Linux v5.5.9

5 files changed, 583 insertions, 128 deletions

diff --git a/0003-Make-get_cert_list-use-efi_status_to_str-to-print-er.patch b/0003-Make-get_cert_list-use-efi_status_to_str-to-print-er.patch
index ec107ba09..d1e43ed3f 100644
--- a/0003-Make-get_cert_list-use-efi_status_to_str-to-print-er.patch
+++ b/0003-Make-get_cert_list-use-efi_status_to_str-to-print-er.patch
@@ -1,38 +1,39 @@
-From 520e902d864930e2d4f329983d9ae9781a24231f Mon Sep 17 00:00:00 2001
+From 46daeedffe98b489014dcdcf14c89438362de7eb Mon Sep 17 00:00:00 2001
 From: Peter Jones <pjones@redhat.com>
 Date: Mon, 2 Oct 2017 18:18:30 -0400
-Subject: [PATCH 3/3] Make get_cert_list() use efi_status_to_str() to print
- error messages.
+Subject: [PATCH] Make get_cert_list() use efi_status_to_str() to print error
+ messages.
 
 Signed-off-by: Peter Jones <pjones@redhat.com>
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
 ---
  security/integrity/platform_certs/load_uefi.c | 6 ++++--
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
-index 9ef34c44fd1..13a2826715d 100644
+index f0c908241966..4e783f6c6cfb 100644
 --- a/security/integrity/platform_certs/load_uefi.c
 +++ b/security/integrity/platform_certs/load_uefi.c
-@@ -51,7 +51,8 @@ static __init int get_cert_list(efi_char16_t *name, efi_guid_t *guid,
- 	}
+@@ -46,7 +46,8 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
+ 		return NULL;
  
- 	if (status != EFI_BUFFER_TOO_SMALL) {
--		pr_err("Couldn't get size: 0x%lx\n", status);
+ 	if (*status != EFI_BUFFER_TOO_SMALL) {
+-		pr_err("Couldn't get size: 0x%lx\n", *status);
 +		pr_err("Couldn't get size: %s (0x%lx)\n",
-+		       efi_status_to_str(status), status);
- 		return efi_status_to_err(status);
++		       efi_status_to_str(*status), *status);
+ 		return NULL;
  	}
  
-@@ -64,7 +65,8 @@ static __init int get_cert_list(efi_char16_t *name, efi_guid_t *guid,
- 	status = efi.get_variable(name, guid, NULL, &lsize, db);
- 	if (status != EFI_SUCCESS) {
+@@ -57,7 +58,8 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
+ 	*status = efi.get_variable(name, guid, NULL, &lsize, db);
+ 	if (*status != EFI_SUCCESS) {
  		kfree(db);
--		pr_err("Error reading db var: 0x%lx\n", status);
+-		pr_err("Error reading db var: 0x%lx\n", *status);
 +		pr_err("Error reading db var: %s (0x%lx)\n",
-+		       efi_status_to_str(status), status);
- 		return efi_status_to_err(status);
++		       efi_status_to_str(*status), *status);
+ 		return NULL;
  	}
  
 -- 
-2.15.0
+2.24.1
 
diff --git a/20200310_chris_chris_wilson_co_uk.patch b/20200310_chris_chris_wilson_co_uk.patch
new file mode 100644
index 000000000..9b2dad2ed
--- /dev/null
+++ b/20200310_chris_chris_wilson_co_uk.patch
@@ -0,0 +1,559 @@
+From MAILER-DAEMON Thu Mar 12 13:30:18 2020
+From: Chris Wilson <chris@chris-wilson.co.uk>
+To: stable@vger.kernel.org
+Cc: Chris Wilson <chris@chris-wilson.co.uk>, Tvrtko Ursulin <tvrtko.ursulin@intel.com>, Jani Nikula <jani.nikula@intel.com>
+Subject: [PATCH 1/5] drm/i915: Check activity on i915_vma after confirming pin_count==0
+Date: Tue, 10 Mar 2020 20:40:42 +0000
+Message-Id: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+Sender: stable-owner@vger.kernel.org
+List-ID: <stable.vger.kernel.org>
+X-Mailing-List: stable@vger.kernel.org
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+Only assert that the i915_vma is now idle if and only if no other pins
+are present. If another user has the i915_vma pinned, they may submit
+more work to the i915_vma skipping the vm->mutex used to serialise the
+unbind. We need to wait again, if we want to continue and unbind this
+vma.
+
+However, if we own the i915_vma (we hold the vm->mutex for the unbind
+and the pin_count is 0), we can assert that the vma remains idle as we
+unbind.
+
+Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
+Closes: https://gitlab.freedesktop.org/drm/intel/issues/530
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200123224459.38128-1-chris@chris-wilson.co.uk
+(cherry picked from commit 60e94557fff1f5514c7fc4da7ddc2c7a13ffff26)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit e4edd4fcbf4daf9d4319bef0bfaf350cb672239a)
+---
+ drivers/gpu/drm/i915/i915_vma.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
+index 01c822256b39..7c7e152cc5ff 100644
+--- a/drivers/gpu/drm/i915/i915_vma.c
++++ b/drivers/gpu/drm/i915/i915_vma.c
+@@ -1149,16 +1149,26 @@ int __i915_vma_unbind(struct i915_vma *vma)
+ 	if (ret)
+ 		return ret;
+ 
+-	GEM_BUG_ON(i915_vma_is_active(vma));
+ 	if (i915_vma_is_pinned(vma)) {
+ 		vma_print_allocator(vma, "is pinned");
+ 		return -EBUSY;
+ 	}
+ 
+-	GEM_BUG_ON(i915_vma_is_active(vma));
++	/*
++	 * After confirming that no one else is pinning this vma, wait for
++	 * any laggards who may have crept in during the wait (through
++	 * a residual pin skipping the vm->mutex) to complete.
++	 */
++	ret = i915_vma_sync(vma);
++	if (ret)
++		return ret;
++
+ 	if (!drm_mm_node_allocated(&vma->node))
+ 		return 0;
+ 
++	GEM_BUG_ON(i915_vma_is_pinned(vma));
++	GEM_BUG_ON(i915_vma_is_active(vma));
++
+ 	if (i915_vma_is_map_and_fenceable(vma)) {
+ 		/*
+ 		 * Check that we have flushed all writes through the GGTT
+-- 
+2.25.1
+
+
+From MAILER-DAEMON Thu Mar 12 13:30:18 2020
+From: Chris Wilson <chris@chris-wilson.co.uk>
+To: stable@vger.kernel.org
+Cc: Chris Wilson <chris@chris-wilson.co.uk>, Matthew Auld <matthew.auld@intel.com>
+Subject: [PATCH 2/5] drm/i915/gem: Avoid parking the vma as we unbind
+Date: Tue, 10 Mar 2020 20:40:43 +0000
+Message-Id: <20200310204046.3995087-2-chris@chris-wilson.co.uk>
+In-Reply-To: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+References: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+Sender: stable-owner@vger.kernel.org
+List-ID: <stable.vger.kernel.org>
+X-Mailing-List: stable@vger.kernel.org
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+In order to avoid keeping a reference on the i915_vma (which is long
+overdue!) we have to coordinate all the possible lifetimes and only use
+the vma while we know it is alive. In this episode, we are reminded that
+while idle, the closed vma are destroyed. So if the GT idles while we are
+working with the vma, the vma itself becomes invalid.
+
+First class i915_vma here we come, but in the meantime keep piling on
+the straw.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191203155032.3137263-1-chris@chris-wilson.co.uk
+(cherry picked from commit cb6c3d45f948f8f184687a23fea30017d01e892f)
+---
+ drivers/gpu/drm/i915/i915_gem.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 3f07948ea4da..f7c52b437f6a 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -128,18 +128,33 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj,
+ 						       struct i915_vma,
+ 						       obj_link))) {
+ 		struct i915_address_space *vm = vma->vm;
++		bool awake = false;
+ 
+-		ret = -EBUSY;
++		ret = -EAGAIN;
+ 		if (!i915_vm_tryopen(vm))
+ 			break;
+ 
++		/* Prevent vma being freed by i915_vma_parked as we unbind */
++		if (intel_gt_pm_get_if_awake(vm->gt)) {
++			awake = true;
++		} else {
++			if (i915_vma_is_closed(vma)) {
++				spin_unlock(&obj->vma.lock);
++				goto err_vm;
++			}
++		}
++
+ 		list_move_tail(&vma->obj_link, &still_in_list);
+ 		spin_unlock(&obj->vma.lock);
+ 
++		ret = -EBUSY;
+ 		if (flags & I915_GEM_OBJECT_UNBIND_ACTIVE ||
+ 		    !i915_vma_is_active(vma))
+ 			ret = i915_vma_unbind(vma);
+ 
++		if (awake)
++			intel_gt_pm_put(vm->gt);
++err_vm:
+ 		i915_vm_close(vm);
+ 		spin_lock(&obj->vma.lock);
+ 	}
+-- 
+2.25.1
+
+
+From MAILER-DAEMON Thu Mar 12 13:30:18 2020
+From: Chris Wilson <chris@chris-wilson.co.uk>
+To: stable@vger.kernel.org
+Cc: Chris Wilson <chris@chris-wilson.co.uk>, Imre Deak <imre.deak@intel.com>
+Subject: [PATCH 3/5] drm/i915: Add a simple is-bound check before unbinding
+Date: Tue, 10 Mar 2020 20:40:44 +0000
+Message-Id: <20200310204046.3995087-3-chris@chris-wilson.co.uk>
+In-Reply-To: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+References: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+Sender: stable-owner@vger.kernel.org
+List-ID: <stable.vger.kernel.org>
+X-Mailing-List: stable@vger.kernel.org
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+Only acquire the various atomic references required to unbind the vma if
+we do need to unbind the vma.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Acked-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191222210256.2066451-1-chris@chris-wilson.co.uk
+(cherry picked from commit f5af1659d809e264d619e5f483fd8f47bced3b6a)
+---
+ drivers/gpu/drm/i915/i915_gem.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index f7c52b437f6a..998b67e3466e 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -130,6 +130,10 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj,
+ 		struct i915_address_space *vm = vma->vm;
+ 		bool awake = false;
+ 
++		list_move_tail(&vma->obj_link, &still_in_list);
++		if (!i915_vma_is_bound(vma, I915_VMA_BIND_MASK))
++			continue;
++
+ 		ret = -EAGAIN;
+ 		if (!i915_vm_tryopen(vm))
+ 			break;
+@@ -144,7 +148,6 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj,
+ 			}
+ 		}
+ 
+-		list_move_tail(&vma->obj_link, &still_in_list);
+ 		spin_unlock(&obj->vma.lock);
+ 
+ 		ret = -EBUSY;
+-- 
+2.25.1
+
+
+From MAILER-DAEMON Thu Mar 12 13:30:18 2020
+From: Chris Wilson <chris@chris-wilson.co.uk>
+To: stable@vger.kernel.org
+Cc: Chris Wilson <chris@chris-wilson.co.uk>, Imre Deak <imre.deak@intel.com>
+Subject: [PATCH 4/5] drm/i915: Introduce a vma.kref
+Date: Tue, 10 Mar 2020 20:40:45 +0000
+Message-Id: <20200310204046.3995087-4-chris@chris-wilson.co.uk>
+In-Reply-To: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+References: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+Sender: stable-owner@vger.kernel.org
+List-ID: <stable.vger.kernel.org>
+X-Mailing-List: stable@vger.kernel.org
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+Start introducing a kref on i915_vma in order to protect the vma unbind
+(i915_gem_object_unbind) from a parallel destruction (i915_vma_parked).
+Later, we will use the refcount to manage all access and turn i915_vma
+into a first class container.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Imre Deak <imre.deak@intel.com>
+Acked-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191222210256.2066451-2-chris@chris-wilson.co.uk
+(cherry picked from commit 76f9764cc3d538435262dea885bf69fac2415402)
+---
+ drivers/gpu/drm/i915/gem/i915_gem_object.c    |  2 +-
+ .../gpu/drm/i915/gem/selftests/huge_pages.c   |  3 +--
+ .../drm/i915/gem/selftests/i915_gem_mman.c    |  4 +--
+ drivers/gpu/drm/i915/i915_gem.c               | 26 +++++++------------
+ drivers/gpu/drm/i915/i915_gem_gtt.c           |  5 ++--
+ drivers/gpu/drm/i915/i915_vma.c               |  9 ++++---
+ drivers/gpu/drm/i915/i915_vma.h               | 25 +++++++++++++++---
+ 7 files changed, 44 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.c b/drivers/gpu/drm/i915/gem/i915_gem_object.c
+index a596548c07bf..b6937469ffd3 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_object.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_object.c
+@@ -174,7 +174,7 @@ static void __i915_gem_free_objects(struct drm_i915_private *i915,
+ 				GEM_BUG_ON(vma->obj != obj);
+ 				spin_unlock(&obj->vma.lock);
+ 
+-				i915_vma_destroy(vma);
++				__i915_vma_put(vma);
+ 
+ 				spin_lock(&obj->vma.lock);
+ 			}
+diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
+index 688c49a24f32..bd1e2c12de63 100644
+--- a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
++++ b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
+@@ -1110,8 +1110,7 @@ static int __igt_write_huge(struct intel_context *ce,
+ out_vma_unpin:
+ 	i915_vma_unpin(vma);
+ out_vma_close:
+-	i915_vma_destroy(vma);
+-
++	__i915_vma_put(vma);
+ 	return err;
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c
+index 29b2077b73d2..d226e55df8b2 100644
+--- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c
++++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c
+@@ -161,7 +161,7 @@ static int check_partial_mapping(struct drm_i915_gem_object *obj,
+ 	kunmap(p);
+ 
+ out:
+-	i915_vma_destroy(vma);
++	__i915_vma_put(vma);
+ 	return err;
+ }
+ 
+@@ -255,7 +255,7 @@ static int check_partial_mappings(struct drm_i915_gem_object *obj,
+ 		if (err)
+ 			return err;
+ 
+-		i915_vma_destroy(vma);
++		__i915_vma_put(vma);
+ 
+ 		if (igt_timeout(end_time,
+ 				"%s: timed out after tiling=%d stride=%d\n",
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 998b67e3466e..67a8e7408e67 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -128,7 +128,6 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj,
+ 						       struct i915_vma,
+ 						       obj_link))) {
+ 		struct i915_address_space *vm = vma->vm;
+-		bool awake = false;
+ 
+ 		list_move_tail(&vma->obj_link, &still_in_list);
+ 		if (!i915_vma_is_bound(vma, I915_VMA_BIND_MASK))
+@@ -139,25 +138,18 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj,
+ 			break;
+ 
+ 		/* Prevent vma being freed by i915_vma_parked as we unbind */
+-		if (intel_gt_pm_get_if_awake(vm->gt)) {
+-			awake = true;
+-		} else {
+-			if (i915_vma_is_closed(vma)) {
+-				spin_unlock(&obj->vma.lock);
+-				goto err_vm;
+-			}
+-		}
+-
++		vma = __i915_vma_get(vma);
+ 		spin_unlock(&obj->vma.lock);
+ 
+-		ret = -EBUSY;
+-		if (flags & I915_GEM_OBJECT_UNBIND_ACTIVE ||
+-		    !i915_vma_is_active(vma))
+-			ret = i915_vma_unbind(vma);
++		if (vma) {
++			ret = -EBUSY;
++			if (flags & I915_GEM_OBJECT_UNBIND_ACTIVE ||
++			    !i915_vma_is_active(vma))
++				ret = i915_vma_unbind(vma);
++
++			__i915_vma_put(vma);
++		}
+ 
+-		if (awake)
+-			intel_gt_pm_put(vm->gt);
+-err_vm:
+ 		i915_vm_close(vm);
+ 		spin_lock(&obj->vma.lock);
+ 	}
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index 44727806dfd7..dd2c20f7d4d2 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -522,7 +522,7 @@ void __i915_vm_close(struct i915_address_space *vm)
+ 
+ 		atomic_and(~I915_VMA_PIN_MASK, &vma->flags);
+ 		WARN_ON(__i915_vma_unbind(vma));
+-		i915_vma_destroy(vma);
++		__i915_vma_put(vma);
+ 
+ 		i915_gem_object_put(obj);
+ 	}
+@@ -1790,7 +1790,7 @@ static void gen6_ppgtt_cleanup(struct i915_address_space *vm)
+ {
+ 	struct gen6_ppgtt *ppgtt = to_gen6_ppgtt(i915_vm_to_ppgtt(vm));
+ 
+-	i915_vma_destroy(ppgtt->vma);
++	__i915_vma_put(ppgtt->vma);
+ 
+ 	gen6_ppgtt_free_pd(ppgtt);
+ 	free_scratch(vm);
+@@ -1878,6 +1878,7 @@ static struct i915_vma *pd_vma_create(struct gen6_ppgtt *ppgtt, int size)
+ 
+ 	i915_active_init(&vma->active, NULL, NULL);
+ 
++	kref_init(&vma->ref);
+ 	mutex_init(&vma->pages_mutex);
+ 	vma->vm = i915_vm_get(&ggtt->vm);
+ 	vma->ops = &pd_vma_ops;
+diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
+index 7c7e152cc5ff..5309872442bc 100644
+--- a/drivers/gpu/drm/i915/i915_vma.c
++++ b/drivers/gpu/drm/i915/i915_vma.c
+@@ -112,6 +112,7 @@ vma_create(struct drm_i915_gem_object *obj,
+ 	if (vma == NULL)
+ 		return ERR_PTR(-ENOMEM);
+ 
++	kref_init(&vma->ref);
+ 	mutex_init(&vma->pages_mutex);
+ 	vma->vm = i915_vm_get(vm);
+ 	vma->ops = &vm->vma_ops;
+@@ -978,8 +979,10 @@ void i915_vma_reopen(struct i915_vma *vma)
+ 		__i915_vma_remove_closed(vma);
+ }
+ 
+-void i915_vma_destroy(struct i915_vma *vma)
++void i915_vma_release(struct kref *ref)
+ {
++	struct i915_vma *vma = container_of(ref, typeof(*vma), ref);
++
+ 	if (drm_mm_node_allocated(&vma->node)) {
+ 		mutex_lock(&vma->vm->mutex);
+ 		atomic_and(~I915_VMA_PIN_MASK, &vma->flags);
+@@ -1027,7 +1030,7 @@ void i915_vma_parked(struct intel_gt *gt)
+ 		spin_unlock_irq(&gt->closed_lock);
+ 
+ 		if (obj) {
+-			i915_vma_destroy(vma);
++			__i915_vma_put(vma);
+ 			i915_gem_object_put(obj);
+ 		}
+ 
+@@ -1202,7 +1205,7 @@ int __i915_vma_unbind(struct i915_vma *vma)
+ 	i915_vma_detach(vma);
+ 	vma_unbind_pages(vma);
+ 
+-	drm_mm_remove_node(&vma->node); /* pairs with i915_vma_destroy() */
++	drm_mm_remove_node(&vma->node); /* pairs with i915_vma_release() */
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/i915_vma.h b/drivers/gpu/drm/i915/i915_vma.h
+index 465932813bc5..ce1db908ad69 100644
+--- a/drivers/gpu/drm/i915/i915_vma.h
++++ b/drivers/gpu/drm/i915/i915_vma.h
+@@ -51,14 +51,19 @@ enum i915_cache_level;
+  */
+ struct i915_vma {
+ 	struct drm_mm_node node;
+-	struct drm_i915_gem_object *obj;
++
+ 	struct i915_address_space *vm;
+ 	const struct i915_vma_ops *ops;
+-	struct i915_fence_reg *fence;
++
++	struct drm_i915_gem_object *obj;
+ 	struct dma_resv *resv; /** Alias of obj->resv */
++
+ 	struct sg_table *pages;
+ 	void __iomem *iomap;
+ 	void *private; /* owned by creator */
++
++	struct i915_fence_reg *fence;
++
+ 	u64 size;
+ 	u64 display_alignment;
+ 	struct i915_page_sizes page_sizes;
+@@ -71,6 +76,7 @@ struct i915_vma {
+ 	 * handles (but same file) for execbuf, i.e. the number of aliases
+ 	 * that exist in the ctx->handle_vmas LUT for this vma.
+ 	 */
++	struct kref ref;
+ 	atomic_t open_count;
+ 	atomic_t flags;
+ 	/**
+@@ -333,7 +339,20 @@ int __must_check i915_vma_unbind(struct i915_vma *vma);
+ void i915_vma_unlink_ctx(struct i915_vma *vma);
+ void i915_vma_close(struct i915_vma *vma);
+ void i915_vma_reopen(struct i915_vma *vma);
+-void i915_vma_destroy(struct i915_vma *vma);
++
++static inline struct i915_vma *__i915_vma_get(struct i915_vma *vma)
++{
++	if (kref_get_unless_zero(&vma->ref))
++		return vma;
++
++	return NULL;
++}
++
++void i915_vma_release(struct kref *ref);
++static inline void __i915_vma_put(struct i915_vma *vma)
++{
++	kref_put(&vma->ref, i915_vma_release);
++}
+ 
+ #define assert_vma_held(vma) dma_resv_assert_held((vma)->resv)
+ 
+-- 
+2.25.1
+
+
+From MAILER-DAEMON Thu Mar 12 13:30:18 2020
+From: Chris Wilson <chris@chris-wilson.co.uk>
+To: stable@vger.kernel.org
+Cc: Chris Wilson <chris@chris-wilson.co.uk>, Kenneth Graunke <kenneth@whitecape.org>, Tvrtko Ursulin <tvrtko.ursulin@intel.com>, Matthew Auld <matthew.auld@intel.com>
+Subject: [PATCH 5/5] drm/i915: Serialise i915_active_acquire() with __active_retire()
+Date: Tue, 10 Mar 2020 20:40:46 +0000
+Message-Id: <20200310204046.3995087-5-chris@chris-wilson.co.uk>
+In-Reply-To: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+References: <20200310204046.3995087-1-chris@chris-wilson.co.uk>
+Sender: stable-owner@vger.kernel.org
+List-ID: <stable.vger.kernel.org>
+X-Mailing-List: stable@vger.kernel.org
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+As __active_retire() does it's final atomic_dec() under the
+ref->tree_lock spinlock, in order to prevent ourselves from reusing the
+ref->cache and ref->tree as they are being destroyed, we need to
+serialise with the retirement during i915_active_acquire().
+
+[  +0.000005] kernel BUG at drivers/gpu/drm/i915/i915_active.c:157!
+[  +0.000011] invalid opcode: 0000 [#1] SMP
+[  +0.000004] CPU: 7 PID: 188 Comm: kworker/u16:4 Not tainted 5.4.0-rc8-03070-gac5e57322614 #89
+[  +0.000002] Hardware name: Razer Razer Blade Stealth 13 Late 2019/LY320, BIOS 1.02 09/10/2019
+[  +0.000082] Workqueue: events_unbound active_work [i915]
+[  +0.000059] RIP: 0010:__active_retire+0x115/0x120 [i915]
+[  +0.000003] Code: 75 28 48 8b 3d 8c 6e 1a 00 48 89 ee e8 e4 5f a5 c0 48 8b 44 24 10 65 48 33 04 25 28 00 00 00 75 0f 48 83 c4 18 5b 5d 41 5c c3 <0f> 0b 0f 0b 0f 0b e8 a0 90 87 c0 0f 1f 44 00 00 48 8b 3d 54 6e 1a
+[  +0.000002] RSP: 0018:ffffb833003f7e48 EFLAGS: 00010286
+[  +0.000003] RAX: ffff8d6e8d726d00 RBX: ffff8d6f9db4e840 RCX: 0000000000000000
+[  +0.000001] RDX: ffffffff82605930 RSI: ffff8d6f9adc4908 RDI: ffff8d6e96cefe28
+[  +0.000002] RBP: ffff8d6e96cefe00 R08: 0000000000000000 R09: ffff8d6f9ffe9a50
+[  +0.000002] R10: 0000000000000048 R11: 0000000000000018 R12: ffff8d6f9adc4930
+[  +0.000001] R13: ffff8d6f9e04fb00 R14: 0000000000000000 R15: ffff8d6f9adc4988
+[  +0.000002] FS:  0000000000000000(0000) GS:ffff8d6f9ffc0000(0000) knlGS:0000000000000000
+[  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  +0.000002] CR2: 000055eb5a34cf10 CR3: 000000018d609002 CR4: 0000000000760ee0
+[  +0.000002] PKRU: 55555554
+[  +0.000001] Call Trace:
+[  +0.000010]  process_one_work+0x1aa/0x350
+[  +0.000004]  worker_thread+0x4d/0x3a0
+[  +0.000004]  kthread+0xfb/0x130
+[  +0.000004]  ? process_one_work+0x350/0x350
+[  +0.000003]  ? kthread_park+0x90/0x90
+[  +0.000005]  ret_from_fork+0x1f/0x40
+
+Reported-by: Kenneth Graunke <kenneth@whitecape.org>
+Fixes: c9ad602feabe ("drm/i915: Split i915_active.mutex into an irq-safe spinlock for the rbtree")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Kenneth Graunke <kenneth@whitecape.org>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Tested-by: Kenneth Graunke <kenneth@whitecape.org>
+Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191205183332.801237-1-chris@chris-wilson.co.uk
+(cherry picked from commit bbca083de291a03ffe1a1eb0832a0d74f8b64898)
+---
+ drivers/gpu/drm/i915/i915_active.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
+index a19e7d89bc8a..378b52d1ab74 100644
+--- a/drivers/gpu/drm/i915/i915_active.c
++++ b/drivers/gpu/drm/i915/i915_active.c
+@@ -91,10 +91,9 @@ static void debug_active_init(struct i915_active *ref)
+ 
+ static void debug_active_activate(struct i915_active *ref)
+ {
+-	spin_lock_irq(&ref->tree_lock);
++	lockdep_assert_held(&ref->tree_lock);
+ 	if (!atomic_read(&ref->count)) /* before the first inc */
+ 		debug_object_activate(ref, &active_debug_desc);
+-	spin_unlock_irq(&ref->tree_lock);
+ }
+ 
+ static void debug_active_deactivate(struct i915_active *ref)
+@@ -407,8 +406,10 @@ int i915_active_acquire(struct i915_active *ref)
+ 	if (!atomic_read(&ref->count) && ref->active)
+ 		err = ref->active(ref);
+ 	if (!err) {
++		spin_lock_irq(&ref->tree_lock); /* vs __active_retire() */
+ 		debug_active_activate(ref);
+ 		atomic_inc(&ref->count);
++		spin_unlock_irq(&ref->tree_lock);
+ 	}
+ 
+ 	mutex_unlock(&ref->mutex);
+-- 
+2.25.1
+
+
diff --git a/alsa-5.6.patch b/alsa-5.6.patch
index 27774175a..b33725784 100644
--- a/alsa-5.6.patch
+++ b/alsa-5.6.patch
@@ -1,76 +1,3 @@
-From 4ef91c45a5a283dc8899402bc68adfe0aa9a026d Mon Sep 17 00:00:00 2001
-From: Jaroslav Kysela <perex@perex.cz>
-Date: Wed, 4 Dec 2019 15:15:44 -0600
-Subject: [PATCH 1/4] ASoC: intel/skl/hda - export number of digital
- microphones via control components
-
-It is required for the auto-detection in the user space (for UCM).
-
-Signed-off-by: Jaroslav Kysela <perex@perex.cz>
-Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
-Cc: Mark Brown <broonie@kernel.org>
-Link: https://lore.kernel.org/r/20191204211556.12671-2-pierre-louis.bossart@linux.intel.com
-Signed-off-by: Mark Brown <broonie@kernel.org>
-
-Signed-off-by: Jaroslav Kysela <jkysela@redhat.com>
-(cherry picked from commit 8cd9956f61c65022209ce6d1e55ed12aea12357d)
-Bugzilla: 1772498
----
- sound/soc/intel/boards/skl_hda_dsp_generic.c | 8 ++++++++
- sound/soc/sof/intel/hda.c                    | 3 ++-
- 2 files changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c
-index 4e45901e3a2f..11eaee9ae41f 100644
---- a/sound/soc/intel/boards/skl_hda_dsp_generic.c
-+++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c
-@@ -100,6 +100,8 @@ static struct snd_soc_card hda_soc_card = {
- 	.late_probe = skl_hda_card_late_probe,
- };
- 
-+static char hda_soc_components[30];
-+
- #define IDISP_DAI_COUNT		3
- #define HDAC_DAI_COUNT		2
- #define DMIC_DAI_COUNT		2
-@@ -183,6 +185,12 @@ static int skl_hda_audio_probe(struct platform_device *pdev)
- 	hda_soc_card.dev = &pdev->dev;
- 	snd_soc_card_set_drvdata(&hda_soc_card, ctx);
- 
-+	if (mach->mach_params.dmic_num > 0) {
-+		snprintf(hda_soc_components, sizeof(hda_soc_components),
-+				"cfg-dmics:%d", mach->mach_params.dmic_num);
-+		hda_soc_card.components = hda_soc_components;
-+	}
-+
- 	return devm_snd_soc_register_card(&pdev->dev, &hda_soc_card);
- }
- 
-diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
-index 91bd88fddac7..eea01f75d23d 100644
---- a/sound/soc/sof/intel/hda.c
-+++ b/sound/soc/sof/intel/hda.c
-@@ -351,7 +351,7 @@ static int hda_init_caps(struct snd_sof_dev *sdev)
- 	const char *tplg_filename;
- 	const char *idisp_str;
- 	const char *dmic_str;
--	int dmic_num;
-+	int dmic_num = 0;
- 	int codec_num = 0;
- 	int i;
- #endif
-@@ -472,6 +472,7 @@ static int hda_init_caps(struct snd_sof_dev *sdev)
- 		mach_params->codec_mask = bus->codec_mask;
- 		mach_params->platform = dev_name(sdev->dev);
- 		mach_params->common_hdmi_codec_drv = hda_codec_use_common_hdmi;
-+		mach_params->dmic_num = dmic_num;
- 	}
- 
- 	/* create codec instances */
--- 
-2.20.1
-
-
 From 89be5f69889f7e9aeab05279869bba3e9e0d2002 Mon Sep 17 00:00:00 2001
 From: Jaroslav Kysela <perex@perex.cz>
 Date: Wed, 4 Dec 2019 15:15:45 -0600
@@ -395,41 +322,6 @@ index 9f4f8868b386..58ff4766b47b 100644
 2.24.1
 
 
-From c37c0ab029569a75fd180edb03d411e7a28a936f Mon Sep 17 00:00:00 2001
-From: Hui Wang <hui.wang@canonical.com>
-Date: Wed, 19 Feb 2020 13:23:06 +0800
-Subject: [PATCH] ALSA: hda/realtek - Fix a regression for mute led on Lenovo
- Carbon X1
-
-Need to chain the THINKPAD_ACPI, otherwise the mute led will not
-work.
-
-Fixes: d2cd795c4ece ("ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen")
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Hui Wang <hui.wang@canonical.com>
-Link: https://lore.kernel.org/r/20200219052306.24935-1-hui.wang@canonical.com
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/pci/hda/patch_realtek.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 477589e7ec1d..31bee0512334 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -6684,6 +6684,8 @@ static const struct hda_fixup alc269_fixups[] = {
- 	[ALC285_FIXUP_SPEAKER2_TO_DAC1] = {
- 		.type = HDA_FIXUP_FUNC,
- 		.v.func = alc285_fixup_speaker2_to_dac1,
-+		.chained = true,
-+		.chain_id = ALC269_FIXUP_THINKPAD_ACPI
- 	},
- 	[ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
- 		.type = HDA_FIXUP_PINS,
--- 
-2.24.1
-
-
 From af7aae1b1f6306a1cda4da393e920a1334eaa3d4 Mon Sep 17 00:00:00 2001
 From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
 Date: Thu, 6 Feb 2020 22:02:23 +0200
diff --git a/kernel.spec b/kernel.spec
index da3ad0e3b..d0b397ce1 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -56,7 +56,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 8
+%define stable_update 9
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -498,7 +498,6 @@ Source5000: patch-5.%{base_sublevel}-git%{gitrev}.xz
 # 200 - x86 / secureboot
 
 # bz 1497559 - Make kernel MODSIGN code not error on missing variables
-Patch200: 0001-Make-get_cert_list-not-complain-about-cert-lists-tha.patch
 Patch201: 0002-Add-efi_status_to_str-and-rework-efi_status_to_err.patch
 Patch202: 0003-Make-get_cert_list-use-efi_status_to_str-to-print-er.patch
 
@@ -564,7 +563,7 @@ Patch505: ARM-fix-__get_user_check-in-case-uaccess_-calls-are-not-inlined.patch
 Patch506: alsa-5.6.patch
 
 # i915 "critical" patch from upstream
-Patch508: 0001-drm-i915-Serialise-i915_active_acquire-with-__active.patch
+Patch508: 20200310_chris_chris_wilson_co_uk.patch
 
 # Backport vboxsf from 5.6, can be dropped when we move to 5.6
 Patch510: 0001-fs-Add-VirtualBox-guest-shared-folder-vboxsf-support.patch
@@ -1816,6 +1815,9 @@ fi
 #
 #
 %changelog
+* Thu Mar 12 2020 Justin M. Forbes <jforbes@fedoraproject.org> - 5.5.9-100
+- Linux v5.5.9
+
 * Mon Mar 09 2020 Hans de Goede <hdegoede@redhat.com>
 - Fix backtraces on various buggy BIOS-es (rhbz 1564895, 1808874)
 
diff --git a/sources b/sources
index 1cffcabc9..4d3dad408 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
 SHA512 (linux-5.5.tar.xz) = fa74fdabb5e63384a39e54da05b86a9ae9ea16179524b041fbbdffc7177e80b53600ae98d76be127ba216148f9dc55fe07ab20637e22c6d6030cb4aa09eb2f86
 SHA512 (patch-5.5.8.xz) = 8daaea68d2eaa51966bae5de14c253daf6ae6dd65cf0541e2f94459df99031d3d4355f436d182b2b9cea5fbfee3c053ac2bc91030dfa23a9f4575996528fd508
+SHA512 (patch-5.5.9.xz) = 44f26e7bce86c149fb4ddae20306ae58dead5a4797c268409f12284c695de80bde4a1b8bb1492f51db0f36210543d4a277024481e43acda10c3bb03470bf5270