psb_private *dev_priv,
+			    struct psb_xhw_buf *buf,
+			    uint32_t fire_flags,
+			    uint32_t hw_context,
+			    uint32_t * cookie,
+			    uint32_t * oom_cmds,
+			    uint32_t num_oom_cmds,
+			    uint32_t offset, uint32_t engine, uint32_t flags)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+
+	buf->copy_back = (fire_flags & PSB_FIRE_FLAG_XHW_OOM);
+	xa->op = PSB_XHW_SCENE_BIND_FIRE;
+	xa->issue_irq = (buf->copy_back) ? 1 : 0;
+	if (unlikely(buf->copy_back))
+		xa->irq_op = (engine == PSB_SCENE_ENGINE_TA) ?
+		    PSB_UIRQ_FIRE_TA_REPLY : PSB_UIRQ_FIRE_RASTER_REPLY;
+	else
+		xa->irq_op = 0;
+	xa->arg.sb.fire_flags = fire_flags;
+	xa->arg.sb.hw_context = hw_context;
+	xa->arg.sb.offset = offset;
+	xa->arg.sb.engine = engine;
+	xa->arg.sb.flags = flags;
+	xa->arg.sb.num_oom_cmds = num_oom_cmds;
+	memcpy(xa->cookie, cookie, sizeof(xa->cookie));
+	if (num_oom_cmds)
+		memcpy(xa->arg.sb.oom_cmds, oom_cmds,
+		       sizeof(uint32_t) * num_oom_cmds);
+	return psb_xhw_add(dev_priv, buf);
+}
+
+int psb_xhw_reset_dpm(struct drm_psb_private *dev_priv, struct psb_xhw_buf *buf)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+	int ret;
+
+	buf->copy_back = 1;
+	xa->op = PSB_XHW_RESET_DPM;
+	xa->issue_irq = 0;
+	xa->irq_op = 0;
+
+	ret = psb_xhw_add(dev_priv, buf);
+	if (ret)
+		return ret;
+
+	(void)wait_event_timeout(dev_priv->xhw_caller_queue,
+				 atomic_read(&buf->done), 3 * DRM_HZ);
+
+	if (!atomic_read(&buf->done)) {
+		psb_xhw_clean_buf(dev_priv, buf);
+		return -EBUSY;
+	}
+
+	return xa->ret;
+}
+
+int psb_xhw_check_lockup(struct drm_psb_private *dev_priv,
+			 struct psb_xhw_buf *buf, uint32_t * value)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+	int ret;
+
+	*value = 0;
+
+	buf->copy_back = 1;
+	xa->op = PSB_XHW_CHECK_LOCKUP;
+	xa->issue_irq = 0;
+	xa->irq_op = 0;
+
+	ret = psb_xhw_add(dev_priv, buf);
+	if (ret)
+		return ret;
+
+	(void)wait_event_timeout(dev_priv->xhw_caller_queue,
+				 atomic_read(&buf->done), DRM_HZ * 3);
+
+	if (!atomic_read(&buf->done)) {
+		psb_xhw_clean_buf(dev_priv, buf);
+		return -EBUSY;
+	}
+
+	if (!xa->ret)
+		*value = xa->arg.cl.value;
+
+	return xa->ret;
+}
+
+static int psb_xhw_terminate(struct drm_psb_private *dev_priv,
+			     struct psb_xhw_buf *buf)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+	unsigned long irq_flags;
+
+	buf->copy_back = 0;
+	xa->op = PSB_XHW_TERMINATE;
+	xa->issue_irq = 0;
+
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	dev_priv->xhw_submit_ok = 0;
+	atomic_set(&buf->done, 0);
+	if (!list_empty(&buf->head)) {
+		DRM_ERROR("Recursive list adding.\n");
+		goto out;
+	}
+	list_add_tail(&buf->head, &dev_priv->xhw_in);
+      out:
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+	wake_up_interruptible(&dev_priv->xhw_queue);
+
+	(void)wait_event_timeout(dev_priv->xhw_caller_queue,
+				 atomic_read(&buf->done), DRM_HZ / 10);
+
+	if (!atomic_read(&buf->done)) {
+		DRM_ERROR("Xpsb terminate timeout.\n");
+		psb_xhw_clean_buf(dev_priv, buf);
+		return -EBUSY;
+	}
+
+	return 0;
+}
+
+int psb_xhw_ta_mem_info(struct drm_psb_private *dev_priv,
+			struct psb_xhw_buf *buf,
+			uint32_t pages, uint32_t * hw_cookie, uint32_t * size)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+	int ret;
+
+	buf->copy_back = 1;
+	xa->op = PSB_XHW_TA_MEM_INFO;
+	xa->issue_irq = 0;
+	xa->irq_op = 0;
+	xa->arg.bi.pages = pages;
+
+	ret = psb_xhw_add(dev_priv, buf);
+	if (ret)
+		return ret;
+
+	(void)wait_event_timeout(dev_priv->xhw_caller_queue,
+				 atomic_read(&buf->done), DRM_HZ);
+
+	if (!atomic_read(&buf->done)) {
+		psb_xhw_clean_buf(dev_priv, buf);
+		return -EBUSY;
+	}
+
+	if (!xa->ret)
+		memcpy(hw_cookie, xa->cookie, sizeof(xa->cookie));
+
+	*size = xa->arg.bi.size;
+	return xa->ret;
+}
+
+int psb_xhw_ta_mem_load(struct drm_psb_private *dev_priv,
+			struct psb_xhw_buf *buf,
+			uint32_t flags,
+			uint32_t param_offset,
+			uint32_t pt_offset, uint32_t * hw_cookie)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+	int ret;
+
+	buf->copy_back = 1;
+	xa->op = PSB_XHW_TA_MEM_LOAD;
+	xa->issue_irq = 0;
+	xa->irq_op = 0;
+	xa->arg.bl.flags = flags;
+	xa->arg.bl.param_offset = param_offset;
+	xa->arg.bl.pt_offset = pt_offset;
+	memcpy(xa->cookie, hw_cookie, sizeof(xa->cookie));
+
+	ret = psb_xhw_add(dev_priv, buf);
+	if (ret)
+		return ret;
+
+	(void)wait_event_timeout(dev_priv->xhw_caller_queue,
+				 atomic_read(&buf->done), 3 * DRM_HZ);
+
+	if (!atomic_read(&buf->done)) {
+		psb_xhw_clean_buf(dev_priv, buf);
+		return -EBUSY;
+	}
+
+	if (!xa->ret)
+		memcpy(hw_cookie, xa->cookie, sizeof(xa->cookie));
+
+	return xa->ret;
+}
+
+int psb_xhw_ta_oom(struct drm_psb_private *dev_priv,
+		   struct psb_xhw_buf *buf, uint32_t * cookie)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+
+	/*
+	 * This calls the extensive closed source
+	 * OOM handler, which resolves the condition and
+	 * sends a reply telling the scheduler what to do
+	 * with the task.
+	 */
+
+	buf->copy_back = 1;
+	xa->op = PSB_XHW_OOM;
+	xa->issue_irq = 1;
+	xa->irq_op = PSB_UIRQ_OOM_REPLY;
+	memcpy(xa->cookie, cookie, sizeof(xa->cookie));
+
+	return psb_xhw_add(dev_priv, buf);
+}
+
+void psb_xhw_ta_oom_reply(struct drm_psb_private *dev_priv,
+			  struct psb_xhw_buf *buf,
+			  uint32_t * cookie,
+			  uint32_t * bca, uint32_t * rca, uint32_t * flags)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+
+	/*
+	 * Get info about how to schedule an OOM task.
+	 */
+
+	memcpy(cookie, xa->cookie, sizeof(xa->cookie));
+	*bca = xa->arg.oom.bca;
+	*rca = xa->arg.oom.rca;
+	*flags = xa->arg.oom.flags;
+}
+
+void psb_xhw_fire_reply(struct drm_psb_private *dev_priv,
+			struct psb_xhw_buf *buf, uint32_t * cookie)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+
+	memcpy(cookie, xa->cookie, sizeof(xa->cookie));
+}
+
+int psb_xhw_resume(struct drm_psb_private *dev_priv, struct psb_xhw_buf *buf)
+{
+	struct drm_psb_xhw_arg *xa = &buf->arg;
+
+	buf->copy_back = 0;
+	xa->op = PSB_XHW_RESUME;
+	xa->issue_irq = 0;
+	xa->irq_op = 0;
+	return psb_xhw_add(dev_priv, buf);
+}
+
+void psb_xhw_takedown(struct drm_psb_private *dev_priv)
+{
+}
+
+int psb_xhw_init(struct drm_device *dev)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	unsigned long irq_flags;
+
+	INIT_LIST_HEAD(&dev_priv->xhw_in);
+	dev_priv->xhw_lock = SPIN_LOCK_UNLOCKED;
+	atomic_set(&dev_priv->xhw_client, 0);
+	init_waitqueue_head(&dev_priv->xhw_queue);
+	init_waitqueue_head(&dev_priv->xhw_caller_queue);
+	mutex_init(&dev_priv->xhw_mutex);
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	dev_priv->xhw_on = 0;
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+
+	return 0;
+}
+
+static int psb_xhw_init_init(struct drm_device *dev,
+			     struct drm_file *file_priv,
+			     struct drm_psb_xhw_init_arg *arg)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	int ret;
+	int is_iomem;
+
+	if (atomic_add_unless(&dev_priv->xhw_client, 1, 1)) {
+		unsigned long irq_flags;
+
+		mutex_lock(&dev->struct_mutex);
+		dev_priv->xhw_bo =
+		    drm_lookup_buffer_object(file_priv, arg->buffer_handle, 1);
+		mutex_unlock(&dev->struct_mutex);
+		if (!dev_priv->xhw_bo) {
+			ret = -EINVAL;
+			goto out_err;
+		}
+		ret = drm_bo_kmap(dev_priv->xhw_bo, 0,
+				  dev_priv->xhw_bo->num_pages,
+				  &dev_priv->xhw_kmap);
+		if (ret) {
+			DRM_ERROR("Failed mapping X server "
+				  "communications buffer.\n");
+			goto out_err0;
+		}
+		dev_priv->xhw = drm_bmo_virtual(&dev_priv->xhw_kmap, &is_iomem);
+		if (is_iomem) {
+			DRM_ERROR("X server communications buffer"
+				  "is in device memory.\n");
+			ret = -EINVAL;
+			goto out_err1;
+		}
+		dev_priv->xhw_file = file_priv;
+
+		spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+		dev_priv->xhw_on = 1;
+		dev_priv->xhw_submit_ok = 1;
+		spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+		return 0;
+	} else {
+		DRM_ERROR("Xhw is already initialized.\n");
+		return -EBUSY;
+	}
+      out_err1:
+	dev_priv->xhw = NULL;
+	drm_bo_kunmap(&dev_priv->xhw_kmap);
+      out_err0:
+	drm_bo_usage_deref_unlocked(&dev_priv->xhw_bo);
+      out_err:
+	atomic_dec(&dev_priv->xhw_client);
+	return ret;
+}
+
+static void psb_xhw_queue_empty(struct drm_psb_private *dev_priv)
+{
+	struct psb_xhw_buf *cur_buf, *next;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	dev_priv->xhw_submit_ok = 0;
+
+	list_for_each_entry_safe(cur_buf, next, &dev_priv->xhw_in, head) {
+		list_del_init(&cur_buf->head);
+		if (cur_buf->copy_back) {
+			cur_buf->arg.ret = -EINVAL;
+		}
+		atomic_set(&cur_buf->done, 1);
+	}
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+	wake_up(&dev_priv->xhw_caller_queue);
+}
+
+void psb_xhw_init_takedown(struct drm_psb_private *dev_priv,
+			   struct drm_file *file_priv, int closing)
+{
+
+	if (dev_priv->xhw_file == file_priv &&
+	    atomic_add_unless(&dev_priv->xhw_client, -1, 0)) {
+
+		if (closing)
+			psb_xhw_queue_empty(dev_priv);
+		else {
+			struct psb_xhw_buf buf;
+			INIT_LIST_HEAD(&buf.head);
+
+			psb_xhw_terminate(dev_priv, &buf);
+			psb_xhw_queue_empty(dev_priv);
+		}
+
+		dev_priv->xhw = NULL;
+		drm_bo_kunmap(&dev_priv->xhw_kmap);
+		drm_bo_usage_deref_unlocked(&dev_priv->xhw_bo);
+		dev_priv->xhw_file = NULL;
+	}
+}
+
+int psb_xhw_init_ioctl(struct drm_device *dev, void *data,
+		       struct drm_file *file_priv)
+{
+	struct drm_psb_xhw_init_arg *arg = (struct drm_psb_xhw_init_arg *)data;
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+
+	switch (arg->operation) {
+	case PSB_XHW_INIT:
+		return psb_xhw_init_init(dev, file_priv, arg);
+	case PSB_XHW_TAKEDOWN:
+		psb_xhw_init_takedown(dev_priv, file_priv, 0);
+	}
+	return 0;
+}
+
+static int psb_xhw_in_empty(struct drm_psb_private *dev_priv)
+{
+	int empty;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	empty = list_empty(&dev_priv->xhw_in);
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+	return empty;
+}
+
+int psb_xhw_handler(struct drm_psb_private *dev_priv)
+{
+	unsigned long irq_flags;
+	struct drm_psb_xhw_arg *xa;
+	struct psb_xhw_buf *buf;
+
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+
+	if (!dev_priv->xhw_on) {
+		spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+		return -EINVAL;
+	}
+
+	buf = dev_priv->xhw_cur_buf;
+	if (buf && buf->copy_back) {
+		xa = &buf->arg;
+		memcpy(xa, dev_priv->xhw, sizeof(*xa));
+		dev_priv->comm[PSB_COMM_USER_IRQ] = xa->irq_op;
+		atomic_set(&buf->done, 1);
+		wake_up(&dev_priv->xhw_caller_queue);
+	} else
+		dev_priv->comm[PSB_COMM_USER_IRQ] = 0;
+
+	dev_priv->xhw_cur_buf = 0;
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+	return 0;
+}
+
+int psb_xhw_ioctl(struct drm_device *dev, void *data,
+		  struct drm_file *file_priv)
+{
+	struct drm_psb_private *dev_priv =
+	    (struct drm_psb_private *)dev->dev_private;
+	unsigned long irq_flags;
+	struct drm_psb_xhw_arg *xa;
+	int ret;
+	struct list_head *list;
+	struct psb_xhw_buf *buf;
+
+	if (!dev_priv)
+		return -EINVAL;
+
+	if (mutex_lock_interruptible(&dev_priv->xhw_mutex))
+		return -EAGAIN;
+
+	if (psb_forced_user_interrupt(dev_priv)) {
+		mutex_unlock(&dev_priv->xhw_mutex);
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	while (list_empty(&dev_priv->xhw_in)) {
+		spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+		ret = wait_event_interruptible_timeout(dev_priv->xhw_queue,
+						       !psb_xhw_in_empty
+						       (dev_priv), DRM_HZ);
+		if (ret == -ERESTARTSYS || ret == 0) {
+			mutex_unlock(&dev_priv->xhw_mutex);
+			return -EAGAIN;
+		}
+		spin_lock_irqsave(&dev_priv->xhw_lock, irq_flags);
+	}
+
+	list = dev_priv->xhw_in.next;
+	list_del_init(list);
+
+	buf = list_entry(list, struct psb_xhw_buf, head);
+	xa = &buf->arg;
+	memcpy(dev_priv->xhw, xa, sizeof(*xa));
+
+	if (unlikely(buf->copy_back))
+		dev_priv->xhw_cur_buf = buf;
+	else {
+		atomic_set(&buf->done, 1);
+		dev_priv->xhw_cur_buf = NULL;
+	}
+
+	if (xa->op == PSB_XHW_TERMINATE) {
+		dev_priv->xhw_on = 0;
+		wake_up(&dev_priv->xhw_caller_queue);
+	}
+	spin_unlock_irqrestore(&dev_priv->xhw_lock, irq_flags);
+
+	mutex_unlock(&dev_priv->xhw_mutex);
+
+	return 0;
+}
Index: linux-2.6.28/drivers/gpu/drm/Kconfig
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/Kconfig	2009-02-25 15:37:02.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/Kconfig	2009-02-25 15:37:02.000000000 +0000
@@ -129,3 +129,10 @@
 	help
 	  Choose this option if you have a Savage3D/4/SuperSavage/Pro/Twister
 	  chipset. If M is selected the module will be called savage.
+
+config DRM_PSB
+	tristate "Intel Poulsbo"
+	depends on DRM && PCI && I2C_ALGOBIT
+	select DRM_INTEL_COMMON
+	help
+	  Choose this option if you have an Intel Poulsbo chipset.
Index: linux-2.6.28/include/drm/drm_objects.h
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/include/drm/drm_objects.h	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,717 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2007 Tungsten Graphics, Inc., Cedar Park, TX., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstr<74>m <thomas-at-tungstengraphics-dot-com>
+ */
+
+#ifndef _DRM_OBJECTS_H
+#define _DRM_OBJECTS_H
+
+struct drm_device;
+struct drm_bo_mem_reg;
+
+/***************************************************
+ * User space objects. (drm_object.c)
+ */
+
+#define drm_user_object_entry(_ptr, _type, _member) container_of(_ptr, _type, _member)
+
+enum drm_object_type {
+	drm_fence_type,
+	drm_buffer_type,
+	drm_lock_type,
+	    /*
+	     * Add other user space object types here.
+	     */
+	drm_driver_type0 = 256,
+	drm_driver_type1,
+	drm_driver_type2,
+	drm_driver_type3,
+	drm_driver_type4
+};
+
+/*
+ * A user object is a structure that helps the drm give out user handles
+ * to kernel internal objects and to keep track of these objects so that
+ * they can be destroyed, for example when the user space process exits.
+ * Designed to be accessible using a user space 32-bit handle.
+ */
+
+struct drm_user_object {
+	struct drm_hash_item hash;
+	struct list_head list;
+	enum drm_object_type type;
+	atomic_t refcount;
+	int shareable;
+	struct drm_file *owner;
+	void (*ref_struct_locked) (struct drm_file *priv,
+				   struct drm_user_object *obj,
+				   enum drm_ref_type ref_action);
+	void (*unref) (struct drm_file *priv, struct drm_user_object *obj,
+		       enum drm_ref_type unref_action);
+	void (*remove) (struct drm_file *priv, struct drm_user_object *obj);
+};
+
+/*
+ * A ref object is a structure which is used to
+ * keep track of references to user objects and to keep track of these
+ * references so that they can be destroyed for example when the user space
+ * process exits. Designed to be accessible using a pointer to the _user_ object.
+ */
+
+struct drm_ref_object {
+	struct drm_hash_item hash;
+	struct list_head list;
+	atomic_t refcount;
+	enum drm_ref_type unref_action;
+};
+
+/**
+ * Must be called with the struct_mutex held.
+ */
+
+extern int drm_add_user_object(struct drm_file *priv, struct drm_user_object *item,
+			       int shareable);
+/**
+ * Must be called with the struct_mutex held.
+ */
+
+extern struct drm_user_object *drm_lookup_user_object(struct drm_file *priv,
+						 uint32_t key);
+
+/*
+ * Must be called with the struct_mutex held. May temporarily release it.
+ */
+
+extern int drm_add_ref_object(struct drm_file *priv,
+			      struct drm_user_object *referenced_object,
+			      enum drm_ref_type ref_action);
+
+/*
+ * Must be called with the struct_mutex held.
+ */
+
+struct drm_ref_object *drm_lookup_ref_object(struct drm_file *priv,
+					struct drm_user_object *referenced_object,
+					enum drm_ref_type ref_action);
+/*
+ * Must be called with the struct_mutex held.
+ * If "item" has been obtained by a call to drm_lookup_ref_object. You may not
+ * release the struct_mutex before calling drm_remove_ref_object.
+ * This function may temporarily release the struct_mutex.
+ */
+
+extern void drm_remove_ref_object(struct drm_file *priv, struct drm_ref_object *item);
+extern int drm_user_object_ref(struct drm_file *priv, uint32_t user_token,
+			       enum drm_object_type type,
+			       struct drm_user_object **object);
+extern int drm_user_object_unref(struct drm_file *priv, uint32_t user_token,
+				 enum drm_object_type type);
+
+/***************************************************
+ * Fence objects. (drm_fence.c)
+ */
+
+struct drm_fence_object {
+	struct drm_user_object base;
+	struct drm_device *dev;
+	atomic_t usage;
+
+	/*
+	 * The below three fields are protected by the fence manager spinlock.
+	 */
+
+	struct list_head ring;
+	int fence_class;
+	uint32_t native_types;
+	uint32_t type;
+	uint32_t signaled_types;
+	uint32_t sequence;
+	uint32_t waiting_types;
+	uint32_t error;
+};
+
+#define _DRM_FENCE_CLASSES 8
+
+struct drm_fence_class_manager {
+	struct list_head ring;
+	uint32_t pending_flush;
+	uint32_t waiting_types;
+	wait_queue_head_t fence_queue;
+	uint32_t highest_waiting_sequence;
+        uint32_t latest_queued_sequence;
+};
+
+struct drm_fence_manager {
+	int initialized;
+	rwlock_t lock;
+	struct drm_fence_class_manager fence_class[_DRM_FENCE_CLASSES];
+	uint32_t num_classes;
+	atomic_t count;
+};
+
+struct drm_fence_driver {
+	unsigned long *waiting_jiffies;
+	uint32_t num_classes;
+	uint32_t wrap_diff;
+	uint32_t flush_diff;
+	uint32_t sequence_mask;
+
+	/*
+	 * Driver implemented functions:
+	 * has_irq() : 1 if the hardware can update the indicated type_flags using an
+	 * irq handler. 0 if polling is required.
+	 *
+	 * emit() : Emit a sequence number to the command stream.
+	 * Return the sequence number.
+	 *
+	 * flush() : Make sure the flags indicated in fc->pending_flush will eventually
+	 * signal for fc->highest_received_sequence and all preceding sequences.
+	 * Acknowledge by clearing the flags fc->pending_flush.
+	 *
+	 * poll() : Call drm_fence_handler with any new information.
+	 *
+	 * needed_flush() : Given the current state of the fence->type flags and previusly
+	 * executed or queued flushes, return the type_flags that need flushing.
+	 *
+	 * wait(): Wait for the "mask" flags to signal on a given fence, performing
+	 * whatever's necessary to make this happen.
+	 */
+
+	int (*has_irq) (struct drm_device *dev, uint32_t fence_class,
+			uint32_t flags);
+	int (*emit) (struct drm_device *dev, uint32_t fence_class,
+		     uint32_t flags, uint32_t *breadcrumb,
+		     uint32_t *native_type);
+	void (*flush) (struct drm_device *dev, uint32_t fence_class);
+	void (*poll) (struct drm_device *dev, uint32_t fence_class,
+		uint32_t types);
+	uint32_t (*needed_flush) (struct drm_fence_object *fence);
+	int (*wait) (struct drm_fence_object *fence, int lazy,
+		     int interruptible, uint32_t mask);
+};
+
+extern int drm_fence_wait_polling(struct drm_fence_object *fence, int lazy,
+				  int interruptible, uint32_t mask,
+				  unsigned long end_jiffies);
+extern void drm_fence_handler(struct drm_device *dev, uint32_t fence_class,
+			      uint32_t sequence, uint32_t type,
+			      uint32_t error);
+extern void drm_fence_manager_init(struct drm_device *dev);
+extern void drm_fence_manager_takedown(struct drm_device *dev);
+extern void drm_fence_flush_old(struct drm_device *dev, uint32_t fence_class,
+				uint32_t sequence);
+extern int drm_fence_object_flush(struct drm_fence_object *fence,
+				  uint32_t type);
+extern int drm_fence_object_signaled(struct drm_fence_object *fence,
+				     uint32_t type);
+extern void drm_fence_usage_deref_locked(struct drm_fence_object **fence);
+extern void drm_fence_usage_deref_unlocked(struct drm_fence_object **fence);
+extern struct drm_fence_object *drm_fence_reference_locked(struct drm_fence_object *src);
+extern void drm_fence_reference_unlocked(struct drm_fence_object **dst,
+					 struct drm_fence_object *src);
+extern int drm_fence_object_wait(struct drm_fence_object *fence,
+				 int lazy, int ignore_signals, uint32_t mask);
+extern int drm_fence_object_create(struct drm_device *dev, uint32_t type,
+				   uint32_t fence_flags, uint32_t fence_class,
+				   struct drm_fence_object **c_fence);
+extern int drm_fence_object_emit(struct drm_fence_object *fence,
+				 uint32_t fence_flags, uint32_t class,
+				 uint32_t type);
+extern void drm_fence_fill_arg(struct drm_fence_object *fence,
+			       struct drm_fence_arg *arg);
+
+extern int drm_fence_add_user_object(struct drm_file *priv,
+				     struct drm_fence_object *fence,
+				     int shareable);
+
+extern int drm_fence_create_ioctl(struct drm_device *dev, void *data,
+				  struct drm_file *file_priv);
+extern int drm_fence_destroy_ioctl(struct drm_device *dev, void *data,
+				   struct drm_file *file_priv);
+extern int drm_fence_reference_ioctl(struct drm_device *dev, void *data,
+				     struct drm_file *file_priv);
+extern int drm_fence_unreference_ioctl(struct drm_device *dev, void *data,
+				       struct drm_file *file_priv);
+extern int drm_fence_signaled_ioctl(struct drm_device *dev, void *data,
+				    struct drm_file *file_priv);
+extern int drm_fence_flush_ioctl(struct drm_device *dev, void *data,
+				 struct drm_file *file_priv);
+extern int drm_fence_wait_ioctl(struct drm_device *dev, void *data,
+				struct drm_file *file_priv);
+extern int drm_fence_emit_ioctl(struct drm_device *dev, void *data,
+				struct drm_file *file_priv);
+extern int drm_fence_buffers_ioctl(struct drm_device *dev, void *data,
+				   struct drm_file *file_priv);
+/**************************************************
+ *TTMs
+ */
+
+/*
+ * The ttm backend GTT interface. (In our case AGP).
+ * Any similar type of device (PCIE?)
+ * needs only to implement these functions to be usable with the TTM interface.
+ * The AGP backend implementation lives in drm_agpsupport.c
+ * basically maps these calls to available functions in agpgart.
+ * Each drm device driver gets an
+ * additional function pointer that creates these types,
+ * so that the device can choose the correct aperture.
+ * (Multiple AGP apertures, etc.)
+ * Most device drivers will let this point to the standard AGP implementation.
+ */
+
+#define DRM_BE_FLAG_NEEDS_FREE     0x00000001
+#define DRM_BE_FLAG_BOUND_CACHED   0x00000002
+
+struct drm_ttm_backend;
+struct drm_ttm_backend_func {
+	int (*needs_ub_cache_adjust) (struct drm_ttm_backend *backend);
+	int (*populate) (struct drm_ttm_backend *backend,
+			 unsigned long num_pages, struct page **pages);
+	void (*clear) (struct drm_ttm_backend *backend);
+	int (*bind) (struct drm_ttm_backend *backend,
+		     struct drm_bo_mem_reg *bo_mem);
+	int (*unbind) (struct drm_ttm_backend *backend);
+	void (*destroy) (struct drm_ttm_backend *backend);
+};
+
+
+struct drm_ttm_backend {
+	struct drm_device *dev;
+	uint32_t flags;
+	struct drm_ttm_backend_func *func;
+};
+
+struct drm_ttm {
+	struct page *dummy_read_page;
+	struct page **pages;
+	uint32_t page_flags;
+	unsigned long num_pages;
+	atomic_t vma_count;
+	struct drm_device *dev;
+	int destroy;
+	uint32_t mapping_offset;
+	struct drm_ttm_backend *be;
+	enum {
+		ttm_bound,
+		ttm_evicted,
+		ttm_unbound,
+		ttm_unpopulated,
+	} state;
+
+};
+
+extern struct drm_ttm *drm_ttm_init(struct drm_device *dev, unsigned long size);
+extern int drm_bind_ttm(struct drm_ttm *ttm, struct drm_bo_mem_reg *bo_mem);
+extern void drm_ttm_unbind(struct drm_ttm *ttm);
+extern void drm_ttm_evict(struct drm_ttm *ttm);
+extern void drm_ttm_fixup_caching(struct drm_ttm *ttm);
+extern struct page *drm_ttm_get_page(struct drm_ttm *ttm, int index);
+extern void drm_ttm_cache_flush(void);
+extern int drm_ttm_populate(struct drm_ttm *ttm);
+extern int drm_ttm_set_user(struct drm_ttm *ttm,
+			    struct task_struct *tsk,
+			    int write,
+			    unsigned long start,
+			    unsigned long num_pages,
+			    struct page *dummy_read_page);
+unsigned long drm_ttm_size(struct drm_device *dev,
+			   unsigned long num_pages,
+			   int user_bo);
+
+
+/*
+ * Destroy a ttm. The user normally calls drmRmMap or a similar IOCTL to do
+ * this which calls this function iff there are no vmas referencing it anymore.
+ * Otherwise it is called when the last vma exits.
+ */
+
+extern int drm_destroy_ttm(struct drm_ttm *ttm);
+
+#define DRM_FLAG_MASKED(_old, _new, _mask) {\
+(_old) ^= (((_old) ^ (_new)) & (_mask)); \
+}
+
+#define DRM_TTM_MASK_FLAGS ((1 << PAGE_SHIFT) - 1)
+#define DRM_TTM_MASK_PFN (0xFFFFFFFFU - DRM_TTM_MASK_FLAGS)
+
+/*
+ * Page flags.
+ */
+
+#define DRM_TTM_PAGE_UNCACHED   (1 << 0)
+#define DRM_TTM_PAGE_USED       (1 << 1)
+#define DRM_TTM_PAGE_BOUND      (1 << 2)
+#define DRM_TTM_PAGE_PRESENT    (1 << 3)
+#define DRM_TTM_PAGE_VMALLOC    (1 << 4)
+#define DRM_TTM_PAGE_USER       (1 << 5)
+#define DRM_TTM_PAGE_USER_WRITE (1 << 6)
+#define DRM_TTM_PAGE_USER_DIRTY (1 << 7)
+#define DRM_TTM_PAGE_USER_DMA   (1 << 8)
+
+/***************************************************
+ * Buffer objects. (drm_bo.c, drm_bo_move.c)
+ */
+
+struct drm_bo_mem_reg {
+	struct drm_mm_node *mm_node;
+	unsigned long size;
+	unsigned long num_pages;
+	uint32_t page_alignment;
+	uint32_t mem_type;
+	uint64_t flags;
+	uint64_t mask;
+	uint32_t desired_tile_stride;
+	uint32_t hw_tile_stride;
+};
+
+enum drm_bo_type {
+	drm_bo_type_dc,
+	drm_bo_type_user,
+	drm_bo_type_kernel, /* for initial kernel allocations */
+};
+
+struct drm_buffer_object {
+	struct drm_device *dev;
+	struct drm_user_object base;
+
+	/*
+	 * If there is a possibility that the usage variable is zero,
+	 * then dev->struct_mutext should be locked before incrementing it.
+	 */
+
+	atomic_t usage;
+	unsigned long buffer_start;
+	enum drm_bo_type type;
+	unsigned long offset;
+	atomic_t mapped;
+	struct drm_bo_mem_reg mem;
+
+	struct list_head lru;
+	struct list_head ddestroy;
+
+	uint32_t fence_type;
+	uint32_t fence_class;
+	uint32_t new_fence_type;
+	uint32_t new_fence_class;
+	struct drm_fence_object *fence;
+	uint32_t priv_flags;
+	wait_queue_head_t event_queue;
+	struct mutex mutex;
+	unsigned long num_pages;
+	unsigned long reserved_size;
+
+	/* For pinned buffers */
+	struct drm_mm_node *pinned_node;
+	uint32_t pinned_mem_type;
+	struct list_head pinned_lru;
+
+	/* For vm */
+	struct drm_ttm *ttm;
+	struct drm_map_list map_list;
+	uint32_t memory_type;
+	unsigned long bus_offset;
+	uint32_t vm_flags;
+	void *iomap;
+
+#ifdef DRM_ODD_MM_COMPAT
+	/* dev->struct_mutex only protected. */
+	struct list_head vma_list;
+	struct list_head p_mm_list;
+#endif
+
+};
+
+#define _DRM_BO_FLAG_UNFENCED 0x00000001
+#define _DRM_BO_FLAG_EVICTED  0x00000002
+
+struct drm_mem_type_manager {
+	int has_type;
+	int use_type;
+	struct drm_mm manager;
+	struct list_head lru;
+	struct list_head pinned;
+	uint32_t flags;
+	uint32_t drm_bus_maptype;
+	unsigned long gpu_offset;
+	unsigned long io_offset;
+	unsigned long io_size;
+	void *io_addr;
+};
+
+struct drm_bo_lock {
+	struct drm_user_object base;
+	wait_queue_head_t queue;
+	atomic_t write_lock_pending;
+	atomic_t readers;
+};
+
+#define _DRM_FLAG_MEMTYPE_FIXED     0x00000001	/* Fixed (on-card) PCI memory */
+#define _DRM_FLAG_MEMTYPE_MAPPABLE  0x00000002	/* Memory mappable */
+#define _DRM_FLAG_MEMTYPE_CACHED    0x00000004	/* Cached binding */
+#define _DRM_FLAG_NEEDS_IOREMAP     0x00000008	/* Fixed memory needs ioremap
+						   before kernel access. */
+#define _DRM_FLAG_MEMTYPE_CMA       0x00000010	/* Can't map aperture */
+#define _DRM_FLAG_MEMTYPE_CSELECT   0x00000020	/* Select caching */
+
+struct drm_buffer_manager {
+	struct drm_bo_lock bm_lock;
+	struct mutex evict_mutex;
+	int nice_mode;
+	int initialized;
+	struct drm_file *last_to_validate;
+	struct drm_mem_type_manager man[DRM_BO_MEM_TYPES];
+	struct list_head unfenced;
+	struct list_head ddestroy;
+	struct delayed_work wq;
+	uint32_t fence_type;
+	unsigned long cur_pages;
+	atomic_t count;
+	struct page *dummy_read_page;
+};
+
+struct drm_bo_driver {
+	const uint32_t *mem_type_prio;
+	const uint32_t *mem_busy_prio;
+	uint32_t num_mem_type_prio;
+	uint32_t num_mem_busy_prio;
+	struct drm_ttm_backend *(*create_ttm_backend_entry)
+	 (struct drm_device *dev);
+	int (*backend_size) (struct drm_device *dev,
+			     unsigned long num_pages);
+	int (*fence_type) (struct drm_buffer_object *bo, uint32_t *fclass,
+			   uint32_t *type);
+	int (*invalidate_caches) (struct drm_device *dev, uint64_t flags);
+	int (*init_mem_type) (struct drm_device *dev, uint32_t type,
+			      struct drm_mem_type_manager *man);
+	 uint32_t(*evict_mask) (struct drm_buffer_object *bo);
+	int (*move) (struct drm_buffer_object *bo,
+		     int evict, int no_wait, struct drm_bo_mem_reg *new_mem);
+	void (*ttm_cache_flush)(struct drm_ttm *ttm);
+
+	/*
+	 * command_stream_barrier
+	 *
+	 * @dev: The drm device.
+	 *
+	 * @bo: The buffer object to validate.
+	 *
+	 * @new_fence_class: The new fence class for the buffer object.
+	 *
+	 * @new_fence_type: The new fence type for the buffer object.
+	 *
+	 * @no_wait: whether this should give up and return -EBUSY
+	 * if this operation would require sleeping
+	 *
+	 * Insert a command stream barrier that makes sure that the
+	 * buffer is idle once the commands associated with the
+	 * current validation are starting to execute. If an error
+	 * condition is returned, or the function pointer is NULL,
+	 * the drm core will force buffer idle
+	 * during validation.
+	 */
+
+	int (*command_stream_barrier) (struct drm_buffer_object *bo,
+				       uint32_t new_fence_class,
+				       uint32_t new_fence_type,
+				       int no_wait);
+};
+
+/*
+ * buffer objects (drm_bo.c)
+ */
+extern int drm_bo_create_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_destroy_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_map_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_unmap_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_reference_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_set_pin(struct drm_device *dev, struct drm_buffer_object *bo, int pin);
+extern int drm_bo_unreference_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_wait_idle_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_info_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_setstatus_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_mm_init_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_mm_takedown_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_mm_lock_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_mm_unlock_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_version_ioctl(struct drm_device *dev, void *data, struct drm_file *file_priv);
+extern int drm_bo_driver_finish(struct drm_device *dev);
+extern int drm_bo_driver_init(struct drm_device *dev);
+extern int drm_bo_pci_offset(struct drm_device *dev,
+			     struct drm_bo_mem_reg *mem,
+			     unsigned long *bus_base,
+			     unsigned long *bus_offset,
+			     unsigned long *bus_size);
+extern int drm_mem_reg_is_pci(struct drm_device *dev, struct drm_bo_mem_reg *mem);
+
+extern void drm_bo_usage_deref_locked(struct drm_buffer_object **bo);
+extern void drm_bo_usage_deref_unlocked(struct drm_buffer_object **bo);
+extern void drm_putback_buffer_objects(struct drm_device *dev);
+extern int drm_fence_buffer_objects(struct drm_device *dev,
+				    struct list_head *list,
+				    uint32_t fence_flags,
+				    struct drm_fence_object *fence,
+				    struct drm_fence_object **used_fence);
+extern void drm_bo_add_to_lru(struct drm_buffer_object *bo);
+extern int drm_buffer_object_create(struct drm_device *dev, unsigned long size,
+				    enum drm_bo_type type, uint64_t mask,
+				    uint32_t hint, uint32_t page_alignment,
+				    unsigned long buffer_start,
+				    struct drm_buffer_object **bo);
+extern int drm_bo_wait(struct drm_buffer_object *bo, int lazy, int ignore_signals,
+		       int no_wait);
+extern int drm_bo_mem_space(struct drm_buffer_object *bo,
+			    struct drm_bo_mem_reg *mem, int no_wait);
+extern int drm_bo_move_buffer(struct drm_buffer_object *bo,
+			      uint64_t new_mem_flags,
+			      int no_wait, int move_unfenced);
+extern int drm_bo_clean_mm(struct drm_device *dev, unsigned mem_type);
+extern int drm_bo_init_mm(struct drm_device *dev, unsigned type,
+			  unsigned long p_offset, unsigned long p_size);
+extern int drm_bo_handle_validate(struct drm_file *file_priv, uint32_t handle,
+				  uint32_t fence_class, uint64_t flags,
+				  uint64_t mask, uint32_t hint,
+				  int use_old_fence_class,
+				  struct drm_bo_info_rep *rep,
+				  struct drm_buffer_object **bo_rep);
+extern struct drm_buffer_object *drm_lookup_buffer_object(struct drm_file *file_priv,
+							  uint32_t handle,
+							  int check_owner);
+extern int drm_bo_do_validate(struct drm_buffer_object *bo,
+			      uint64_t flags, uint64_t mask, uint32_t hint,
+			      uint32_t fence_class,
+			      int no_wait,
+			      struct drm_bo_info_rep *rep);
+extern void drm_bo_fill_rep_arg(struct drm_buffer_object *bo,
+				struct drm_bo_info_rep *rep);
+/*
+ * Buffer object memory move- and map helpers.
+ * drm_bo_move.c
+ */
+
+extern int drm_bo_move_ttm(struct drm_buffer_object *bo,
+			   int evict, int no_wait,
+			   struct drm_bo_mem_reg *new_mem);
+extern int drm_bo_move_memcpy(struct drm_buffer_object *bo,
+			      int evict,
+			      int no_wait, struct drm_bo_mem_reg *new_mem);
+extern int drm_bo_move_accel_cleanup(struct drm_buffer_object *bo,
+				     int evict, int no_wait,
+				     uint32_t fence_class, uint32_t fence_type,
+				     uint32_t fence_flags,
+				     struct drm_bo_mem_reg *new_mem);
+extern int drm_bo_same_page(unsigned long offset, unsigned long offset2);
+extern unsigned long drm_bo_offset_end(unsigned long offset,
+				       unsigned long end);
+
+struct drm_bo_kmap_obj {
+	void *virtual;
+	struct page *page;
+	enum {
+		bo_map_iomap,
+		bo_map_vmap,
+		bo_map_kmap,
+		bo_map_premapped,
+	} bo_kmap_type;
+};
+
+static inline void *drm_bmo_virtual(struct drm_bo_kmap_obj *map, int *is_iomem)
+{
+	*is_iomem = (map->bo_kmap_type == bo_map_iomap ||
+		     map->bo_kmap_type == bo_map_premapped);
+	return map->virtual;
+}
+extern void drm_bo_kunmap(struct drm_bo_kmap_obj *map);
+extern int drm_bo_kmap(struct drm_buffer_object *bo, unsigned long start_page,
+		       unsigned long num_pages, struct drm_bo_kmap_obj *map);
+
+
+/*
+ * drm_regman.c
+ */
+
+struct drm_reg {
+	struct list_head head;
+	struct drm_fence_object *fence;
+	uint32_t fence_type;
+	uint32_t new_fence_type;
+};
+
+struct drm_reg_manager {
+	struct list_head free;
+	struct list_head lru;
+	struct list_head unfenced;
+
+	int (*reg_reusable)(const struct drm_reg *reg, const void *data);
+	void (*reg_destroy)(struct drm_reg *reg);
+};
+
+extern int drm_regs_alloc(struct drm_reg_manager *manager,
+			  const void *data,
+			  uint32_t fence_class,
+			  uint32_t fence_type,
+			  int interruptible,
+			  int no_wait,
+			  struct drm_reg **reg);
+
+extern void drm_regs_fence(struct drm_reg_manager *regs,
+			   struct drm_fence_object *fence);
+
+extern void drm_regs_free(struct drm_reg_manager *manager);
+extern void drm_regs_add(struct drm_reg_manager *manager, struct drm_reg *reg);
+extern void drm_regs_init(struct drm_reg_manager *manager,
+			  int (*reg_reusable)(const struct drm_reg *,
+					      const void *),
+			  void (*reg_destroy)(struct drm_reg *));
+
+extern int drm_mem_reg_ioremap(struct drm_device *dev, struct drm_bo_mem_reg * mem,
+			       void **virtual);
+extern void drm_mem_reg_iounmap(struct drm_device *dev, struct drm_bo_mem_reg * mem,
+				void *virtual);
+/*
+ * drm_bo_lock.c
+ * Simple replacement for the hardware lock on buffer manager init and clean.
+ */
+
+
+extern void drm_bo_init_lock(struct drm_bo_lock *lock);
+extern void drm_bo_read_unlock(struct drm_bo_lock *lock);
+extern int drm_bo_read_lock(struct drm_bo_lock *lock);
+extern int drm_bo_write_lock(struct drm_bo_lock *lock,
+			     struct drm_file *file_priv);
+
+extern int drm_bo_write_unlock(struct drm_bo_lock *lock,
+			       struct drm_file *file_priv);
+
+#ifdef CONFIG_DEBUG_MUTEXES
+#define DRM_ASSERT_LOCKED(_mutex)					\
+	BUG_ON(!mutex_is_locked(_mutex) ||				\
+	       ((_mutex)->owner != current_thread_info()))
+#else
+#define DRM_ASSERT_LOCKED(_mutex)
+#endif
+#endif
Index: linux-2.6.28/drivers/gpu/drm/drm_crtc.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/drm_crtc.c	2009-02-25 15:36:50.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/drm_crtc.c	2009-02-25 15:37:02.000000000 +0000
@@ -807,6 +807,53 @@
 }
 EXPORT_SYMBOL(drm_mode_config_init);
 
+/**
+ * drm_get_buffer_object - find the buffer object for a given handle
+ * @dev: DRM device
+ * @bo: pointer to caller's buffer_object pointer
+ * @handle: handle to lookup
+ *
+ * LOCKING:
+ * Must take @dev's struct_mutex to protect buffer object lookup.
+ *
+ * Given @handle, lookup the buffer object in @dev and put it in the caller's
+ * @bo pointer.
+ *
+ * RETURNS:
+ * Zero on success, -EINVAL if the handle couldn't be found.
+ */
+static int drm_get_buffer_object(struct drm_device *dev, struct drm_buffer_object **bo, unsigned long handle)
+{
+	struct drm_user_object *uo;
+	struct drm_hash_item *hash;
+	int ret;
+
+	*bo = NULL;
+
+	mutex_lock(&dev->struct_mutex);
+	ret = drm_ht_find_item(&dev->object_hash, handle, &hash);
+	if (ret) {
+		DRM_ERROR("Couldn't find handle.\n");
+		ret = -EINVAL;
+		goto out_err;
+	}
+
+	uo = drm_hash_entry(hash, struct drm_user_object, hash);
+	if (uo->type != drm_buffer_type) {
+		ret = -EINVAL;
+		goto out_err;
+	}
+
+	*bo = drm_user_object_entry(uo, struct drm_buffer_object, base);
+	ret = 0;
+out_err:
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
+char drm_init_mode[32];
+EXPORT_SYMBOL(drm_init_mode);
+
 int drm_mode_group_init(struct drm_device *dev, struct drm_mode_group *group)
 {
 	uint32_t total_objects = 0;
@@ -1588,6 +1635,8 @@
 	struct drm_mode_fb_cmd *r = data;
 	struct drm_mode_config *config = &dev->mode_config;
 	struct drm_framebuffer *fb;
+	struct drm_buffer_object *bo;
+	struct drm_crtc *crtc;
 	int ret = 0;
 
 	if ((config->min_width > r->width) || (r->width > config->max_width)) {
@@ -1600,20 +1649,46 @@
 	}
 
 	mutex_lock(&dev->mode_config.mutex);
+	/* TODO check limits are okay */
+	ret = drm_get_buffer_object(dev, &bo, r->handle);
+	if (ret || !bo) {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	/* TODO check buffer is sufficently large */
 	/* TODO setup destructor callback */
 
-	fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
+	fb = kzalloc(sizeof(struct drm_framebuffer), GFP_KERNEL);
+	if (!fb) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	drm_framebuffer_init(dev, fb, NULL);
 	if (!fb) {
 		DRM_ERROR("could not create framebuffer\n");
 		ret = -EINVAL;
 		goto out;
 	}
 
+	fb->width = r->width;
+	fb->height = r->height;
+	fb->pitch = r->pitch;
+	fb->bits_per_pixel = r->bpp;
+	fb->depth = r->depth;
+	fb->offset = bo->offset;
+	fb->bo = bo;
+
 	r->fb_id = fb->base.id;
 	list_add(&fb->filp_head, &file_priv->fbs);
 
+	/* FIXME: bind the fb to the right crtc */
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+		crtc->fb = fb;
+		dev->driver->fb_probe(dev, crtc);
+	}
+
 out:
 	mutex_unlock(&dev->mode_config.mutex);
 	return ret;
@@ -1669,8 +1744,10 @@
 	/* TODO release all crtc connected to the framebuffer */
 	/* TODO unhock the destructor from the buffer object */
 
-	list_del(&fb->filp_head);
-	fb->funcs->destroy(fb);
+	if (fb->bo->type != drm_bo_type_kernel)
+		drm_framebuffer_cleanup(fb);
+	else
+		dev->driver->fb_remove(dev, drm_crtc_from_fb(dev, fb));
 
 out:
 	mutex_unlock(&dev->mode_config.mutex);
@@ -1716,7 +1793,7 @@
 	r->depth = fb->depth;
 	r->bpp = fb->bits_per_pixel;
 	r->pitch = fb->pitch;
-	fb->funcs->create_handle(fb, file_priv, &r->handle);
+	r->handle = fb->bo->base.hash.key;
 
 out:
 	mutex_unlock(&dev->mode_config.mutex);
@@ -1746,7 +1823,10 @@
 	mutex_lock(&dev->mode_config.mutex);
 	list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
 		list_del(&fb->filp_head);
-		fb->funcs->destroy(fb);
+		if (fb->bo->type != drm_bo_type_kernel)
+			drm_framebuffer_cleanup(fb);
+		else
+			dev->driver->fb_remove(dev, drm_crtc_from_fb(dev, fb));
 	}
 	mutex_unlock(&dev->mode_config.mutex);
 }
Index: linux-2.6.28/include/drm/drm_crtc.h
===================================================================
--- linux-2.6.28.orig/include/drm/drm_crtc.h	2009-02-25 15:37:00.000000000 +0000
+++ linux-2.6.28/include/drm/drm_crtc.h	2009-02-25 15:37:02.000000000 +0000
@@ -50,6 +50,8 @@
 	uint32_t type;
 };
 
+#include <drm/drm_objects.h>
+
 /*
  * Note on terminology:  here, for brevity and convenience, we refer to connector
  * control chips as 'CRTCs'.  They can control any type of connector, VGA, LVDS,
@@ -258,6 +260,9 @@
 	int flags;
 	void *fbdev;
 	u32 pseudo_palette[17];
+	unsigned long offset;
+	struct drm_buffer_object *bo;
+	struct drm_bo_kmap_obj kmap;
 	struct list_head filp_head;
 };
 
Index: linux-2.6.28/drivers/gpu/drm/i915/intel_lvds.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/i915/intel_lvds.c	2009-02-25 15:37:02.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/i915/intel_lvds.c	2009-02-25 15:37:02.000000000 +0000
@@ -36,6 +36,259 @@
 #include "i915_drm.h"
 #include "i915_drv.h"
 
+#include <acpi/acpi_drivers.h>
+
+#define BLC_I2C_TYPE 0x01
+#define BLC_PWM_TYPE 0x02
+#define BRIGHTNESS_MASK 0xff
+#define BRIGHTNESS_MAX_LEVEL 100
+#define BLC_POLARITY_NORMAL 0
+#define BLC_POLARITY_INVERSE 1
+#define BACKLIGHT_PWM_POLARITY_BIT_CLEAR (0xfffe)
+#define BACKLIGHT_PWM_CTL_SHIFT (16)
+#define BLC_MAX_PWM_REG_FREQ 0xfffe
+#define BLC_MIN_PWM_REG_FREQ 0x2
+#define BLC_PWM_LEGACY_MODE_ENABLE 0x0001
+#define BLC_PWM_PRECISION_FACTOR 10//10000000
+#define BLC_PWM_FREQ_CALC_CONSTANT 32
+#define MHz 1000000
+#define OFFSET_OPREGION_VBT	0x400
+
+typedef struct OpRegion_Header
+{
+	char sign[16];
+	u32 size;
+	u32 over;
+	char sver[32];
+	char vver[16];
+	char gver[16];
+	u32 mbox;
+	char rhd1[164];
+} OpRegionRec, *OpRegionPtr;
+
+struct vbt_header2
+{
+	char signature[20];		/**< Always starts with 'VBT$' */
+	u16 version;			/**< decimal */
+	u16 header_size;		/**< in bytes */
+	u16 vbt_size;			/**< in bytes */
+	u8 vbt_checksum;
+	u8 reserved0;
+	u32 bdb_offset;			/**< from beginning of VBT */
+	u32 aim1_offset;		/**< from beginning of VBT */
+	u32 aim2_offset;		/**< from beginning of VBT */
+	u32 aim3_offset;		/**< from beginning of VBT */
+	u32 aim4_offset;		/**< from beginning of VBT */
+} __attribute__ ((packed));
+
+struct bdb_header2
+{
+	char signature[16];		/**< Always 'BIOS_DATA_BLOCK' */
+	u16 version;			/**< decimal */
+	u16 header_size;		/**< in bytes */
+	u16 bdb_size;			/**< in bytes */
+} __attribute__ ((packed));
+
+#define LVDS_CAP_EDID			(1 << 6)
+#define LVDS_CAP_DITHER			(1 << 5)
+#define LVDS_CAP_PFIT_AUTO_RATIO	(1 << 4)
+#define LVDS_CAP_PFIT_GRAPHICS_MODE	(1 << 3)
+#define LVDS_CAP_PFIT_TEXT_MODE		(1 << 2)
+#define LVDS_CAP_PFIT_GRAPHICS		(1 << 1)
+#define LVDS_CAP_PFIT_TEXT		(1 << 0)
+struct lvds_bdb_1
+{
+	u8 id;				/**< 40 */
+	u16 size;
+	u8 panel_type;
+	u8 reserved0;
+	u16 caps;
+} __attribute__ ((packed));
+
+struct lvds_bdb_2_fp_params
+{
+	u16 x_res;
+	u16 y_res;
+	u32 lvds_reg;
+	u32 lvds_reg_val;
+	u32 pp_on_reg;
+	u32 pp_on_reg_val;
+	u32 pp_off_reg;
+	u32 pp_off_reg_val;
+	u32 pp_cycle_reg;
+	u32 pp_cycle_reg_val;
+	u32 pfit_reg;
+	u32 pfit_reg_val;
+	u16 terminator;
+} __attribute__ ((packed));
+
+struct lvds_bdb_2_fp_edid_dtd
+{
+	u16 dclk;		/**< In 10khz */
+	u8 hactive;
+	u8 hblank;
+	u8 high_h;		/**< 7:4 = hactive 11:8, 3:0 = hblank 11:8 */
+	u8 vactive;
+	u8 vblank;
+	u8 high_v;		/**< 7:4 = vactive 11:8, 3:0 = vblank 11:8 */
+	u8 hsync_off;
+	u8 hsync_pulse_width;
+	u8 vsync_off;
+	u8 high_hsync_off;	/**< 7:6 = hsync off 9:8 */
+	u8 h_image;
+	u8 v_image;
+	u8 max_hv;
+	u8 h_border;
+	u8 v_border;
+	u8 flags;
+#define FP_EDID_FLAG_VSYNC_POSITIVE	(1 << 2)
+#define FP_EDID_FLAG_HSYNC_POSITIVE	(1 << 1)
+} __attribute__ ((packed));
+
+struct lvds_bdb_2_entry
+{
+	u16 fp_params_offset;		/**< From beginning of BDB */
+	u8 fp_params_size;
+	u16 fp_edid_dtd_offset;
+	u8 fp_edid_dtd_size;
+	u16 fp_edid_pid_offset;
+	u8 fp_edid_pid_size;
+} __attribute__ ((packed));
+
+struct lvds_bdb_2
+{
+	u8 id;				/**< 41 */
+	u16 size;
+	u8 table_size;		       /* not sure on this one */
+	struct lvds_bdb_2_entry panels[16];
+} __attribute__ ((packed));
+
+
+struct lvds_bdb_blc
+{
+	u8 id;				/**< 43 */
+	u16 size;
+	u8 table_size;
+} __attribute__ ((packed));
+
+struct lvds_blc
+{
+	u8 type:2;
+	u8 pol:1;
+	u8 gpio:3;
+	u8 gmbus:2;
+	u16 freq;
+	u8 minbrightness;
+	u8 i2caddr;
+	u8 brightnesscmd;
+	/* more... */
+} __attribute__ ((packed));
+
+int drm_intel_ignore_acpi = 0;
+MODULE_PARM_DESC(ignore_acpi, "Ignore ACPI");
+module_param_named(ignore_acpi, drm_intel_ignore_acpi, int, 0600);
+
+uint8_t blc_type;
+uint8_t blc_pol;
+uint8_t blc_freq;
+uint8_t blc_minbrightness;
+uint8_t blc_i2caddr;
+uint8_t blc_brightnesscmd;
+int lvds_backlight;	/* restore backlight to this value */
+
+struct intel_i2c_chan *lvds_i2c_bus;
+u32 CoreClock;
+u32 PWMControlRegFreq;
+
+unsigned char * dev_OpRegion = NULL;
+unsigned int dev_OpRegionSize;
+
+#define PCI_PORT5_REG80_FFUSE				0xD0058000
+#define PCI_PORT5_REG80_MAXRES_INT_EN		0x0040
+#define MAX_HDISPLAY 800
+#define MAX_VDISPLAY 480
+bool sku_bMaxResEnableInt = false;
+
+/** Set BLC through I2C*/
+static int
+LVDSI2CSetBacklight(struct drm_device *dev, unsigned char ch)
+{
+	u8 out_buf[2];
+	struct i2c_msg msgs[] = {
+		{
+			.addr = lvds_i2c_bus->slave_addr,
+			.flags = 0,
+			.len = 2,
+			.buf = out_buf,
+		}
+	};
+
+	DRM_INFO("LVDSI2CSetBacklight: the slave_addr is 0x%x, the backlight value is %d\n", lvds_i2c_bus->slave_addr, ch);
+
+	out_buf[0] = blc_brightnesscmd;
+	out_buf[1] = ch;
+
+	if (i2c_transfer(&lvds_i2c_bus->adapter, msgs, 1) == 1)
+	{
+		DRM_INFO("LVDSI2CSetBacklight: i2c_transfer done\n");
+		return true;
+	}
+
+	DRM_ERROR("msg: i2c_transfer error\n");
+	return false;
+}
+
+/**
+ * Calculate PWM control register value.
+ */
+static int
+LVDSCalculatePWMCtrlRegFreq(struct drm_device *dev)
+{
+	unsigned long value = 0;
+
+	DRM_INFO("Enter LVDSCalculatePWMCtrlRegFreq.\n");
+	if (blc_freq == 0) {
+		DRM_ERROR("LVDSCalculatePWMCtrlRegFreq:  Frequency Requested is 0.\n");
+		return FALSE;
+	}
+	value = (CoreClock * MHz);
+	value = (value / BLC_PWM_FREQ_CALC_CONSTANT);
+	value = (value * BLC_PWM_PRECISION_FACTOR);
+	value = (value / blc_freq);
+	value = (value / BLC_PWM_PRECISION_FACTOR);
+
+	if (value > (unsigned long)BLC_MAX_PWM_REG_FREQ ||
+			value < (unsigned long)BLC_MIN_PWM_REG_FREQ) {
+		return FALSE;
+	} else {
+		PWMControlRegFreq = ((u32)value & ~BLC_PWM_LEGACY_MODE_ENABLE);
+		return TRUE;
+	}
+}
+
+/**
+ * Returns the maximum level of the backlight duty cycle field.
+ */
+static u32
+LVDSGetPWMMaxBacklight(struct drm_device *dev)
+{
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
+	u32 max_pwm_blc = 0;
+
+	max_pwm_blc = ((I915_READ(BLC_PWM_CTL) & BACKLIGHT_MODULATION_FREQ_MASK) >> \
+			BACKLIGHT_MODULATION_FREQ_SHIFT) * 2;
+
+	if (!(max_pwm_blc & BLC_MAX_PWM_REG_FREQ)) {
+		if (LVDSCalculatePWMCtrlRegFreq(dev)) {
+			max_pwm_blc = PWMControlRegFreq;
+		}
+	}
+
+	DRM_INFO("LVDSGetPWMMaxBacklight: the max_pwm_blc is %d.\n", max_pwm_blc);
+	return max_pwm_blc;
+}
+
+
 /**
  * Sets the backlight level.
  *
@@ -43,12 +296,48 @@
  */
 static void intel_lvds_set_backlight(struct drm_device *dev, int level)
 {
-	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
+	/*
 	u32 blc_pwm_ctl;
 
 	blc_pwm_ctl = I915_READ(BLC_PWM_CTL) & ~BACKLIGHT_DUTY_CYCLE_MASK;
 	I915_WRITE(BLC_PWM_CTL, (blc_pwm_ctl |
 				 (level << BACKLIGHT_DUTY_CYCLE_SHIFT)));
+	 */
+	u32 newbacklight = 0;
+
+	DRM_INFO("intel_lvds_set_backlight: the level is %d\n", level);
+
+	if(blc_type == BLC_I2C_TYPE){
+		newbacklight = BRIGHTNESS_MASK & ((unsigned long)level * \
+				BRIGHTNESS_MASK /BRIGHTNESS_MAX_LEVEL);
+
+		if (blc_pol == BLC_POLARITY_INVERSE) {
+			newbacklight = BRIGHTNESS_MASK - newbacklight;
+		}
+
+		LVDSI2CSetBacklight(dev, newbacklight);
+
+	} else if (blc_type == BLC_PWM_TYPE) {
+		u32 max_pwm_blc = LVDSGetPWMMaxBacklight(dev);
+
+		u32 blc_pwm_duty_cycle;
+
+		/* Provent LVDS going to total black */
+		if ( level < 20) {
+			level = 20;
+		}
+		blc_pwm_duty_cycle = level * max_pwm_blc/BRIGHTNESS_MAX_LEVEL;
+
+		if (blc_pol == BLC_POLARITY_INVERSE) {
+			blc_pwm_duty_cycle = max_pwm_blc - blc_pwm_duty_cycle;
+		}
+
+		blc_pwm_duty_cycle &= BACKLIGHT_PWM_POLARITY_BIT_CLEAR;
+
+		I915_WRITE(BLC_PWM_CTL,
+				(max_pwm_blc << BACKLIGHT_PWM_CTL_SHIFT)| (blc_pwm_duty_cycle));
+	}
 }
 
 /**
@@ -56,10 +345,13 @@
  */
 static u32 intel_lvds_get_max_backlight(struct drm_device *dev)
 {
-	struct drm_i915_private *dev_priv = dev->dev_private;
+	return BRIGHTNESS_MAX_LEVEL;
+	/*
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
 
 	return ((I915_READ(BLC_PWM_CTL) & BACKLIGHT_MODULATION_FREQ_MASK) >>
 		BACKLIGHT_MODULATION_FREQ_SHIFT) * 2;
+	*/
 }
 
 /**
@@ -77,7 +369,7 @@
 			pp_status = I915_READ(PP_STATUS);
 		} while ((pp_status & PP_ON) == 0);
 
-		intel_lvds_set_backlight(dev, dev_priv->backlight_duty_cycle);
+		intel_lvds_set_backlight(dev, lvds_backlight);
 	} else {
 		intel_lvds_set_backlight(dev, 0);
 
@@ -93,6 +385,7 @@
 {
 	struct drm_device *dev = encoder->dev;
 
+	DRM_INFO("intel_lvds_dpms: the mode is %d\n", mode);
 	if (mode == DRM_MODE_DPMS_ON)
 		intel_lvds_set_power(dev, true);
 	else
@@ -152,6 +445,13 @@
 			return MODE_PANEL;
 	}
 
+	if (IS_POULSBO(dev) && sku_bMaxResEnableInt) {
+		if (mode->hdisplay > MAX_HDISPLAY)
+			return MODE_PANEL;
+		if (mode->vdisplay > MAX_VDISPLAY)
+			return MODE_PANEL;
+	}
+
 	return MODE_OK;
 }
 
@@ -185,20 +485,20 @@
 	 * with the panel scaling set up to source from the H/VDisplay
 	 * of the original mode.
 	 */
-	if (dev_priv->panel_fixed_mode != NULL) {
-		adjusted_mode->hdisplay = dev_priv->panel_fixed_mode->hdisplay;
+	if (dev_priv_common->panel_fixed_mode != NULL) {
+		adjusted_mode->hdisplay = dev_priv_common->panel_fixed_mode->hdisplay;
 		adjusted_mode->hsync_start =
-			dev_priv->panel_fixed_mode->hsync_start;
+			dev_priv_common->panel_fixed_mode->hsync_start;
 		adjusted_mode->hsync_end =
-			dev_priv->panel_fixed_mode->hsync_end;
-		adjusted_mode->htotal = dev_priv->panel_fixed_mode->htotal;
-		adjusted_mode->vdisplay = dev_priv->panel_fixed_mode->vdisplay;
+			dev_priv_common->panel_fixed_mode->hsync_end;
+		adjusted_mode->htotal = dev_priv_common->panel_fixed_mode->htotal;
+		adjusted_mode->vdisplay = dev_priv_common->panel_fixed_mode->vdisplay;
 		adjusted_mode->vsync_start =
-			dev_priv->panel_fixed_mode->vsync_start;
+			dev_priv_common->panel_fixed_mode->vsync_start;
 		adjusted_mode->vsync_end =
-			dev_priv->panel_fixed_mode->vsync_end;
-		adjusted_mode->vtotal = dev_priv->panel_fixed_mode->vtotal;
-		adjusted_mode->clock = dev_priv->panel_fixed_mode->clock;
+			dev_priv_common->panel_fixed_mode->vsync_end;
+		adjusted_mode->vtotal = dev_priv_common->panel_fixed_mode->vtotal;
+		adjusted_mode->clock = dev_priv_common->panel_fixed_mode->clock;
 		drm_mode_set_crtcinfo(adjusted_mode, CRTC_INTERLACE_HALVE_V);
 	}
 
@@ -214,10 +514,10 @@
 static void intel_lvds_prepare(struct drm_encoder *encoder)
 {
 	struct drm_device *dev = encoder->dev;
-	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
 
-	dev_priv->saveBLC_PWM_CTL = I915_READ(BLC_PWM_CTL);
-	dev_priv->backlight_duty_cycle = (dev_priv->saveBLC_PWM_CTL &
+	dev_priv_common->saveBLC_PWM_CTL = I915_READ(BLC_PWM_CTL);
+	dev_priv_common->backlight_duty_cycle = (dev_priv_common->saveBLC_PWM_CTL &
 				       BACKLIGHT_DUTY_CYCLE_MASK);
 
 	intel_lvds_set_power(dev, false);
@@ -226,10 +526,11 @@
 static void intel_lvds_commit( struct drm_encoder *encoder)
 {
 	struct drm_device *dev = encoder->dev;
-	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
 
-	if (dev_priv->backlight_duty_cycle == 0)
-		dev_priv->backlight_duty_cycle =
+	if (dev_priv_common->backlight_duty_cycle == 0)
+		//dev_priv_common->backlight_duty_cycle =
+		lvds_backlight =
 			intel_lvds_get_max_backlight(dev);
 
 	intel_lvds_set_power(dev, true);
@@ -291,10 +592,12 @@
 {
 	struct drm_device *dev = connector->dev;
 	struct intel_output *intel_output = to_intel_output(connector);
-	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
 	int ret = 0;
 
+	mutex_lock(&dev->mode_config.mutex);
 	ret = intel_ddc_get_modes(intel_output);
+	mutex_unlock(&dev->mode_config.mutex);
 
 	if (ret)
 		return ret;
@@ -308,11 +611,11 @@
 	connector->display_info.min_hfreq = 0;
 	connector->display_info.max_hfreq = 200;
 
-	if (dev_priv->panel_fixed_mode != NULL) {
+	if (dev_priv_common->panel_fixed_mode != NULL) {
 		struct drm_display_mode *mode;
 
 		mutex_unlock(&dev->mode_config.mutex);
-		mode = drm_mode_duplicate(dev, dev_priv->panel_fixed_mode);
+		mode = drm_mode_duplicate(dev, dev_priv_common->panel_fixed_mode);
 		drm_mode_probed_add(connector, mode);
 		mutex_unlock(&dev->mode_config.mutex);
 
@@ -333,8 +636,11 @@
 {
 	struct intel_output *intel_output = to_intel_output(connector);
 
+	if(dev_OpRegion != NULL)
+		iounmap(dev_OpRegion);
 	if (intel_output->ddc_bus)
 		intel_i2c_destroy(intel_output->ddc_bus);
+	intel_i2c_destroy(lvds_i2c_bus);
 	drm_sysfs_connector_remove(connector);
 	drm_connector_cleanup(connector);
 	kfree(connector);
@@ -373,7 +679,45 @@
 };
 
 
-
+int intel_get_acpi_dod(char *method)
+{
+	int status;
+	int found = 0;
+	int i;
+	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+	union acpi_object *dod = NULL;
+	union acpi_object *obj;
+
+	status = acpi_evaluate_object(NULL, method, NULL, &buffer);
+	if (ACPI_FAILURE(status))
+		return -ENODEV;
+
+	dod = buffer.pointer;
+	if (!dod || (dod->type != ACPI_TYPE_PACKAGE)) {
+		status = -EFAULT;
+		goto out;
+	}
+
+	DRM_DEBUG("Found %d video heads in _DOD\n", dod->package.count);
+
+	for (i = 0; i < dod->package.count; i++) {
+		obj = &dod->package.elements[i];
+
+		if (obj->type != ACPI_TYPE_INTEGER) {
+			DRM_DEBUG("Invalid _DOD data\n");
+		} else {
+			DRM_DEBUG("dod element[%d] = 0x%x\n", i,
+				  (int)obj->integer.value);
+
+			/* look for an LVDS type */
+			if (obj->integer.value & 0x00000400)
+				found = 1;
+		}
+	}
+      out:
+	kfree(buffer.pointer);
+	return found;
+}
 /**
  * intel_lvds_init - setup LVDS connectors on this device
  * @dev: drm device
@@ -383,7 +727,7 @@
  */
 void intel_lvds_init(struct drm_device *dev)
 {
-	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
 	struct intel_output *intel_output;
 	struct drm_connector *connector;
 	struct drm_encoder *encoder;
@@ -391,12 +735,38 @@
 	struct drm_crtc *crtc;
 	u32 lvds;
 	int pipe;
+	u32 OpRegion_Phys;
+	unsigned int OpRegion_Size = 0x100;
+	OpRegionPtr OpRegion;
+	char *OpRegion_String = "IntelGraphicsMem";
+	struct pci_dev * pci_root = pci_get_bus_and_slot(0, 0);
+	u32 clock;
+	u32 sku_value = 0;
+	unsigned int CoreClocks[] = {
+		100,
+		133,
+		150,
+		178,
+		200,
+		266,
+		266,
+		266
+	};
+	struct vbt_header *vbt;
+	struct bdb_header *bdb;
+	int vbt_off, bdb_off, bdb_block_off, block_size;
+	int panel_type = -1;
+	unsigned char *bios;
+	unsigned char *vbt_buf;
 
 	intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
 	if (!intel_output) {
 		return;
 	}
 
+	//if (!drm_intel_ignore_acpi && !intel_get_acpi_dod(ACPI_DOD))
+	//	return;
+
 	connector = &intel_output->base;
 	encoder = &intel_output->enc;
 	drm_connector_init(dev, &intel_output->base, &intel_lvds_connector_funcs,
@@ -414,16 +784,139 @@
 	connector->interlace_allowed = false;
 	connector->doublescan_allowed = false;
 
+	//initialize the I2C bus and BLC data
+	lvds_i2c_bus = intel_i2c_create(dev, GPIOB, "LVDSBLC_B");
+	if (!lvds_i2c_bus) {
+		dev_printk(KERN_ERR, &dev->pdev->dev, "i2c bus registration "
+			   "failed.\n");
+		return;
+	}
+	lvds_i2c_bus->slave_addr = 0x2c;//0x58;
+	lvds_backlight = BRIGHTNESS_MAX_LEVEL;
+	blc_type = 0;
+	blc_pol = 0;
 
-	/*
-	 * LVDS discovery:
-	 * 1) check for EDID on DDC
-	 * 2) check for VBT data
-	 * 3) check to see if LVDS is already on
-	 *    if none of the above, no panel
-	 * 4) make sure lid is open
-	 *    if closed, act like it's not there for now
-	 */
+	 //get the BLC init data from VBT
+
+
+
+
+	pci_read_config_dword(dev->pdev, 0xFC, &OpRegion_Phys);
+
+	dev_OpRegion = ioremap(OpRegion_Phys, OpRegion_Size);
+	dev_OpRegionSize = OpRegion_Size;
+
+	OpRegion = (OpRegionPtr) dev_OpRegion;
+
+	if (!memcmp(OpRegion->sign, OpRegion_String, 16)) {
+		unsigned int OpRegion_NewSize;
+
+		OpRegion_NewSize = OpRegion->size * 1024;
+
+		dev_OpRegionSize = OpRegion_NewSize;
+
+		iounmap(dev_OpRegion);
+		dev_OpRegion = ioremap(OpRegion_Phys, OpRegion_NewSize);
+	} else {
+		iounmap(dev_OpRegion);
+		dev_OpRegion = NULL;
+	}
+
+	if((dev_OpRegion != NULL)&&(dev_OpRegionSize >= OFFSET_OPREGION_VBT)) {
+		DRM_INFO("intel_lvds_init: OpRegion has the VBT address\n");
+		vbt_buf = dev_OpRegion + OFFSET_OPREGION_VBT;
+		vbt = (struct vbt_header *)(dev_OpRegion + OFFSET_OPREGION_VBT);
+	} else {
+		DRM_INFO("intel_lvds_init: No OpRegion, use the bios at fixed address 0xc0000\n");
+		bios = phys_to_virt(0xC0000);
+		if(*((u16 *)bios) != 0xAA55){
+			bios = NULL;
+			DRM_ERROR("the bios is incorrect\n");
+			goto blc_out;
+		}
+		vbt_off = bios[0x1a] | (bios[0x1a + 1] << 8);
+		DRM_INFO("intel_lvds_init: the vbt off is %x\n", vbt_off);
+		vbt_buf = bios + vbt_off;
+		vbt = (struct vbt_header *)(bios + vbt_off);
+	}
+
+	bdb_off = vbt->bdb_offset;
+	bdb = (struct bdb_header *)(vbt_buf + bdb_off);
+
+	DRM_INFO("intel_lvds_init: The bdb->signature is %s, the bdb_off is %d\n",bdb->signature, bdb_off);
+
+	if (memcmp(bdb->signature, "BIOS_DATA_BLOCK ", 16) != 0) {
+		DRM_ERROR("the vbt is error\n");
+		goto blc_out;
+	}
+
+		for (bdb_block_off = bdb->header_size; bdb_block_off < bdb->bdb_size;
+				bdb_block_off += block_size) {
+			int start = bdb_off + bdb_block_off;
+			int id, num_entries;
+			struct lvds_bdb_1 *lvds1;
+			struct lvds_blc *lvdsblc;
+			struct lvds_bdb_blc *bdbblc;
+
+			id = vbt_buf[start];
+			block_size = (vbt_buf[start + 1] | (vbt_buf[start + 2] << 8)) + 3;
+			switch (id) {
+				case 40:
+					lvds1 = (struct lvds_bdb_1 *)(vbt_buf+ start);
+					panel_type = lvds1->panel_type;
+					//if (lvds1->caps & LVDS_CAP_DITHER)
+					//	*panelWantsDither = TRUE;
+					break;
+
+				case 43:
+					bdbblc = (struct lvds_bdb_blc *)(vbt_buf + start);
+					num_entries = bdbblc->table_size? (bdbblc->size - \
+							sizeof(bdbblc->table_size))/bdbblc->table_size : 0;
+					if (num_entries << 16 && bdbblc->table_size == sizeof(struct lvds_blc)) {
+						lvdsblc = (struct lvds_blc *)(vbt_buf + start + sizeof(struct lvds_bdb_blc));
+						lvdsblc += panel_type;
+						blc_type = lvdsblc->type;
+						blc_pol = lvdsblc->pol;
+						blc_freq = lvdsblc->freq;
+						blc_minbrightness = lvdsblc->minbrightness;
+						blc_i2caddr = lvdsblc->i2caddr;
+						blc_brightnesscmd = lvdsblc->brightnesscmd;
+						DRM_INFO("intel_lvds_init: BLC Data in BIOS VBT tables: datasize=%d paneltype=%d \
+								type=0x%02x pol=0x%02x freq=0x%04x minlevel=0x%02x    \
+								i2caddr=0x%02x cmd=0x%02x \n",
+								0,
+								panel_type,
+								lvdsblc->type,
+								lvdsblc->pol,
+								lvdsblc->freq,
+								lvdsblc->minbrightness,
+								lvdsblc->i2caddr,
+								lvdsblc->brightnesscmd);
+					}
+					break;
+			}
+		}
+
+	//get the Core Clock for calculating MAX PWM value
+	//check whether the MaxResEnableInt is
+
+	if(pci_root)
+	{
+		pci_write_config_dword(pci_root, 0xD0, 0xD0050300);
+		pci_read_config_dword(pci_root, 0xD4, &clock);
+		CoreClock = CoreClocks[clock & 0x07];
+		DRM_INFO("intel_lvds_init: the CoreClock is %d\n", CoreClock);
+
+		pci_write_config_dword(pci_root, 0xD0, PCI_PORT5_REG80_FFUSE);
+		pci_read_config_dword(pci_root, 0xD4, &sku_value);
+		sku_bMaxResEnableInt = (sku_value & PCI_PORT5_REG80_MAXRES_INT_EN)? true : false;
+		DRM_INFO("intel_lvds_init: sku_value is 0x%08x\n", sku_value);
+		DRM_INFO("intel_lvds_init: sku_bMaxResEnableInt is %d\n", sku_bMaxResEnableInt);
+	}
+
+
+
+blc_out:
 
 	/* Set up the DDC bus. */
 	intel_output->ddc_bus = intel_i2c_create(dev, GPIOC, "LVDSDDC_C");
@@ -437,12 +930,14 @@
 	 * Attempt to get the fixed panel mode from DDC.  Assume that the
 	 * preferred mode is the right one.
 	 */
+	mutex_lock(&dev->mode_config.mutex);
 	intel_ddc_get_modes(intel_output);
+	mutex_unlock(&dev->mode_config.mutex);
 
 	list_for_each_entry(scan, &connector->probed_modes, head) {
 		mutex_lock(&dev->mode_config.mutex);
 		if (scan->type & DRM_MODE_TYPE_PREFERRED) {
-			dev_priv->panel_fixed_mode =
+			dev_priv_common->panel_fixed_mode =
 				drm_mode_duplicate(dev, scan);
 			mutex_unlock(&dev->mode_config.mutex);
 			goto out; /* FIXME: check for quirks */
@@ -450,21 +945,6 @@
 		mutex_unlock(&dev->mode_config.mutex);
 	}
 
-	/* Failed to get EDID, what about VBT? */
-	if (dev_priv->vbt_mode) {
-		mutex_lock(&dev->mode_config.mutex);
-		dev_priv->panel_fixed_mode =
-			drm_mode_duplicate(dev, dev_priv->vbt_mode);
-		mutex_unlock(&dev->mode_config.mutex);
-		if (dev_priv->panel_fixed_mode) {
-			dev_priv->panel_fixed_mode->type |=
-				DRM_MODE_TYPE_PREFERRED;
-			drm_mode_probed_add(connector,
-					    dev_priv->panel_fixed_mode);
-			goto out;
-		}
-	}
-
 	/*
 	 * If we didn't get EDID, try checking if the panel is already turned
 	 * on.  If so, assume that whatever is currently programmed is the
Index: linux-2.6.28/drivers/gpu/drm/i915/intel_sdvo.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/i915/intel_sdvo.c	2009-02-25 15:37:02.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/i915/intel_sdvo.c	2009-02-25 15:37:02.000000000 +0000
@@ -37,6 +37,9 @@
 
 #undef SDVO_DEBUG
 
+#define PCI_PORT5_REG80_FFUSE				0xD0058000
+#define PCI_PORT5_REG80_SDVO_DISABLE		0x0020
+
 struct intel_sdvo_priv {
 	struct intel_i2c_chan *i2c_bus;
 	int slaveaddr;
@@ -989,6 +992,21 @@
 	int i;
 	int encoder_type, output_id;
 
+	if (IS_POULSBO(dev)) {
+		struct pci_dev * pci_root = pci_get_bus_and_slot(0, 0);
+		u32 sku_value = 0;
+		bool sku_bSDVOEnable = true;
+		if(pci_root) {
+			pci_write_config_dword(pci_root, 0xD0, PCI_PORT5_REG80_FFUSE);
+			pci_read_config_dword(pci_root, 0xD4, &sku_value);
+			sku_bSDVOEnable = (sku_value & PCI_PORT5_REG80_SDVO_DISABLE)?false : true;
+			DRM_INFO("intel_sdvo_init: sku_value is 0x%08x\n", sku_value);
+			DRM_INFO("intel_sdvo_init: sku_bSDVOEnable is %d\n", sku_bSDVOEnable);
+			if (sku_bSDVOEnable == false)
+				return false;
+		}
+	}
+
 	intel_output = kcalloc(sizeof(struct intel_output)+sizeof(struct intel_sdvo_priv), 1, GFP_KERNEL);
 	if (!intel_output) {
 		return false;
Index: linux-2.6.28/drivers/gpu/drm/psb/psb_priv.h
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/psb/psb_priv.h	2009-02-25 15:37:02.000000000 +0000
@@ -0,0 +1,181 @@
+#include "psb_drm.h"
+#include "psb_reg.h"
+#include "psb_schedule.h"
+#include "../i915/i915_common.h"
+
+#define DRM_DRIVER_PRIVATE_T struct drm_i915_common_private
+
+struct drm_psb_uopt {
+	int clock_gating;
+};
+
+struct drm_psb_private {
+	/* common is assumed to be the first item in this structure */
+	struct drm_i915_common_private common;
+
+	unsigned long chipset;
+        uint8_t psb_rev_id;
+
+	struct psb_xhw_buf resume_buf;
+	struct drm_psb_dev_info_arg dev_info;
+	struct drm_psb_uopt uopt;
+
+	struct psb_gtt *pg;
+
+	struct page *scratch_page;
+	struct page *comm_page;
+
+	volatile uint32_t *comm;
+	uint32_t comm_mmu_offset;
+	uint32_t mmu_2d_offset;
+	uint32_t sequence[PSB_NUM_ENGINES];
+	uint32_t last_sequence[PSB_NUM_ENGINES];
+	int idle[PSB_NUM_ENGINES];
+	uint32_t last_submitted_seq[PSB_NUM_ENGINES];
+	int engine_lockup_2d;
+
+	/** Protects user_irq_refcount and irq_mask_reg */
+	spinlock_t user_irq_lock;
+	u32 pipestat[2];
+
+	struct psb_mmu_driver *mmu;
+	struct psb_mmu_pd *pf_pd;
+
+	uint8_t *sgx_reg;
+	//uint8_t *vdc_reg;
+	uint8_t *msvdx_reg;
+
+	/*
+	 * MSVDX
+	 */
+	int msvdx_needs_reset;
+	int has_msvdx;
+	uint32_t gatt_free_offset;
+	atomic_t msvdx_mmu_invaldc;
+
+	/*
+	 * Fencing / irq.
+	 */
+
+	uint32_t sgx_irq_mask;
+	uint32_t sgx2_irq_mask;
+	uint32_t vdc_irq_mask;
+
+	spinlock_t irqmask_lock;
+	spinlock_t sequence_lock;
+	int fence0_irq_on;
+	int irq_enabled;
+	unsigned int irqen_count_2d;
+	wait_queue_head_t event_2d_queue;
+
+	wait_queue_head_t queue_2d;
+	atomic_t lock_2d;
+	atomic_t ta_wait_2d;
+	atomic_t ta_wait_2d_irq;
+	atomic_t waiters_2d;
+
+	uint32_t msvdx_current_sequence;
+	uint32_t msvdx_last_sequence;
+#define MSVDX_MAX_IDELTIME HZ*30
+	uint32_t msvdx_finished_sequence;
+	uint32_t msvdx_start_idle;
+	unsigned long msvdx_idle_start_jiffies;
+
+	int fence2_irq_on;
+
+	/*
+	 * MSVDX Rendec Memory
+	 */
+	struct drm_buffer_object *ccb0;
+	uint32_t base_addr0;
+	struct drm_buffer_object *ccb1;
+	uint32_t base_addr1;
+
+	/*
+	 * Memory managers
+	 */
+
+	int have_vram;
+	int have_tt;
+	int have_mem_mmu;
+	int have_mem_aper;
+	int have_mem_kernel;
+	int have_mem_pds;
+	int have_mem_rastgeom;
+	struct mutex temp_mem;
+
+	/*
+	 * Relocation buffer mapping.
+	 */
+
+	spinlock_t reloc_lock;
+	unsigned int rel_mapped_pages;
+	wait_queue_head_t rel_mapped_queue;
+
+	/*
+	 * Register state
+	 */
+	uint32_t saveCLOCKGATING;
+
+	/*
+	 * USE code base register management.
+	 */
+
+	struct drm_reg_manager use_manager;
+
+	/*
+	 * Xhw
+	 */
+
+	uint32_t *xhw;
+	struct drm_buffer_object *xhw_bo;
+	struct drm_bo_kmap_obj xhw_kmap;
+	struct list_head xhw_in;
+	spinlock_t xhw_lock;
+	atomic_t xhw_client;
+	struct drm_file *xhw_file;
+	wait_queue_head_t xhw_queue;
+	wait_queue_head_t xhw_caller_queue;
+	struct mutex xhw_mutex;
+	struct psb_xhw_buf *xhw_cur_buf;
+	int xhw_submit_ok;
+	int xhw_on;
+
+	/*
+	 * Scheduling.
+	 */
+
+	struct mutex reset_mutex;
+	struct mutex cmdbuf_mutex;
+	struct psb_scheduler scheduler;
+        struct psb_buflist_item *buffers;
+	uint32_t ta_mem_pages;
+	struct psb_ta_mem *ta_mem;
+	int force_ta_mem_load;
+
+	/*
+	 * Watchdog
+	 */
+
+	spinlock_t watchdog_lock;
+	struct timer_list watchdog_timer;
+	struct work_struct watchdog_wq;
+	struct work_struct msvdx_watchdog_wq;
+	int timer_available;
+
+	/*
+	 * msvdx command queue
+	 */
+	spinlock_t msvdx_lock;
+	struct mutex msvdx_mutex;
+	struct list_head msvdx_queue;
+	int msvdx_busy;
+
+};
+
+
+extern void intel_modeset_init(struct drm_device *dev);
+extern void intel_modeset_cleanup(struct drm_device *dev);
+
+extern void intel_crtc_mode_restore(struct drm_crtc *crtc);
+extern void intel_crtc_mode_save(struct drm_crtc *crtc);
Index: linux-2.6.28/drivers/gpu/drm/i915/intel_display.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/i915/intel_display.c	2009-02-25 15:37:02.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/i915/intel_display.c	2009-02-25 15:37:02.000000000 +0000
@@ -342,60 +342,25 @@
 	/* Wait for 20ms, i.e. one cycle at 50hz. */
 	udelay(20000);
 }
+EXPORT_SYMBOL(intel_wait_for_vblank);
 
 static void
 intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 		    struct drm_framebuffer *old_fb)
 {
 	struct drm_device *dev = crtc->dev;
-	struct drm_i915_private *dev_priv = dev->dev_private;
 	struct drm_i915_master_private *master_priv;
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-	struct intel_framebuffer *intel_fb;
-	struct drm_i915_gem_object *obj_priv;
-	struct drm_gem_object *obj;
 	int pipe = intel_crtc->pipe;
 	unsigned long Start, Offset;
 	int dspbase = (pipe == 0 ? DSPAADDR : DSPBADDR);
 	int dspsurf = (pipe == 0 ? DSPASURF : DSPBSURF);
 	int dspstride = (pipe == 0) ? DSPASTRIDE : DSPBSTRIDE;
 	int dspcntr_reg = (pipe == 0) ? DSPACNTR : DSPBCNTR;
-	u32 dspcntr, alignment;
-
-	/* no fb bound */
-	if (!crtc->fb) {
-		DRM_DEBUG("No FB bound\n");
-		return;
-	}
-
-	intel_fb = to_intel_framebuffer(crtc->fb);
-	obj = intel_fb->obj;
-	obj_priv = obj->driver_private;
-
-	switch (obj_priv->tiling_mode) {
-	case I915_TILING_NONE:
-		alignment = 64 * 1024;
-		break;
-	case I915_TILING_X:
-		if (IS_I9XX(dev))
-			alignment = 1024 * 1024;
-		else
-			alignment = 512 * 1024;
-		break;
-	case I915_TILING_Y:
-		/* FIXME: Is this true? */
-		DRM_ERROR("Y tiled not allowed for scan out buffers\n");
-		return;
-	default:
-		BUG();
-	}
+	u32 dspcntr;
 
-	if (i915_gem_object_pin(intel_fb->obj, alignment))
-		return;
-
-	i915_gem_object_set_to_gtt_domain(intel_fb->obj, 1);
-
-	Start = obj_priv->gtt_offset;
+	Start = crtc->fb->offset;
 	Offset = y * crtc->fb->pitch + x * (crtc->fb->bits_per_pixel / 8);
 
 	I915_WRITE(dspstride, crtc->fb->pitch);
@@ -434,13 +399,6 @@
 		I915_READ(dspbase);
 	}
 
-	intel_wait_for_vblank(dev);
-
-	if (old_fb) {
-		intel_fb = to_intel_framebuffer(old_fb);
-		i915_gem_object_unpin(intel_fb->obj);
-	}
-
 	if (!dev->primary->master)
 		return;
 
@@ -642,7 +600,7 @@
 		return 400000;
 	else if (IS_I915G(dev))
 		return 333000;
-	else if (IS_I945GM(dev) || IS_845G(dev))
+	else if (IS_I945GM(dev) || IS_POULSBO(dev) || IS_845G(dev))
 		return 200000;
 	else if (IS_I915GM(dev)) {
 		u16 gcfgc = 0;
@@ -786,13 +744,15 @@
 
 	dpll = DPLL_VGA_MODE_DIS;
 	if (IS_I9XX(dev)) {
-		if (is_lvds)
+		if (is_lvds) {
 			dpll |= DPLLB_MODE_LVDS;
-		else
+			if (IS_POULSBO(dev))
+				dpll |= DPLL_DVO_HIGH_SPEED;
+		} else
 			dpll |= DPLLB_MODE_DAC_SERIAL;
 		if (is_sdvo) {
 			dpll |= DPLL_DVO_HIGH_SPEED;
-			if (IS_I945G(dev) || IS_I945GM(dev)) {
+			if (IS_I945G(dev) || IS_I945GM(dev) || IS_POULSBO(dev)) {
 				int sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
 				dpll |= (sdvo_pixel_multiply - 1) << SDVO_MULTIPLIER_SHIFT_HIRES;
 			}
@@ -959,7 +919,7 @@
 void intel_crtc_load_lut(struct drm_crtc *crtc)
 {
 	struct drm_device *dev = crtc->dev;
-	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
 	int palreg = (intel_crtc->pipe == 0) ? PALETTE_A : PALETTE_B;
 	int i;
@@ -1021,7 +981,7 @@
 		ret = -ENOMEM;
 		goto fail;
 	}
-
+#if 0
 	/* we only need to pin inside GTT if cursor is non-phy */
 	if (!dev_priv->cursor_needs_physical) {
 		ret = i915_gem_object_pin(bo, PAGE_SIZE);
@@ -1038,7 +998,7 @@
 		}
 		addr = obj_priv->phys_obj->handle->busaddr;
 	}
-
+#endif
 	temp = 0;
 	/* set the pipe for the cursor */
 	temp |= (pipe << 28);
@@ -1049,6 +1009,7 @@
 	I915_WRITE(base, addr);
 
 	if (intel_crtc->cursor_bo) {
+#if 0
 		if (dev_priv->cursor_needs_physical) {
 			if (intel_crtc->cursor_bo != bo)
 				i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
@@ -1057,6 +1018,7 @@
 		mutex_lock(&dev->struct_mutex);
 		drm_gem_object_unreference(intel_crtc->cursor_bo);
 		mutex_unlock(&dev->struct_mutex);
+#endif
 	}
 
 	intel_crtc->cursor_addr = addr;
@@ -1456,7 +1418,8 @@
 {
 	struct drm_connector *connector;
 
-	intel_crt_init(dev);
+	if (!IS_POULSBO(dev))
+		intel_crt_init(dev);
 
 	/* Set up integrated LVDS */
 	if (IS_MOBILE(dev) && !IS_I830(dev))
@@ -1472,12 +1435,9 @@
 		found = intel_sdvo_init(dev, SDVOC);
 		if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
 			intel_hdmi_init(dev, SDVOC);
-	} else
+	} else 
 		intel_dvo_init(dev);
 
-	if (IS_I9XX(dev) && IS_MOBILE(dev))
-		intel_tv_init(dev);
-
 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
 		struct intel_output *intel_output = to_intel_output(connector);
 		struct drm_encoder *encoder = &intel_output->enc;
@@ -1525,8 +1485,8 @@
 	struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
 	struct drm_device *dev = fb->dev;
 
-	if (fb->fbdev)
-		intelfb_remove(dev, fb);
+	//if (fb->fbdev)
+	//	intelfb_remove(dev, fb);
 
 	drm_framebuffer_cleanup(fb);
 	mutex_lock(&dev->struct_mutex);
@@ -1603,7 +1563,7 @@
 
 static const struct drm_mode_config_funcs intel_mode_funcs = {
 	.fb_create = intel_user_framebuffer_create,
-	.fb_changed = intelfb_probe,
+//	.fb_changed = intelfb_probe,
 };
 
 void intel_modeset_init(struct drm_device *dev)
Index: linux-2.6.28/drivers/gpu/drm/i915/i915_irq.c
===================================================================
--- linux-2.6.28.orig/drivers/gpu/drm/i915/i915_irq.c	2009-02-25 15:37:02.000000000 +0000
+++ linux-2.6.28/drivers/gpu/drm/i915/i915_irq.c	2009-02-25 15:37:02.000000000 +0000
@@ -536,6 +536,7 @@
 
 int i915_driver_irq_postinstall(struct drm_device *dev)
 {
+	struct drm_i915_common_private *dev_priv_common = dev->dev_private;
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 
 	dev_priv->vblank_pipe = DRM_I915_VBLANK_PIPE_A | DRM_I915_VBLANK_PIPE_B;