5 files changed, 35 insertions, 24 deletions

diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c
index 36990b80e790..16077785ad47 100644
--- a/drivers/gpu/drm/vmwgfx/ttm_object.c
+++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
@@ -174,7 +174,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
         kref_init(&base->refcount);
         idr_preload(GFP_KERNEL);
         spin_lock(&tdev->object_lock);
-        ret = idr_alloc(&tdev->idr, base, 0, 0, GFP_NOWAIT);
+        ret = idr_alloc(&tdev->idr, base, 1, 0, GFP_NOWAIT);
         spin_unlock(&tdev->object_lock);
         idr_preload_end();
         if (ret < 0)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index bf6c3500d363..4ff11a0077e1 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1239,7 +1239,13 @@ static int vmw_master_set(struct drm_device *dev,
         }
 
         dev_priv->active_master = vmaster;
-        drm_sysfs_hotplug_event(dev);
+
+        /*
+         * Inform a new master that the layout may have changed while
+         * it was gone.
+         */
+        if (!from_open)
+                drm_sysfs_hotplug_event(dev);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 96983c47fb40..366dcfc1f9bb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -296,7 +296,7 @@ struct vmw_sg_table {
 struct vmw_piter {
         struct page **pages;
         const dma_addr_t *addrs;
-        struct sg_page_iter iter;
+        struct sg_dma_page_iter iter;
         unsigned long i;
         unsigned long num_pages;
         bool (*next)(struct vmw_piter *);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 2ff7ba04d8c8..33533d126277 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -2010,6 +2010,11 @@ static int vmw_cmd_set_shader(struct vmw_private *dev_priv,
                 return 0;
 
         if (cmd->body.shid != SVGA3D_INVALID_ID) {
+                /*
+                 * This is the compat shader path - Per device guest-backed
+                 * shaders, but user-space thinks it's per context host-
+                 * backed shaders.
+                 */
                 res = vmw_shader_lookup(vmw_context_res_man(ctx),
                                         cmd->body.shid, cmd->body.type);
                 if (!IS_ERR(res)) {
@@ -2017,6 +2022,14 @@ static int vmw_cmd_set_shader(struct vmw_private *dev_priv,
                                                             VMW_RES_DIRTY_NONE);
                         if (unlikely(ret != 0))
                                 return ret;
+
+                        ret = vmw_resource_relocation_add
+                                (sw_context, res,
+                                 vmw_ptr_diff(sw_context->buf_start,
+                                              &cmd->body.shid),
+                                 vmw_res_rel_normal);
+                        if (unlikely(ret != 0))
+                                return ret;
                 }
         }
 
@@ -2193,7 +2206,8 @@ static int vmw_cmd_dx_set_shader(struct vmw_private *dev_priv,
 
         cmd = container_of(header, typeof(*cmd), header);
 
-        if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX) {
+        if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX ||
+            cmd->body.type < SVGA3D_SHADERTYPE_MIN) {
                 VMW_DEBUG_USER("Illegal shader type %u.\n",
                                (unsigned int) cmd->body.type);
                 return -EINVAL;
@@ -2414,6 +2428,10 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
                 return -EINVAL;
 
         cmd = container_of(header, typeof(*cmd), header);
+        if (unlikely(cmd->sid == SVGA3D_INVALID_ID)) {
+                VMW_DEBUG_USER("Invalid surface id.\n");
+                return -EINVAL;
+        }
         ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
                                 VMW_RES_DIRTY_NONE, user_surface_converter,
                                 &cmd->sid, &srf);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c
index a3357ff7540d..a6ea75b58a83 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c
@@ -266,7 +266,9 @@ static bool __vmw_piter_non_sg_next(struct vmw_piter *viter)
 
 static bool __vmw_piter_sg_next(struct vmw_piter *viter)
 {
-        return __sg_page_iter_next(&viter->iter);
+        bool ret = __vmw_piter_non_sg_next(viter);
+
+        return __sg_page_iter_dma_next(&viter->iter) && ret;
 }
 
 
@@ -284,12 +286,6 @@ static struct page *__vmw_piter_non_sg_page(struct vmw_piter *viter)
         return viter->pages[viter->i];
 }
 
-static struct page *__vmw_piter_sg_page(struct vmw_piter *viter)
-{
-        return sg_page_iter_page(&viter->iter);
-}
-
-
 /**
  * Helper functions to return the DMA address of the current page.
  *
@@ -311,13 +307,7 @@ static dma_addr_t __vmw_piter_dma_addr(struct vmw_piter *viter)
 
 static dma_addr_t __vmw_piter_sg_addr(struct vmw_piter *viter)
 {
-        /*
-         * FIXME: This driver wrongly mixes DMA and CPU SG list iteration and
-         * needs revision. See
-         * https://lore.kernel.org/lkml/20190104223531.GA1705@ziepe.ca/
-         */
-        return sg_page_iter_dma_address(
-                container_of(&viter->iter, struct sg_dma_page_iter, base));
+        return sg_page_iter_dma_address(&viter->iter);
 }
 
 
@@ -336,26 +326,23 @@ void vmw_piter_start(struct vmw_piter *viter, const struct vmw_sg_table *vsgt,
 {
         viter->i = p_offset - 1;
         viter->num_pages = vsgt->num_pages;
+        viter->page = &__vmw_piter_non_sg_page;
+        viter->pages = vsgt->pages;
         switch (vsgt->mode) {
         case vmw_dma_phys:
                 viter->next = &__vmw_piter_non_sg_next;
                 viter->dma_address = &__vmw_piter_phys_addr;
-                viter->page = &__vmw_piter_non_sg_page;
-                viter->pages = vsgt->pages;
                 break;
         case vmw_dma_alloc_coherent:
                 viter->next = &__vmw_piter_non_sg_next;
                 viter->dma_address = &__vmw_piter_dma_addr;
-                viter->page = &__vmw_piter_non_sg_page;
                 viter->addrs = vsgt->addrs;
-                viter->pages = vsgt->pages;
                 break;
         case vmw_dma_map_populate:
         case vmw_dma_map_bind:
                 viter->next = &__vmw_piter_sg_next;
                 viter->dma_address = &__vmw_piter_sg_addr;
-                viter->page = &__vmw_piter_sg_page;
-                __sg_page_iter_start(&viter->iter, vsgt->sgt->sgl,
+                __sg_page_iter_start(&viter->iter.base, vsgt->sgt->sgl,
                                      vsgt->sgt->orig_nents, p_offset);
                 break;
         default: