Home Home > GIT Browse > SLE12-SP3-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-01-11 08:29:48 +0100
committerJiri Slaby <jslaby@suse.cz>2019-01-14 14:28:40 +0100
commitd7fef27dc68ba8520f49d1ad41798d83e70143e2 (patch)
tree9c9bf4a941708f91d5fd68b9c8de72e427c0b1fb
parent7ec49b128ea591dcde4bfce9d72b6c45ca0dcd93 (diff)
- Linux 4.4.169 (bnc#1012382).
- lib/interval_tree_test.c: make test options module parameters (bnc#1012382). - lib/interval_tree_test.c: allow full tree search (bnc#1012382). - lib/rbtree_test.c: make input module parameters (bnc#1012382). - lib/rbtree-test: lower default params (bnc#1012382). - lib/interval_tree_test.c: allow users to limit scope of endpoint (bnc#1012382). - timer/debug: Change /proc/timer_list from 0444 to 0400 (bnc#1012382). - powerpc/boot: Fix random libfdt related build errors (bnc#1012382). - pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11 (bnc#1012382). - aio: fix spectre gadget in lookup_ioctx (bnc#1012382). - MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 (bnc#1012382). - tracing: Fix memory leak in set_trigger_filter() (bnc#1012382). - tracing: Fix memory leak of instance function hash filters (bnc#1012382). - powerpc/msi: Fix NULL pointer access in teardown code (bnc#1012382). - mac80211_hwsim: fix module init error paths for netlink (bnc#1012382). - scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset (bnc#1012382). - scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload (bnc#1012382). - x86/earlyprintk/efi: Fix infinite loop on some screen widths (bnc#1012382). - drm/msm: Grab a vblank reference when waiting for commit_done (bnc#1012382). - ARC: io.h: Implement reads{x}()/writes{x}() (bnc#1012382). - bonding: fix 802.3ad state sent to partner when unbinding slave (bnc#1012382). - sbus: char: add of_node_put() (bnc#1012382). - drivers/sbus/char: add of_node_put() (bnc#1012382). - drivers/tty: add missing of_node_put() (bnc#1012382). - ide: pmac: add of_node_put() (bnc#1012382). - clk: mmp: Off by one in mmp_clk_add() (bnc#1012382). - Input: omap-keypad - fix keyboard debounce configuration (bnc#1012382). - libata: whitelist all SAMSUNG MZ7KM* solid-state disks (bnc#1012382). - mv88e6060: disable hardware level MAC learning (bnc#1012382). - ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling (bnc#1012382). - cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) (bnc#1012382). - i2c: axxia: properly handle master timeout (bnc#1012382). - i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node (bnc#1012382). - rtc: snvs: add a missing write sync (bnc#1012382). - rtc: snvs: Add timeouts to avoid kernel lockups (bnc#1012382). - ALSA: isa/wavefront: prevent some out of bound writes (bnc#1012382). - Refresh patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch.
-rw-r--r--patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch34
-rw-r--r--patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch148
-rw-r--r--patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch70
-rw-r--r--patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch158
-rw-r--r--patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch61
-rw-r--r--patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch69
-rw-r--r--patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch39
-rw-r--r--patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch61
-rw-r--r--patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch42
-rw-r--r--patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch47
-rw-r--r--patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch133
-rw-r--r--patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch50
-rw-r--r--patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch46
-rw-r--r--patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch59
-rw-r--r--patches.kernel.org/4.4.169-014-Revert-drm-rockchip-Allow-driver-to-be-shutdo.patch (renamed from patches.fixes/0001-Revert-drm-rockchip-Allow-driver-to-be-shutdown-on-r.patch)19
-rw-r--r--patches.kernel.org/4.4.169-015-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_con.patch (renamed from patches.fixes/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch)19
-rw-r--r--patches.kernel.org/4.4.169-016-mac80211-don-t-WARN-on-bad-WMM-parameters-fro.patch (renamed from patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy)20
-rw-r--r--patches.kernel.org/4.4.169-017-mac80211-Fix-condition-validating-WMM-IE.patch (renamed from patches.drivers/mac80211-Fix-condition-validating-WMM-IE)20
-rw-r--r--patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch62
-rw-r--r--patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch42
-rw-r--r--patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch58
-rw-r--r--patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch66
-rw-r--r--patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch42
-rw-r--r--patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch146
-rw-r--r--patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch64
-rw-r--r--patches.kernel.org/4.4.169-025-SUNRPC-Fix-a-potential-race-in-xprt_connect.patch (renamed from patches.fixes/SUNRPC-Fix-a-potential-race-in-xprt_connect.patch)17
-rw-r--r--patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch34
-rw-r--r--patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch37
-rw-r--r--patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch36
-rw-r--r--patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch34
-rw-r--r--patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch40
-rw-r--r--patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch70
-rw-r--r--patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch37
-rw-r--r--patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch55
-rw-r--r--patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch77
-rw-r--r--patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch38
-rw-r--r--patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch176
-rw-r--r--patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch75
-rw-r--r--patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch36
-rw-r--r--patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch199
-rw-r--r--patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch57
-rw-r--r--patches.kernel.org/4.4.169-041-Linux-4.4.169.patch27
-rw-r--r--series.conf47
43 files changed, 2606 insertions, 61 deletions
diff --git a/patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch b/patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch
index 632f2fb801..3260451327 100644
--- a/patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch
+++ b/patches.drivers/0085-Replace-asm-uaccess.h-with-linux-uaccess.h-globally.patch
@@ -889,12 +889,6 @@ Signed-off-by: Coly Li <colyli@suse.de>
fs/dcache.c | 2 +-
fs/dcookies.c | 2 +-
fs/dlm/dlm_internal.h | 2 +-
- fs/dmapi/dmapi_config.c | 2 +-
- fs/dmapi/dmapi_event.c | 2 +-
- fs/dmapi/dmapi_register.c | 2 +-
- fs/dmapi/dmapi_right.c | 2 +-
- fs/dmapi/dmapi_session.c | 2 +-
- fs/dmapi/dmapi_sysent.c | 2 +-
fs/efs/efs.h | 2 +-
fs/eventpoll.c | 2 +-
fs/exec.c | 2 +-
@@ -1134,7 +1128,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
sound/oss/swarm_cs4297a.c | 2 +-
sound/sound_firmware.c | 2 +-
virt/kvm/kvm_main.c | 2 +-
- 1115 files changed, 1115 insertions(+), 1115 deletions(-)
+ 1109 files changed, 1109 insertions(+), 1109 deletions(-)
--- a/arch/alpha/boot/misc.c
+++ b/arch/alpha/boot/misc.c
@@ -1336,7 +1330,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
* Error-checking SWP macros implemented using ldrex{b}/strex{b}
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
-@@ -32,7 +32,7 @@
+@@ -33,7 +33,7 @@
#define CREATE_TRACE_POINTS
#include "trace.h"
@@ -1424,7 +1418,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
#include <mach/time.h>
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
-@@ -21,7 +21,7 @@
+@@ -19,7 +19,7 @@
#include <asm/sysreg.h>
#include <asm/system_misc.h>
#include <asm/traps.h>
@@ -3393,7 +3387,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
#define MODULE_VERS "1.0"
--- a/arch/powerpc/kernel/rtasd.c
+++ b/arch/powerpc/kernel/rtasd.c
-@@ -23,7 +23,7 @@
+@@ -22,7 +22,7 @@
#include <linux/workqueue.h>
#include <linux/slab.h>
@@ -3613,7 +3607,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
int len, __wsum sum, int *err_ptr)
--- a/arch/powerpc/lib/code-patching.c
+++ b/arch/powerpc/lib/code-patching.c
-@@ -15,7 +15,7 @@
+@@ -13,7 +13,7 @@
#include <linux/mm.h>
#include <asm/page.h>
#include <asm/code-patching.h>
@@ -6131,7 +6125,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
-@@ -41,7 +41,7 @@
+@@ -40,7 +40,7 @@
#include <linux/thermal.h>
#include <linux/acpi.h>
#include <linux/workqueue.h>
@@ -9739,7 +9733,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
#include <scsi/scsi_tcq.h>
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
-@@ -38,7 +38,7 @@
+@@ -32,7 +32,7 @@
#include <linux/slab.h>
#include <linux/completion.h>
#include <linux/blkdev.h>
@@ -9750,7 +9744,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
-@@ -42,7 +42,7 @@
+@@ -41,7 +41,7 @@
#include <linux/delay.h> /* ssleep prototype */
#include <linux/kthread.h>
#include <linux/semaphore.h>
@@ -10443,8 +10437,8 @@ Signed-off-by: Coly Li <colyli@suse.de>
static struct proc_dir_entry *proc_afs;
--- a/fs/aio.c
+++ b/fs/aio.c
-@@ -42,7 +42,7 @@
- #include <linux/mount.h>
+@@ -43,7 +43,7 @@
+ #include <linux/nospec.h>
#include <asm/kmap_types.h>
-#include <asm/uaccess.h>
@@ -11773,7 +11767,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
-@@ -50,7 +50,7 @@
+@@ -47,7 +47,7 @@
#include <linux/ctype.h>
#include <linux/uio.h>
@@ -11971,7 +11965,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
--- a/mm/memory.c
+++ b/mm/memory.c
-@@ -67,7 +67,7 @@
+@@ -68,7 +68,7 @@
#include <asm/io.h>
#include <asm/mmu_context.h>
#include <asm/pgalloc.h>
@@ -12444,7 +12438,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
#include <net/protocol.h>
--- a/net/core/utils.c
+++ b/net/core/utils.c
-@@ -35,7 +35,7 @@
+@@ -31,7 +31,7 @@
#include <net/net_ratelimit.h>
#include <asm/byteorder.h>
@@ -13280,7 +13274,7 @@ Signed-off-by: Coly Li <colyli@suse.de>
static int do_mod_firmware_load(const char *fn, char **fp)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
-@@ -53,7 +53,7 @@
+@@ -54,7 +54,7 @@
#include <asm/processor.h>
#include <asm/io.h>
#include <asm/ioctl.h>
diff --git a/patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch b/patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch
new file mode 100644
index 0000000000..d4d80c2629
--- /dev/null
+++ b/patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch
@@ -0,0 +1,148 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 10 Jul 2017 15:51:46 -0700
+Subject: [PATCH] lib/interval_tree_test.c: make test options module parameters
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a54dae0338b7f01eb0f9c7571fb9b74f791d1c6b
+
+[ Upstream commit a54dae0338b7f01eb0f9c7571fb9b74f791d1c6b ]
+
+Allows for more flexible debugging.
+
+Link: http://lkml.kernel.org/r/20170518174936.20265-3-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/interval_tree_test.c | 57 ++++++++++++++++++++++++++++------------
+ 1 file changed, 40 insertions(+), 17 deletions(-)
+
+diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
+index 245900b98c8e..1093f0496d5e 100644
+--- a/lib/interval_tree_test.c
++++ b/lib/interval_tree_test.c
+@@ -1,16 +1,25 @@
+ #include <linux/module.h>
++#include <linux/moduleparam.h>
+ #include <linux/interval_tree.h>
+ #include <linux/random.h>
++#include <linux/slab.h>
+ #include <asm/timex.h>
+
+-#define NODES 100
+-#define PERF_LOOPS 100000
+-#define SEARCHES 100
+-#define SEARCH_LOOPS 10000
++#define __param(type, name, init, msg) \
++ static type name = init; \
++ module_param(name, type, 0444); \
++ MODULE_PARM_DESC(name, msg);
++
++__param(int, nnodes, 100, "Number of nodes in the interval tree");
++__param(int, perf_loops, 100000, "Number of iterations modifying the tree");
++
++__param(int, nsearches, 100, "Number of searches to the interval tree");
++__param(int, search_loops, 10000, "Number of iterations searching the tree");
++
+
+ static struct rb_root root = RB_ROOT;
+-static struct interval_tree_node nodes[NODES];
+-static u32 queries[SEARCHES];
++static struct interval_tree_node *nodes = NULL;
++static u32 *queries = NULL;
+
+ static struct rnd_state rnd;
+
+@@ -29,7 +38,8 @@ search(unsigned long query, struct rb_root *root)
+ static void init(void)
+ {
+ int i;
+- for (i = 0; i < NODES; i++) {
++
++ for (i = 0; i < nnodes; i++) {
+ u32 a = prandom_u32_state(&rnd);
+ u32 b = prandom_u32_state(&rnd);
+ if (a <= b) {
+@@ -40,7 +50,7 @@ static void init(void)
+ nodes[i].last = a;
+ }
+ }
+- for (i = 0; i < SEARCHES; i++)
++ for (i = 0; i < nsearches; i++)
+ queries[i] = prandom_u32_state(&rnd);
+ }
+
+@@ -50,6 +60,16 @@ static int interval_tree_test_init(void)
+ unsigned long results;
+ cycles_t time1, time2, time;
+
++ nodes = kmalloc(nnodes * sizeof(struct interval_tree_node), GFP_KERNEL);
++ if (!nodes)
++ return -ENOMEM;
++
++ queries = kmalloc(nsearches * sizeof(int), GFP_KERNEL);
++ if (!queries) {
++ kfree(nodes);
++ return -ENOMEM;
++ }
++
+ printk(KERN_ALERT "interval tree insert/remove");
+
+ prandom_seed_state(&rnd, 3141592653589793238ULL);
+@@ -57,39 +77,42 @@ static int interval_tree_test_init(void)
+
+ time1 = get_cycles();
+
+- for (i = 0; i < PERF_LOOPS; i++) {
+- for (j = 0; j < NODES; j++)
++ for (i = 0; i < perf_loops; i++) {
++ for (j = 0; j < nnodes; j++)
+ interval_tree_insert(nodes + j, &root);
+- for (j = 0; j < NODES; j++)
++ for (j = 0; j < nnodes; j++)
+ interval_tree_remove(nodes + j, &root);
+ }
+
+ time2 = get_cycles();
+ time = time2 - time1;
+
+- time = div_u64(time, PERF_LOOPS);
++ time = div_u64(time, perf_loops);
+ printk(" -> %llu cycles\n", (unsigned long long)time);
+
+ printk(KERN_ALERT "interval tree search");
+
+- for (j = 0; j < NODES; j++)
++ for (j = 0; j < nnodes; j++)
+ interval_tree_insert(nodes + j, &root);
+
+ time1 = get_cycles();
+
+ results = 0;
+- for (i = 0; i < SEARCH_LOOPS; i++)
+- for (j = 0; j < SEARCHES; j++)
++ for (i = 0; i < search_loops; i++)
++ for (j = 0; j < nsearches; j++)
+ results += search(queries[j], &root);
+
+ time2 = get_cycles();
+ time = time2 - time1;
+
+- time = div_u64(time, SEARCH_LOOPS);
+- results = div_u64(results, SEARCH_LOOPS);
++ time = div_u64(time, search_loops);
++ results = div_u64(results, search_loops);
+ printk(" -> %llu cycles (%lu results)\n",
+ (unsigned long long)time, results);
+
++ kfree(queries);
++ kfree(nodes);
++
+ return -EAGAIN; /* Fail will directly unload the module */
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch b/patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch
new file mode 100644
index 0000000000..40fd19957b
--- /dev/null
+++ b/patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch
@@ -0,0 +1,70 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 10 Jul 2017 15:51:52 -0700
+Subject: [PATCH] lib/interval_tree_test.c: allow full tree search
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: c46ecce431ebe6b1a9551d1f530eb432dae5c39b
+
+[ Upstream commit c46ecce431ebe6b1a9551d1f530eb432dae5c39b ]
+
+... such that a user can specify visiting all the nodes in the tree
+(intersects with the world). This is a nice opposite from the very
+basic default query which is a single point.
+
+Link: http://lkml.kernel.org/r/20170518174936.20265-5-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/interval_tree_test.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
+index 1093f0496d5e..409383463879 100644
+--- a/lib/interval_tree_test.c
++++ b/lib/interval_tree_test.c
+@@ -15,6 +15,7 @@ __param(int, perf_loops, 100000, "Number of iterations modifying the tree");
+
+ __param(int, nsearches, 100, "Number of searches to the interval tree");
+ __param(int, search_loops, 10000, "Number of iterations searching the tree");
++__param(bool, search_all, false, "Searches will iterate all nodes in the tree");
+
+
+ static struct rb_root root = RB_ROOT;
+@@ -24,13 +25,13 @@ static u32 *queries = NULL;
+ static struct rnd_state rnd;
+
+ static inline unsigned long
+-search(unsigned long query, struct rb_root *root)
++search(struct rb_root *root, unsigned long start, unsigned long last)
+ {
+ struct interval_tree_node *node;
+ unsigned long results = 0;
+
+- for (node = interval_tree_iter_first(root, query, query); node;
+- node = interval_tree_iter_next(node, query, query))
++ for (node = interval_tree_iter_first(root, start, last); node;
++ node = interval_tree_iter_next(node, start, last))
+ results++;
+ return results;
+ }
+@@ -99,8 +100,12 @@ static int interval_tree_test_init(void)
+
+ results = 0;
+ for (i = 0; i < search_loops; i++)
+- for (j = 0; j < nsearches; j++)
+- results += search(queries[j], &root);
++ for (j = 0; j < nsearches; j++) {
++ unsigned long start = search_all ? 0 : queries[j];
++ unsigned long last = search_all ? max_endpoint : queries[j];
++
++ results += search(&root, start, last);
++ }
+
+ time2 = get_cycles();
+ time = time2 - time1;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch b/patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch
new file mode 100644
index 0000000000..d4cf285780
--- /dev/null
+++ b/patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch
@@ -0,0 +1,158 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Fri, 8 Sep 2017 16:14:46 -0700
+Subject: [PATCH] lib/rbtree_test.c: make input module parameters
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 223f8911eace60c787f8767c25148b80ece9732a
+
+[ Upstream commit 223f8911eace60c787f8767c25148b80ece9732a ]
+
+Allows for more flexible debugging.
+
+Link: http://lkml.kernel.org/r/20170719014603.19029-5-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/rbtree_test.c | 55 +++++++++++++++++++++++++++++------------------
+ 1 file changed, 34 insertions(+), 21 deletions(-)
+
+diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c
+index 8b3c9dc88262..e83331aa1b7f 100644
+--- a/lib/rbtree_test.c
++++ b/lib/rbtree_test.c
+@@ -1,11 +1,18 @@
+ #include <linux/module.h>
++#include <linux/moduleparam.h>
+ #include <linux/rbtree_augmented.h>
+ #include <linux/random.h>
++#include <linux/slab.h>
+ #include <asm/timex.h>
+
+-#define NODES 100
+-#define PERF_LOOPS 100000
+-#define CHECK_LOOPS 100
++#define __param(type, name, init, msg) \
++ static type name = init; \
++ module_param(name, type, 0444); \
++ MODULE_PARM_DESC(name, msg);
++
++__param(int, nnodes, 100, "Number of nodes in the rb-tree");
++__param(int, perf_loops, 100000, "Number of iterations modifying the rb-tree");
++__param(int, check_loops, 100, "Number of iterations modifying and verifying the rb-tree");
+
+ struct test_node {
+ u32 key;
+@@ -17,7 +24,7 @@ struct test_node {
+ };
+
+ static struct rb_root root = RB_ROOT;
+-static struct test_node nodes[NODES];
++static struct test_node *nodes = NULL;
+
+ static struct rnd_state rnd;
+
+@@ -95,7 +102,7 @@ static void erase_augmented(struct test_node *node, struct rb_root *root)
+ static void init(void)
+ {
+ int i;
+- for (i = 0; i < NODES; i++) {
++ for (i = 0; i < nnodes; i++) {
+ nodes[i].key = prandom_u32_state(&rnd);
+ nodes[i].val = prandom_u32_state(&rnd);
+ }
+@@ -177,6 +184,10 @@ static int __init rbtree_test_init(void)
+ int i, j;
+ cycles_t time1, time2, time;
+
++ nodes = kmalloc(nnodes * sizeof(*nodes), GFP_KERNEL);
++ if (!nodes)
++ return -ENOMEM;
++
+ printk(KERN_ALERT "rbtree testing");
+
+ prandom_seed_state(&rnd, 3141592653589793238ULL);
+@@ -184,27 +195,27 @@ static int __init rbtree_test_init(void)
+
+ time1 = get_cycles();
+
+- for (i = 0; i < PERF_LOOPS; i++) {
+- for (j = 0; j < NODES; j++)
++ for (i = 0; i < perf_loops; i++) {
++ for (j = 0; j < nnodes; j++)
+ insert(nodes + j, &root);
+- for (j = 0; j < NODES; j++)
++ for (j = 0; j < nnodes; j++)
+ erase(nodes + j, &root);
+ }
+
+ time2 = get_cycles();
+ time = time2 - time1;
+
+- time = div_u64(time, PERF_LOOPS);
++ time = div_u64(time, perf_loops);
+ printk(" -> %llu cycles\n", (unsigned long long)time);
+
+- for (i = 0; i < CHECK_LOOPS; i++) {
++ for (i = 0; i < check_loops; i++) {
+ init();
+- for (j = 0; j < NODES; j++) {
++ for (j = 0; j < nnodes; j++) {
+ check(j);
+ insert(nodes + j, &root);
+ }
+- for (j = 0; j < NODES; j++) {
+- check(NODES - j);
++ for (j = 0; j < nnodes; j++) {
++ check(nnodes - j);
+ erase(nodes + j, &root);
+ }
+ check(0);
+@@ -216,32 +227,34 @@ static int __init rbtree_test_init(void)
+
+ time1 = get_cycles();
+
+- for (i = 0; i < PERF_LOOPS; i++) {
+- for (j = 0; j < NODES; j++)
++ for (i = 0; i < perf_loops; i++) {
++ for (j = 0; j < nnodes; j++)
+ insert_augmented(nodes + j, &root);
+- for (j = 0; j < NODES; j++)
++ for (j = 0; j < nnodes; j++)
+ erase_augmented(nodes + j, &root);
+ }
+
+ time2 = get_cycles();
+ time = time2 - time1;
+
+- time = div_u64(time, PERF_LOOPS);
++ time = div_u64(time, perf_loops);
+ printk(" -> %llu cycles\n", (unsigned long long)time);
+
+- for (i = 0; i < CHECK_LOOPS; i++) {
++ for (i = 0; i < check_loops; i++) {
+ init();
+- for (j = 0; j < NODES; j++) {
++ for (j = 0; j < nnodes; j++) {
+ check_augmented(j);
+ insert_augmented(nodes + j, &root);
+ }
+- for (j = 0; j < NODES; j++) {
+- check_augmented(NODES - j);
++ for (j = 0; j < nnodes; j++) {
++ check_augmented(nnodes - j);
+ erase_augmented(nodes + j, &root);
+ }
+ check_augmented(0);
+ }
+
++ kfree(nodes);
++
+ return -EAGAIN; /* Fail will directly unload the module */
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch b/patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch
new file mode 100644
index 0000000000..d5b2bef244
--- /dev/null
+++ b/patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch
@@ -0,0 +1,61 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Fri, 17 Nov 2017 15:28:27 -0800
+Subject: [PATCH] lib/rbtree-test: lower default params
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 0b548e33e6cb2bff240fdaf1783783be15c29080
+
+[ Upstream commit 0b548e33e6cb2bff240fdaf1783783be15c29080 ]
+
+Fengguang reported soft lockups while running the rbtree and interval
+tree test modules. The logic for these tests all occur in init phase,
+and we currently are pounding with the default values for number of
+nodes and number of iterations of each test. Reduce the latter by two
+orders of magnitude. This does not influence the value of the tests in
+that one thousand times by default is enough to get the picture.
+
+Link: http://lkml.kernel.org/r/20171109161715.xai2dtwqw2frhkcm@linux-n805
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/interval_tree_test.c | 4 ++--
+ lib/rbtree_test.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
+index 409383463879..bababcf7ffdd 100644
+--- a/lib/interval_tree_test.c
++++ b/lib/interval_tree_test.c
+@@ -11,10 +11,10 @@
+ MODULE_PARM_DESC(name, msg);
+
+ __param(int, nnodes, 100, "Number of nodes in the interval tree");
+-__param(int, perf_loops, 100000, "Number of iterations modifying the tree");
++__param(int, perf_loops, 1000, "Number of iterations modifying the tree");
+
+ __param(int, nsearches, 100, "Number of searches to the interval tree");
+-__param(int, search_loops, 10000, "Number of iterations searching the tree");
++__param(int, search_loops, 1000, "Number of iterations searching the tree");
+ __param(bool, search_all, false, "Searches will iterate all nodes in the tree");
+
+
+diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c
+index e83331aa1b7f..afedd3770562 100644
+--- a/lib/rbtree_test.c
++++ b/lib/rbtree_test.c
+@@ -11,7 +11,7 @@
+ MODULE_PARM_DESC(name, msg);
+
+ __param(int, nnodes, 100, "Number of nodes in the rb-tree");
+-__param(int, perf_loops, 100000, "Number of iterations modifying the rb-tree");
++__param(int, perf_loops, 1000, "Number of iterations modifying the rb-tree");
+ __param(int, check_loops, 100, "Number of iterations modifying and verifying the rb-tree");
+
+ struct test_node {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch b/patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch
new file mode 100644
index 0000000000..bb6ed1dcb7
--- /dev/null
+++ b/patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch
@@ -0,0 +1,69 @@
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 10 Jul 2017 15:51:49 -0700
+Subject: [PATCH] lib/interval_tree_test.c: allow users to limit scope of
+ endpoint
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a8ec14d4f6aa8e245efacc992c8ee6ea0464ce2a
+
+[ Upstream commit a8ec14d4f6aa8e245efacc992c8ee6ea0464ce2a ]
+
+Add a 'max_endpoint' parameter such that users may easily limit the size
+of the intervals that are randomly generated.
+
+Link: http://lkml.kernel.org/r/20170518174936.20265-4-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ lib/interval_tree_test.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
+index bababcf7ffdd..222c8010bda0 100644
+--- a/lib/interval_tree_test.c
++++ b/lib/interval_tree_test.c
+@@ -17,6 +17,7 @@ __param(int, nsearches, 100, "Number of searches to the interval tree");
+ __param(int, search_loops, 1000, "Number of iterations searching the tree");
+ __param(bool, search_all, false, "Searches will iterate all nodes in the tree");
+
++__param(uint, max_endpoint, ~0, "Largest value for the interval's endpoint");
+
+ static struct rb_root root = RB_ROOT;
+ static struct interval_tree_node *nodes = NULL;
+@@ -41,18 +42,20 @@ static void init(void)
+ int i;
+
+ for (i = 0; i < nnodes; i++) {
+- u32 a = prandom_u32_state(&rnd);
+- u32 b = prandom_u32_state(&rnd);
+- if (a <= b) {
+- nodes[i].start = a;
+- nodes[i].last = b;
+- } else {
+- nodes[i].start = b;
+- nodes[i].last = a;
+- }
++ u32 b = (prandom_u32_state(&rnd) >> 4) % max_endpoint;
++ u32 a = (prandom_u32_state(&rnd) >> 4) % b;
++
++ nodes[i].start = a;
++ nodes[i].last = b;
+ }
++
++ /*
++ * Limit the search scope to what the user defined.
++ * Otherwise we are merely measuring empty walks,
++ * which is pointless.
++ */
+ for (i = 0; i < nsearches; i++)
+- queries[i] = prandom_u32_state(&rnd);
++ queries[i] = (prandom_u32_state(&rnd) >> 4) % max_endpoint;
+ }
+
+ static int interval_tree_test_init(void)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch b/patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch
new file mode 100644
index 0000000000..23bd42e01d
--- /dev/null
+++ b/patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch
@@ -0,0 +1,39 @@
+From: Ingo Molnar <mingo@kernel.org>
+Date: Mon, 13 Nov 2017 07:15:41 +0100
+Subject: [PATCH] timer/debug: Change /proc/timer_list from 0444 to 0400
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 8e7df2b5b7f245c9bd11064712db5cb69044a362
+
+[ Upstream commit 8e7df2b5b7f245c9bd11064712db5cb69044a362 ]
+
+While it uses %pK, there's still few reasons to read this file
+as non-root.
+
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/time/timer_list.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
+index ef4f16e81283..1407ed20ea93 100644
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -399,7 +399,7 @@ static int __init init_timer_list_procfs(void)
+ {
+ struct proc_dir_entry *pe;
+
+- pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
++ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
+ if (!pe)
+ return -ENOMEM;
+ return 0;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch b/patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch
new file mode 100644
index 0000000000..44457c8e18
--- /dev/null
+++ b/patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch
@@ -0,0 +1,61 @@
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sat, 15 Dec 2018 07:30:39 -0800
+Subject: [PATCH] powerpc/boot: Fix random libfdt related build errors
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 64c3f648c25d108f346fdc96c15180c6b7d250e9
+
+[ Upstream commit 64c3f648c25d108f346fdc96c15180c6b7d250e9 ]
+
+Once in a while I see build errors similar to the following
+when building images from a clean tree.
+
+ Building powerpc:virtex-ml507:44x/virtex5_defconfig ... failed
+ ------------
+ Error log:
+ arch/powerpc/boot/treeboot-akebono.c:37:20: fatal error:
+ libfdt.h: No such file or directory
+
+ Building powerpc:bamboo:smpdev:44x/bamboo_defconfig ... failed
+ ------------
+ Error log:
+ arch/powerpc/boot/treeboot-akebono.c:37:20: fatal error:
+ libfdt.h: No such file or directory
+
+ arch/powerpc/boot/treeboot-currituck.c:35:20: fatal error:
+ libfdt.h: No such file or directory
+
+Rebuilds will succeed.
+
+Turns out that several source files in arch/powerpc/boot/ include
+libfdt.h, but Makefile dependencies are incomplete. Let's fix that.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[groeck: Backport to v4.4.y]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/boot/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index 99e4487248ff..57003d1bd243 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -70,7 +70,8 @@ $(addprefix $(obj)/,$(zlib) cuboot-c2k.o gunzip_util.o main.o): \
+ libfdt := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c
+ libfdtheader := fdt.h libfdt.h libfdt_internal.h
+
+-$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o): \
++$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o \
++ treeboot-akebono.o treeboot-currituck.o treeboot-iss4xx.o): \
+ $(addprefix $(obj)/,$(libfdtheader))
+
+ src-wlib-y := string.S crt0.S crtsavres.S stdio.c main.c \
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch b/patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch
new file mode 100644
index 0000000000..c9ed658a8e
--- /dev/null
+++ b/patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch
@@ -0,0 +1,42 @@
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Tue, 4 Dec 2018 17:04:57 +0800
+Subject: [PATCH] pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 478b6767ad26ab86d9ecc341027dd09a87b1f997
+
+commit 478b6767ad26ab86d9ecc341027dd09a87b1f997 upstream.
+
+Pin PH11 is used on various A83T board to detect a change in the OTG
+port's ID pin, as in when an OTG host cable is plugged in.
+
+The incorrect offset meant the gpiochip/irqchip was activating the wrong
+pin for interrupts.
+
+Fixes: 4730f33f0d82 ("pinctrl: sunxi: add allwinner A83T PIO controller support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+index a7c81e988656..383977ea3a3c 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+@@ -568,7 +568,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 11),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 1)), /* PH_EINT11 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 11)), /* PH_EINT11 */
+ };
+
+ static const struct sunxi_pinctrl_desc sun8i_a83t_pinctrl_data = {
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch b/patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch
new file mode 100644
index 0000000000..99b3dbc913
--- /dev/null
+++ b/patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch
@@ -0,0 +1,47 @@
+From: Jeff Moyer <jmoyer@redhat.com>
+Date: Tue, 11 Dec 2018 12:37:49 -0500
+Subject: [PATCH] aio: fix spectre gadget in lookup_ioctx
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a538e3ff9dabcdf6c3f477a373c629213d1c3066
+
+commit a538e3ff9dabcdf6c3f477a373c629213d1c3066 upstream.
+
+Matthew pointed out that the ioctx_table is susceptible to spectre v1,
+because the index can be controlled by an attacker. The below patch
+should mitigate the attack for all of the aio system calls.
+
+Cc: stable@vger.kernel.org
+Reported-by: Matthew Wilcox <willy@infradead.org>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/aio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/aio.c b/fs/aio.c
+index c283eb03cb38..7187d03aa0bc 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -40,6 +40,7 @@
+ #include <linux/ramfs.h>
+ #include <linux/percpu-refcount.h>
+ #include <linux/mount.h>
++#include <linux/nospec.h>
+
+ #include <asm/kmap_types.h>
+ #include <asm/uaccess.h>
+@@ -1063,6 +1064,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
+ if (!table || id >= table->nr)
+ goto out;
+
++ id = array_index_nospec(id, table->nr);
+ ctx = rcu_dereference(table->table[id]);
+ if (ctx && ctx->user_id == ctx_id) {
+ if (percpu_ref_tryget_live(&ctx->users))
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch b/patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch
new file mode 100644
index 0000000000..d254c38220
--- /dev/null
+++ b/patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch
@@ -0,0 +1,133 @@
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Tue, 20 Nov 2018 01:14:00 +0200
+Subject: [PATCH] MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: e8cde625bfe8a714a856e1366bcbb259d7346095
+
+commit e8cde625bfe8a714a856e1366bcbb259d7346095 upstream.
+
+Since v2.6.22 or so there has been reports [1] about OMAP MMC being
+broken on OMAP15XX based hardware (OMAP5910 and OMAP310). The breakage
+seems to have been caused by commit 46a6730e3ff9 ("mmc-omap: Fix
+omap to use MMC_POWER_ON") that changed clock enabling to be done
+on MMC_POWER_ON. This can happen multiple times in a row, and on 15XX
+the hardware doesn't seem to like it and the MMC just stops responding.
+Fix by memorizing the power mode and do the init only when necessary.
+
+Before the patch (on Palm TE):
+
+ mmc0: new SD card at address b368
+ mmcblk0: mmc0:b368 SDC 977 MiB
+ mmci-omap mmci-omap.0: command timeout (CMD18)
+ mmci-omap mmci-omap.0: command timeout (CMD13)
+ mmci-omap mmci-omap.0: command timeout (CMD13)
+ mmci-omap mmci-omap.0: command timeout (CMD12) [x 6]
+ mmci-omap mmci-omap.0: command timeout (CMD13) [x 6]
+ mmcblk0: error -110 requesting status
+ mmci-omap mmci-omap.0: command timeout (CMD8)
+ mmci-omap mmci-omap.0: command timeout (CMD18)
+ mmci-omap mmci-omap.0: command timeout (CMD13)
+ mmci-omap mmci-omap.0: command timeout (CMD13)
+ mmci-omap mmci-omap.0: command timeout (CMD12) [x 6]
+ mmci-omap mmci-omap.0: command timeout (CMD13) [x 6]
+ mmcblk0: error -110 requesting status
+ mmcblk0: recovery failed!
+ print_req_error: I/O error, dev mmcblk0, sector 0
+ Buffer I/O error on dev mmcblk0, logical block 0, async page read
+ mmcblk0: unable to read partition table
+
+After the patch:
+
+ mmc0: new SD card at address b368
+ mmcblk0: mmc0:b368 SDC 977 MiB
+ mmcblk0: p1
+
+The patch is based on a fix and analysis done by Ladislav Michl.
+
+Tested on OMAP15XX/OMAP310 (Palm TE), OMAP1710 (Nokia 770)
+and OMAP2420 (Nokia N810).
+
+[1] https://marc.info/?t=123175197000003&r=1&w=2
+
+Fixes: 46a6730e3ff9 ("mmc-omap: Fix omap to use MMC_POWER_ON")
+Reported-by: Ladislav Michl <ladis@linux-mips.org>
+Reported-by: Andrzej Zaborowski <balrogg@gmail.com>
+Tested-by: Ladislav Michl <ladis@linux-mips.org>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/mmc/host/omap.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
+index b9958a123594..5bcf4f45f8b4 100644
+--- a/drivers/mmc/host/omap.c
++++ b/drivers/mmc/host/omap.c
+@@ -105,6 +105,7 @@ struct mmc_omap_slot {
+ unsigned int vdd;
+ u16 saved_con;
+ u16 bus_mode;
++ u16 power_mode;
+ unsigned int fclk_freq;
+
+ struct tasklet_struct cover_tasklet;
+@@ -1156,7 +1157,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ struct mmc_omap_slot *slot = mmc_priv(mmc);
+ struct mmc_omap_host *host = slot->host;
+ int i, dsor;
+- int clk_enabled;
++ int clk_enabled, init_stream;
+
+ mmc_omap_select_slot(slot, 0);
+
+@@ -1166,6 +1167,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ slot->vdd = ios->vdd;
+
+ clk_enabled = 0;
++ init_stream = 0;
+ switch (ios->power_mode) {
+ case MMC_POWER_OFF:
+ mmc_omap_set_power(slot, 0, ios->vdd);
+@@ -1173,13 +1175,17 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ case MMC_POWER_UP:
+ /* Cannot touch dsor yet, just power up MMC */
+ mmc_omap_set_power(slot, 1, ios->vdd);
++ slot->power_mode = ios->power_mode;
+ goto exit;
+ case MMC_POWER_ON:
+ mmc_omap_fclk_enable(host, 1);
+ clk_enabled = 1;
+ dsor |= 1 << 11;
++ if (slot->power_mode != MMC_POWER_ON)
++ init_stream = 1;
+ break;
+ }
++ slot->power_mode = ios->power_mode;
+
+ if (slot->bus_mode != ios->bus_mode) {
+ if (slot->pdata->set_bus_mode != NULL)
+@@ -1195,7 +1201,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ for (i = 0; i < 2; i++)
+ OMAP_MMC_WRITE(host, CON, dsor);
+ slot->saved_con = dsor;
+- if (ios->power_mode == MMC_POWER_ON) {
++ if (init_stream) {
+ /* worst case at 400kHz, 80 cycles makes 200 microsecs */
+ int usecs = 250;
+
+@@ -1233,6 +1239,7 @@ static int mmc_omap_new_slot(struct mmc_omap_host *host, int id)
+ slot->host = host;
+ slot->mmc = mmc;
+ slot->id = id;
++ slot->power_mode = MMC_POWER_UNDEFINED;
+ slot->pdata = &host->pdata->slots[id];
+
+ host->slots[id] = slot;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch b/patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch
new file mode 100644
index 0000000000..d00d951504
--- /dev/null
+++ b/patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch
@@ -0,0 +1,50 @@
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Sun, 9 Dec 2018 21:17:30 -0500
+Subject: [PATCH] tracing: Fix memory leak in set_trigger_filter()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 3cec638b3d793b7cacdec5b8072364b41caeb0e1
+
+commit 3cec638b3d793b7cacdec5b8072364b41caeb0e1 upstream.
+
+When create_event_filter() fails in set_trigger_filter(), the filter may
+still be allocated and needs to be freed. The caller expects the
+data->filter to be updated with the new filter, even if the new filter
+failed (we could add an error message by setting set_str parameter of
+create_event_filter(), but that's another update).
+
+But because the error would just exit, filter was left hanging and
+nothing could free it.
+
+Found by kmemleak detector.
+
+Cc: stable@vger.kernel.org
+Fixes: bac5fb97a173a ("tracing: Add and use generic set_trigger_filter() implementation")
+Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/trace/trace_events_trigger.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index b8a894adab2c..8be66a2b0cac 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -727,8 +727,10 @@ static int set_trigger_filter(char *filter_str,
+
+ /* The filter is for the 'trigger' event, not the triggered event */
+ ret = create_event_filter(file->event_call, filter_str, false, &filter);
+- if (ret)
+- goto out;
++ /*
++ * If create_event_filter() fails, filter still needs to be freed.
++ * Which the calling code will do with data->filter.
++ */
+ assign:
+ tmp = rcu_access_pointer(data->filter);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch b/patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch
new file mode 100644
index 0000000000..0c60810bb5
--- /dev/null
+++ b/patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch
@@ -0,0 +1,46 @@
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Mon, 10 Dec 2018 23:58:01 -0500
+Subject: [PATCH] tracing: Fix memory leak of instance function hash filters
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 2840f84f74035e5a535959d5f17269c69fa6edc5
+
+commit 2840f84f74035e5a535959d5f17269c69fa6edc5 upstream.
+
+The following commands will cause a memory leak:
+
+ # cd /sys/kernel/tracing
+ # mkdir instances/foo
+ # echo schedule > instance/foo/set_ftrace_filter
+ # rmdir instances/foo
+
+The reason is that the hashes that hold the filters to set_ftrace_filter and
+set_ftrace_notrace are not freed if they contain any data on the instance
+and the instance is removed.
+
+Found by kmemleak detector.
+
+Cc: stable@vger.kernel.org
+Fixes: 591dffdade9f ("ftrace: Allow for function tracing instance to filter functions")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/trace/ftrace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index ac758a53fcea..d90b42b39908 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -4767,6 +4767,7 @@ void ftrace_destroy_filter_files(struct ftrace_ops *ops)
+ if (ops->flags & FTRACE_OPS_FL_ENABLED)
+ ftrace_shutdown(ops, 0);
+ ops->flags |= FTRACE_OPS_FL_DELETED;
++ ftrace_free_filter(ops);
+ mutex_unlock(&ftrace_lock);
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch b/patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch
new file mode 100644
index 0000000000..b564d3f77a
--- /dev/null
+++ b/patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch
@@ -0,0 +1,59 @@
+From: Radu Rendec <radu.rendec@gmail.com>
+Date: Tue, 27 Nov 2018 22:20:48 -0500
+Subject: [PATCH] powerpc/msi: Fix NULL pointer access in teardown code
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 78e7b15e17ac175e7eed9e21c6f92d03d3b0a6fa
+
+commit 78e7b15e17ac175e7eed9e21c6f92d03d3b0a6fa upstream.
+
+The arch_teardown_msi_irqs() function assumes that controller ops
+pointers were already checked in arch_setup_msi_irqs(), but this
+assumption is wrong: arch_teardown_msi_irqs() can be called even when
+arch_setup_msi_irqs() returns an error (-ENOSYS).
+
+This can happen in the following scenario:
+ - msi_capability_init() calls pci_msi_setup_msi_irqs()
+ - pci_msi_setup_msi_irqs() returns -ENOSYS
+ - msi_capability_init() notices the error and calls free_msi_irqs()
+ - free_msi_irqs() calls pci_msi_teardown_msi_irqs()
+
+This is easier to see when CONFIG_PCI_MSI_IRQ_DOMAIN is not set and
+pci_msi_setup_msi_irqs() and pci_msi_teardown_msi_irqs() are just
+aliases to arch_setup_msi_irqs() and arch_teardown_msi_irqs().
+
+The call to free_msi_irqs() upon pci_msi_setup_msi_irqs() failure
+seems legit, as it does additional cleanup; e.g.
+list_del(&entry->list) and kfree(entry) inside free_msi_irqs() do
+happen (MSI descriptors are allocated before pci_msi_setup_msi_irqs()
+is called and need to be cleaned up if that fails).
+
+Fixes: 6b2fd7efeb88 ("PCI/MSI/PPC: Remove arch_msi_check_device()")
+Cc: stable@vger.kernel.org # v3.18+
+Signed-off-by: Radu Rendec <radu.rendec@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/kernel/msi.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/msi.c b/arch/powerpc/kernel/msi.c
+index dab616a33b8d..f2197654be07 100644
+--- a/arch/powerpc/kernel/msi.c
++++ b/arch/powerpc/kernel/msi.c
+@@ -34,5 +34,10 @@ void arch_teardown_msi_irqs(struct pci_dev *dev)
+ {
+ struct pci_controller *phb = pci_bus_to_host(dev->bus);
+
+- phb->controller_ops.teardown_msi_irqs(dev);
++ /*
++ * We can be called even when arch_setup_msi_irqs() returns -ENOSYS,
++ * so check the pointer again.
++ */
++ if (phb->controller_ops.teardown_msi_irqs)
++ phb->controller_ops.teardown_msi_irqs(dev);
+ }
+--
+2.20.1
+
diff --git a/patches.fixes/0001-Revert-drm-rockchip-Allow-driver-to-be-shutdown-on-r.patch b/patches.kernel.org/4.4.169-014-Revert-drm-rockchip-Allow-driver-to-be-shutdo.patch
index 1942091540..efac3d4b2f 100644
--- a/patches.fixes/0001-Revert-drm-rockchip-Allow-driver-to-be-shutdown-on-r.patch
+++ b/patches.kernel.org/4.4.169-014-Revert-drm-rockchip-Allow-driver-to-be-shutdo.patch
@@ -1,10 +1,12 @@
-From 63238173b2faf3d6b85a416f1c69af6c7be2413f Mon Sep 17 00:00:00 2001
From: Brian Norris <briannorris@chromium.org>
Date: Wed, 5 Dec 2018 10:16:57 -0800
-Subject: Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
+Subject: [PATCH] Revert "drm/rockchip: Allow driver to be shutdown on
+ reboot/kexec"
+Patch-mainline: 4.4.169
+References: bnc#1012382 bsc#1106929
Git-commit: 63238173b2faf3d6b85a416f1c69af6c7be2413f
-Patch-mainline: v4.20-rc7
-References: bsc#1106929
+
+commit 63238173b2faf3d6b85a416f1c69af6c7be2413f upstream.
This reverts commit 7f3ef5dedb146e3d5063b6845781ad1bb59b92b5.
@@ -60,16 +62,17 @@ Cc: stable@vger.kernel.org
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20181205181657.177703-1-briannorris@chromium.org
-Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
-index 941f35233b1f..5864cb452c5c 100644
+index d1f3be78c649..f22e1e1ee64a 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
-@@ -448,11 +448,6 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
+@@ -547,11 +547,6 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
return 0;
}
@@ -81,7 +84,7 @@ index 941f35233b1f..5864cb452c5c 100644
static const struct of_device_id rockchip_drm_dt_ids[] = {
{ .compatible = "rockchip,display-subsystem", },
{ /* sentinel */ },
-@@ -462,7 +457,6 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
+@@ -561,7 +556,6 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
static struct platform_driver rockchip_drm_platform_driver = {
.probe = rockchip_drm_platform_probe,
.remove = rockchip_drm_platform_remove,
diff --git a/patches.fixes/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch b/patches.kernel.org/4.4.169-015-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_con.patch
index 1f326fd8e4..a46c326baf 100644
--- a/patches.fixes/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
+++ b/patches.kernel.org/4.4.169-015-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_con.patch
@@ -1,10 +1,11 @@
-From e8ad4f9a609fb14bbd3d32602145e569e489a418 Mon Sep 17 00:00:00 2001
From: Yunlei He <heyunlei@huawei.com>
Date: Thu, 1 Jun 2017 16:43:51 +0800
Subject: [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control
+Patch-mainline: 4.4.169
+References: CVE-2017-18241 bnc#1012382 bsc#1086400
Git-commit: d4fdf8ba0e5808ba9ad6b44337783bd9935e0982
-Patch-mainline: v4.13-rc1
-References: bsc#1086400, CVE-2017-18241
+
+commit d4fdf8ba0e5808ba9ad6b44337783bd9935e0982 upstream.
Mount fs with option noflush_merge, boot failed for illegal address
fcc in function f2fs_issue_flush:
@@ -17,16 +18,18 @@ fcc in function f2fs_issue_flush:
Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Acked-by: Nikolay Borisov <nborisov@suse.com>
+[bwh: Backported to 4.9: adjust context]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/f2fs/segment.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
-index 0b00bbadc864..f85d5b3765fc 100644
+index 2bba0c4ef4b7..39ec9da08bb5 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
-@@ -396,6 +396,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
+@@ -398,6 +398,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
init_waitqueue_head(&fcc->flush_wait_queue);
init_llist_head(&fcc->issue_list);
SM_I(sbi)->cmd_control_info = fcc;
@@ -36,7 +39,7 @@ index 0b00bbadc864..f85d5b3765fc 100644
fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
if (IS_ERR(fcc->f2fs_issue_flush)) {
-@@ -2314,7 +2317,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
+@@ -2316,7 +2319,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
INIT_LIST_HEAD(&sm_info->sit_entry_set);
@@ -46,5 +49,5 @@ index 0b00bbadc864..f85d5b3765fc 100644
if (err)
return err;
--
-2.7.4
+2.20.1
diff --git a/patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy b/patches.kernel.org/4.4.169-016-mac80211-don-t-WARN-on-bad-WMM-parameters-fro.patch
index fc160d475a..3bfba31f84 100644
--- a/patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy
+++ b/patches.kernel.org/4.4.169-016-mac80211-don-t-WARN-on-bad-WMM-parameters-fro.patch
@@ -1,10 +1,11 @@
-From c470bdc1aaf36669e04ba65faf1092b2d1c6cabe Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Mon, 26 Mar 2018 16:21:04 +0300
Subject: [PATCH] mac80211: don't WARN on bad WMM parameters from buggy APs
+Patch-mainline: 4.4.169
+References: bnc#1012382 bsc#1031717
Git-commit: c470bdc1aaf36669e04ba65faf1092b2d1c6cabe
-Patch-mainline: v4.17-rc1
-References: bsc#1031717
+
+[ Upstream commit c470bdc1aaf36669e04ba65faf1092b2d1c6cabe ]
Apparently, some APs are buggy enough to send a zeroed
WMM IE. Don't WARN on this since this is not caused by a bug
@@ -21,15 +22,17 @@ https://bugzilla.kernel.org/show_bug.cgi?id=199161
Fixes: f409079bb678 ("mac80211: sanity check CW_min/CW_max towards driver")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- net/mac80211/mlme.c | 3 ++-
+ net/mac80211/mlme.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index a5e11280f405..51f31e77c19b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
-@@ -1829,7 +1829,8 @@ static bool ieee80211_sta_wmm_params(str
+@@ -1886,7 +1886,8 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
params[ac].acm = acm;
params[ac].uapsd = uapsd;
@@ -39,3 +42,6 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
sdata_info(sdata,
"AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
params[ac].cw_min, params[ac].cw_max, aci);
+--
+2.20.1
+
diff --git a/patches.drivers/mac80211-Fix-condition-validating-WMM-IE b/patches.kernel.org/4.4.169-017-mac80211-Fix-condition-validating-WMM-IE.patch
index 719c49f0f7..12c2994d96 100644
--- a/patches.drivers/mac80211-Fix-condition-validating-WMM-IE
+++ b/patches.kernel.org/4.4.169-017-mac80211-Fix-condition-validating-WMM-IE.patch
@@ -1,10 +1,11 @@
-From 911a26484c33e10de6237228ca1d7293548e9f49 Mon Sep 17 00:00:00 2001
From: Ilan Peer <ilan.peer@intel.com>
Date: Tue, 3 Apr 2018 11:35:22 +0300
Subject: [PATCH] mac80211: Fix condition validating WMM IE
+Patch-mainline: 4.4.169
+References: bnc#1012382 bsc#1099732 bsc#1099810
Git-commit: 911a26484c33e10de6237228ca1d7293548e9f49
-Patch-mainline: v4.17-rc5
-References: bsc#1099810,bsc#1099732
+
+[ Upstream commit 911a26484c33e10de6237228ca1d7293548e9f49 ]
Commit c470bdc1aaf3 ("mac80211: don't WARN on bad WMM parameters from
buggy APs") handled cases where an AP reports a zeroed WMM
@@ -16,15 +17,17 @@ Fixes: c470bdc1aaf3 ("mac80211: don't WARN on bad WMM parameters from buggy APs"
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- net/mac80211/mlme.c | 2 +-
+ net/mac80211/mlme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 51f31e77c19b..ed4fef32b394 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
-@@ -1829,7 +1829,7 @@ static bool ieee80211_sta_wmm_params(str
+@@ -1886,7 +1886,7 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
params[ac].acm = acm;
params[ac].uapsd = uapsd;
@@ -33,3 +36,6 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
params[ac].cw_min > params[ac].cw_max) {
sdata_info(sdata,
"AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch b/patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch
new file mode 100644
index 0000000000..df7f13a275
--- /dev/null
+++ b/patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch
@@ -0,0 +1,62 @@
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Fri, 5 Oct 2018 23:22:06 +0300
+Subject: [PATCH] mac80211_hwsim: fix module init error paths for netlink
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 05cc09de4c017663a217630682041066f2f9a5cd
+
+[ Upstream commit 05cc09de4c017663a217630682041066f2f9a5cd ]
+
+There is no unregister netlink notifier and family on error paths
+in init_mac80211_hwsim(). Also there is an error path where
+hwsim_class is not destroyed.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Fixes: 62759361eb49 ("mac80211-hwsim: Provide multicast event for HWSIM_CMD_NEW_RADIO")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index ab480ea6d95a..0d1abcfec003 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3195,16 +3195,16 @@ static int __init init_mac80211_hwsim(void)
+ if (err)
+ return err;
+
++ err = hwsim_init_netlink();
++ if (err)
++ goto out_unregister_driver;
++
+ hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
+ if (IS_ERR(hwsim_class)) {
+ err = PTR_ERR(hwsim_class);
+- goto out_unregister_driver;
++ goto out_exit_netlink;
+ }
+
+- err = hwsim_init_netlink();
+- if (err < 0)
+- goto out_unregister_driver;
+-
+ for (i = 0; i < radios; i++) {
+ struct hwsim_new_radio_params param = { 0 };
+
+@@ -3310,6 +3310,8 @@ static int __init init_mac80211_hwsim(void)
+ free_netdev(hwsim_mon);
+ out_free_radios:
+ mac80211_hwsim_free();
++out_exit_netlink:
++ hwsim_exit_netlink();
+ out_unregister_driver:
+ platform_driver_unregister(&mac80211_hwsim_driver);
+ return err;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch b/patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch
new file mode 100644
index 0000000000..e3225d3891
--- /dev/null
+++ b/patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch
@@ -0,0 +1,42 @@
+From: Fred Herard <fred.herard@oracle.com>
+Date: Tue, 20 Nov 2018 20:22:45 -0500
+Subject: [PATCH] scsi: libiscsi: Fix NULL pointer dereference in
+ iscsi_eh_session_reset
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 5db6dd14b31397e8cccaaddab2ff44ebec1acf25
+
+[ Upstream commit 5db6dd14b31397e8cccaaddab2ff44ebec1acf25 ]
+
+This commit addresses NULL pointer dereference in iscsi_eh_session_reset.
+Reference should not be made to session->leadconn when session->state is
+set to ISCSI_STATE_TERMINATE.
+
+Signed-off-by: Fred Herard <fred.herard@oracle.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/scsi/libiscsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index a74f8fbefd33..009a2ef829d6 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -2416,8 +2416,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc)
+ failed:
+ ISCSI_DBG_EH(session,
+ "failing session reset: Could not log back into "
+- "%s, %s [age %d]\n", session->targetname,
+- conn->persistent_address, session->age);
++ "%s [age %d]\n", session->targetname,
++ session->age);
+ spin_unlock_bh(&session->frwd_lock);
+ mutex_unlock(&session->eh_mutex);
+ return FAILED;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch b/patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch
new file mode 100644
index 0000000000..20f219c055
--- /dev/null
+++ b/patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch
@@ -0,0 +1,58 @@
+From: Cathy Avery <cavery@redhat.com>
+Date: Tue, 27 Nov 2018 14:28:53 -0500
+Subject: [PATCH] scsi: vmw_pscsi: Rearrange code to avoid multiple calls to
+ free_irq during unload
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 02f425f811cefcc4d325d7a72272651e622dc97e
+
+[ Upstream commit 02f425f811cefcc4d325d7a72272651e622dc97e ]
+
+Currently pvscsi_remove calls free_irq more than once as
+pvscsi_release_resources and __pvscsi_shutdown both call
+pvscsi_shutdown_intr. This results in a 'Trying to free already-free IRQ'
+warning and stack trace. To solve the problem pvscsi_shutdown_intr has been
+moved out of pvscsi_release_resources.
+
+Signed-off-by: Cathy Avery <cavery@redhat.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/scsi/vmw_pvscsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+index 0de2f9069e23..23081ed8f1e3 100644
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -1199,8 +1199,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
+
+ static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
+ {
+- pvscsi_shutdown_intr(adapter);
+-
+ if (adapter->workqueue)
+ destroy_workqueue(adapter->workqueue);
+
+@@ -1529,6 +1527,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ out_reset_adapter:
+ ll_adapter_reset(adapter);
+ out_release_resources:
++ pvscsi_shutdown_intr(adapter);
+ pvscsi_release_resources(adapter);
+ scsi_host_put(host);
+ out_disable_device:
+@@ -1537,6 +1536,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return error;
+
+ out_release_resources_and_disable:
++ pvscsi_shutdown_intr(adapter);
+ pvscsi_release_resources(adapter);
+ goto out_disable_device;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch b/patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch
new file mode 100644
index 0000000000..7d5ae6c60a
--- /dev/null
+++ b/patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch
@@ -0,0 +1,66 @@
+From: YiFei Zhu <zhuyifei1999@gmail.com>
+Date: Thu, 29 Nov 2018 18:12:30 +0100
+Subject: [PATCH] x86/earlyprintk/efi: Fix infinite loop on some screen widths
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 79c2206d369b87b19ac29cb47601059b6bf5c291
+
+[ Upstream commit 79c2206d369b87b19ac29cb47601059b6bf5c291 ]
+
+An affected screen resolution is 1366 x 768, which width is not
+divisible by 8, the default font width. On such screens, when longer
+lines are earlyprintk'ed, overflow-to-next-line can never trigger,
+due to the left-most x-coordinate of the next character always less
+than the screen width. Earlyprintk will infinite loop in trying to
+print the rest of the string but unable to, due to the line being
+full.
+
+This patch makes the trigger consider the right-most x-coordinate,
+instead of left-most, as the value to compare against the screen
+width threshold.
+
+Signed-off-by: YiFei Zhu <zhuyifei1999@gmail.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
+Cc: Bhupesh Sharma <bhsharma@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Eric Snowberg <eric.snowberg@oracle.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Joe Perches <joe@perches.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Cc: Julien Thierry <julien.thierry@arm.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Nathan Chancellor <natechancellor@gmail.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
+Cc: Sedat Dilek <sedat.dilek@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Link: http://lkml.kernel.org/r/20181129171230.18699-12-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/platform/efi/early_printk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c
+index 524142117296..82324fc25d5e 100644
+--- a/arch/x86/platform/efi/early_printk.c
++++ b/arch/x86/platform/efi/early_printk.c
+@@ -179,7 +179,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num)
+ num--;
+ }
+
+- if (efi_x >= si->lfb_width) {
++ if (efi_x + font->width > si->lfb_width) {
+ efi_x = 0;
+ efi_y += font->height;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch b/patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch
new file mode 100644
index 0000000000..0335e1d76c
--- /dev/null
+++ b/patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch
@@ -0,0 +1,42 @@
+From: Sean Paul <seanpaul@chromium.org>
+Date: Wed, 3 Oct 2018 16:22:31 -0400
+Subject: [PATCH] drm/msm: Grab a vblank reference when waiting for commit_done
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 3b712e43e3876b42b38321ecf790a1f5fe59c834
+
+[ Upstream commit 3b712e43e3876b42b38321ecf790a1f5fe59c834 ]
+
+Similar to the atomic helpers, we should enable vblank while we're
+waiting for the commit to finish. DPU needs this, MDP5 seems to work
+fine without it.
+
+Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/gpu/drm/msm/msm_atomic.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
+index 7eb253bc24df..221eaea651d4 100644
+--- a/drivers/gpu/drm/msm/msm_atomic.c
++++ b/drivers/gpu/drm/msm/msm_atomic.c
+@@ -107,7 +107,12 @@ static void msm_atomic_wait_for_commit_done(struct drm_device *dev,
+ if (old_state->legacy_cursor_update)
+ continue;
+
++ if (drm_crtc_vblank_get(crtc))
++ continue;
++
+ kms->funcs->wait_for_crtc_commit_done(kms, crtc);
++
++ drm_crtc_vblank_put(crtc);
+ }
+ }
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch b/patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch
new file mode 100644
index 0000000000..38b4daf256
--- /dev/null
+++ b/patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch
@@ -0,0 +1,146 @@
+From: Jose Abreu <joabreu@synopsys.com>
+Date: Fri, 30 Nov 2018 09:47:31 +0000
+Subject: [PATCH] ARC: io.h: Implement reads{x}()/writes{x}()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 10d443431dc2bb733cf7add99b453e3fb9047a2e
+
+[ Upstream commit 10d443431dc2bb733cf7add99b453e3fb9047a2e ]
+
+Some ARC CPU's do not support unaligned loads/stores. Currently, generic
+implementation of reads{b/w/l}()/writes{b/w/l}() is being used with ARC.
+This can lead to misfunction of some drivers as generic functions do a
+plain dereference of a pointer that can be unaligned.
+
+Let's use {get/put}_unaligned() helpers instead of plain dereference of
+pointer in order to fix. The helpers allow to get and store data from an
+unaligned address whilst preserving the CPU internal alignment.
+According to [1], the use of these helpers are costly in terms of
+performance so we added an initial check for a buffer already aligned so
+that the usage of the helpers can be avoided, when possible.
+
+[1] Documentation/unaligned-memory-access.txt
+
+Cc: Alexey Brodkin <abrodkin@synopsys.com>
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Tested-by: Vitor Soares <soares@synopsys.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/arc/include/asm/io.h | 72 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 72 insertions(+)
+
+diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
+index cb69299a492e..f120d823e8c2 100644
+--- a/arch/arc/include/asm/io.h
++++ b/arch/arc/include/asm/io.h
+@@ -12,6 +12,7 @@
+ #include <linux/types.h>
+ #include <asm/byteorder.h>
+ #include <asm/page.h>
++#include <asm/unaligned.h>
+
+ #ifdef CONFIG_ISA_ARCV2
+ #include <asm/barrier.h>
+@@ -85,6 +86,42 @@ static inline u32 __raw_readl(const volatile void __iomem *addr)
+ return w;
+ }
+
++/*
++ * {read,write}s{b,w,l}() repeatedly access the same IO address in
++ * native endianness in 8-, 16-, 32-bit chunks {into,from} memory,
++ * @count times
++ */
++#define __raw_readsx(t,f) \
++static inline void __raw_reads##f(const volatile void __iomem *addr, \
++ void *ptr, unsigned int count) \
++{ \
++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \
++ u##t *buf = ptr; \
++ \
++ if (!count) \
++ return; \
++ \
++ /* Some ARC CPU's don't support unaligned accesses */ \
++ if (is_aligned) { \
++ do { \
++ u##t x = __raw_read##f(addr); \
++ *buf++ = x; \
++ } while (--count); \
++ } else { \
++ do { \
++ u##t x = __raw_read##f(addr); \
++ put_unaligned(x, buf++); \
++ } while (--count); \
++ } \
++}
++
++#define __raw_readsb __raw_readsb
++__raw_readsx(8, b)
++#define __raw_readsw __raw_readsw
++__raw_readsx(16, w)
++#define __raw_readsl __raw_readsl
++__raw_readsx(32, l)
++
+ #define __raw_writeb __raw_writeb
+ static inline void __raw_writeb(u8 b, volatile void __iomem *addr)
+ {
+@@ -117,6 +154,35 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
+
+ }
+
++#define __raw_writesx(t,f) \
++static inline void __raw_writes##f(volatile void __iomem *addr, \
++ const void *ptr, unsigned int count) \
++{ \
++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \
++ const u##t *buf = ptr; \
++ \
++ if (!count) \
++ return; \
++ \
++ /* Some ARC CPU's don't support unaligned accesses */ \
++ if (is_aligned) { \
++ do { \
++ __raw_write##f(*buf++, addr); \
++ } while (--count); \
++ } else { \
++ do { \
++ __raw_write##f(get_unaligned(buf++), addr); \
++ } while (--count); \
++ } \
++}
++
++#define __raw_writesb __raw_writesb
++__raw_writesx(8, b)
++#define __raw_writesw __raw_writesw
++__raw_writesx(16, w)
++#define __raw_writesl __raw_writesl
++__raw_writesx(32, l)
++
+ /*
+ * MMIO can also get buffered/optimized in micro-arch, so barriers needed
+ * Based on ARM model for the typical use case
+@@ -132,10 +198,16 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
+ #define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(); __v; })
+ #define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
+ #define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
++#define readsb(p,d,l) ({ __raw_readsb(p,d,l); __iormb(); })
++#define readsw(p,d,l) ({ __raw_readsw(p,d,l); __iormb(); })
++#define readsl(p,d,l) ({ __raw_readsl(p,d,l); __iormb(); })
+
+ #define writeb(v,c) ({ __iowmb(); writeb_relaxed(v,c); })
+ #define writew(v,c) ({ __iowmb(); writew_relaxed(v,c); })
+ #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); })
++#define writesb(p,d,l) ({ __iowmb(); __raw_writesb(p,d,l); })
++#define writesw(p,d,l) ({ __iowmb(); __raw_writesw(p,d,l); })
++#define writesl(p,d,l) ({ __iowmb(); __raw_writesl(p,d,l); })
+
+ /*
+ * Relaxed API for drivers which can handle barrier ordering themselves
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch b/patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch
new file mode 100644
index 0000000000..7bdd916bed
--- /dev/null
+++ b/patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch
@@ -0,0 +1,64 @@
+From: Toni Peltonen <peltzi@peltzi.fi>
+Date: Tue, 27 Nov 2018 16:56:57 +0200
+Subject: [PATCH] bonding: fix 802.3ad state sent to partner when unbinding
+ slave
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4
+
+[ Upstream commit 3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4 ]
+
+Previously when unbinding a slave the 802.3ad implementation only told
+partner that the port is not suitable for aggregation by setting the port
+aggregation state from aggregatable to individual. This is not enough. If the
+physical layer still stays up and we only unbinded this port from the bond there
+is nothing in the aggregation status alone to prevent the partner from sending
+traffic towards us. To ensure that the partner doesn't consider this
+port at all anymore we should also disable collecting and distributing to
+signal that this actor is going away. Also clear AD_STATE_SYNCHRONIZATION to
+ensure partner exits collecting + distributing state.
+
+I have tested this behaviour againts Arista EOS switches with mlx5 cards
+(physical link stays up even when interface is down) and simulated
+the same situation virtually Linux <-> Linux with two network namespaces
+running two veth device pairs. In both cases setting aggregation to
+individual doesn't alone prevent traffic from being to sent towards this
+port given that the link stays up in partners end. Partner still keeps
+it's end in collecting + distributing state and continues until timeout is
+reached. In most cases this means we are losing the traffic partner sends
+towards our port while we wait for timeout. This is most visible with slow
+periodic time (LACP rate slow).
+
+Other open source implementations like Open VSwitch and libreswitch, and
+vendor implementations like Arista EOS, seem to disable collecting +
+distributing to when doing similar port disabling/detaching/removing change.
+With this patch kernel implementation would behave the same way and ensure
+partner doesn't consider our actor viable anymore.
+
+Signed-off-by: Toni Peltonen <peltzi@peltzi.fi>
+Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Acked-by: Jonathan Toppins <jtoppins@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/bonding/bond_3ad.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index 940e2ebbdea8..399c627b15cc 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -2011,6 +2011,9 @@ void bond_3ad_unbind_slave(struct slave *slave)
+ aggregator->aggregator_identifier);
+
+ /* Tell the partner that this port is not suitable for aggregation */
++ port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION;
++ port->actor_oper_port_state &= ~AD_STATE_COLLECTING;
++ port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING;
+ port->actor_oper_port_state &= ~AD_STATE_AGGREGATION;
+ __update_lacpdu_from_port(port);
+ ad_lacpdu_send(port);
+--
+2.20.1
+
diff --git a/patches.fixes/SUNRPC-Fix-a-potential-race-in-xprt_connect.patch b/patches.kernel.org/4.4.169-025-SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
index a7d796ec7a..34a8c8e104 100644
--- a/patches.fixes/SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
+++ b/patches.kernel.org/4.4.169-025-SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
@@ -1,9 +1,11 @@
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Sat, 1 Dec 2018 23:18:00 -0500
Subject: [PATCH] SUNRPC: Fix a potential race in xprt_connect()
+Patch-mainline: 4.4.169
+References: bnc#1012382 git-fixes
Git-commit: 0a9a4304f3614e25d9de9b63502ca633c01c0d70
-Patch-mainline: v4.20
-References: git-fixes
+
+[ Upstream commit 0a9a4304f3614e25d9de9b63502ca633c01c0d70 ]
If an asynchronous connection attempt completes while another task is
in xprt_connect(), then the call to rpc_sleep_on() could end up
@@ -14,12 +16,14 @@ can be no asynchronous connection attempts still in progress.
Fixes: 0b9e79431377d ("SUNRPC: Move the test for XPRT_CONNECTING into...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
-Acked-by: NeilBrown <neilb@suse.com>
-
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- net/sunrpc/xprt.c | 11 +++++++++--
+ net/sunrpc/xprt.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 2e98f4a243e5..112c191b8336 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -758,8 +758,15 @@ void xprt_connect(struct rpc_task *task)
@@ -40,3 +44,6 @@ Acked-by: NeilBrown <neilb@suse.com>
}
xprt_release_write(xprt, task);
}
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch b/patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch
new file mode 100644
index 0000000000..7112dde3af
--- /dev/null
+++ b/patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch
@@ -0,0 +1,34 @@
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:30:40 -0500
+Subject: [PATCH] sbus: char: add of_node_put()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 87d81a23e24f24ebe014891e8bdf3ff8785031e8
+
+[ Upstream commit 87d81a23e24f24ebe014891e8bdf3ff8785031e8 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/sbus/char/display7seg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
+index 33fbe8249fd5..044cffbc45e8 100644
+--- a/drivers/sbus/char/display7seg.c
++++ b/drivers/sbus/char/display7seg.c
+@@ -221,6 +221,7 @@ static int d7s_probe(struct platform_device *op)
+ dev_set_drvdata(&op->dev, p);
+ d7s_device = p;
+ err = 0;
++ of_node_put(opts);
+
+ out:
+ return err;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch b/patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch
new file mode 100644
index 0000000000..25ac26b229
--- /dev/null
+++ b/patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch
@@ -0,0 +1,37 @@
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:38:26 -0500
+Subject: [PATCH] drivers/sbus/char: add of_node_put()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100
+
+[ Upstream commit 6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/sbus/char/envctrl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
+index 5609b602c54d..baa9b322520b 100644
+--- a/drivers/sbus/char/envctrl.c
++++ b/drivers/sbus/char/envctrl.c
+@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp,
+ for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) {
+ pchild->mon_type[len] = ENVCTRL_NOMON;
+ }
++ of_node_put(root_node);
+ return;
+ }
++ of_node_put(root_node);
+ }
+
+ /* Get the monitor channels. */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch b/patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch
new file mode 100644
index 0000000000..b52ebce89c
--- /dev/null
+++ b/patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch
@@ -0,0 +1,36 @@
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Wed, 21 Nov 2018 10:22:54 -0500
+Subject: [PATCH] drivers/tty: add missing of_node_put()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: dac097c4546e4c5b16dd303a1e97c1d319c8ab3e
+
+[ Upstream commit dac097c4546e4c5b16dd303a1e97c1d319c8ab3e ]
+
+of_find_node_by_path() acquires a reference to the node
+returned by it and that reference needs to be dropped by its caller.
+This place is not doing this, so fix it.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/serial/suncore.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c
+index 127472bd6a7c..209f314745ab 100644
+--- a/drivers/tty/serial/suncore.c
++++ b/drivers/tty/serial/suncore.c
+@@ -111,6 +111,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
+ mode = of_get_property(dp, mode_prop, NULL);
+ if (!mode)
+ mode = "9600,8,n,1,-";
++ of_node_put(dp);
+ }
+
+ cflag = CREAD | HUPCL | CLOCAL;
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch b/patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch
new file mode 100644
index 0000000000..fa67ae716a
--- /dev/null
+++ b/patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch
@@ -0,0 +1,34 @@
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Tue, 20 Nov 2018 08:02:49 -0500
+Subject: [PATCH] ide: pmac: add of_node_put()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5
+
+[ Upstream commit a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5 ]
+
+use of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/ide/pmac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
+index 96a345248224..0add5bb3cee8 100644
+--- a/drivers/ide/pmac.c
++++ b/drivers/ide/pmac.c
+@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif)
+ struct device_node *root = of_find_node_by_path("/");
+ const char *model = of_get_property(root, "model", NULL);
+
++ of_node_put(root);
+ /* Get cable type from device-tree. */
+ if (cable && !strncmp(cable, "80-", 3)) {
+ /* Some drives fail to detect 80c cable in PowerBook */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch b/patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch
new file mode 100644
index 0000000000..9284018fd9
--- /dev/null
+++ b/patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch
@@ -0,0 +1,40 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2018 17:51:43 +0300
+Subject: [PATCH] clk: mmp: Off by one in mmp_clk_add()
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 2e85c57493e391b93445c1e0d530b36b95becc64
+
+[ Upstream commit 2e85c57493e391b93445c1e0d530b36b95becc64 ]
+
+The > comparison should be >= or we write one element beyond the end of
+the unit->clk_table[] array.
+
+(The unit->clk_table[] array is allocated in the mmp_clk_init() function
+and it has unit->nr_clks elements).
+
+Fixes: 4661fda10f8b ("clk: mmp: add basic support functions for DT support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/clk/mmp/clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mmp/clk.c b/drivers/clk/mmp/clk.c
+index 61893fe73251..18b6c9b55b95 100644
+--- a/drivers/clk/mmp/clk.c
++++ b/drivers/clk/mmp/clk.c
+@@ -182,7 +182,7 @@ void mmp_clk_add(struct mmp_clk_unit *unit, unsigned int id,
+ pr_err("CLK %d has invalid pointer %p\n", id, clk);
+ return;
+ }
+- if (id > unit->nr_clks) {
++ if (id >= unit->nr_clks) {
+ pr_err("CLK %d is invalid\n", id);
+ return;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch b/patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch
new file mode 100644
index 0000000000..526b19e24a
--- /dev/null
+++ b/patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch
@@ -0,0 +1,70 @@
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 3 Dec 2018 11:24:30 -0800
+Subject: [PATCH] Input: omap-keypad - fix keyboard debounce configuration
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 6c3516fed7b61a3527459ccfa67fab130d910610
+
+[ Upstream commit 6c3516fed7b61a3527459ccfa67fab130d910610 ]
+
+I noticed that the Android v3.0.8 kernel on droid4 is using different
+keypad values from the mainline kernel and does not have issues with
+keys occasionally being stuck until pressed again. Turns out there was
+an earlier patch posted to fix this as "Input: omap-keypad: errata i689:
+Correct debounce time", but it was never reposted to fix use macros
+for timing calculations.
+
+This updated version is using macros, and also fixes the use of the
+input clock rate to use 32768KiHz instead of 32000KiHz. And we want to
+use the known good Android kernel values of 3 and 6 instead of 2 and 6
+in the earlier patch.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/input/keyboard/omap4-keypad.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index 6639b2b8528a..f78c464899db 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -60,8 +60,18 @@
+
+ /* OMAP4 values */
+ #define OMAP4_VAL_IRQDISABLE 0x0
+-#define OMAP4_VAL_DEBOUNCINGTIME 0x7
+-#define OMAP4_VAL_PVT 0x7
++
++/*
++ * Errata i689: If a key is released for a time shorter than debounce time,
++ * the keyboard will idle and never detect the key release. The workaround
++ * is to use at least a 12ms debounce time. See omap5432 TRM chapter
++ * "26.4.6.2 Keyboard Controller Timer" for more information.
++ */
++#define OMAP4_KEYPAD_PTV_DIV_128 0x6
++#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv) \
++ ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1)
++#define OMAP4_VAL_DEBOUNCINGTIME_16MS \
++ OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128)
+
+ enum {
+ KBD_REVISION_OMAP4 = 0,
+@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input)
+
+ kbd_writel(keypad_data, OMAP4_KBD_CTRL,
+ OMAP4_DEF_CTRL_NOSOFTMODE |
+- (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT));
++ (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT));
+ kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME,
+- OMAP4_VAL_DEBOUNCINGTIME);
++ OMAP4_VAL_DEBOUNCINGTIME_16MS);
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch b/patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch
new file mode 100644
index 0000000000..b1ec401811
--- /dev/null
+++ b/patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch
@@ -0,0 +1,37 @@
+From: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
+Date: Sun, 2 Dec 2018 12:47:08 +0200
+Subject: [PATCH] libata: whitelist all SAMSUNG MZ7KM* solid-state disks
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: fd6f32f78645db32b6b95a42e45da2ddd6de0e67
+
+[ Upstream commit fd6f32f78645db32b6b95a42e45da2ddd6de0e67 ]
+
+These devices support read zero after trim (RZAT), as they advertise to
+the OS. However, the OS doesn't believe the SSDs unless they are
+explicitly whitelisted.
+
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/ata/libata-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index ba514fa733de..d543172b20b3 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4297,6 +4297,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "SAMSUNG*MZ7KM*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+ /*
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch b/patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch
new file mode 100644
index 0000000000..6340709552
--- /dev/null
+++ b/patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch
@@ -0,0 +1,55 @@
+From: Anderson Luiz Alves <alacn1@gmail.com>
+Date: Fri, 30 Nov 2018 21:58:36 -0200
+Subject: [PATCH] mv88e6060: disable hardware level MAC learning
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a74515604a7b171f2702bdcbd1e231225fb456d0
+
+[ Upstream commit a74515604a7b171f2702bdcbd1e231225fb456d0 ]
+
+Disable hardware level MAC learning because it breaks station roaming.
+When enabled it drops all frames that arrive from a MAC address
+that is on a different port at learning table.
+
+Signed-off-by: Anderson Luiz Alves <alacn1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/dsa/mv88e6060.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
+index 0527f485c3dc..973fcd442aea 100644
+--- a/drivers/net/dsa/mv88e6060.c
++++ b/drivers/net/dsa/mv88e6060.c
+@@ -98,8 +98,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds)
+ /* Reset the switch. */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+ GLOBAL_ATU_CONTROL_SWRESET |
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ /* Wait up to one second for reset to complete. */
+ timeout = jiffies + 1 * HZ;
+@@ -124,13 +123,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds)
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536);
+
+- /* Enable automatic address learning, set the address
+- * database size to 1024 entries, and set the default aging
+- * time to 5 minutes.
++ /* Disable automatic address learning.
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ return 0;
+ }
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch b/patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch
new file mode 100644
index 0000000000..4b2df5d223
--- /dev/null
+++ b/patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch
@@ -0,0 +1,77 @@
+From: Chris Cole <chris@sageembedded.com>
+Date: Fri, 23 Nov 2018 12:20:45 +0100
+Subject: [PATCH] ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned
+ address handling
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: a1208f6a822ac29933e772ef1f637c5d67838da9
+
+[ Upstream commit a1208f6a822ac29933e772ef1f637c5d67838da9 ]
+
+This patch addresses possible memory corruption when
+v7_dma_inv_range(start_address, end_address) address parameters are not
+aligned to whole cache lines. This function issues "invalidate" cache
+management operations to all cache lines from start_address (inclusive)
+to end_address (exclusive). When start_address and/or end_address are
+not aligned, the start and/or end cache lines are first issued "clean &
+invalidate" operation. The assumption is this is done to ensure that any
+dirty data addresses outside the address range (but part of the first or
+last cache lines) are cleaned/flushed so that data is not lost, which
+could happen if just an invalidate is issued.
+
+The problem is that these first/last partial cache lines are issued
+"clean & invalidate" and then "invalidate". This second "invalidate" is
+not required and worse can cause "lost" writes to addresses outside the
+address range but part of the cache line. If another component writes to
+its part of the cache line between the "clean & invalidate" and
+"invalidate" operations, the write can get lost. This fix is to remove
+the extra "invalidate" operation when unaligned addressed are used.
+
+A kernel module is available that has a stress test to reproduce the
+issue and a unit test of the updated v7_dma_inv_range(). It can be
+downloaded from
+http://ftp.sageembedded.com/outgoing/linux/cache-test-20181107.tgz.
+
+v7_dma_inv_range() is call by dmac_[un]map_area(addr, len, direction)
+when the direction is DMA_FROM_DEVICE. One can (I believe) successfully
+argue that DMA from a device to main memory should use buffers aligned
+to cache line size, because the "clean & invalidate" might overwrite
+data that the device just wrote using DMA. But if a driver does use
+unaligned buffers, at least this fix will prevent memory corruption
+outside the buffer.
+
+Signed-off-by: Chris Cole <chris@sageembedded.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/arm/mm/cache-v7.S | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
+index a134d8a13d00..11d699af30ed 100644
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -359,14 +359,16 @@ v7_dma_inv_range:
+ ALT_UP(W(nop))
+ #endif
+ mcrne p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line
++ addne r0, r0, r2
+
+ tst r1, r3
+ bic r1, r1, r3
+ mcrne p15, 0, r1, c7, c14, 1 @ clean & invalidate D / U line
+-1:
+- mcr p15, 0, r0, c7, c6, 1 @ invalidate D / U line
+- add r0, r0, r2
+ cmp r0, r1
++1:
++ mcrlo p15, 0, r0, c7, c6, 1 @ invalidate D / U line
++ addlo r0, r0, r2
++ cmplo r0, r1
+ blo 1b
+ dsb st
+ ret lr
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch b/patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch
new file mode 100644
index 0000000000..f7523465d1
--- /dev/null
+++ b/patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch
@@ -0,0 +1,38 @@
+From: Steve French <stfrench@microsoft.com>
+Date: Sat, 3 Nov 2018 15:02:44 -0500
+Subject: [PATCH] cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy
+ (insecure cifs)
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 6e785302dad32228819d8066e5376acd15d0e6ba
+
+[ Upstream commit 6e785302dad32228819d8066e5376acd15d0e6ba ]
+
+Missing a dependency. Shouldn't show cifs posix extensions
+in Kconfig if CONFIG_CIFS_ALLOW_INSECURE_DIALECTS (ie SMB1
+protocol) is disabled.
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/cifs/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
+index e7b478b49985..8bef27b8f85d 100644
+--- a/fs/cifs/Kconfig
++++ b/fs/cifs/Kconfig
+@@ -111,7 +111,7 @@ config CIFS_XATTR
+
+ config CIFS_POSIX
+ bool "CIFS POSIX Extensions"
+- depends on CIFS_XATTR
++ depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR
+ help
+ Enabling this option will cause the cifs client to attempt to
+ negotiate a newer dialect with servers, such as Samba 3.0.5
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch b/patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch
new file mode 100644
index 0000000000..761038d83e
--- /dev/null
+++ b/patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch
@@ -0,0 +1,176 @@
+From: "Adamski, Krzysztof (Nokia - PL/Wroclaw)" <krzysztof.adamski@nokia.com>
+Date: Fri, 16 Nov 2018 13:24:41 +0000
+Subject: [PATCH] i2c: axxia: properly handle master timeout
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 6c7f25cae54b840302e4f1b371dbf318fbf09ab2
+
+[ Upstream commit 6c7f25cae54b840302e4f1b371dbf318fbf09ab2 ]
+
+According to Intel (R) Axxia TM Lionfish Communication Processor
+Peripheral Subsystem Hardware Reference Manual, the AXXIA I2C module
+have a programmable Master Wait Timer, which among others, checks the
+time between commands send in manual mode. When a timeout (25ms) passes,
+TSS bit is set in Master Interrupt Status register and a Stop command is
+issued by the hardware.
+
+The axxia_i2c_xfer(), does not properly handle this situation, however.
+For each message a separate axxia_i2c_xfer_msg() is called and this
+function incorrectly assumes that any interrupt might happen only when
+waiting for completion. This is mostly correct but there is one
+exception - a master timeout can trigger if enough time has passed
+between individual transfers. It will, by definition, happen between
+transfers when the interrupts are disabled by the code. If that happens,
+the hardware issues Stop command.
+
+The interrupt indicating timeout will not be triggered as soon as we
+enable them since the Master Interrupt Status is cleared when master
+mode is entered again (which happens before enabling irqs) meaning this
+error is lost and the transfer is continued even though the Stop was
+issued on the bus. The subsequent operations completes without error but
+a bogus value (0xFF in case of read) is read as the client device is
+confused because aborted transfer. No error is returned from
+master_xfer() making caller believe that a valid value was read.
+
+To fix the problem, the TSS bit (indicating timeout) in Master Interrupt
+Status register is checked before each transfer. If it is set, there was
+a timeout before this transfer and (as described above) the hardware
+already issued Stop command so the transaction should be aborted thus
+-ETIMEOUT is returned from the master_xfer() callback. In order to be
+sure no timeout was issued we can't just read the status just before
+starting new transaction as there will always be a small window of time
+(few CPU cycles at best) where this might still happen. For this reason
+we have to temporally disable the timer before checking for TSS bit.
+Disabling it will, however, clear the TSS bit so in order to preserve
+that information, we have to read it in ISR so we have to ensure that
+the TSS interrupt is not masked between transfers of one transaction.
+There is no need to call bus recovery or controller reinitialization if
+that happens so it's skipped.
+
+Signed-off-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/i2c/busses/i2c-axxia.c | 40 ++++++++++++++++++++++++----------
+ 1 file changed, 29 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c
+index c335cc7852f9..9c9fd2e87a4b 100644
+--- a/drivers/i2c/busses/i2c-axxia.c
++++ b/drivers/i2c/busses/i2c-axxia.c
+@@ -74,8 +74,7 @@
+ MST_STATUS_ND)
+ #define MST_STATUS_ERR (MST_STATUS_NAK | \
+ MST_STATUS_AL | \
+- MST_STATUS_IP | \
+- MST_STATUS_TSS)
++ MST_STATUS_IP)
+ #define MST_TX_BYTES_XFRD 0x50
+ #define MST_RX_BYTES_XFRD 0x54
+ #define SCL_HIGH_PERIOD 0x80
+@@ -241,7 +240,7 @@ static int axxia_i2c_empty_rx_fifo(struct axxia_i2c_dev *idev)
+ */
+ if (c <= 0 || c > I2C_SMBUS_BLOCK_MAX) {
+ idev->msg_err = -EPROTO;
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ complete(&idev->msg_complete);
+ break;
+ }
+@@ -299,14 +298,19 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
+
+ if (status & MST_STATUS_SCC) {
+ /* Stop completed */
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ complete(&idev->msg_complete);
+ } else if (status & MST_STATUS_SNS) {
+ /* Transfer done */
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
+ axxia_i2c_empty_rx_fifo(idev);
+ complete(&idev->msg_complete);
++ } else if (status & MST_STATUS_TSS) {
++ /* Transfer timeout */
++ idev->msg_err = -ETIMEDOUT;
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
++ complete(&idev->msg_complete);
+ } else if (unlikely(status & MST_STATUS_ERR)) {
+ /* Transfer error */
+ i2c_int_disable(idev, ~0);
+@@ -339,10 +343,10 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ u32 rx_xfer, tx_xfer;
+ u32 addr_1, addr_2;
+ unsigned long time_left;
++ unsigned int wt_value;
+
+ idev->msg = msg;
+ idev->msg_xfrd = 0;
+- idev->msg_err = 0;
+ reinit_completion(&idev->msg_complete);
+
+ if (i2c_m_ten(msg)) {
+@@ -382,9 +386,18 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ else if (axxia_i2c_fill_tx_fifo(idev) != 0)
+ int_mask |= MST_STATUS_TFL;
+
++ wt_value = WT_VALUE(readl(idev->base + WAIT_TIMER_CONTROL));
++ /* Disable wait timer temporarly */
++ writel(wt_value, idev->base + WAIT_TIMER_CONTROL);
++ /* Check if timeout error happened */
++ if (idev->msg_err)
++ goto out;
++
+ /* Start manual mode */
+ writel(CMD_MANUAL, idev->base + MST_COMMAND);
+
++ writel(WT_EN | wt_value, idev->base + WAIT_TIMER_CONTROL);
++
+ i2c_int_enable(idev, int_mask);
+
+ time_left = wait_for_completion_timeout(&idev->msg_complete,
+@@ -395,13 +408,15 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ if (readl(idev->base + MST_COMMAND) & CMD_BUSY)
+ dev_warn(idev->dev, "busy after xfer\n");
+
+- if (time_left == 0)
++ if (time_left == 0) {
+ idev->msg_err = -ETIMEDOUT;
+-
+- if (idev->msg_err == -ETIMEDOUT)
+ i2c_recover_bus(&idev->adapter);
++ axxia_i2c_init(idev);
++ }
+
+- if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO)
++out:
++ if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO &&
++ idev->msg_err != -ETIMEDOUT)
+ axxia_i2c_init(idev);
+
+ return idev->msg_err;
+@@ -409,7 +424,7 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+
+ static int axxia_i2c_stop(struct axxia_i2c_dev *idev)
+ {
+- u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC;
++ u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC | MST_STATUS_TSS;
+ unsigned long time_left;
+
+ reinit_completion(&idev->msg_complete);
+@@ -436,6 +451,9 @@ axxia_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
+ int i;
+ int ret = 0;
+
++ idev->msg_err = 0;
++ i2c_int_enable(idev, MST_STATUS_TSS);
++
+ for (i = 0; ret == 0 && i < num; ++i)
+ ret = axxia_i2c_xfer_msg(idev, &msgs[i]);
+
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch b/patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch
new file mode 100644
index 0000000000..a9f81f0940
--- /dev/null
+++ b/patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch
@@ -0,0 +1,75 @@
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 21 Nov 2018 10:19:55 +0100
+Subject: [PATCH] i2c: scmi: Fix probe error on devices with an empty SMB0001
+ ACPI device node
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 0544ee4b1ad574aec3b6379af5f5cdee42840971
+
+[ Upstream commit 0544ee4b1ad574aec3b6379af5f5cdee42840971 ]
+
+Some AMD based HP laptops have a SMB0001 ACPI device node which does not
+define any methods.
+
+This leads to the following error in dmesg:
+
+[ 5.222731] cmi: probe of SMB0001:00 failed with error -5
+
+This commit makes acpi_smbus_cmi_add() return -ENODEV instead in this case
+silencing the error. In case of a failure of the i2c_add_adapter() call
+this commit now propagates the error from that call instead of -EIO.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/i2c/busses/i2c-scmi.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c
+index efefcfa24a4c..d2178f701b41 100644
+--- a/drivers/i2c/busses/i2c-scmi.c
++++ b/drivers/i2c/busses/i2c-scmi.c
+@@ -364,6 +364,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ {
+ struct acpi_smbus_cmi *smbus_cmi;
+ const struct acpi_device_id *id;
++ int ret;
+
+ smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL);
+ if (!smbus_cmi)
+@@ -385,8 +386,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1,
+ acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL);
+
+- if (smbus_cmi->cap_info == 0)
++ if (smbus_cmi->cap_info == 0) {
++ ret = -ENODEV;
+ goto err;
++ }
+
+ snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name),
+ "SMBus CMI adapter %s",
+@@ -397,7 +400,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
+ smbus_cmi->adapter.dev.parent = &device->dev;
+
+- if (i2c_add_adapter(&smbus_cmi->adapter)) {
++ ret = i2c_add_adapter(&smbus_cmi->adapter);
++ if (ret) {
+ dev_err(&device->dev, "Couldn't register adapter!\n");
+ goto err;
+ }
+@@ -407,7 +411,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ err:
+ kfree(smbus_cmi);
+ device->driver_data = NULL;
+- return -EIO;
++ return ret;
+ }
+
+ static int acpi_smbus_cmi_remove(struct acpi_device *device)
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch b/patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch
new file mode 100644
index 0000000000..58021e83ee
--- /dev/null
+++ b/patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch
@@ -0,0 +1,36 @@
+From: Guy Shapiro <guy.shapiro@mobi-wize.com>
+Date: Sun, 29 Jan 2017 11:57:19 +0200
+Subject: [PATCH] rtc: snvs: add a missing write sync
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 7bb633b1a9812a6b9f3e49d0cf17f60a633914e5
+
+[ Upstream commit 7bb633b1a9812a6b9f3e49d0cf17f60a633914e5 ]
+
+The clear of the LPTA_EN flag should be synced before writing to the
+alarm register. Omitting this synchronization creates a race when
+trying to change existing alarm.
+
+Signed-off-by: Guy Shapiro <guy.shapiro@mobi-wize.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/rtc/rtc-snvs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
+index a161fbf6f172..af131682dbc9 100644
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -187,6 +187,7 @@ static int snvs_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ rtc_tm_to_time(alrm_tm, &time);
+
+ regmap_update_bits(data->regmap, data->offset + SNVS_LPCR, SNVS_LPCR_LPTA_EN, 0);
++ rtc_write_sync_lp(data);
+ regmap_write(data->regmap, data->offset + SNVS_LPTAR, time);
+
+ /* Clear alarm interrupt status bit */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch b/patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch
new file mode 100644
index 0000000000..da68c4d213
--- /dev/null
+++ b/patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch
@@ -0,0 +1,199 @@
+From: Trent Piepho <tpiepho@impinj.com>
+Date: Wed, 16 May 2018 16:45:51 -0700
+Subject: [PATCH] rtc: snvs: Add timeouts to avoid kernel lockups
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: cd7f3a249dbed2858e6c2f30e5be7f1f7a709ee2
+
+[ Upstream commit cd7f3a249dbed2858e6c2f30e5be7f1f7a709ee2 ]
+
+In order to read correctly from asynchronously updated RTC registers,
+it's necessary to read repeatedly until their values do not change from
+read to read. It's also necessary to wait for three RTC clock ticks for
+certain operations. There are no timeouts in this code and these
+operations could possibly loop forever.
+
+To avoid kernel hangs, put in timeouts.
+
+The iMX7d can be configured to stop the SRTC on a tamper event, which
+will lockup the kernel inside this driver as described above.
+
+These hangs can happen when running under qemu, which doesn't emulate
+the SNVS RTC, though currently the driver will refuse to load on qemu
+due to a timeout in the driver probe method.
+
+It could also happen if the SRTC block where somehow placed into reset
+or the slow speed clock that drives the SRTC counter (but not the CPU)
+were to stop.
+
+The symptoms on a two core iMX7d are a work queue hang on
+rtc_timer_do_work(), which eventually blocks a systemd fsnotify
+operation that triggers a work queue flush, causing systemd to hang and
+thus causing all services that should be started by systemd, like a
+console getty, to fail to start or stop.
+
+Also optimize the wait code to wait less. It only needs to wait for the
+clock to advance three ticks, not to see it change three times.
+
+Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Fabio Estevam <fabio.estevam@nxp.com>
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Signed-off-by: Trent Piepho <tpiepho@impinj.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/rtc/rtc-snvs.c | 105 +++++++++++++++++++++++++++--------------
+ 1 file changed, 70 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
+index af131682dbc9..63ad5b543f14 100644
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -47,49 +47,83 @@ struct snvs_rtc_data {
+ struct clk *clk;
+ };
+
++/* Read 64 bit timer register, which could be in inconsistent state */
++static u64 rtc_read_lpsrt(struct snvs_rtc_data *data)
++{
++ u32 msb, lsb;
++
++ regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &msb);
++ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &lsb);
++ return (u64)msb << 32 | lsb;
++}
++
++/* Read the secure real time counter, taking care to deal with the cases of the
++ * counter updating while being read.
++ */
+ static u32 rtc_read_lp_counter(struct snvs_rtc_data *data)
+ {
+ u64 read1, read2;
+- u32 val;
++ unsigned int timeout = 100;
+
++ /* As expected, the registers might update between the read of the LSB
++ * reg and the MSB reg. It's also possible that one register might be
++ * in partially modified state as well.
++ */
++ read1 = rtc_read_lpsrt(data);
+ do {
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &val);
+- read1 = val;
+- read1 <<= 32;
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &val);
+- read1 |= val;
+-
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &val);
+- read2 = val;
+- read2 <<= 32;
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &val);
+- read2 |= val;
+- } while (read1 != read2);
++ read2 = read1;
++ read1 = rtc_read_lpsrt(data);
++ } while (read1 != read2 && --timeout);
++ if (!timeout)
++ dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n");
+
+ /* Convert 47-bit counter to 32-bit raw second count */
+ return (u32) (read1 >> CNTR_TO_SECS_SH);
+ }
+
+-static void rtc_write_sync_lp(struct snvs_rtc_data *data)
++/* Just read the lsb from the counter, dealing with inconsistent state */
++static int rtc_read_lp_counter_lsb(struct snvs_rtc_data *data, u32 *lsb)
+ {
+- u32 count1, count2, count3;
+- int i;
+-
+- /* Wait for 3 CKIL cycles */
+- for (i = 0; i < 3; i++) {
+- do {
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1);
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count2);
+- } while (count1 != count2);
+-
+- /* Now wait until counter value changes */
+- do {
+- do {
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count2);
+- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count3);
+- } while (count2 != count3);
+- } while (count3 == count1);
++ u32 count1, count2;
++ unsigned int timeout = 100;
++
++ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1);
++ do {
++ count2 = count1;
++ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1);
++ } while (count1 != count2 && --timeout);
++ if (!timeout) {
++ dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n");
++ return -ETIMEDOUT;
+ }
++
++ *lsb = count1;
++ return 0;
++}
++
++static int rtc_write_sync_lp(struct snvs_rtc_data *data)
++{
++ u32 count1, count2;
++ u32 elapsed;
++ unsigned int timeout = 1000;
++ int ret;
++
++ ret = rtc_read_lp_counter_lsb(data, &count1);
++ if (ret)
++ return ret;
++
++ /* Wait for 3 CKIL cycles, about 61.0-91.5 ┬Ás */
++ do {
++ ret = rtc_read_lp_counter_lsb(data, &count2);
++ if (ret)
++ return ret;
++ elapsed = count2 - count1; /* wrap around _is_ handled! */
++ } while (elapsed < 3 && --timeout);
++ if (!timeout) {
++ dev_err(&data->rtc->dev, "Timeout waiting for LPSRT Counter to change\n");
++ return -ETIMEDOUT;
++ }
++ return 0;
+ }
+
+ static int snvs_rtc_enable(struct snvs_rtc_data *data, bool enable)
+@@ -173,9 +207,7 @@ static int snvs_rtc_alarm_irq_enable(struct device *dev, unsigned int enable)
+ (SNVS_LPCR_LPTA_EN | SNVS_LPCR_LPWUI_EN),
+ enable ? (SNVS_LPCR_LPTA_EN | SNVS_LPCR_LPWUI_EN) : 0);
+
+- rtc_write_sync_lp(data);
+-
+- return 0;
++ return rtc_write_sync_lp(data);
+ }
+
+ static int snvs_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+@@ -183,11 +215,14 @@ static int snvs_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ struct snvs_rtc_data *data = dev_get_drvdata(dev);
+ struct rtc_time *alrm_tm = &alrm->time;
+ unsigned long time;
++ int ret;
+
+ rtc_tm_to_time(alrm_tm, &time);
+
+ regmap_update_bits(data->regmap, data->offset + SNVS_LPCR, SNVS_LPCR_LPTA_EN, 0);
+- rtc_write_sync_lp(data);
++ ret = rtc_write_sync_lp(data);
++ if (ret)
++ return ret;
+ regmap_write(data->regmap, data->offset + SNVS_LPTAR, time);
+
+ /* Clear alarm interrupt status bit */
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch b/patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch
new file mode 100644
index 0000000000..b8215c7c7f
--- /dev/null
+++ b/patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch
@@ -0,0 +1,57 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 May 2016 09:27:37 +0300
+Subject: [PATCH] ALSA: isa/wavefront: prevent some out of bound writes
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: 84d7a4470dbac0dd9389050100b54a1625d04264
+
+[ Upstream commit 84d7a4470dbac0dd9389050100b54a1625d04264 ]
+
+"header->number" can be up to USHRT_MAX and it comes from the ioctl so
+it needs to be capped.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ sound/isa/wavefront/wavefront_synth.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
+index 69f76ff5693d..718d5e3b7806 100644
+--- a/sound/isa/wavefront/wavefront_synth.c
++++ b/sound/isa/wavefront/wavefront_synth.c
+@@ -785,6 +785,9 @@ wavefront_send_patch (snd_wavefront_t *dev, wavefront_patch_info *header)
+ DPRINT (WF_DEBUG_LOAD_PATCH, "downloading patch %d\n",
+ header->number);
+
++ if (header->number >= ARRAY_SIZE(dev->patch_status))
++ return -EINVAL;
++
+ dev->patch_status[header->number] |= WF_SLOT_FILLED;
+
+ bptr = buf;
+@@ -809,6 +812,9 @@ wavefront_send_program (snd_wavefront_t *dev, wavefront_patch_info *header)
+ DPRINT (WF_DEBUG_LOAD_PATCH, "downloading program %d\n",
+ header->number);
+
++ if (header->number >= ARRAY_SIZE(dev->prog_status))
++ return -EINVAL;
++
+ dev->prog_status[header->number] = WF_SLOT_USED;
+
+ /* XXX need to zero existing SLOT_USED bit for program_status[i]
+@@ -898,6 +904,9 @@ wavefront_send_sample (snd_wavefront_t *dev,
+ header->number = x;
+ }
+
++ if (header->number >= WF_MAX_SAMPLE)
++ return -EINVAL;
++
+ if (header->size) {
+
+ /* XXX it's a debatable point whether or not RDONLY semantics
+--
+2.20.1
+
diff --git a/patches.kernel.org/4.4.169-041-Linux-4.4.169.patch b/patches.kernel.org/4.4.169-041-Linux-4.4.169.patch
new file mode 100644
index 0000000000..4ec2ea7650
--- /dev/null
+++ b/patches.kernel.org/4.4.169-041-Linux-4.4.169.patch
@@ -0,0 +1,27 @@
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 21 Dec 2018 14:09:54 +0100
+Subject: [PATCH] Linux 4.4.169
+References: bnc#1012382
+Patch-mainline: 4.4.169
+Git-commit: ba0da581b466dcd333eeb326919a698116926258
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 082f82471b51..0d41b0626c0c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 168
++SUBLEVEL = 169
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+
+--
+2.20.1
+
diff --git a/series.conf b/series.conf
index 03b0010f88..ebd8efad24 100644
--- a/series.conf
+++ b/series.conf
@@ -4789,7 +4789,6 @@
patches.kernel.org/4.4.164-159-drm-dp_mst-Check-if-primary-mstb-is-null.patch
patches.kernel.org/4.4.164-160-drm-i915-hdmi-Add-HDMI-2.0-audio-clock-recove.patch
patches.kernel.org/4.4.164-161-Linux-4.4.164.patch
-
patches.kernel.org/4.4.165-001-flow_dissector-do-not-dissect-l4-ports-for-fr.patch
patches.kernel.org/4.4.165-002-ip_tunnel-don-t-force-DF-when-MTU-is-locked.patch
patches.kernel.org/4.4.165-003-net-gro-reset-skb-pkt_type-in-napi_reuse_skb.patch
@@ -5126,6 +5125,47 @@
patches.kernel.org/4.4.168-087-rocker-fix-rocker_tlv_put_-functions-for-KASA.patch
patches.kernel.org/4.4.168-088-selftests-Move-networking-timestamping-from-D.patch
patches.kernel.org/4.4.168-089-Linux-4.4.168.patch
+ patches.kernel.org/4.4.169-001-lib-interval_tree_test.c-make-test-options-mo.patch
+ patches.kernel.org/4.4.169-002-lib-interval_tree_test.c-allow-full-tree-sear.patch
+ patches.kernel.org/4.4.169-003-lib-rbtree_test.c-make-input-module-parameter.patch
+ patches.kernel.org/4.4.169-004-lib-rbtree-test-lower-default-params.patch
+ patches.kernel.org/4.4.169-005-lib-interval_tree_test.c-allow-users-to-limit.patch
+ patches.kernel.org/4.4.169-006-timer-debug-Change-proc-timer_list-from-0444-.patch
+ patches.kernel.org/4.4.169-007-powerpc-boot-Fix-random-libfdt-related-build-.patch
+ patches.kernel.org/4.4.169-008-pinctrl-sunxi-a83t-Fix-IRQ-offset-typo-for-PH.patch
+ patches.kernel.org/4.4.169-009-aio-fix-spectre-gadget-in-lookup_ioctx.patch
+ patches.kernel.org/4.4.169-010-MMC-OMAP-fix-broken-MMC-on-OMAP15XX-OMAP5910-.patch
+ patches.kernel.org/4.4.169-011-tracing-Fix-memory-leak-in-set_trigger_filter.patch
+ patches.kernel.org/4.4.169-012-tracing-Fix-memory-leak-of-instance-function-.patch
+ patches.kernel.org/4.4.169-013-powerpc-msi-Fix-NULL-pointer-access-in-teardo.patch
+ patches.kernel.org/4.4.169-014-Revert-drm-rockchip-Allow-driver-to-be-shutdo.patch
+ patches.kernel.org/4.4.169-015-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_con.patch
+ patches.kernel.org/4.4.169-016-mac80211-don-t-WARN-on-bad-WMM-parameters-fro.patch
+ patches.kernel.org/4.4.169-017-mac80211-Fix-condition-validating-WMM-IE.patch
+ patches.kernel.org/4.4.169-018-mac80211_hwsim-fix-module-init-error-paths-fo.patch
+ patches.kernel.org/4.4.169-019-scsi-libiscsi-Fix-NULL-pointer-dereference-in.patch
+ patches.kernel.org/4.4.169-020-scsi-vmw_pscsi-Rearrange-code-to-avoid-multip.patch
+ patches.kernel.org/4.4.169-021-x86-earlyprintk-efi-Fix-infinite-loop-on-some.patch
+ patches.kernel.org/4.4.169-022-drm-msm-Grab-a-vblank-reference-when-waiting-.patch
+ patches.kernel.org/4.4.169-023-ARC-io.h-Implement-reads-x-writes-x.patch
+ patches.kernel.org/4.4.169-024-bonding-fix-802.3ad-state-sent-to-partner-whe.patch
+ patches.kernel.org/4.4.169-025-SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
+ patches.kernel.org/4.4.169-026-sbus-char-add-of_node_put.patch
+ patches.kernel.org/4.4.169-027-drivers-sbus-char-add-of_node_put.patch
+ patches.kernel.org/4.4.169-028-drivers-tty-add-missing-of_node_put.patch
+ patches.kernel.org/4.4.169-029-ide-pmac-add-of_node_put.patch
+ patches.kernel.org/4.4.169-030-clk-mmp-Off-by-one-in-mmp_clk_add.patch
+ patches.kernel.org/4.4.169-031-Input-omap-keypad-fix-keyboard-debounce-confi.patch
+ patches.kernel.org/4.4.169-032-libata-whitelist-all-SAMSUNG-MZ7KM-solid-stat.patch
+ patches.kernel.org/4.4.169-033-mv88e6060-disable-hardware-level-MAC-learning.patch
+ patches.kernel.org/4.4.169-034-ARM-8814-1-mm-improve-fix-ARM-v7_dma_inv_rang.patch
+ patches.kernel.org/4.4.169-035-cifs-In-Kconfig-CONFIG_CIFS_POSIX-needs-depen.patch
+ patches.kernel.org/4.4.169-036-i2c-axxia-properly-handle-master-timeout.patch
+ patches.kernel.org/4.4.169-037-i2c-scmi-Fix-probe-error-on-devices-with-an-e.patch
+ patches.kernel.org/4.4.169-038-rtc-snvs-add-a-missing-write-sync.patch
+ patches.kernel.org/4.4.169-039-rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch
+ patches.kernel.org/4.4.169-040-ALSA-isa-wavefront-prevent-some-out-of-bound-.patch
+ patches.kernel.org/4.4.169-041-Linux-4.4.169.patch
########################################################
# Build fixes that apply to the vanilla kernel too.
@@ -21334,7 +21374,6 @@
patches.drivers/0022-ipmi_ssif-remove-redundant-null-check-on-array-clien.patch
patches.drivers/0023-ipmi-Use-the-proper-default-value-for-register-size-.patch
patches.drivers/0024-ipmi-ssif-Use-i2c_adapter_id-instead-of-adapter-nr.patch
- patches.fixes/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
patches.fixes/mm-make-PR_SET_THP_DISABLE-immediately-active.patch
patches.suse/0001-mm-memory_hotplug-support-movable_node-for-hotplugab.patch
patches.fixes/0001-mm-memory_hotplug-simplify-empty-node-mask-handling-.patch
@@ -22973,7 +23012,6 @@
patches.drivers/ibmvnic-Potential-NULL-dereference-in-clean_one_tx_p.patch
patches.drivers/net-ena-Eliminate-duplicate-barriers-on-weakly-order.patch
patches.drivers/net-mlx5e-Remove-unused-define-MLX5_MPWRQ_STRIDES_PE.patch
- patches.drivers/mac80211-don-t-WARN-on-bad-WMM-parameters-from-buggy
patches.drivers/ibmvnic-Disable-irqs-before-exiting-reset-from-close.patch
patches.drivers/media-au0828-fix-VIDEO_V4L2-dependency
patches.fixes/xfs-Remove-dead-code-from-inode-recover-function.patch
@@ -23200,7 +23238,6 @@
patches.drivers/nvmet-switch-loopback-target-state-to-connecting-whe.patch
patches.arch/powerpc-pseries-Fix-CONFIG_NUMA-n-build.patch
patches.fixes/ceph-fix-rsize-wsize-capping-in-ceph_direct_read_write.patch
- patches.drivers/mac80211-Fix-condition-validating-WMM-IE
patches.drivers/net-mlx5-E-Switch-Include-VF-RDMA-stats-in-vport-sta.patch
patches.drivers/net-mlx5e-Err-if-asked-to-offload-TC-match-on-frag-b.patch
patches.suse/init-fix-false-positives-in-w-x-checking.patch
@@ -23717,14 +23754,12 @@
patches.fixes/0001-fscache-Fix-race-in-fscache_op_complete-due-to-split.patch
patches.fixes/0001-xen-x86-add-diagnostic-printout-to-xen_mc_flush-in-c.patch
patches.fixes/scsi-lpfc-fix-block-guard-enablement-on-sli3-adapters.patch
- patches.fixes/SUNRPC-Fix-a-potential-race-in-xprt_connect.patch
patches.fixes/nvme-validate-controller-state-before-rescheduling-k.patch
patches.drivers/revert-pci-aspm-do-not-initialize-link-state-when-aspm_disabled-is-set
patches.drivers/net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch
patches.fixes/ipv4-ipv6-netfilter-Adjust-the-frag-mem-limit-when-t.patch
patches.drivers/net-mlx4_core-Correctly-set-PFC-param-if-global-paus.patch
patches.drivers/IB-hfi1-Fix-an-out-of-bounds-access-in-get_hw_stats.patch
- patches.fixes/0001-Revert-drm-rockchip-Allow-driver-to-be-shutdown-on-r.patch
patches.arch/ibmvnic-Convert-reset-work-item-mutex-to-spin-lock.patch
patches.arch/ibmvnic-Fix-non-atomic-memory-allocation-in-IRQ-cont.patch
patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch