diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/arc/kernel/entry.S linux-libre-3.16.51-gnu/arch/arc/kernel/entry.S
--- linux-libre-3.16.50-gnu/arch/arc/kernel/entry.S	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/arc/kernel/entry.S	2017-11-26 08:50:43.000000000 -0500
@@ -315,6 +315,12 @@ ENTRY(EV_MachineCheck)
 	lr  r0, [efa]
 	mov r1, sp
 
+	; hardware auto-disables MMU, re-enable it to allow kernel vaddr
+	; access for say stack unwinding of modules for crash dumps
+	lr	r3, [ARC_REG_PID]
+	or	r3, r3, MMU_ENABLE
+	sr	r3, [ARC_REG_PID]
+
 	lsr  	r3, r2, 8
 	bmsk 	r3, r3, 7
 	brne    r3, ECR_C_MCHK_DUP_TLB, 1f
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/arc/mm/tlb.c linux-libre-3.16.51-gnu/arch/arc/mm/tlb.c
--- linux-libre-3.16.50-gnu/arch/arc/mm/tlb.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/arc/mm/tlb.c	2017-11-26 08:50:43.000000000 -0500
@@ -691,9 +691,6 @@ void do_tlb_overlap_fault(unsigned long
 
 	local_irq_save(flags);
 
-	/* re-enable the MMU */
-	write_aux_reg(ARC_REG_PID, MMU_ENABLE | read_aux_reg(ARC_REG_PID));
-
 	/* loop thru all sets of TLB */
 	for (set = 0; set < mmu->sets; set++) {
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/arm/boot/dts/dra7-evm.dts linux-libre-3.16.51-gnu/arch/arm/boot/dts/dra7-evm.dts
--- linux-libre-3.16.50-gnu/arch/arm/boot/dts/dra7-evm.dts	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/arm/boot/dts/dra7-evm.dts	2017-11-26 08:50:43.000000000 -0500
@@ -18,9 +18,17 @@
 		reg = <0x80000000 0x60000000>; /* 1536 MB */
 	};
 
-	mmc2_3v3: fixedregulator-mmc2 {
+	evm_1v8_sw: fixedregulator-evm_1v8 {
 		compatible = "regulator-fixed";
-		regulator-name = "mmc2_3v3";
+		regulator-name = "evm_1v8";
+		vin-supply = <&smps9_reg>;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+	};
+
+	evm_3v3_sw: fixedregulator-evm_3v3_sw {
+		compatible = "regulator-fixed";
+		regulator-name = "evm_3v3_sw";
 		regulator-min-microvolt = <3300000>;
 		regulator-max-microvolt = <3300000>;
 	};
@@ -325,7 +333,7 @@
 
 &mmc2 {
 	status = "okay";
-	vmmc-supply = <&mmc2_3v3>;
+	vmmc-supply = <&evm_1v8_sw>;
 	bus-width = <8>;
 };
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/arm/mach-omap2/omap_device.c linux-libre-3.16.51-gnu/arch/arm/mach-omap2/omap_device.c
--- linux-libre-3.16.50-gnu/arch/arm/mach-omap2/omap_device.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/arm/mach-omap2/omap_device.c	2017-11-26 08:50:43.000000000 -0500
@@ -640,7 +640,6 @@ static int _od_suspend_noirq(struct devi
 
 	if (!ret && !pm_runtime_status_suspended(dev)) {
 		if (pm_generic_runtime_suspend(dev) == 0) {
-			pm_runtime_set_suspended(dev);
 			omap_device_idle(pdev);
 			od->flags |= OMAP_DEVICE_SUSPENDED;
 		}
@@ -657,15 +656,6 @@ static int _od_resume_noirq(struct devic
 	if (od->flags & OMAP_DEVICE_SUSPENDED) {
 		od->flags &= ~OMAP_DEVICE_SUSPENDED;
 		omap_device_enable(pdev);
-		/*
-		 * XXX: we run before core runtime pm has resumed itself. At
-		 * this point in time, we just restore the runtime pm state and
-		 * considering symmetric operations in resume, we donot expect
-		 * to fail. If we failed, something changed in core runtime_pm
-		 * framework OR some device driver messed things up, hence, WARN
-		 */
-		WARN(pm_runtime_set_active(dev),
-		     "Could not set %s runtime state active\n", dev_name(dev));
 		pm_generic_runtime_resume(dev);
 	}
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/arm/mm/fault.c linux-libre-3.16.51-gnu/arch/arm/mm/fault.c
--- linux-libre-3.16.50-gnu/arch/arm/mm/fault.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/arm/mm/fault.c	2017-11-26 08:50:43.000000000 -0500
@@ -315,8 +315,11 @@ retry:
 	 * signal first. We do not need to release the mmap_sem because
 	 * it would already be released in __lock_page_or_retry in
 	 * mm/filemap.c. */
-	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) {
+		if (!user_mode(regs))
+			goto no_context;
 		return 0;
+	}
 
 	/*
 	 * Major/minor page fault accounting is only done on the
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/m68k/platform/coldfire/clk.c linux-libre-3.16.51-gnu/arch/m68k/platform/coldfire/clk.c
--- linux-libre-3.16.50-gnu/arch/m68k/platform/coldfire/clk.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/m68k/platform/coldfire/clk.c	2017-11-26 08:50:43.000000000 -0500
@@ -117,6 +117,9 @@ EXPORT_SYMBOL(clk_put);
 
 unsigned long clk_get_rate(struct clk *clk)
 {
+	if (!clk)
+		return 0;
+
 	return clk->rate;
 }
 EXPORT_SYMBOL(clk_get_rate);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/mips/ar7/clock.c linux-libre-3.16.51-gnu/arch/mips/ar7/clock.c
--- linux-libre-3.16.50-gnu/arch/mips/ar7/clock.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/mips/ar7/clock.c	2017-11-26 08:50:43.000000000 -0500
@@ -430,6 +430,9 @@ EXPORT_SYMBOL(clk_disable);
 
 unsigned long clk_get_rate(struct clk *clk)
 {
+	if (!clk)
+		return 0;
+
 	return clk->rate;
 }
 EXPORT_SYMBOL(clk_get_rate);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/mips/bcm63xx/clk.c linux-libre-3.16.51-gnu/arch/mips/bcm63xx/clk.c
--- linux-libre-3.16.50-gnu/arch/mips/bcm63xx/clk.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/mips/bcm63xx/clk.c	2017-11-26 08:50:43.000000000 -0500
@@ -335,6 +335,9 @@ EXPORT_SYMBOL(clk_disable);
 
 unsigned long clk_get_rate(struct clk *clk)
 {
+	if (!clk)
+		return 0;
+
 	return clk->rate;
 }
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/mips/include/uapi/asm/inst.h linux-libre-3.16.51-gnu/arch/mips/include/uapi/asm/inst.h
--- linux-libre-3.16.50-gnu/arch/mips/include/uapi/asm/inst.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/mips/include/uapi/asm/inst.h	2017-11-26 08:50:43.000000000 -0500
@@ -808,7 +808,7 @@ struct mm16_r3_format {		/* Load from gl
 struct mm16_r5_format {		/* Load/store from stack pointer format */
 	__BITFIELD_FIELD(unsigned int opcode : 6,
 	__BITFIELD_FIELD(unsigned int rt : 5,
-	__BITFIELD_FIELD(signed int simmediate : 5,
+	__BITFIELD_FIELD(unsigned int imm : 5,
 	__BITFIELD_FIELD(unsigned int : 16, /* Ignored */
 	;))))
 };
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/mips/kernel/process.c linux-libre-3.16.51-gnu/arch/mips/kernel/process.c
--- linux-libre-3.16.50-gnu/arch/mips/kernel/process.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/mips/kernel/process.c	2017-11-26 08:50:43.000000000 -0500
@@ -235,13 +235,13 @@ static inline int is_ra_save_ins(union m
 	 *
 	 * microMIPS is way more fun...
 	 */
-	if (mm_insn_16bit(ip->halfword[1])) {
+	if (mm_insn_16bit(ip->word >> 16)) {
 		switch (ip->mm16_r5_format.opcode) {
 		case mm_swsp16_op:
 			if (ip->mm16_r5_format.rt != 31)
 				return 0;
 
-			*poff = ip->mm16_r5_format.simmediate;
+			*poff = ip->mm16_r5_format.imm;
 			*poff = (*poff << 2) / sizeof(ulong);
 			return 1;
 
@@ -314,7 +314,7 @@ static inline int is_jump_ins(union mips
 	 *
 	 * microMIPS is kind of more fun...
 	 */
-	if (mm_insn_16bit(ip->halfword[1])) {
+	if (mm_insn_16bit(ip->word >> 16)) {
 		if ((ip->mm16_r5_format.opcode == mm_pool16c_op &&
 		    (ip->mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op))
 			return 1;
@@ -351,9 +351,9 @@ static inline int is_sp_move_ins(union m
 	 *
 	 * microMIPS is not more fun...
 	 */
-	if (mm_insn_16bit(ip->halfword[1])) {
+	if (mm_insn_16bit(ip->word >> 16)) {
 		return (ip->mm16_r3_format.opcode == mm_pool16d_op &&
-			ip->mm16_r3_format.simmediate && mm_addiusp_func) ||
+			ip->mm16_r3_format.simmediate & mm_addiusp_func) ||
 		       (ip->mm16_r5_format.opcode == mm_pool16d_op &&
 			ip->mm16_r5_format.rt == 29);
 	}
@@ -375,6 +375,7 @@ static int get_frame_info(struct mips_fr
 	bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS);
 	union mips_instruction insn, *ip, *ip_end;
 	const unsigned int max_insns = 128;
+	unsigned int last_insn_size = 0;
 	unsigned int i;
 
 	info->pc_offset = -1;
@@ -386,15 +387,17 @@ static int get_frame_info(struct mips_fr
 
 	ip_end = (void *)ip + info->func_size;
 
-	for (i = 0; i < max_insns && ip < ip_end; i++, ip++) {
+	for (i = 0; i < max_insns && ip < ip_end; i++) {
+		ip = (void *)ip + last_insn_size;
 		if (is_mmips && mm_insn_16bit(ip->halfword[0])) {
-			insn.halfword[0] = 0;
-			insn.halfword[1] = ip->halfword[0];
+			insn.word = ip->halfword[0] << 16;
+			last_insn_size = 2;
 		} else if (is_mmips) {
-			insn.halfword[0] = ip->halfword[1];
-			insn.halfword[1] = ip->halfword[0];
+			insn.word = ip->halfword[0] << 16 | ip->halfword[1];
+			last_insn_size = 4;
 		} else {
 			insn.word = ip->word;
+			last_insn_size = 4;
 		}
 
 		if (is_jump_ins(&insn))
@@ -404,20 +407,22 @@ static int get_frame_info(struct mips_fr
 			if (is_sp_move_ins(&insn))
 			{
 #ifdef CONFIG_CPU_MICROMIPS
-				if (mm_insn_16bit(ip->halfword[0]))
+				if (mm_insn_16bit(insn.word >> 16))
 				{
 					unsigned short tmp;
 
-					if (ip->halfword[0] & mm_addiusp_func)
+					if (ip->mm16_r3_format.simmediate & mm_addiusp_func)
 					{
-						tmp = (((ip->halfword[0] >> 1) & 0x1ff) << 2);
-						info->frame_size = -(signed short)(tmp | ((tmp & 0x100) ? 0xfe00 : 0));
+						tmp = ip->mm_b0_format.simmediate >> 1;
+						tmp = ((tmp & 0x1ff) ^ 0x100) - 0x100;
+						/* 0x0,0x1,0x1fe,0x1ff are special */
+						if ((tmp + 2) < 4)
+							tmp ^= 0x100;
+						info->frame_size = -(signed short)(tmp << 2);
 					} else {
-						tmp = (ip->halfword[0] >> 1);
+						tmp = (ip->mm16_r5_format.imm >> 1);
 						info->frame_size = -(signed short)(tmp & 0xf);
 					}
-					ip = (void *) &ip->halfword[1];
-					ip--;
 				} else
 #endif
 				info->frame_size = - ip->i_format.simmediate;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/mips/loongson/lemote-2f/clock.c linux-libre-3.16.51-gnu/arch/mips/loongson/lemote-2f/clock.c
--- linux-libre-3.16.50-gnu/arch/mips/loongson/lemote-2f/clock.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/mips/loongson/lemote-2f/clock.c	2017-11-26 08:50:43.000000000 -0500
@@ -80,6 +80,9 @@ EXPORT_SYMBOL(clk_disable);
 
 unsigned long clk_get_rate(struct clk *clk)
 {
+	if (!clk)
+		return 0;
+
 	return (unsigned long)clk->rate;
 }
 EXPORT_SYMBOL(clk_get_rate);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/mips/ralink/clk.c linux-libre-3.16.51-gnu/arch/mips/ralink/clk.c
--- linux-libre-3.16.50-gnu/arch/mips/ralink/clk.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/mips/ralink/clk.c	2017-11-26 08:50:43.000000000 -0500
@@ -52,6 +52,9 @@ EXPORT_SYMBOL_GPL(clk_disable);
 
 unsigned long clk_get_rate(struct clk *clk)
 {
+	if (!clk)
+		return 0;
+
 	return clk->rate;
 }
 EXPORT_SYMBOL_GPL(clk_get_rate);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/powerpc/boot/4xx.c linux-libre-3.16.51-gnu/arch/powerpc/boot/4xx.c
--- linux-libre-3.16.50-gnu/arch/powerpc/boot/4xx.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/powerpc/boot/4xx.c	2017-11-26 08:50:43.000000000 -0500
@@ -564,7 +564,7 @@ void ibm405gp_fixup_clocks(unsigned int
 		fbdv = 16;
 	cbdv = ((pllmr & 0x00060000) >> 17) + 1; /* CPU:PLB */
 	opdv = ((pllmr & 0x00018000) >> 15) + 1; /* PLB:OPB */
-	ppdv = ((pllmr & 0x00001800) >> 13) + 1; /* PLB:PCI */
+	ppdv = ((pllmr & 0x00006000) >> 13) + 1; /* PLB:PCI */
 	epdv = ((pllmr & 0x00001800) >> 11) + 2; /* PLB:EBC */
 	udiv = ((cpc0_cr0 & 0x3e) >> 1) + 1;
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/powerpc/include/asm/ppc-opcode.h linux-libre-3.16.51-gnu/arch/powerpc/include/asm/ppc-opcode.h
--- linux-libre-3.16.50-gnu/arch/powerpc/include/asm/ppc-opcode.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/powerpc/include/asm/ppc-opcode.h	2017-11-26 08:50:43.000000000 -0500
@@ -182,7 +182,7 @@
 #define PPC_INST_WAIT			0x7c00007c
 #define PPC_INST_TLBIVAX		0x7c000624
 #define PPC_INST_TLBSRX_DOT		0x7c0006a5
-#define PPC_INST_XXLOR			0xf0000510
+#define PPC_INST_XXLOR			0xf0000490
 #define PPC_INST_XXSWAPD		0xf0000250
 #define PPC_INST_XVCPSGNDP		0xf0000780
 #define PPC_INST_TRECHKPT		0x7c0007dd
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/powerpc/kernel/align.c linux-libre-3.16.51-gnu/arch/powerpc/kernel/align.c
--- linux-libre-3.16.50-gnu/arch/powerpc/kernel/align.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/powerpc/kernel/align.c	2017-11-26 08:50:43.000000000 -0500
@@ -236,6 +236,28 @@ static int emulate_dcbz(struct pt_regs *
 
 #define SWIZ_PTR(p)		((unsigned char __user *)((p) ^ swiz))
 
+#define __get_user_or_set_dar(_regs, _dest, _addr)		\
+	({							\
+		int rc = 0;					\
+		typeof(_addr) __addr = (_addr);			\
+		if (__get_user_inatomic(_dest, __addr)) {	\
+			_regs->dar = (unsigned long)__addr;	\
+			rc = -EFAULT;				\
+		}						\
+		rc;						\
+	})
+
+#define __put_user_or_set_dar(_regs, _src, _addr)		\
+	({							\
+		int rc = 0;					\
+		typeof(_addr) __addr = (_addr);			\
+		if (__put_user_inatomic(_src, __addr)) {	\
+			_regs->dar = (unsigned long)__addr;	\
+			rc = -EFAULT;				\
+		}						\
+		rc;						\
+	})
+
 static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr,
 			    unsigned int reg, unsigned int nb,
 			    unsigned int flags, unsigned int instr,
@@ -264,9 +286,10 @@ static int emulate_multiple(struct pt_re
 		} else {
 			unsigned long pc = regs->nip ^ (swiz & 4);
 
-			if (__get_user_inatomic(instr,
-						(unsigned int __user *)pc))
+			if (__get_user_or_set_dar(regs, instr,
+						  (unsigned int __user *)pc))
 				return -EFAULT;
+
 			if (swiz == 0 && (flags & SW))
 				instr = cpu_to_le32(instr);
 			nb = (instr >> 11) & 0x1f;
@@ -310,31 +333,31 @@ static int emulate_multiple(struct pt_re
 			       ((nb0 + 3) / 4) * sizeof(unsigned long));
 
 		for (i = 0; i < nb; ++i, ++p)
-			if (__get_user_inatomic(REG_BYTE(rptr, i ^ bswiz),
-						SWIZ_PTR(p)))
+			if (__get_user_or_set_dar(regs, REG_BYTE(rptr, i ^ bswiz),
+						  SWIZ_PTR(p)))
 				return -EFAULT;
 		if (nb0 > 0) {
 			rptr = &regs->gpr[0];
 			addr += nb;
 			for (i = 0; i < nb0; ++i, ++p)
-				if (__get_user_inatomic(REG_BYTE(rptr,
-								 i ^ bswiz),
-							SWIZ_PTR(p)))
+				if (__get_user_or_set_dar(regs,
+							  REG_BYTE(rptr, i ^ bswiz),
+							  SWIZ_PTR(p)))
 					return -EFAULT;
 		}
 
 	} else {
 		for (i = 0; i < nb; ++i, ++p)
-			if (__put_user_inatomic(REG_BYTE(rptr, i ^ bswiz),
-						SWIZ_PTR(p)))
+			if (__put_user_or_set_dar(regs, REG_BYTE(rptr, i ^ bswiz),
+						  SWIZ_PTR(p)))
 				return -EFAULT;
 		if (nb0 > 0) {
 			rptr = &regs->gpr[0];
 			addr += nb;
 			for (i = 0; i < nb0; ++i, ++p)
-				if (__put_user_inatomic(REG_BYTE(rptr,
-								 i ^ bswiz),
-							SWIZ_PTR(p)))
+				if (__put_user_or_set_dar(regs,
+							  REG_BYTE(rptr, i ^ bswiz),
+							  SWIZ_PTR(p)))
 					return -EFAULT;
 		}
 	}
@@ -346,29 +369,32 @@ static int emulate_multiple(struct pt_re
  * Only POWER6 has these instructions, and it does true little-endian,
  * so we don't need the address swizzling.
  */
-static int emulate_fp_pair(unsigned char __user *addr, unsigned int reg,
-			   unsigned int flags)
+static int emulate_fp_pair(struct pt_regs *regs, unsigned char __user *addr,
+			   unsigned int reg, unsigned int flags)
 {
 	char *ptr0 = (char *) &current->thread.TS_FPR(reg);
 	char *ptr1 = (char *) &current->thread.TS_FPR(reg+1);
-	int i, ret, sw = 0;
+	int i, sw = 0;
 
 	if (reg & 1)
 		return 0;	/* invalid form: FRS/FRT must be even */
 	if (flags & SW)
 		sw = 7;
-	ret = 0;
+
 	for (i = 0; i < 8; ++i) {
 		if (!(flags & ST)) {
-			ret |= __get_user(ptr0[i^sw], addr + i);
-			ret |= __get_user(ptr1[i^sw], addr + i + 8);
+			if (__get_user_or_set_dar(regs, ptr0[i^sw], addr + i))
+				return -EFAULT;
+			if (__get_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8))
+				return -EFAULT;
 		} else {
-			ret |= __put_user(ptr0[i^sw], addr + i);
-			ret |= __put_user(ptr1[i^sw], addr + i + 8);
+			if (__put_user_or_set_dar(regs, ptr0[i^sw], addr + i))
+				return -EFAULT;
+			if (__put_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8))
+				return -EFAULT;
 		}
 	}
-	if (ret)
-		return -EFAULT;
+
 	return 1;	/* exception handled and fixed up */
 }
 
@@ -378,24 +404,27 @@ static int emulate_lq_stq(struct pt_regs
 {
 	char *ptr0 = (char *)&regs->gpr[reg];
 	char *ptr1 = (char *)&regs->gpr[reg+1];
-	int i, ret, sw = 0;
+	int i, sw = 0;
 
 	if (reg & 1)
 		return 0;	/* invalid form: GPR must be even */
 	if (flags & SW)
 		sw = 7;
-	ret = 0;
+
 	for (i = 0; i < 8; ++i) {
 		if (!(flags & ST)) {
-			ret |= __get_user(ptr0[i^sw], addr + i);
-			ret |= __get_user(ptr1[i^sw], addr + i + 8);
+			if (__get_user_or_set_dar(regs, ptr0[i^sw], addr + i))
+				return -EFAULT;
+			if (__get_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8))
+				return -EFAULT;
 		} else {
-			ret |= __put_user(ptr0[i^sw], addr + i);
-			ret |= __put_user(ptr1[i^sw], addr + i + 8);
+			if (__put_user_or_set_dar(regs, ptr0[i^sw], addr + i))
+				return -EFAULT;
+			if (__put_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8))
+				return -EFAULT;
 		}
 	}
-	if (ret)
-		return -EFAULT;
+
 	return 1;	/* exception handled and fixed up */
 }
 #endif /* CONFIG_PPC64 */
@@ -688,9 +717,14 @@ static int emulate_vsx(unsigned char __u
 	for (j = 0; j < length; j += elsize) {
 		for (i = 0; i < elsize; ++i) {
 			if (flags & ST)
-				ret |= __put_user(ptr[i^sw], addr + i);
+				ret = __put_user_or_set_dar(regs, ptr[i^sw],
+							    addr + i);
 			else
-				ret |= __get_user(ptr[i^sw], addr + i);
+				ret = __get_user_or_set_dar(regs, ptr[i^sw],
+							    addr + i);
+
+			if (ret)
+				return ret;
 		}
 		ptr  += elsize;
 #ifdef __LITTLE_ENDIAN__
@@ -740,7 +774,7 @@ int fix_alignment(struct pt_regs *regs)
 	unsigned int dsisr;
 	unsigned char __user *addr;
 	unsigned long p, swiz;
-	int ret, i;
+	int i;
 	union data {
 		u64 ll;
 		double dd;
@@ -923,7 +957,7 @@ int fix_alignment(struct pt_regs *regs)
 		if (flags & F) {
 			/* Special case for 16-byte FP loads and stores */
 			PPC_WARN_ALIGNMENT(fp_pair, regs);
-			return emulate_fp_pair(addr, reg, flags);
+			return emulate_fp_pair(regs, addr, reg, flags);
 		} else {
 #ifdef CONFIG_PPC64
 			/* Special case for 16-byte loads and stores */
@@ -953,15 +987,12 @@ int fix_alignment(struct pt_regs *regs)
 		}
 
 		data.ll = 0;
-		ret = 0;
 		p = (unsigned long)addr;
 
 		for (i = 0; i < nb; i++)
-			ret |= __get_user_inatomic(data.v[start + i],
-						   SWIZ_PTR(p++));
-
-		if (unlikely(ret))
-			return -EFAULT;
+			if (__get_user_or_set_dar(regs, data.v[start + i],
+						  SWIZ_PTR(p++)))
+				return -EFAULT;
 
 	} else if (flags & F) {
 		data.ll = current->thread.TS_FPR(reg);
@@ -1031,15 +1062,13 @@ int fix_alignment(struct pt_regs *regs)
 			break;
 		}
 
-		ret = 0;
 		p = (unsigned long)addr;
 
 		for (i = 0; i < nb; i++)
-			ret |= __put_user_inatomic(data.v[start + i],
-						   SWIZ_PTR(p++));
+			if (__put_user_or_set_dar(regs, data.v[start + i],
+						  SWIZ_PTR(p++)))
+				return -EFAULT;
 
-		if (unlikely(ret))
-			return -EFAULT;
 	} else if (flags & F)
 		current->thread.TS_FPR(reg) = data.ll;
 	else
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/powerpc/mm/hash_utils_64.c linux-libre-3.16.51-gnu/arch/powerpc/mm/hash_utils_64.c
--- linux-libre-3.16.50-gnu/arch/powerpc/mm/hash_utils_64.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/powerpc/mm/hash_utils_64.c	2017-11-26 08:50:43.000000000 -0500
@@ -433,7 +433,7 @@ static int __init htab_dt_scan_hugepage_
 	printk(KERN_INFO "Huge page(16GB) memory: "
 			"addr = 0x%lX size = 0x%lX pages = %d\n",
 			phys_addr, block_size, expected_pages);
-	if (phys_addr + (16 * GB) <= memblock_end_of_DRAM()) {
+	if (phys_addr + block_size * expected_pages <= memblock_end_of_DRAM()) {
 		memblock_reserve(phys_addr, block_size * expected_pages);
 		add_gpage(phys_addr, block_size, expected_pages);
 	}
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/powerpc/mm/init_64.c linux-libre-3.16.51-gnu/arch/powerpc/mm/init_64.c
--- linux-libre-3.16.50-gnu/arch/powerpc/mm/init_64.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/powerpc/mm/init_64.c	2017-11-26 08:50:43.000000000 -0500
@@ -345,7 +345,7 @@ struct page *realmode_pfn_to_page(unsign
 }
 EXPORT_SYMBOL_GPL(realmode_pfn_to_page);
 
-#elif defined(CONFIG_FLATMEM)
+#else
 
 struct page *realmode_pfn_to_page(unsigned long pfn)
 {
@@ -354,4 +354,4 @@ struct page *realmode_pfn_to_page(unsign
 }
 EXPORT_SYMBOL_GPL(realmode_pfn_to_page);
 
-#endif /* CONFIG_SPARSEMEM_VMEMMAP/CONFIG_FLATMEM */
+#endif /* CONFIG_SPARSEMEM_VMEMMAP */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/s390/include/asm/mmu_context.h linux-libre-3.16.51-gnu/arch/s390/include/asm/mmu_context.h
--- linux-libre-3.16.50-gnu/arch/s390/include/asm/mmu_context.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/s390/include/asm/mmu_context.h	2017-11-26 08:50:43.000000000 -0500
@@ -15,6 +15,7 @@
 static inline int init_new_context(struct task_struct *tsk,
 				   struct mm_struct *mm)
 {
+	spin_lock_init(&mm->context.lock);
 	spin_lock_init(&mm->context.list_lock);
 	INIT_LIST_HEAD(&mm->context.pgtable_list);
 	INIT_LIST_HEAD(&mm->context.gmap_list);
@@ -95,8 +96,7 @@ static inline void finish_arch_post_lock
 			cpu_relax();
 
 		cpumask_set_cpu(smp_processor_id(), mm_cpumask(mm));
-		if (mm->context.flush_mm)
-			__tlb_flush_mm(mm);
+		__tlb_flush_mm_lazy(mm);
 		preempt_enable();
 	}
 	set_fs(current->thread.mm_segment);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/s390/include/asm/mmu.h linux-libre-3.16.51-gnu/arch/s390/include/asm/mmu.h
--- linux-libre-3.16.50-gnu/arch/s390/include/asm/mmu.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/s390/include/asm/mmu.h	2017-11-26 08:50:43.000000000 -0500
@@ -5,6 +5,7 @@
 #include <linux/errno.h>
 
 typedef struct {
+	spinlock_t lock;
 	cpumask_t cpu_attach_mask;
 	atomic_t attach_count;
 	unsigned int flush_mm;
@@ -21,6 +22,7 @@ typedef struct {
 } mm_context_t;
 
 #define INIT_MM_CONTEXT(name)						      \
+	.context.lock =	__SPIN_LOCK_UNLOCKED(name.context.lock),	      \
 	.context.list_lock    = __SPIN_LOCK_UNLOCKED(name.context.list_lock), \
 	.context.pgtable_list = LIST_HEAD_INIT(name.context.pgtable_list),    \
 	.context.gmap_list = LIST_HEAD_INIT(name.context.gmap_list),
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/s390/include/asm/tlbflush.h linux-libre-3.16.51-gnu/arch/s390/include/asm/tlbflush.h
--- linux-libre-3.16.50-gnu/arch/s390/include/asm/tlbflush.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/s390/include/asm/tlbflush.h	2017-11-26 08:50:43.000000000 -0500
@@ -164,10 +164,12 @@ static inline void __tlb_flush_mm(struct
 
 static inline void __tlb_flush_mm_lazy(struct mm_struct * mm)
 {
+	spin_lock(&mm->context.lock);
 	if (mm->context.flush_mm) {
-		__tlb_flush_mm(mm);
 		mm->context.flush_mm = 0;
+		__tlb_flush_mm(mm);
 	}
+	spin_unlock(&mm->context.lock);
 }
 
 /*
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/x86/include/asm/elf.h linux-libre-3.16.51-gnu/arch/x86/include/asm/elf.h
--- linux-libre-3.16.50-gnu/arch/x86/include/asm/elf.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/x86/include/asm/elf.h	2017-11-26 08:50:43.000000000 -0500
@@ -203,6 +203,7 @@ void set_personality_ia32(bool);
 
 #define ELF_CORE_COPY_REGS(pr_reg, regs)			\
 do {								\
+	unsigned long base;					\
 	unsigned v;						\
 	(pr_reg)[0] = (regs)->r15;				\
 	(pr_reg)[1] = (regs)->r14;				\
@@ -225,8 +226,8 @@ do {								\
 	(pr_reg)[18] = (regs)->flags;				\
 	(pr_reg)[19] = (regs)->sp;				\
 	(pr_reg)[20] = (regs)->ss;				\
-	(pr_reg)[21] = current->thread.fs;			\
-	(pr_reg)[22] = current->thread.gs;			\
+	rdmsrl(MSR_FS_BASE, base); (pr_reg)[21] = base;		\
+	rdmsrl(MSR_KERNEL_GS_BASE, base); (pr_reg)[22] = base;	\
 	asm("movl %%ds,%0" : "=r" (v)); (pr_reg)[23] = v;	\
 	asm("movl %%es,%0" : "=r" (v)); (pr_reg)[24] = v;	\
 	asm("movl %%fs,%0" : "=r" (v)); (pr_reg)[25] = v;	\
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/x86/include/asm/kvm_para.h linux-libre-3.16.51-gnu/arch/x86/include/asm/kvm_para.h
--- linux-libre-3.16.50-gnu/arch/x86/include/asm/kvm_para.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/x86/include/asm/kvm_para.h	2017-11-26 08:50:43.000000000 -0500
@@ -95,7 +95,7 @@ static inline long kvm_hypercall4(unsign
 bool kvm_para_available(void);
 unsigned int kvm_arch_para_features(void);
 void __init kvm_guest_init(void);
-void kvm_async_pf_task_wait(u32 token);
+void kvm_async_pf_task_wait(u32 token, int interrupt_kernel);
 void kvm_async_pf_task_wake(u32 token);
 u32 kvm_read_and_reset_pf_reason(void);
 extern void kvm_disable_steal_time(void);
@@ -110,7 +110,7 @@ static inline void kvm_spinlock_init(voi
 
 #else /* CONFIG_KVM_GUEST */
 #define kvm_guest_init() do {} while (0)
-#define kvm_async_pf_task_wait(T) do {} while(0)
+#define kvm_async_pf_task_wait(T, I) do {} while(0)
 #define kvm_async_pf_task_wake(T) do {} while(0)
 
 static inline bool kvm_para_available(void)
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/x86/kernel/kvm.c linux-libre-3.16.51-gnu/arch/x86/kernel/kvm.c
--- linux-libre-3.16.50-gnu/arch/x86/kernel/kvm.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/x86/kernel/kvm.c	2017-11-26 08:50:43.000000000 -0500
@@ -116,7 +116,11 @@ static struct kvm_task_sleep_node *_find
 	return NULL;
 }
 
-void kvm_async_pf_task_wait(u32 token)
+/*
+ * @interrupt_kernel: Is this called from a routine which interrupts the kernel
+ * 		      (other than user space)?
+ */
+void kvm_async_pf_task_wait(u32 token, int interrupt_kernel)
 {
 	u32 key = hash_32(token, KVM_TASK_SLEEP_HASHBITS);
 	struct kvm_task_sleep_head *b = &async_pf_sleepers[key];
@@ -139,7 +143,10 @@ void kvm_async_pf_task_wait(u32 token)
 
 	n.token = token;
 	n.cpu = smp_processor_id();
-	n.halted = is_idle_task(current) || preempt_count() > 1;
+	n.halted = is_idle_task(current) ||
+		   (IS_ENABLED(CONFIG_PREEMPT_COUNT)
+		    ? preempt_count() > 1 || rcu_preempt_depth()
+		    : interrupt_kernel);
 	init_waitqueue_head(&n.wq);
 	hlist_add_head(&n.link, &b->list);
 	spin_unlock(&b->lock);
@@ -268,7 +275,7 @@ do_async_page_fault(struct pt_regs *regs
 		/* page is swapped out by the host. */
 		prev_state = exception_enter();
 		exit_idle();
-		kvm_async_pf_task_wait((u32)read_cr2());
+		kvm_async_pf_task_wait((u32)read_cr2(), !user_mode_vm(regs));
 		exception_exit(prev_state);
 		break;
 	case KVM_PV_REASON_PAGE_READY:
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/x86/kvm/svm.c linux-libre-3.16.51-gnu/arch/x86/kvm/svm.c
--- linux-libre-3.16.50-gnu/arch/x86/kvm/svm.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/x86/kvm/svm.c	2017-11-26 08:50:43.000000000 -0500
@@ -1718,7 +1718,7 @@ static int pf_interception(struct vcpu_s
 	case KVM_PV_REASON_PAGE_NOT_PRESENT:
 		svm->apf_reason = 0;
 		local_irq_disable();
-		kvm_async_pf_task_wait(fault_address);
+		kvm_async_pf_task_wait(fault_address, 0);
 		local_irq_enable();
 		break;
 	case KVM_PV_REASON_PAGE_READY:
@@ -4248,6 +4248,7 @@ static int svm_check_intercept(struct kv
 		 */
 		if (info->rep_prefix != REPE_PREFIX)
 			goto out;
+		break;
 	case SVM_EXIT_IOIO: {
 		u64 exit_info;
 		u32 bytes;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/arch/x86/kvm/x86.c linux-libre-3.16.51-gnu/arch/x86/kvm/x86.c
--- linux-libre-3.16.50-gnu/arch/x86/kvm/x86.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/arch/x86/kvm/x86.c	2017-11-26 08:50:43.000000000 -0500
@@ -7561,6 +7561,13 @@ static int apf_put_user(struct kvm_vcpu
 				      sizeof(val));
 }
 
+static int apf_get_user(struct kvm_vcpu *vcpu, u32 *val)
+{
+
+	return kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.apf.data, val,
+				      sizeof(u32));
+}
+
 void kvm_arch_async_page_not_present(struct kvm_vcpu *vcpu,
 				     struct kvm_async_pf *work)
 {
@@ -7587,6 +7594,7 @@ void kvm_arch_async_page_present(struct
 				 struct kvm_async_pf *work)
 {
 	struct x86_exception fault;
+	u32 val;
 
 	trace_kvm_async_pf_ready(work->arch.token, work->gva);
 	if (work->wakeup_all)
@@ -7594,14 +7602,24 @@ void kvm_arch_async_page_present(struct
 	else
 		kvm_del_async_pf_gfn(vcpu, work->arch.gfn);
 
-	if ((vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) &&
-	    !apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) {
-		fault.vector = PF_VECTOR;
-		fault.error_code_valid = true;
-		fault.error_code = 0;
-		fault.nested_page_fault = false;
-		fault.address = work->arch.token;
-		kvm_inject_page_fault(vcpu, &fault);
+	if (vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED &&
+	    !apf_get_user(vcpu, &val)) {
+		if (val == KVM_PV_REASON_PAGE_NOT_PRESENT &&
+		    vcpu->arch.exception.pending &&
+		    vcpu->arch.exception.nr == PF_VECTOR &&
+		    !apf_put_user(vcpu, 0)) {
+			vcpu->arch.exception.pending = false;
+			vcpu->arch.exception.nr = 0;
+			vcpu->arch.exception.has_error_code = false;
+			vcpu->arch.exception.error_code = 0;
+		} else if (!apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) {
+			fault.vector = PF_VECTOR;
+			fault.error_code_valid = true;
+			fault.error_code = 0;
+			fault.nested_page_fault = false;
+			fault.address = work->arch.token;
+			kvm_inject_page_fault(vcpu, &fault);
+		}
 	}
 	vcpu->arch.apf.halted = false;
 	vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/block/blk-core.c linux-libre-3.16.51-gnu/block/blk-core.c
--- linux-libre-3.16.50-gnu/block/blk-core.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/block/blk-core.c	2017-11-26 08:50:43.000000000 -0500
@@ -198,7 +198,7 @@ EXPORT_SYMBOL(blk_delay_queue);
  **/
 void blk_start_queue(struct request_queue *q)
 {
-	WARN_ON(!irqs_disabled());
+	WARN_ON(!in_interrupt() && !irqs_disabled());
 
 	queue_flag_clear(QUEUE_FLAG_STOPPED, q);
 	__blk_run_queue(q);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/Documentation/DocBook/media/v4l/dev-subdev.xml linux-libre-3.16.51-gnu/Documentation/DocBook/media/v4l/dev-subdev.xml
--- linux-libre-3.16.50-gnu/Documentation/DocBook/media/v4l/dev-subdev.xml	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/Documentation/DocBook/media/v4l/dev-subdev.xml	2017-11-26 08:50:43.000000000 -0500
@@ -369,7 +369,7 @@
       underlying hardware.</para>
 
       <para>The coordinates to a step always refer to the actual size
-      of the previous step. The exception to this rule is the source
+      of the previous step. The exception to this rule is the sink
       compose rectangle, which refers to the sink compose bounds
       rectangle --- if it is supported by the hardware.</para>
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/acpi/apei/einj.c linux-libre-3.16.51-gnu/drivers/acpi/apei/einj.c
--- linux-libre-3.16.50-gnu/drivers/acpi/apei/einj.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/acpi/apei/einj.c	2017-11-26 08:50:43.000000000 -0500
@@ -285,7 +285,7 @@ static struct acpi_generic_address *einj
 		((char *)trigger_tab + sizeof(struct acpi_einj_trigger));
 	for (i = 0; i < trigger_tab->entry_count; i++) {
 		if (entry->action == ACPI_EINJ_TRIGGER_ERROR &&
-		entry->instruction == ACPI_EINJ_WRITE_REGISTER_VALUE &&
+		entry->instruction <= ACPI_EINJ_WRITE_REGISTER_VALUE &&
 		entry->register_region.space_id ==
 			ACPI_ADR_SPACE_SYSTEM_MEMORY &&
 		(entry->register_region.address & param2) == (param1 & param2))
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/ata/pata_amd.c linux-libre-3.16.51-gnu/drivers/ata/pata_amd.c
--- linux-libre-3.16.50-gnu/drivers/ata/pata_amd.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/ata/pata_amd.c	2017-11-26 08:50:43.000000000 -0500
@@ -616,6 +616,7 @@ static const struct pci_device_id amd[]
 	{ PCI_VDEVICE(NVIDIA,	PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE),	8 },
 	{ PCI_VDEVICE(NVIDIA,	PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE),	8 },
 	{ PCI_VDEVICE(AMD,	PCI_DEVICE_ID_AMD_CS5536_IDE),		9 },
+	{ PCI_VDEVICE(AMD,	PCI_DEVICE_ID_AMD_CS5536_DEV_IDE),	9 },
 
 	{ },
 };
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/ata/pata_cs5536.c linux-libre-3.16.51-gnu/drivers/ata/pata_cs5536.c
--- linux-libre-3.16.50-gnu/drivers/ata/pata_cs5536.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/ata/pata_cs5536.c	2017-11-26 08:50:43.000000000 -0500
@@ -289,6 +289,7 @@ static int cs5536_init_one(struct pci_de
 
 static const struct pci_device_id cs5536[] = {
 	{ PCI_VDEVICE(AMD,	PCI_DEVICE_ID_AMD_CS5536_IDE), },
+	{ PCI_VDEVICE(AMD,	PCI_DEVICE_ID_AMD_CS5536_DEV_IDE), },
 	{ },
 };
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/base/bus.c linux-libre-3.16.51-gnu/drivers/base/bus.c
--- linux-libre-3.16.50-gnu/drivers/base/bus.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/base/bus.c	2017-11-26 08:50:43.000000000 -0500
@@ -722,7 +722,7 @@ int bus_add_driver(struct device_driver
 
 out_unregister:
 	kobject_put(&priv->kobj);
-	kfree(drv->p);
+	/* drv->p is freed in driver_release()  */
 	drv->p = NULL;
 out_put_bus:
 	bus_put(bus);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/block/skd_main.c linux-libre-3.16.51-gnu/drivers/block/skd_main.c
--- linux-libre-3.16.50-gnu/drivers/block/skd_main.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/block/skd_main.c	2017-11-26 08:50:43.000000000 -0500
@@ -2214,6 +2214,9 @@ static void skd_send_fitmsg(struct skd_d
 		 */
 		qcmd |= FIT_QCMD_MSGSIZE_64;
 
+	/* Make sure skd_msg_buf is written before the doorbell is triggered. */
+	smp_wmb();
+
 	SKD_WRITEQ(skdev, qcmd, FIT_Q_COMMAND);
 
 }
@@ -2260,6 +2263,9 @@ static void skd_send_special_fitmsg(stru
 	qcmd = skspcl->mb_dma_address;
 	qcmd |= FIT_QCMD_QID_NORMAL + FIT_QCMD_MSGSIZE_128;
 
+	/* Make sure skd_msg_buf is written before the doorbell is triggered. */
+	smp_wmb();
+
 	SKD_WRITEQ(skdev, qcmd, FIT_Q_COMMAND);
 }
 
@@ -4685,15 +4691,16 @@ static void skd_free_disk(struct skd_dev
 {
 	struct gendisk *disk = skdev->disk;
 
-	if (disk != NULL) {
-		struct request_queue *q = disk->queue;
+	if (disk && (disk->flags & GENHD_FL_UP))
+		del_gendisk(disk);
 
-		if (disk->flags & GENHD_FL_UP)
-			del_gendisk(disk);
-		if (q)
-			blk_cleanup_queue(q);
-		put_disk(disk);
+	if (skdev->queue) {
+		blk_cleanup_queue(skdev->queue);
+		skdev->queue = NULL;
+		disk->queue = NULL;
 	}
+
+	put_disk(disk);
 	skdev->disk = NULL;
 }
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-libre-3.16.51-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c
--- linux-libre-3.16.50-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c	2017-11-26 08:50:43.000000000 -0500
@@ -612,7 +612,7 @@ static void ttm_page_pool_fill_locked(st
 		} else {
 			pr_err("Failed to fill pool (%p)\n", pool);
 			/* If we have any pages left put them to the pool. */
-			list_for_each_entry(p, &pool->list, lru) {
+			list_for_each_entry(p, &new_pages, lru) {
 				++cpages;
 			}
 			list_splice(&new_pages, &pool->list);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/iio/accel/st_accel_core.c linux-libre-3.16.51-gnu/drivers/iio/accel/st_accel_core.c
--- linux-libre-3.16.50-gnu/drivers/iio/accel/st_accel_core.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/iio/accel/st_accel_core.c	2017-11-26 08:50:43.000000000 -0500
@@ -66,7 +66,7 @@
 #define ST_ACCEL_1_BDU_MASK			0x80
 #define ST_ACCEL_1_DRDY_IRQ_ADDR		0x22
 #define ST_ACCEL_1_DRDY_IRQ_INT1_MASK		0x10
-#define ST_ACCEL_1_DRDY_IRQ_INT2_MASK		0x08
+#define ST_ACCEL_1_DRDY_IRQ_INT2_MASK		0x00
 #define ST_ACCEL_1_MULTIREAD_BIT		true
 
 /* CUSTOM VALUES FOR SENSOR 2 */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/iio/magnetometer/st_magn_core.c linux-libre-3.16.51-gnu/drivers/iio/magnetometer/st_magn_core.c
--- linux-libre-3.16.50-gnu/drivers/iio/magnetometer/st_magn_core.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/iio/magnetometer/st_magn_core.c	2017-11-26 08:50:43.000000000 -0500
@@ -112,7 +112,7 @@
 #define ST_MAGN_2_FS_AVL_8000_GAIN		292
 #define ST_MAGN_2_FS_AVL_12000_GAIN		438
 #define ST_MAGN_2_FS_AVL_16000_GAIN		584
-#define ST_MAGN_2_MULTIREAD_BIT			false
+#define ST_MAGN_2_MULTIREAD_BIT			true
 #define ST_MAGN_2_OUT_X_L_ADDR			0x28
 #define ST_MAGN_2_OUT_Y_L_ADDR			0x2a
 #define ST_MAGN_2_OUT_Z_L_ADDR			0x2c
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/iio/pressure/st_pressure_core.c linux-libre-3.16.51-gnu/drivers/iio/pressure/st_pressure_core.c
--- linux-libre-3.16.50-gnu/drivers/iio/pressure/st_pressure_core.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/iio/pressure/st_pressure_core.c	2017-11-26 08:50:43.000000000 -0500
@@ -104,7 +104,7 @@
 #define ST_PRESS_LPS25H_BDU_MASK		0x04
 #define ST_PRESS_LPS25H_DRDY_IRQ_ADDR		0x23
 #define ST_PRESS_LPS25H_DRDY_IRQ_INT1_MASK	0x01
-#define ST_PRESS_LPS25H_DRDY_IRQ_INT2_MASK	0x10
+#define ST_PRESS_LPS25H_DRDY_IRQ_INT2_MASK	0x00
 #define ST_PRESS_LPS25H_MULTIREAD_BIT		true
 #define ST_PRESS_LPS25H_OUT_XL_ADDR		0x28
 #define ST_TEMP_LPS25H_OUT_L_ADDR		0x2b
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/infiniband/core/verbs.c linux-libre-3.16.51-gnu/drivers/infiniband/core/verbs.c
--- linux-libre-3.16.50-gnu/drivers/infiniband/core/verbs.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/infiniband/core/verbs.c	2017-11-26 08:50:43.000000000 -0500
@@ -1340,6 +1340,44 @@ EXPORT_SYMBOL(ib_dealloc_fmr);
 
 /* Multicast groups */
 
+static bool is_valid_mcast_lid(struct ib_qp *qp, u16 lid)
+{
+	struct ib_qp_init_attr init_attr = {};
+	struct ib_qp_attr attr = {};
+	int num_eth_ports = 0;
+	int port;
+
+	/* If QP state >= init, it is assigned to a port and we can check this
+	 * port only.
+	 */
+	if (!ib_query_qp(qp, &attr, IB_QP_STATE | IB_QP_PORT, &init_attr)) {
+		if (attr.qp_state >= IB_QPS_INIT) {
+			if (qp->device->get_link_layer(qp->device, attr.port_num) !=
+			    IB_LINK_LAYER_INFINIBAND)
+				return true;
+			goto lid_check;
+		}
+	}
+
+	/* Can't get a quick answer, iterate over all ports */
+	for (port = 0; port < qp->device->phys_port_cnt; port++)
+		if (qp->device->get_link_layer(qp->device, port) !=
+		    IB_LINK_LAYER_INFINIBAND)
+			num_eth_ports++;
+
+	/* If we have at lease one Ethernet port, RoCE annex declares that
+	 * multicast LID should be ignored. We can't tell at this step if the
+	 * QP belongs to an IB or Ethernet port.
+	 */
+	if (num_eth_ports)
+		return true;
+
+	/* If all the ports are IB, we can check according to IB spec. */
+lid_check:
+	return !(lid < 0xC000 ||
+		 lid == be16_to_cpu(IB_LID_PERMISSIVE));
+}
+
 int ib_attach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid)
 {
 	int ret;
@@ -1347,8 +1385,7 @@ int ib_attach_mcast(struct ib_qp *qp, un
 	if (!qp->device->attach_mcast)
 		return -ENOSYS;
 	if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD ||
-	    lid < 0xC000 ||
-	    lid == be16_to_cpu(IB_LID_PERMISSIVE))
+	    !is_valid_mcast_lid(qp, lid))
 		return -EINVAL;
 
 	ret = qp->device->attach_mcast(qp, gid, lid);
@@ -1365,8 +1402,7 @@ int ib_detach_mcast(struct ib_qp *qp, un
 	if (!qp->device->detach_mcast)
 		return -ENOSYS;
 	if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD ||
-	    lid < 0xC000 ||
-	    lid == be16_to_cpu(IB_LID_PERMISSIVE))
+	    !is_valid_mcast_lid(qp, lid))
 		return -EINVAL;
 
 	ret = qp->device->detach_mcast(qp, gid, lid);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/infiniband/hw/mlx4/sysfs.c linux-libre-3.16.51-gnu/drivers/infiniband/hw/mlx4/sysfs.c
--- linux-libre-3.16.50-gnu/drivers/infiniband/hw/mlx4/sysfs.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/infiniband/hw/mlx4/sysfs.c	2017-11-26 08:50:43.000000000 -0500
@@ -241,7 +241,7 @@ void del_sysfs_port_mcg_attr(struct mlx4
 static int add_port_entries(struct mlx4_ib_dev *device, int port_num)
 {
 	int i;
-	char buff[10];
+	char buff[11];
 	struct mlx4_ib_iov_port *port = NULL;
 	int ret = 0 ;
 	struct ib_port_attr attr;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/infiniband/hw/mlx5/mr.c linux-libre-3.16.51-gnu/drivers/infiniband/hw/mlx5/mr.c
--- linux-libre-3.16.50-gnu/drivers/infiniband/hw/mlx5/mr.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/infiniband/hw/mlx5/mr.c	2017-11-26 08:50:43.000000000 -0500
@@ -682,13 +682,14 @@ err_free:
 	return ERR_PTR(err);
 }
 
-static int get_octo_len(u64 addr, u64 len, int page_size)
+static int get_octo_len(u64 addr, u64 len, int page_shift)
 {
+	u64 page_size = 1ULL << page_shift;
 	u64 offset;
 	int npages;
 
 	offset = addr & (page_size - 1);
-	npages = ALIGN(len + offset, page_size) >> ilog2(page_size);
+	npages = ALIGN(len + offset, page_size) >> page_shift;
 	return (npages + 1) / 2;
 }
 
@@ -870,11 +871,11 @@ static struct mlx5_ib_mr *reg_create(str
 	in->seg.start_addr = cpu_to_be64(virt_addr);
 	in->seg.len = cpu_to_be64(length);
 	in->seg.bsfs_octo_size = 0;
-	in->seg.xlt_oct_size = cpu_to_be32(get_octo_len(virt_addr, length, 1 << page_shift));
+	in->seg.xlt_oct_size = cpu_to_be32(get_octo_len(virt_addr, length, page_shift));
 	in->seg.log2_page_size = page_shift;
 	in->seg.qpn_mkey7_0 = cpu_to_be32(0xffffff << 8);
 	in->xlat_oct_act_size = cpu_to_be32(get_octo_len(virt_addr, length,
-							 1 << page_shift));
+							 page_shift));
 	err = mlx5_core_create_mkey(&dev->mdev, &mr->mmr, in, inlen, NULL,
 				    NULL, NULL);
 	if (err) {
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/infiniband/hw/qib/qib_rc.c linux-libre-3.16.51-gnu/drivers/infiniband/hw/qib/qib_rc.c
--- linux-libre-3.16.50-gnu/drivers/infiniband/hw/qib/qib_rc.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/infiniband/hw/qib/qib_rc.c	2017-11-26 08:50:43.000000000 -0500
@@ -365,7 +365,7 @@ int qib_make_rc_req(struct qib_qp *qp)
 		case IB_WR_RDMA_WRITE:
 			if (newreq && !(qp->s_flags & QIB_S_UNLIMITED_CREDIT))
 				qp->s_lsn++;
-			/* FALLTHROUGH */
+			goto no_flow_control;
 		case IB_WR_RDMA_WRITE_WITH_IMM:
 			/* If no credit, return. */
 			if (!(qp->s_flags & QIB_S_UNLIMITED_CREDIT) &&
@@ -373,6 +373,7 @@ int qib_make_rc_req(struct qib_qp *qp)
 				qp->s_flags |= QIB_S_WAIT_SSN_CREDIT;
 				goto bail;
 			}
+no_flow_control:
 			ohdr->u.rc.reth.vaddr =
 				cpu_to_be64(wqe->wr.wr.rdma.remote_addr);
 			ohdr->u.rc.reth.rkey =
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/infiniband/hw/usnic/usnic_fwd.c linux-libre-3.16.51-gnu/drivers/infiniband/hw/usnic/usnic_fwd.c
--- linux-libre-3.16.50-gnu/drivers/infiniband/hw/usnic/usnic_fwd.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/infiniband/hw/usnic/usnic_fwd.c	2017-11-26 08:50:43.000000000 -0500
@@ -95,20 +95,12 @@ void usnic_fwd_set_mac(struct usnic_fwd_
 	spin_unlock(&ufdev->lock);
 }
 
-int usnic_fwd_add_ipaddr(struct usnic_fwd_dev *ufdev, __be32 inaddr)
+void usnic_fwd_add_ipaddr(struct usnic_fwd_dev *ufdev, __be32 inaddr)
 {
-	int status;
-
 	spin_lock(&ufdev->lock);
-	if (ufdev->inaddr == 0) {
+	if (!ufdev->inaddr)
 		ufdev->inaddr = inaddr;
-		status = 0;
-	} else {
-		status = -EFAULT;
-	}
 	spin_unlock(&ufdev->lock);
-
-	return status;
 }
 
 void usnic_fwd_del_ipaddr(struct usnic_fwd_dev *ufdev)
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/infiniband/hw/usnic/usnic_fwd.h linux-libre-3.16.51-gnu/drivers/infiniband/hw/usnic/usnic_fwd.h
--- linux-libre-3.16.50-gnu/drivers/infiniband/hw/usnic/usnic_fwd.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/infiniband/hw/usnic/usnic_fwd.h	2017-11-26 08:50:43.000000000 -0500
@@ -59,7 +59,7 @@ struct usnic_fwd_dev *usnic_fwd_dev_allo
 void usnic_fwd_dev_free(struct usnic_fwd_dev *ufdev);
 
 void usnic_fwd_set_mac(struct usnic_fwd_dev *ufdev, char mac[ETH_ALEN]);
-int usnic_fwd_add_ipaddr(struct usnic_fwd_dev *ufdev, __be32 inaddr);
+void usnic_fwd_add_ipaddr(struct usnic_fwd_dev *ufdev, __be32 inaddr);
 void usnic_fwd_del_ipaddr(struct usnic_fwd_dev *ufdev);
 void usnic_fwd_carrier_up(struct usnic_fwd_dev *ufdev);
 void usnic_fwd_carrier_down(struct usnic_fwd_dev *ufdev);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/infiniband/hw/usnic/usnic_ib_main.c linux-libre-3.16.51-gnu/drivers/infiniband/hw/usnic/usnic_ib_main.c
--- linux-libre-3.16.50-gnu/drivers/infiniband/hw/usnic/usnic_ib_main.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/infiniband/hw/usnic/usnic_ib_main.c	2017-11-26 08:50:43.000000000 -0500
@@ -305,7 +305,7 @@ static void *usnic_ib_device_add(struct
 {
 	struct usnic_ib_dev *us_ibdev;
 	union ib_gid gid;
-	struct in_ifaddr *in;
+	struct in_device *ind;
 	struct net_device *netdev;
 
 	usnic_dbg("\n");
@@ -393,9 +393,11 @@ static void *usnic_ib_device_add(struct
 	if (netif_carrier_ok(us_ibdev->netdev))
 		usnic_fwd_carrier_up(us_ibdev->ufdev);
 
-	in = ((struct in_device *)(netdev->ip_ptr))->ifa_list;
-	if (in != NULL)
-		usnic_fwd_add_ipaddr(us_ibdev->ufdev, in->ifa_address);
+	ind = in_dev_get(netdev);
+	if (ind->ifa_list)
+		usnic_fwd_add_ipaddr(us_ibdev->ufdev,
+				     ind->ifa_list->ifa_address);
+	in_dev_put(ind);
 
 	usnic_mac_ip_to_gid(us_ibdev->netdev->perm_addr,
 				us_ibdev->ufdev->inaddr, &gid.raw[0]);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/infiniband/hw/usnic/usnic_ib_verbs.c linux-libre-3.16.51-gnu/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
--- linux-libre-3.16.50-gnu/drivers/infiniband/hw/usnic/usnic_ib_verbs.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/infiniband/hw/usnic/usnic_ib_verbs.c	2017-11-26 08:50:43.000000000 -0500
@@ -148,6 +148,8 @@ find_free_vf_and_create_qp_grp(struct us
 	if (usnic_ib_share_vf) {
 		/* Try to find resouces on a used vf which is in pd */
 		dev_list = usnic_uiom_get_dev_list(pd->umem_pd);
+		if (IS_ERR(dev_list))
+			return ERR_CAST(dev_list);
 		for (i = 0; dev_list[i]; i++) {
 			dev = dev_list[i];
 			vf = pci_get_drvdata(to_pci_dev(dev));
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/input/joystick/xpad.c linux-libre-3.16.51-gnu/drivers/input/joystick/xpad.c
--- linux-libre-3.16.50-gnu/drivers/input/joystick/xpad.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/input/joystick/xpad.c	2017-11-26 08:50:43.000000000 -0500
@@ -95,7 +95,8 @@
 #define XTYPE_XBOX        0
 #define XTYPE_XBOX360     1
 #define XTYPE_XBOX360W    2
-#define XTYPE_UNKNOWN     3
+#define XTYPE_XBOXONE     3
+#define XTYPE_UNKNOWN     4
 
 static bool dpad_to_buttons;
 module_param(dpad_to_buttons, bool, S_IRUGO);
@@ -121,6 +122,7 @@ static const struct xpad_device {
 	{ 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX },
 	{ 0x045e, 0x0289, "Microsoft X-Box pad v2 (US)", 0, XTYPE_XBOX },
 	{ 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 },
+	{ 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE },
 	{ 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
 	{ 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
 	{ 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
@@ -263,10 +265,12 @@ static const signed short xpad_abs_trigg
 	-1
 };
 
-/* Xbox 360 has a vendor-specific class, so we cannot match it with only
+/*
+ * Xbox 360 has a vendor-specific class, so we cannot match it with only
  * USB_INTERFACE_INFO (also specifically refused by USB subsystem), so we
  * match against vendor id as well. Wired Xbox 360 devices have protocol 1,
- * wireless controllers have protocol 129. */
+ * wireless controllers have protocol 129.
+ */
 #define XPAD_XBOX360_VENDOR_PROTOCOL(vend,pr) \
 	.match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \
 	.idVendor = (vend), \
@@ -277,9 +281,20 @@ static const signed short xpad_abs_trigg
 	{ XPAD_XBOX360_VENDOR_PROTOCOL(vend,1) }, \
 	{ XPAD_XBOX360_VENDOR_PROTOCOL(vend,129) }
 
+/* The Xbox One controller uses subclass 71 and protocol 208. */
+#define XPAD_XBOXONE_VENDOR_PROTOCOL(vend, pr) \
+	.match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \
+	.idVendor = (vend), \
+	.bInterfaceClass = USB_CLASS_VENDOR_SPEC, \
+	.bInterfaceSubClass = 71, \
+	.bInterfaceProtocol = (pr)
+#define XPAD_XBOXONE_VENDOR(vend) \
+	{ XPAD_XBOXONE_VENDOR_PROTOCOL(vend, 208) }
+
 static struct usb_device_id xpad_table[] = {
 	{ USB_INTERFACE_INFO('X', 'B', 0) },	/* X-Box USB-IF not approved class */
 	XPAD_XBOX360_VENDOR(0x045e),		/* Microsoft X-Box 360 controllers */
+	XPAD_XBOXONE_VENDOR(0x045e),		/* Microsoft X-Box One controllers */
 	XPAD_XBOX360_VENDOR(0x046d),		/* Logitech X-Box 360 style controllers */
 	XPAD_XBOX360_VENDOR(0x0738),		/* Mad Catz X-Box 360 controllers */
 	{ USB_DEVICE(0x0738, 0x4540) },		/* Mad Catz Beat Pad */
@@ -313,12 +328,10 @@ struct usb_xpad {
 	struct urb *bulk_out;
 	unsigned char *bdata;
 
-#if defined(CONFIG_JOYSTICK_XPAD_FF) || defined(CONFIG_JOYSTICK_XPAD_LEDS)
 	struct urb *irq_out;		/* urb for interrupt out report */
 	unsigned char *odata;		/* output data */
 	dma_addr_t odata_dma;
 	struct mutex odata_mutex;
-#endif
 
 #if defined(CONFIG_JOYSTICK_XPAD_LEDS)
 	struct xpad_led *led;
@@ -509,6 +522,105 @@ static void xpad360w_process_packet(stru
 	xpad360_process_packet(xpad, cmd, &data[4]);
 }
 
+/*
+ *	xpadone_process_buttons
+ *
+ *	Process a button update packet from an Xbox one controller.
+ */
+static void xpadone_process_buttons(struct usb_xpad *xpad,
+				struct input_dev *dev,
+				unsigned char *data)
+{
+	/* menu/view buttons */
+	input_report_key(dev, BTN_START,  data[4] & 0x04);
+	input_report_key(dev, BTN_SELECT, data[4] & 0x08);
+
+	/* buttons A,B,X,Y */
+	input_report_key(dev, BTN_A,	data[4] & 0x10);
+	input_report_key(dev, BTN_B,	data[4] & 0x20);
+	input_report_key(dev, BTN_X,	data[4] & 0x40);
+	input_report_key(dev, BTN_Y,	data[4] & 0x80);
+
+	/* digital pad */
+	if (xpad->mapping & MAP_DPAD_TO_BUTTONS) {
+		/* dpad as buttons (left, right, up, down) */
+		input_report_key(dev, BTN_TRIGGER_HAPPY1, data[5] & 0x04);
+		input_report_key(dev, BTN_TRIGGER_HAPPY2, data[5] & 0x08);
+		input_report_key(dev, BTN_TRIGGER_HAPPY3, data[5] & 0x01);
+		input_report_key(dev, BTN_TRIGGER_HAPPY4, data[5] & 0x02);
+	} else {
+		input_report_abs(dev, ABS_HAT0X,
+				 !!(data[5] & 0x08) - !!(data[5] & 0x04));
+		input_report_abs(dev, ABS_HAT0Y,
+				 !!(data[5] & 0x02) - !!(data[5] & 0x01));
+	}
+
+	/* TL/TR */
+	input_report_key(dev, BTN_TL,	data[5] & 0x10);
+	input_report_key(dev, BTN_TR,	data[5] & 0x20);
+
+	/* stick press left/right */
+	input_report_key(dev, BTN_THUMBL, data[5] & 0x40);
+	input_report_key(dev, BTN_THUMBR, data[5] & 0x80);
+
+	if (!(xpad->mapping & MAP_STICKS_TO_NULL)) {
+		/* left stick */
+		input_report_abs(dev, ABS_X,
+				 (__s16) le16_to_cpup((__le16 *)(data + 10)));
+		input_report_abs(dev, ABS_Y,
+				 ~(__s16) le16_to_cpup((__le16 *)(data + 12)));
+
+		/* right stick */
+		input_report_abs(dev, ABS_RX,
+				 (__s16) le16_to_cpup((__le16 *)(data + 14)));
+		input_report_abs(dev, ABS_RY,
+				 ~(__s16) le16_to_cpup((__le16 *)(data + 16)));
+	}
+
+	/* triggers left/right */
+	if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) {
+		input_report_key(dev, BTN_TL2,
+				 (__u16) le16_to_cpup((__le16 *)(data + 6)));
+		input_report_key(dev, BTN_TR2,
+				 (__u16) le16_to_cpup((__le16 *)(data + 8)));
+	} else {
+		input_report_abs(dev, ABS_Z,
+				 (__u16) le16_to_cpup((__le16 *)(data + 6)));
+		input_report_abs(dev, ABS_RZ,
+				 (__u16) le16_to_cpup((__le16 *)(data + 8)));
+	}
+
+	input_sync(dev);
+}
+
+/*
+ *	xpadone_process_packet
+ *
+ *	Completes a request by converting the data into events for the
+ *	input subsystem. This version is for the Xbox One controller.
+ *
+ *	The report format was gleaned from
+ *	https://github.com/kylelemons/xbox/blob/master/xbox.go
+ */
+
+static void xpadone_process_packet(struct usb_xpad *xpad,
+				u16 cmd, unsigned char *data)
+{
+	struct input_dev *dev = xpad->dev;
+
+	switch (data[0]) {
+	case 0x20:
+		xpadone_process_buttons(xpad, dev, data);
+		break;
+
+	case 0x07:
+		/* the xbox button has its own special report */
+		input_report_key(dev, BTN_MODE, data[4] & 0x01);
+		input_sync(dev);
+		break;
+	}
+}
+
 static void xpad_irq_in(struct urb *urb)
 {
 	struct usb_xpad *xpad = urb->context;
@@ -541,6 +653,9 @@ static void xpad_irq_in(struct urb *urb)
 	case XTYPE_XBOX360W:
 		xpad360w_process_packet(xpad, 0, xpad->idata);
 		break;
+	case XTYPE_XBOXONE:
+		xpadone_process_packet(xpad, 0, xpad->idata);
+		break;
 	default:
 		xpad_process_packet(xpad, 0, xpad->idata);
 	}
@@ -574,7 +689,6 @@ static void xpad_bulk_out(struct urb *ur
 	}
 }
 
-#if defined(CONFIG_JOYSTICK_XPAD_FF) || defined(CONFIG_JOYSTICK_XPAD_LEDS)
 static void xpad_irq_out(struct urb *urb)
 {
 	struct usb_xpad *xpad = urb->context;
@@ -609,9 +723,9 @@ exit:
 			__func__, retval);
 }
 
-static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad)
+static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad,
+			struct usb_endpoint_descriptor *ep_irq_out)
 {
-	struct usb_endpoint_descriptor *ep_irq_out;
 	int error;
 
 	if (xpad->xtype == XTYPE_UNKNOWN)
@@ -632,7 +746,6 @@ static int xpad_init_output(struct usb_i
 		goto fail2;
 	}
 
-	ep_irq_out = &intf->cur_altsetting->endpoint[1].desc;
 	usb_fill_int_urb(xpad->irq_out, xpad->udev,
 			 usb_sndintpipe(xpad->udev, ep_irq_out->bEndpointAddress),
 			 xpad->odata, XPAD_PKT_LEN,
@@ -660,11 +773,6 @@ static void xpad_deinit_output(struct us
 				xpad->odata, xpad->odata_dma);
 	}
 }
-#else
-static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) { return 0; }
-static void xpad_deinit_output(struct usb_xpad *xpad) {}
-static void xpad_stop_output(struct usb_xpad *xpad) {}
-#endif
 
 #ifdef CONFIG_JOYSTICK_XPAD_FF
 static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect)
@@ -731,7 +839,7 @@ static int xpad_play_effect(struct input
 
 static int xpad_init_ff(struct usb_xpad *xpad)
 {
-	if (xpad->xtype == XTYPE_UNKNOWN)
+	if (xpad->xtype == XTYPE_UNKNOWN || xpad->xtype == XTYPE_XBOXONE)
 		return 0;
 
 	input_set_capability(xpad->dev, EV_FF, FF_RUMBLE);
@@ -840,6 +948,14 @@ static int xpad_open(struct input_dev *d
 	if (usb_submit_urb(xpad->irq_in, GFP_KERNEL))
 		return -EIO;
 
+	if (xpad->xtype == XTYPE_XBOXONE) {
+		/* Xbox one controller needs to be initialized. */
+		xpad->odata[0] = 0x05;
+		xpad->odata[1] = 0x20;
+		xpad->irq_out->transfer_buffer_length = 2;
+		return usb_submit_urb(xpad->irq_out, GFP_KERNEL);
+	}
+
 	return 0;
 }
 
@@ -855,6 +971,7 @@ static void xpad_close(struct input_dev
 
 static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs)
 {
+	struct usb_xpad *xpad = input_get_drvdata(input_dev);
 	set_bit(abs, input_dev->absbit);
 
 	switch (abs) {
@@ -866,7 +983,10 @@ static void xpad_set_up_abs(struct input
 		break;
 	case ABS_Z:
 	case ABS_RZ:	/* the triggers (if mapped to axes) */
-		input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
+		if (xpad->xtype == XTYPE_XBOXONE)
+			input_set_abs_params(input_dev, abs, 0, 1023, 0, 0);
+		else
+			input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
 		break;
 	case ABS_HAT0X:
 	case ABS_HAT0Y:	/* the d-pad (only if dpad is mapped to axes */
@@ -880,7 +1000,7 @@ static int xpad_probe(struct usb_interfa
 	struct usb_device *udev = interface_to_usbdev(intf);
 	struct usb_xpad *xpad;
 	struct input_dev *input_dev;
-	struct usb_endpoint_descriptor *ep_irq_in;
+	struct usb_endpoint_descriptor *ep_irq_in, *ep_irq_out;
 	int i, error;
 
 	if (intf->cur_altsetting->desc.bNumEndpoints != 2)
@@ -892,6 +1012,16 @@ static int xpad_probe(struct usb_interfa
 			break;
 	}
 
+	if (xpad_device[i].xtype == XTYPE_XBOXONE &&
+	    intf->cur_altsetting->desc.bInterfaceNumber != 0) {
+		/*
+		 * The Xbox One controller lists three interfaces all with the
+		 * same interface class, subclass and protocol. Differentiate by
+		 * interface number.
+		 */
+		return -ENODEV;
+	}
+
 	xpad = kzalloc(sizeof(struct usb_xpad), GFP_KERNEL);
 	input_dev = input_allocate_device();
 	if (!xpad || !input_dev) {
@@ -962,7 +1092,8 @@ static int xpad_probe(struct usb_interfa
 		__set_bit(xpad_common_btn[i], input_dev->keybit);
 
 	/* set up model-specific ones */
-	if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W) {
+	if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W ||
+	    xpad->xtype == XTYPE_XBOXONE) {
 		for (i = 0; xpad360_btn[i] >= 0; i++)
 			__set_bit(xpad360_btn[i], input_dev->keybit);
 	} else {
@@ -975,7 +1106,7 @@ static int xpad_probe(struct usb_interfa
 			__set_bit(xpad_btn_pad[i], input_dev->keybit);
 	} else {
 		for (i = 0; xpad_abs_pad[i] >= 0; i++)
-		    xpad_set_up_abs(input_dev, xpad_abs_pad[i]);
+			xpad_set_up_abs(input_dev, xpad_abs_pad[i]);
 	}
 
 	if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) {
@@ -986,7 +1117,26 @@ static int xpad_probe(struct usb_interfa
 			xpad_set_up_abs(input_dev, xpad_abs_triggers[i]);
 	}
 
-	error = xpad_init_output(intf, xpad);
+	ep_irq_in = ep_irq_out = NULL;
+
+	for (i = 0; i < 2; i++) {
+		struct usb_endpoint_descriptor *ep =
+				&intf->cur_altsetting->endpoint[i].desc;
+
+		if (usb_endpoint_xfer_int(ep)) {
+			if (usb_endpoint_dir_in(ep))
+				ep_irq_in = ep;
+			else
+				ep_irq_out = ep;
+		}
+	}
+
+	if (!ep_irq_in || !ep_irq_out) {
+		error = -ENODEV;
+		goto fail3;
+	}
+
+	error = xpad_init_output(intf, xpad, ep_irq_out);
 	if (error)
 		goto fail3;
 
@@ -998,7 +1148,6 @@ static int xpad_probe(struct usb_interfa
 	if (error)
 		goto fail5;
 
-	ep_irq_in = &intf->cur_altsetting->endpoint[0].desc;
 	usb_fill_int_urb(xpad->irq_in, udev,
 			 usb_rcvintpipe(udev, ep_irq_in->bEndpointAddress),
 			 xpad->idata, XPAD_PKT_LEN, xpad_irq_in,
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/input/serio/i8042-x86ia64io.h linux-libre-3.16.51-gnu/drivers/input/serio/i8042-x86ia64io.h
--- linux-libre-3.16.50-gnu/drivers/input/serio/i8042-x86ia64io.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/input/serio/i8042-x86ia64io.h	2017-11-26 08:50:43.000000000 -0500
@@ -804,6 +804,13 @@ static const struct dmi_system_id __init
 		},
 	},
 	{
+		/* Gigabyte P57 - Elantech touchpad */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "P57"),
+		},
+	},
+	{
 		/* Schenker XMG C504 - Elantech touchpad */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "XMG"),
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/input/tablet/gtco.c linux-libre-3.16.51-gnu/drivers/input/tablet/gtco.c
--- linux-libre-3.16.50-gnu/drivers/input/tablet/gtco.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/input/tablet/gtco.c	2017-11-26 08:50:43.000000000 -0500
@@ -231,13 +231,17 @@ static void parse_hid_report_descriptor(
 
 	/* Walk  this report and pull out the info we need */
 	while (i < length) {
-		prefix = report[i];
-
-		/* Skip over prefix */
-		i++;
+		prefix = report[i++];
 
 		/* Determine data size and save the data in the proper variable */
-		size = PREF_SIZE(prefix);
+		size = (1U << PREF_SIZE(prefix)) >> 1;
+		if (i + size > length) {
+			dev_err(ddev,
+				"Not enough data (need %d, have %d)\n",
+				i + size, length);
+			break;
+		}
+
 		switch (size) {
 		case 1:
 			data = report[i];
@@ -245,8 +249,7 @@ static void parse_hid_report_descriptor(
 		case 2:
 			data16 = get_unaligned_le16(&report[i]);
 			break;
-		case 3:
-			size = 4;
+		case 4:
 			data32 = get_unaligned_le32(&report[i]);
 			break;
 		}
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/input/touchscreen/ucb1400_ts.c linux-libre-3.16.51-gnu/drivers/input/touchscreen/ucb1400_ts.c
--- linux-libre-3.16.50-gnu/drivers/input/touchscreen/ucb1400_ts.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/input/touchscreen/ucb1400_ts.c	2017-11-26 08:50:43.000000000 -0500
@@ -415,7 +415,7 @@ static int ucb1400_ts_suspend(struct dev
 	mutex_lock(&idev->mutex);
 
 	if (idev->users)
-		ucb1400_ts_start(ucb);
+		ucb1400_ts_stop(ucb);
 
 	mutex_unlock(&idev->mutex);
 	return 0;
@@ -429,7 +429,7 @@ static int ucb1400_ts_resume(struct devi
 	mutex_lock(&idev->mutex);
 
 	if (idev->users)
-		ucb1400_ts_stop(ucb);
+		ucb1400_ts_start(ucb);
 
 	mutex_unlock(&idev->mutex);
 	return 0;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/md/bcache/bcache.h linux-libre-3.16.51-gnu/drivers/md/bcache/bcache.h
--- linux-libre-3.16.50-gnu/drivers/md/bcache/bcache.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/md/bcache/bcache.h	2017-11-26 08:50:43.000000000 -0500
@@ -348,6 +348,7 @@ struct cached_dev {
 	/* Limit number of writeback bios in flight */
 	struct semaphore	in_flight;
 	struct task_struct	*writeback_thread;
+	struct workqueue_struct	*writeback_write_wq;
 
 	struct keybuf		writeback_keys;
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/md/bcache/request.c linux-libre-3.16.51-gnu/drivers/md/bcache/request.c
--- linux-libre-3.16.50-gnu/drivers/md/bcache/request.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/md/bcache/request.c	2017-11-26 08:50:43.000000000 -0500
@@ -193,14 +193,14 @@ static void bch_data_insert_start(struct
 	struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
 	struct bio *bio = op->bio, *n;
 
+	if (op->bypass)
+		return bch_data_invalidate(cl);
+
 	if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) {
 		set_gc_sectors(op->c);
 		wake_up_gc(op->c);
 	}
 
-	if (op->bypass)
-		return bch_data_invalidate(cl);
-
 	/*
 	 * Journal writes are marked REQ_FLUSH; if the original write was a
 	 * flush, it'll wait on the journal write.
@@ -395,12 +395,6 @@ static bool check_should_bypass(struct c
 	if (!congested && !dc->sequential_cutoff)
 		goto rescale;
 
-	if (!congested &&
-	    mode == CACHE_MODE_WRITEBACK &&
-	    (bio->bi_rw & REQ_WRITE) &&
-	    (bio->bi_rw & REQ_SYNC))
-		goto rescale;
-
 	spin_lock(&dc->io_lock);
 
 	hlist_for_each_entry(i, iohash(dc, bio->bi_iter.bi_sector), hash)
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/md/bcache/super.c linux-libre-3.16.51-gnu/drivers/md/bcache/super.c
--- linux-libre-3.16.50-gnu/drivers/md/bcache/super.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/md/bcache/super.c	2017-11-26 08:50:43.000000000 -0500
@@ -1045,7 +1045,7 @@ int bch_cached_dev_attach(struct cached_
 	atomic_set(&dc->count, 1);
 
 	if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
-		bch_sectors_dirty_init(dc);
+		bch_sectors_dirty_init(&dc->disk);
 		atomic_set(&dc->has_dirty, 1);
 		atomic_inc(&dc->count);
 		bch_writeback_queue(dc);
@@ -1073,7 +1073,10 @@ static void cached_dev_free(struct closu
 	struct cached_dev *dc = container_of(cl, struct cached_dev, disk.cl);
 
 	cancel_delayed_work_sync(&dc->writeback_rate_update);
-	kthread_stop(dc->writeback_thread);
+	if (!IS_ERR_OR_NULL(dc->writeback_thread))
+		kthread_stop(dc->writeback_thread);
+	if (dc->writeback_write_wq)
+		destroy_workqueue(dc->writeback_write_wq);
 
 	mutex_lock(&bch_register_lock);
 
@@ -1245,6 +1248,7 @@ static int flash_dev_run(struct cache_se
 		goto err;
 
 	bcache_device_attach(d, c, u - c->uuids);
+	bch_sectors_dirty_init(d);
 	bch_flash_dev_request_init(d);
 	add_disk(d->disk);
 
@@ -1974,6 +1978,8 @@ static ssize_t register_bcache(struct ko
 			else
 				err = "device busy";
 			mutex_unlock(&bch_register_lock);
+			if (!IS_ERR(bdev))
+				bdput(bdev);
 			if (attr == &ksysfs_register_quiet)
 				goto out;
 		}
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/md/bcache/sysfs.c linux-libre-3.16.51-gnu/drivers/md/bcache/sysfs.c
--- linux-libre-3.16.50-gnu/drivers/md/bcache/sysfs.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/md/bcache/sysfs.c	2017-11-26 08:50:43.000000000 -0500
@@ -191,7 +191,7 @@ STORE(__cached_dev)
 {
 	struct cached_dev *dc = container_of(kobj, struct cached_dev,
 					     disk.kobj);
-	unsigned v = size;
+	ssize_t v = size;
 	struct cache_set *c;
 	struct kobj_uevent_env *env;
 
@@ -226,7 +226,7 @@ STORE(__cached_dev)
 		bch_cached_dev_run(dc);
 
 	if (attr == &sysfs_cache_mode) {
-		ssize_t v = bch_read_string_list(buf, bch_cache_modes + 1);
+		v = bch_read_string_list(buf, bch_cache_modes + 1);
 
 		if (v < 0)
 			return v;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/md/bcache/util.c linux-libre-3.16.51-gnu/drivers/md/bcache/util.c
--- linux-libre-3.16.50-gnu/drivers/md/bcache/util.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/md/bcache/util.c	2017-11-26 08:50:43.000000000 -0500
@@ -73,24 +73,44 @@ STRTO_H(strtouint, unsigned int)
 STRTO_H(strtoll, long long)
 STRTO_H(strtoull, unsigned long long)
 
+/**
+ * bch_hprint() - formats @v to human readable string for sysfs.
+ *
+ * @v - signed 64 bit integer
+ * @buf - the (at least 8 byte) buffer to format the result into.
+ *
+ * Returns the number of bytes used by format.
+ */
 ssize_t bch_hprint(char *buf, int64_t v)
 {
 	static const char units[] = "?kMGTPEZY";
-	char dec[4] = "";
-	int u, t = 0;
+	int u = 0, t;
 
-	for (u = 0; v >= 1024 || v <= -1024; u++) {
-		t = v & ~(~0 << 10);
-		v >>= 10;
-	}
+	uint64_t q;
 
-	if (!u)
-		return sprintf(buf, "%llu", v);
+	if (v < 0)
+		q = -v;
+	else
+		q = v;
 
-	if (v < 100 && v > -100)
-		snprintf(dec, sizeof(dec), ".%i", t / 100);
+	/* For as long as the number is more than 3 digits, but at least
+	 * once, shift right / divide by 1024.  Keep the remainder for
+	 * a digit after the decimal point.
+	 */
+	do {
+		u++;
 
-	return sprintf(buf, "%lli%s%c", v, dec, units[u]);
+		t = q & ~(~0 << 10);
+		q >>= 10;
+	} while (q >= 1000);
+
+	if (v < 0)
+		/* '-', up to 3 digits, '.', 1 digit, 1 character, null;
+		 * yields 8 bytes.
+		 */
+		return sprintf(buf, "-%llu.%i%c", q, t * 10 / 1024, units[u]);
+	else
+		return sprintf(buf, "%llu.%i%c", q, t * 10 / 1024, units[u]);
 }
 
 ssize_t bch_snprint_string_list(char *buf, size_t size, const char * const list[],
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/md/bcache/writeback.c linux-libre-3.16.51-gnu/drivers/md/bcache/writeback.c
--- linux-libre-3.16.50-gnu/drivers/md/bcache/writeback.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/md/bcache/writeback.c	2017-11-26 08:50:43.000000000 -0500
@@ -21,7 +21,8 @@
 static void __update_writeback_rate(struct cached_dev *dc)
 {
 	struct cache_set *c = dc->disk.c;
-	uint64_t cache_sectors = c->nbuckets * c->sb.bucket_size;
+	uint64_t cache_sectors = c->nbuckets * c->sb.bucket_size -
+				bcache_flash_devs_sectors_dirty(c);
 	uint64_t cache_dirty_target =
 		div_u64(cache_sectors * dc->writeback_percent, 100);
 
@@ -190,7 +191,7 @@ static void write_dirty(struct closure *
 
 	closure_bio_submit(&io->bio, cl, &io->dc->disk);
 
-	continue_at(cl, write_dirty_finish, system_wq);
+	continue_at(cl, write_dirty_finish, io->dc->writeback_write_wq);
 }
 
 static void read_dirty_endio(struct bio *bio, int error)
@@ -210,7 +211,7 @@ static void read_dirty_submit(struct clo
 
 	closure_bio_submit(&io->bio, cl, &io->dc->disk);
 
-	continue_at(cl, write_dirty, system_wq);
+	continue_at(cl, write_dirty, io->dc->writeback_write_wq);
 }
 
 static void read_dirty(struct cached_dev *dc)
@@ -488,17 +489,17 @@ static int sectors_dirty_init_fn(struct
 	return MAP_CONTINUE;
 }
 
-void bch_sectors_dirty_init(struct cached_dev *dc)
+void bch_sectors_dirty_init(struct bcache_device *d)
 {
 	struct sectors_dirty_init op;
 
 	bch_btree_op_init(&op.op, -1);
-	op.inode = dc->disk.id;
+	op.inode = d->id;
 
-	bch_btree_map_keys(&op.op, dc->disk.c, &KEY(op.inode, 0, 0),
+	bch_btree_map_keys(&op.op, d->c, &KEY(op.inode, 0, 0),
 			   sectors_dirty_init_fn, 0);
 
-	dc->disk.sectors_dirty_last = bcache_dev_sectors_dirty(&dc->disk);
+	d->sectors_dirty_last = bcache_dev_sectors_dirty(d);
 }
 
 int bch_cached_dev_writeback_init(struct cached_dev *dc)
@@ -517,6 +518,11 @@ int bch_cached_dev_writeback_init(struct
 	dc->writeback_rate_d_term	= 30;
 	dc->writeback_rate_p_term_inverse = 6000;
 
+	dc->writeback_write_wq = alloc_workqueue("bcache_writeback_wq",
+						WQ_MEM_RECLAIM, 0);
+	if (!dc->writeback_write_wq)
+		return -ENOMEM;
+
 	dc->writeback_thread = kthread_create(bch_writeback_thread, dc,
 					      "bcache_writeback");
 	if (IS_ERR(dc->writeback_thread))
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/md/bcache/writeback.h linux-libre-3.16.51-gnu/drivers/md/bcache/writeback.h
--- linux-libre-3.16.50-gnu/drivers/md/bcache/writeback.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/md/bcache/writeback.h	2017-11-26 08:50:43.000000000 -0500
@@ -14,6 +14,25 @@ static inline uint64_t bcache_dev_sector
 	return ret;
 }
 
+static inline uint64_t  bcache_flash_devs_sectors_dirty(struct cache_set *c)
+{
+	uint64_t i, ret = 0;
+
+	mutex_lock(&bch_register_lock);
+
+	for (i = 0; i < c->nr_uuids; i++) {
+		struct bcache_device *d = c->devices[i];
+
+		if (!d || !UUID_FLASH_ONLY(&c->uuids[i]))
+			continue;
+	   ret += bcache_dev_sectors_dirty(d);
+	}
+
+	mutex_unlock(&bch_register_lock);
+
+	return ret;
+}
+
 static inline unsigned offset_to_stripe(struct bcache_device *d,
 					uint64_t offset)
 {
@@ -85,7 +104,7 @@ static inline void bch_writeback_add(str
 
 void bcache_dev_sectors_dirty_add(struct cache_set *, unsigned, uint64_t, int);
 
-void bch_sectors_dirty_init(struct cached_dev *dc);
+void bch_sectors_dirty_init(struct bcache_device *);
 int bch_cached_dev_writeback_init(struct cached_dev *);
 
 #endif
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/md/bitmap.c linux-libre-3.16.51-gnu/drivers/md/bitmap.c
--- linux-libre-3.16.50-gnu/drivers/md/bitmap.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/md/bitmap.c	2017-11-26 08:50:43.000000000 -0500
@@ -1802,6 +1802,11 @@ int bitmap_resize(struct bitmap *bitmap,
 	long pages;
 	struct bitmap_page *new_bp;
 
+	if (bitmap->storage.file && !init) {
+		pr_info("md: cannot resize file-based bitmap\n");
+		return -EINVAL;
+	}
+
 	if (chunksize == 0) {
 		/* If there is enough space, leave the chunk size unchanged,
 		 * else increase by factor of two until there is enough space.
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/media/rc/imon.c linux-libre-3.16.51-gnu/drivers/media/rc/imon.c
--- linux-libre-3.16.50-gnu/drivers/media/rc/imon.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/media/rc/imon.c	2017-11-26 08:50:43.000000000 -0500
@@ -2312,6 +2312,11 @@ static int imon_probe(struct usb_interfa
 	mutex_lock(&driver_lock);
 
 	first_if = usb_ifnum_to_if(usbdev, 0);
+	if (!first_if) {
+		ret = -ENODEV;
+		goto fail;
+	}
+
 	first_if_ctx = usb_get_intfdata(first_if);
 
 	if (ifnum == 0) {
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/media/usb/cx231xx/cx231xx-cards.c linux-libre-3.16.51-gnu/drivers/media/usb/cx231xx/cx231xx-cards.c
--- linux-libre-3.16.50-gnu/drivers/media/usb/cx231xx/cx231xx-cards.c	2017-11-13 09:06:53.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/media/usb/cx231xx/cx231xx-cards.c	2017-11-26 13:24:16.000000000 -0500
@@ -1226,7 +1226,7 @@ static int cx231xx_usb_probe(struct usb_
 	nr = dev->devno;
 
 	assoc_desc = udev->actconfig->intf_assoc[0];
-	if (assoc_desc->bFirstInterface != ifnum) {
+	if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) {
 		cx231xx_err(DRIVER_NAME ": Not found "
 			    "matching IAD interface\n");
 		retval = -ENODEV;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/media/usb/em28xx/em28xx-audio.c linux-libre-3.16.51-gnu/drivers/media/usb/em28xx/em28xx-audio.c
--- linux-libre-3.16.50-gnu/drivers/media/usb/em28xx/em28xx-audio.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/media/usb/em28xx/em28xx-audio.c	2017-11-26 08:50:43.000000000 -0500
@@ -562,7 +562,7 @@ static int em28xx_vol_get(struct snd_kco
 		val, (int)kcontrol->private_value);
 
 	value->value.integer.value[0] = 0x1f - (val & 0x1f);
-	value->value.integer.value[1] = 0x1f - ((val << 8) & 0x1f);
+	value->value.integer.value[1] = 0x1f - ((val >> 8) & 0x1f);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/media/usb/uvc/uvc_ctrl.c linux-libre-3.16.51-gnu/drivers/media/usb/uvc/uvc_ctrl.c
--- linux-libre-3.16.50-gnu/drivers/media/usb/uvc/uvc_ctrl.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/media/usb/uvc/uvc_ctrl.c	2017-11-26 08:50:43.000000000 -0500
@@ -1949,6 +1949,13 @@ int uvc_ctrl_add_mapping(struct uvc_vide
 		goto done;
 	}
 
+	/* Validate the user-provided bit-size and offset */
+	if (mapping->size > 32 ||
+	    mapping->offset + mapping->size > ctrl->info.size * 8) {
+		ret = -EINVAL;
+		goto done;
+	}
+
 	list_for_each_entry(map, &ctrl->info.mappings, list) {
 		if (mapping->id == map->id) {
 			uvc_trace(UVC_TRACE_CONTROL, "Can't add mapping '%s', "
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/media/v4l2-core/v4l2-compat-ioctl32.c linux-libre-3.16.51-gnu/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
--- linux-libre-3.16.50-gnu/drivers/media/v4l2-core/v4l2-compat-ioctl32.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/media/v4l2-core/v4l2-compat-ioctl32.c	2017-11-26 08:50:43.000000000 -0500
@@ -731,7 +731,8 @@ static int put_v4l2_event32(struct v4l2_
 		copy_to_user(&up->u, &kp->u, sizeof(kp->u)) ||
 		put_user(kp->pending, &up->pending) ||
 		put_user(kp->sequence, &up->sequence) ||
-		compat_put_timespec(&kp->timestamp, &up->timestamp) ||
+		put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) ||
+		put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) ||
 		put_user(kp->id, &up->id) ||
 		copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32)))
 			return -EFAULT;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/mfd/max8998.c linux-libre-3.16.51-gnu/drivers/mfd/max8998.c
--- linux-libre-3.16.50-gnu/drivers/mfd/max8998.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/mfd/max8998.c	2017-11-26 08:50:43.000000000 -0500
@@ -195,10 +195,8 @@ static int max8998_i2c_probe(struct i2c_
 
 	if (IS_ENABLED(CONFIG_OF) && i2c->dev.of_node) {
 		pdata = max8998_i2c_parse_dt_pdata(&i2c->dev);
-		if (IS_ERR(pdata)) {
-			ret = PTR_ERR(pdata);
-			goto err;
-		}
+		if (IS_ERR(pdata))
+			return PTR_ERR(pdata);
 	}
 
 	i2c_set_clientdata(i2c, max8998);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/mfd/omap-usb-tll.c linux-libre-3.16.51-gnu/drivers/mfd/omap-usb-tll.c
--- linux-libre-3.16.50-gnu/drivers/mfd/omap-usb-tll.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/mfd/omap-usb-tll.c	2017-11-26 08:50:43.000000000 -0500
@@ -129,12 +129,12 @@ static inline u32 usbtll_read(void __iom
 	return readl_relaxed(base + reg);
 }
 
-static inline void usbtll_writeb(void __iomem *base, u8 reg, u8 val)
+static inline void usbtll_writeb(void __iomem *base, u32 reg, u8 val)
 {
 	writeb_relaxed(val, base + reg);
 }
 
-static inline u8 usbtll_readb(void __iomem *base, u8 reg)
+static inline u8 usbtll_readb(void __iomem *base, u32 reg)
 {
 	return readb_relaxed(base + reg);
 }
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/ethernet/mellanox/mlx4/fw.c linux-libre-3.16.51-gnu/drivers/net/ethernet/mellanox/mlx4/fw.c
--- linux-libre-3.16.50-gnu/drivers/net/ethernet/mellanox/mlx4/fw.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/ethernet/mellanox/mlx4/fw.c	2017-11-26 08:50:43.000000000 -0500
@@ -1084,7 +1084,7 @@ int mlx4_map_cmd(struct mlx4_dev *dev, u
 		for (i = 0; i < mlx4_icm_size(&iter) >> lg; ++i) {
 			if (virt != -1) {
 				pages[nent * 2] = cpu_to_be64(virt);
-				virt += 1 << lg;
+				virt += 1ULL << lg;
 			}
 
 			pages[nent * 2 + 1] =
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/usb/cdc_ether.c linux-libre-3.16.51-gnu/drivers/net/usb/cdc_ether.c
--- linux-libre-3.16.50-gnu/drivers/net/usb/cdc_ether.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/usb/cdc_ether.c	2017-11-26 08:50:43.000000000 -0500
@@ -235,8 +235,9 @@ int usbnet_generic_cdc_bind(struct usbne
 					info->ether->bLength);
 				goto bad_desc;
 			}
-			dev->hard_mtu = le16_to_cpu(
-						info->ether->wMaxSegmentSize);
+			if (info->ether->wMaxSegmentSize)
+				dev->hard_mtu = le16_to_cpu(
+					info->ether->wMaxSegmentSize);
 			/* because of Zaurus, we may be ignoring the host
 			 * side link address we were given.
 			 */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/usb/qmi_wwan.c linux-libre-3.16.51-gnu/drivers/net/usb/qmi_wwan.c
--- linux-libre-3.16.50-gnu/drivers/net/usb/qmi_wwan.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/usb/qmi_wwan.c	2017-11-26 08:50:43.000000000 -0500
@@ -314,7 +314,7 @@ next_desc:
 	}
 
 	/* errors aren't fatal - we can live with the dynamic address */
-	if (cdc_ether) {
+	if (cdc_ether && cdc_ether->wMaxSegmentSize) {
 		dev->hard_mtu = le16_to_cpu(cdc_ether->wMaxSegmentSize);
 		usbnet_get_ethernet_addr(dev, cdc_ether->iMACAddress);
 	}
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/usb/smsc95xx.c linux-libre-3.16.51-gnu/drivers/net/usb/smsc95xx.c
--- linux-libre-3.16.50-gnu/drivers/net/usb/smsc95xx.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/usb/smsc95xx.c	2017-11-26 08:50:43.000000000 -0500
@@ -516,7 +516,7 @@ static void smsc95xx_set_multicast(struc
 static int smsc95xx_phy_update_flowcontrol(struct usbnet *dev, u8 duplex,
 					   u16 lcladv, u16 rmtadv)
 {
-	u32 flow, afc_cfg = 0;
+	u32 flow = 0, afc_cfg;
 
 	int ret = smsc95xx_read_reg(dev, AFC_CFG, &afc_cfg);
 	if (ret < 0)
@@ -527,20 +527,19 @@ static int smsc95xx_phy_update_flowcontr
 
 		if (cap & FLOW_CTRL_RX)
 			flow = 0xFFFF0002;
-		else
-			flow = 0;
 
-		if (cap & FLOW_CTRL_TX)
+		if (cap & FLOW_CTRL_TX) {
 			afc_cfg |= 0xF;
-		else
+			flow |= 0xFFFF0000;
+		} else {
 			afc_cfg &= ~0xF;
+		}
 
 		netif_dbg(dev, link, dev->net, "rx pause %s, tx pause %s\n",
 				   cap & FLOW_CTRL_RX ? "enabled" : "disabled",
 				   cap & FLOW_CTRL_TX ? "enabled" : "disabled");
 	} else {
 		netif_dbg(dev, link, dev->net, "half duplex\n");
-		flow = 0;
 		afc_cfg |= 0xF;
 	}
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/wireless/ath/wcn36xx/main.c linux-libre-3.16.51-gnu/drivers/net/wireless/ath/wcn36xx/main.c
--- linux-libre-3.16.50-gnu/drivers/net/wireless/ath/wcn36xx/main.c	2017-11-13 09:17:21.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/wireless/ath/wcn36xx/main.c	2017-11-26 13:35:10.000000000 -0500
@@ -339,6 +339,8 @@ static int wcn36xx_config(struct ieee802
 
 	wcn36xx_dbg(WCN36XX_DBG_MAC, "mac config changed 0x%08x\n", changed);
 
+	mutex_lock(&wcn->conf_mutex);
+
 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
 		int ch = WCN36XX_HW_CHANNEL(wcn);
 		wcn36xx_dbg(WCN36XX_DBG_MAC, "wcn36xx_config channel switch=%d\n",
@@ -351,6 +353,8 @@ static int wcn36xx_config(struct ieee802
 		}
 	}
 
+	mutex_unlock(&wcn->conf_mutex);
+
 	return 0;
 }
 
@@ -398,6 +402,8 @@ static int wcn36xx_set_key(struct ieee80
 			 key_conf->key,
 			 key_conf->keylen);
 
+	mutex_lock(&wcn->conf_mutex);
+
 	switch (key_conf->cipher) {
 	case WLAN_CIPHER_SUITE_WEP40:
 		vif_priv->encrypt_type = WCN36XX_HAL_ED_WEP40;
@@ -492,6 +498,8 @@ static int wcn36xx_set_key(struct ieee80
 	}
 
 out:
+	mutex_unlock(&wcn->conf_mutex);
+
 	return ret;
 }
 
@@ -591,6 +599,8 @@ static void wcn36xx_bss_info_changed(str
 	wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss info changed vif %p changed 0x%08x\n",
 		    vif, changed);
 
+	mutex_lock(&wcn->conf_mutex);
+
 	if (changed & BSS_CHANGED_BEACON_INFO) {
 		wcn36xx_dbg(WCN36XX_DBG_MAC,
 			    "mac bss changed dtim period %d\n",
@@ -651,12 +661,17 @@ static void wcn36xx_bss_info_changed(str
 				     vif->addr,
 				     bss_conf->aid);
 
-			rcu_read_lock();
+
+			/*
+			 * Holding conf_mutex ensures mutal exclusion with
+			 * wcn36xx_sta_remove() and as such ensures that sta
+			 * won't be freed while we're operating on it. As such
+			 * we do not need to hold the rcu_read_lock().
+			 */
 			sta = ieee80211_find_sta(vif, bss_conf->bssid);
 			if (!sta) {
 				wcn36xx_err("sta %pM is not found\n",
 					      bss_conf->bssid);
-				rcu_read_unlock();
 				goto out;
 			}
 			sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
@@ -675,7 +690,6 @@ static void wcn36xx_bss_info_changed(str
 			 * place where AID is available.
 			 */
 			wcn36xx_smd_config_sta(wcn, vif, sta);
-			rcu_read_unlock();
 		} else {
 			wcn36xx_dbg(WCN36XX_DBG_MAC,
 				    "disassociated bss %pM vif %pM AID=%d\n",
@@ -736,6 +750,9 @@ static void wcn36xx_bss_info_changed(str
 		}
 	}
 out:
+
+	mutex_unlock(&wcn->conf_mutex);
+
 	return;
 }
 
@@ -745,7 +762,10 @@ static int wcn36xx_set_rts_threshold(str
 	struct wcn36xx *wcn = hw->priv;
 	wcn36xx_dbg(WCN36XX_DBG_MAC, "mac set RTS threshold %d\n", value);
 
+	mutex_lock(&wcn->conf_mutex);
 	wcn36xx_smd_update_cfg(wcn, WCN36XX_HAL_CFG_RTS_THRESHOLD, value);
+	mutex_unlock(&wcn->conf_mutex);
+
 	return 0;
 }
 
@@ -756,8 +776,12 @@ static void wcn36xx_remove_interface(str
 	struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
 	wcn36xx_dbg(WCN36XX_DBG_MAC, "mac remove interface vif %p\n", vif);
 
+	mutex_lock(&wcn->conf_mutex);
+
 	list_del(&vif_priv->list);
 	wcn36xx_smd_delete_sta_self(wcn, vif->addr);
+
+	mutex_unlock(&wcn->conf_mutex);
 }
 
 static int wcn36xx_add_interface(struct ieee80211_hw *hw,
@@ -778,9 +802,13 @@ static int wcn36xx_add_interface(struct
 		return -EOPNOTSUPP;
 	}
 
+	mutex_lock(&wcn->conf_mutex);
+
 	list_add(&vif_priv->list, &wcn->vif_list);
 	wcn36xx_smd_add_sta_self(wcn, vif);
 
+	mutex_unlock(&wcn->conf_mutex);
+
 	return 0;
 }
 
@@ -793,6 +821,8 @@ static int wcn36xx_sta_add(struct ieee80
 	wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta add vif %p sta %pM\n",
 		    vif, sta->addr);
 
+	mutex_lock(&wcn->conf_mutex);
+
 	vif_priv->sta = sta_priv;
 	sta_priv->vif = vif_priv;
 	/*
@@ -804,6 +834,9 @@ static int wcn36xx_sta_add(struct ieee80
 		sta_priv->aid = sta->aid;
 		wcn36xx_smd_config_sta(wcn, vif, sta);
 	}
+
+	mutex_unlock(&wcn->conf_mutex);
+
 	return 0;
 }
 
@@ -818,9 +851,14 @@ static int wcn36xx_sta_remove(struct iee
 	wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta remove vif %p sta %pM index %d\n",
 		    vif, sta->addr, sta_priv->sta_index);
 
+	mutex_lock(&wcn->conf_mutex);
+
 	wcn36xx_smd_delete_sta(wcn, sta_priv->sta_index);
 	vif_priv->sta = NULL;
 	sta_priv->vif = NULL;
+
+	mutex_unlock(&wcn->conf_mutex);
+
 	return 0;
 }
 
@@ -864,6 +902,8 @@ static int wcn36xx_ampdu_action(struct i
 
 	sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
 
+	mutex_lock(&wcn->conf_mutex);
+
 	switch (action) {
 	case IEEE80211_AMPDU_RX_START:
 		sta_priv->tid = tid;
@@ -892,6 +932,8 @@ static int wcn36xx_ampdu_action(struct i
 		wcn36xx_err("Unknown AMPDU action\n");
 	}
 
+	mutex_unlock(&wcn->conf_mutex);
+
 	return 0;
 }
 
@@ -1022,6 +1064,7 @@ static int wcn36xx_probe(struct platform
 	wcn->dev = &pdev->dev;
 	wcn->ctrl_ops = pdev->dev.platform_data;
 
+	mutex_init(&wcn->conf_mutex);
 	mutex_init(&wcn->hal_mutex);
 
 	if (!wcn->ctrl_ops->get_hw_mac(addr)) {
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/wireless/ath/wcn36xx/wcn36xx.h linux-libre-3.16.51-gnu/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
--- linux-libre-3.16.50-gnu/drivers/net/wireless/ath/wcn36xx/wcn36xx.h	2017-11-13 09:17:19.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/wireless/ath/wcn36xx/wcn36xx.h	2017-11-26 13:35:07.000000000 -0500
@@ -191,6 +191,10 @@ struct wcn36xx {
 	void __iomem		*mmio;
 
 	struct wcn36xx_platform_ctrl_ops *ctrl_ops;
+
+	/* prevents concurrent FW reconfiguration */
+	struct mutex		conf_mutex;
+
 	/*
 	 * smd_buf must be protected with smd_mutex to garantee
 	 * that all messages are sent one after another
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c linux-libre-3.16.51-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c
--- linux-libre-3.16.50-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c	2017-11-26 08:50:43.000000000 -0500
@@ -485,12 +485,11 @@ static void iwl_mvm_mac_tx(struct ieee80
 	    !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status))
 		goto drop;
 
-	/* treat non-bufferable MMPDUs as broadcast if sta is sleeping */
-	if (unlikely(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER &&
-		     ieee80211_is_mgmt(hdr->frame_control) &&
-		     !ieee80211_is_deauth(hdr->frame_control) &&
-		     !ieee80211_is_disassoc(hdr->frame_control) &&
-		     !ieee80211_is_action(hdr->frame_control)))
+	/* treat non-bufferable MMPDUs on AP interfaces as broadcast */
+	if ((info->control.vif->type == NL80211_IFTYPE_AP ||
+	     info->control.vif->type == NL80211_IFTYPE_ADHOC) &&
+	    ieee80211_is_mgmt(hdr->frame_control) &&
+	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
 		sta = NULL;
 
 	if (sta) {
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/wireless/iwlwifi/pcie/drv.c linux-libre-3.16.51-gnu/drivers/net/wireless/iwlwifi/pcie/drv.c
--- linux-libre-3.16.50-gnu/drivers/net/wireless/iwlwifi/pcie/drv.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/wireless/iwlwifi/pcie/drv.c	2017-11-26 08:50:43.000000000 -0500
@@ -403,6 +403,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_ca
 	{IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x095A, 0x9E10, iwl7265_2ac_cfg)},
 
 /* 8000 Series */
 	{IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/net/wireless/mac80211_hwsim.c linux-libre-3.16.51-gnu/drivers/net/wireless/mac80211_hwsim.c
--- linux-libre-3.16.50-gnu/drivers/net/wireless/mac80211_hwsim.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/net/wireless/mac80211_hwsim.c	2017-11-26 08:50:43.000000000 -0500
@@ -1122,7 +1122,6 @@ static void mac80211_hwsim_tx(struct iee
 				       txi->control.rates,
 				       ARRAY_SIZE(txi->control.rates));
 
-	txi->rate_driver_data[0] = channel;
 	mac80211_hwsim_monitor_rx(hw, skb, channel);
 
 	/* wmediumd mode check */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/pci/hotplug/shpchp_hpc.c linux-libre-3.16.51-gnu/drivers/pci/hotplug/shpchp_hpc.c
--- linux-libre-3.16.50-gnu/drivers/pci/hotplug/shpchp_hpc.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/pci/hotplug/shpchp_hpc.c	2017-11-26 08:50:43.000000000 -0500
@@ -1061,6 +1061,8 @@ int shpc_init(struct controller *ctrl, s
 		if (rc) {
 			ctrl_info(ctrl, "Can't get msi for the hotplug controller\n");
 			ctrl_info(ctrl, "Use INTx for the hotplug controller\n");
+		} else {
+			pci_set_master(pdev);
 		}
 
 		rc = request_irq(ctrl->pci_dev->irq, shpc_isr, IRQF_SHARED,
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/pwm/pwm-tiehrpwm.c linux-libre-3.16.51-gnu/drivers/pwm/pwm-tiehrpwm.c
--- linux-libre-3.16.50-gnu/drivers/pwm/pwm-tiehrpwm.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/pwm/pwm-tiehrpwm.c	2017-11-26 08:50:43.000000000 -0500
@@ -483,7 +483,7 @@ static int ehrpwm_pwm_probe(struct platf
 	ret = pwmchip_add(&pc->chip);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
-		return ret;
+		goto err_clk_unprepare;
 	}
 
 	pm_runtime_enable(&pdev->dev);
@@ -506,7 +506,9 @@ pwmss_clk_failure:
 	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	pwmchip_remove(&pc->chip);
+err_clk_unprepare:
 	clk_unprepare(pc->tbclk);
+
 	return ret;
 }
 
@@ -524,7 +526,6 @@ static int ehrpwm_pwm_remove(struct plat
 	pwmss_submodule_state_change(pdev->dev.parent, PWMSS_EPWMCLK_STOP_REQ);
 	pm_runtime_put_sync(&pdev->dev);
 
-	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	return pwmchip_remove(&pc->chip);
 }
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/regulator/da9063-regulator.c linux-libre-3.16.51-gnu/drivers/regulator/da9063-regulator.c
--- linux-libre-3.16.50-gnu/drivers/regulator/da9063-regulator.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/regulator/da9063-regulator.c	2017-11-26 08:50:43.000000000 -0500
@@ -739,7 +739,7 @@ static int da9063_regulator_probe(struct
 	if (IS_ERR(regl_pdata) || regl_pdata->n_regulators == 0) {
 		dev_err(&pdev->dev,
 			"No regulators defined for the platform\n");
-		return PTR_ERR(regl_pdata);
+		return -ENODEV;
 	}
 
 	/* Find regulators set for particular device model */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/rtc/rtc-sa1100.c linux-libre-3.16.51-gnu/drivers/rtc/rtc-sa1100.c
--- linux-libre-3.16.50-gnu/drivers/rtc/rtc-sa1100.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/rtc/rtc-sa1100.c	2017-11-26 08:50:43.000000000 -0500
@@ -111,7 +111,7 @@ static int sa1100_rtc_open(struct device
 	ret = request_irq(info->irq_1hz, sa1100_rtc_interrupt, 0, "rtc 1Hz", dev);
 	if (ret) {
 		dev_err(dev, "IRQ %d already in use.\n", info->irq_1hz);
-		goto fail_ui;
+		return ret;
 	}
 	ret = request_irq(info->irq_alarm, sa1100_rtc_interrupt, 0, "rtc Alrm", dev);
 	if (ret) {
@@ -125,8 +125,6 @@ static int sa1100_rtc_open(struct device
 
  fail_ai:
 	free_irq(info->irq_1hz, dev);
- fail_ui:
-	clk_disable_unprepare(info->clk);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_dbf.c linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_dbf.c
--- linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_dbf.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_dbf.c	2017-11-26 08:50:43.000000000 -0500
@@ -3,7 +3,7 @@
  *
  * Debug traces for zfcp.
  *
- * Copyright IBM Corp. 2002, 2016
+ * Copyright IBM Corp. 2002, 2017
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -447,6 +447,7 @@ static u16 zfcp_dbf_san_res_cap_len_if_g
 	struct fc_ct_hdr *reqh = sg_virt(ct_els->req);
 	struct fc_ns_gid_ft *reqn = (struct fc_ns_gid_ft *)(reqh + 1);
 	struct scatterlist *resp_entry = ct_els->resp;
+	struct fc_ct_hdr *resph;
 	struct fc_gpn_ft_resp *acc;
 	int max_entries, x, last = 0;
 
@@ -473,6 +474,13 @@ static u16 zfcp_dbf_san_res_cap_len_if_g
 		return len; /* not GPN_FT response so do not cap */
 
 	acc = sg_virt(resp_entry);
+
+	/* cap all but accept CT responses to at least the CT header */
+	resph = (struct fc_ct_hdr *)acc;
+	if ((ct_els->status) ||
+	    (resph->ct_cmd != cpu_to_be16(FC_FS_ACC)))
+		return max(FC_CT_HDR_LEN, ZFCP_DBF_SAN_MAX_PAYLOAD);
+
 	max_entries = (reqh->ct_mr_size * 4 / sizeof(struct fc_gpn_ft_resp))
 		+ 1 /* zfcp_fc_scan_ports: bytes correct, entries off-by-one
 		     * to account for header as 1st pseudo "entry" */;
@@ -563,19 +571,32 @@ void zfcp_dbf_scsi(char *tag, int level,
 
 	if (fsf) {
 		rec->fsf_req_id = fsf->req_id;
+		rec->pl_len = FCP_RESP_WITH_EXT;
 		fcp_rsp = (struct fcp_resp_with_ext *)
 				&(fsf->qtcb->bottom.io.fcp_rsp);
+		/* mandatory parts of FCP_RSP IU in this SCSI record */
 		memcpy(&rec->fcp_rsp, fcp_rsp, FCP_RESP_WITH_EXT);
 		if (fcp_rsp->resp.fr_flags & FCP_RSP_LEN_VAL) {
 			fcp_rsp_info = (struct fcp_resp_rsp_info *) &fcp_rsp[1];
 			rec->fcp_rsp_info = fcp_rsp_info->rsp_code;
+			rec->pl_len += be32_to_cpu(fcp_rsp->ext.fr_rsp_len);
 		}
 		if (fcp_rsp->resp.fr_flags & FCP_SNS_LEN_VAL) {
-			rec->pl_len = min((u16)SCSI_SENSE_BUFFERSIZE,
-					  (u16)ZFCP_DBF_PAY_MAX_REC);
-			zfcp_dbf_pl_write(dbf, sc->sense_buffer, rec->pl_len,
-					  "fcp_sns", fsf->req_id);
+			rec->pl_len += be32_to_cpu(fcp_rsp->ext.fr_sns_len);
 		}
+		/* complete FCP_RSP IU in associated PAYload record
+		 * but only if there are optional parts
+		 */
+		if (fcp_rsp->resp.fr_flags != 0)
+			zfcp_dbf_pl_write(
+				dbf, fcp_rsp,
+				/* at least one full PAY record
+				 * but not beyond hardware response field
+				 */
+				min_t(u16, max_t(u16, rec->pl_len,
+						 ZFCP_DBF_PAY_MAX_REC),
+				      FSF_FCP_RSP_SIZE),
+				"fcp_riu", fsf->req_id);
 	}
 
 	debug_event(dbf->scsi, level, rec, sizeof(*rec));
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_dbf.h linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_dbf.h
--- linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_dbf.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_dbf.h	2017-11-26 08:50:43.000000000 -0500
@@ -2,7 +2,7 @@
  * zfcp device driver
  * debug feature declarations
  *
- * Copyright IBM Corp. 2008, 2016
+ * Copyright IBM Corp. 2008, 2017
  */
 
 #ifndef ZFCP_DBF_H
@@ -323,7 +323,11 @@ void zfcp_dbf_hba_fsf_response(struct zf
 {
 	struct fsf_qtcb *qtcb = req->qtcb;
 
-	if ((qtcb->prefix.prot_status != FSF_PROT_GOOD) &&
+	if (unlikely(req->status & (ZFCP_STATUS_FSFREQ_DISMISSED |
+				    ZFCP_STATUS_FSFREQ_ERROR))) {
+		zfcp_dbf_hba_fsf_resp("fs_rerr", 3, req);
+
+	} else if ((qtcb->prefix.prot_status != FSF_PROT_GOOD) &&
 	    (qtcb->prefix.prot_status != FSF_PROT_FSF_STATUS_PRESENTED)) {
 		zfcp_dbf_hba_fsf_resp("fs_perr", 1, req);
 
@@ -401,7 +405,8 @@ void zfcp_dbf_scsi_abort(char *tag, stru
  * @flag: indicates type of reset (Target Reset, Logical Unit Reset)
  */
 static inline
-void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag)
+void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag,
+			    struct zfcp_fsf_req *fsf_req)
 {
 	char tmp_tag[ZFCP_DBF_TAG_LEN];
 
@@ -411,7 +416,7 @@ void zfcp_dbf_scsi_devreset(char *tag, s
 		memcpy(tmp_tag, "lr_", 3);
 
 	memcpy(&tmp_tag[3], tag, 4);
-	_zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL);
+	_zfcp_dbf_scsi(tmp_tag, 1, scmnd, fsf_req);
 }
 
 /**
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_fc.h linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_fc.h
--- linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_fc.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_fc.h	2017-11-26 08:50:43.000000000 -0500
@@ -4,7 +4,7 @@
  * Fibre Channel related definitions and inline functions for the zfcp
  * device driver
  *
- * Copyright IBM Corp. 2009
+ * Copyright IBM Corp. 2009, 2017
  */
 
 #ifndef ZFCP_FC_H
@@ -291,6 +291,10 @@ void zfcp_fc_eval_fcp_rsp(struct fcp_res
 		     !(rsp_flags & FCP_SNS_LEN_VAL) &&
 		     fcp_rsp->resp.fr_status == SAM_STAT_GOOD)
 			set_host_byte(scsi, DID_ERROR);
+	} else if (unlikely(rsp_flags & FCP_RESID_OVER)) {
+		/* FCP_DL was not sufficient for SCSI data length */
+		if (fcp_rsp->resp.fr_status == SAM_STAT_GOOD)
+			set_host_byte(scsi, DID_ERROR);
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_fsf.c linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_fsf.c
--- linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_fsf.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_fsf.c	2017-11-26 08:50:43.000000000 -0500
@@ -928,8 +928,8 @@ static void zfcp_fsf_send_ct_handler(str
 
 	switch (header->fsf_status) {
         case FSF_GOOD:
-		zfcp_dbf_san_res("fsscth2", req);
 		ct->status = 0;
+		zfcp_dbf_san_res("fsscth2", req);
 		break;
         case FSF_SERVICE_CLASS_NOT_SUPPORTED:
 		zfcp_fsf_class_not_supp(req);
@@ -1109,8 +1109,8 @@ static void zfcp_fsf_send_els_handler(st
 
 	switch (header->fsf_status) {
 	case FSF_GOOD:
-		zfcp_dbf_san_res("fsselh1", req);
 		send_els->status = 0;
+		zfcp_dbf_san_res("fsselh1", req);
 		break;
 	case FSF_SERVICE_CLASS_NOT_SUPPORTED:
 		zfcp_fsf_class_not_supp(req);
@@ -2259,7 +2259,8 @@ int zfcp_fsf_fcp_cmnd(struct scsi_cmnd *
 	fcp_cmnd = (struct fcp_cmnd *) &req->qtcb->bottom.io.fcp_cmnd;
 	zfcp_fc_scsi_to_fcp(fcp_cmnd, scsi_cmnd, 0);
 
-	if (scsi_prot_sg_count(scsi_cmnd)) {
+	if ((scsi_get_prot_op(scsi_cmnd) != SCSI_PROT_NORMAL) &&
+	    scsi_prot_sg_count(scsi_cmnd)) {
 		zfcp_qdio_set_data_div(qdio, &req->qdio_req,
 				       scsi_prot_sg_count(scsi_cmnd));
 		retval = zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req,
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_scsi.c linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_scsi.c
--- linux-libre-3.16.50-gnu/drivers/s390/scsi/zfcp_scsi.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/s390/scsi/zfcp_scsi.c	2017-11-26 08:50:43.000000000 -0500
@@ -3,7 +3,7 @@
  *
  * Interface to Linux SCSI midlayer.
  *
- * Copyright IBM Corp. 2002, 2016
+ * Copyright IBM Corp. 2002, 2017
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -294,25 +294,29 @@ static int zfcp_task_mgmt_function(struc
 
 		zfcp_erp_wait(adapter);
 		ret = fc_block_scsi_eh(scpnt);
-		if (ret)
+		if (ret) {
+			zfcp_dbf_scsi_devreset("fiof", scpnt, tm_flags, NULL);
 			return ret;
+		}
 
 		if (!(atomic_read(&adapter->status) &
 		      ZFCP_STATUS_COMMON_RUNNING)) {
-			zfcp_dbf_scsi_devreset("nres", scpnt, tm_flags);
+			zfcp_dbf_scsi_devreset("nres", scpnt, tm_flags, NULL);
 			return SUCCESS;
 		}
 	}
-	if (!fsf_req)
+	if (!fsf_req) {
+		zfcp_dbf_scsi_devreset("reqf", scpnt, tm_flags, NULL);
 		return FAILED;
+	}
 
 	wait_for_completion(&fsf_req->completion);
 
 	if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) {
-		zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags);
+		zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags, fsf_req);
 		retval = FAILED;
 	} else {
-		zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags);
+		zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags, fsf_req);
 		zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags);
 	}
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/scsi/aacraid/aachba.c linux-libre-3.16.51-gnu/drivers/scsi/aacraid/aachba.c
--- linux-libre-3.16.50-gnu/drivers/scsi/aacraid/aachba.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/scsi/aacraid/aachba.c	2017-11-26 08:50:43.000000000 -0500
@@ -480,6 +480,7 @@ static int aac_get_container_name(struct
 
 	aac_fib_init(cmd_fibcontext);
 	dinfo = (struct aac_get_name *) fib_data(cmd_fibcontext);
+	scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 
 	dinfo->command = cpu_to_le32(VM_ContainerConfig);
 	dinfo->type = cpu_to_le32(CT_READ_NAME);
@@ -497,10 +498,8 @@ static int aac_get_container_name(struct
 	/*
 	 *	Check that the command queued to the controller
 	 */
-	if (status == -EINPROGRESS) {
-		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+	if (status == -EINPROGRESS)
 		return 0;
-	}
 
 	printk(KERN_WARNING "aac_get_container_name: aac_fib_send failed with status: %d.\n", status);
 	aac_fib_complete(cmd_fibcontext);
@@ -589,6 +588,7 @@ static void _aac_probe_container1(void *
 	dinfo->command = cpu_to_le32(VM_NameServe64);
 	dinfo->count = cpu_to_le32(scmd_id(scsicmd));
 	dinfo->type = cpu_to_le32(FT_FILESYS);
+	scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 
 	status = aac_fib_send(ContainerCommand,
 			  fibptr,
@@ -600,9 +600,7 @@ static void _aac_probe_container1(void *
 	/*
 	 *	Check that the command queued to the controller
 	 */
-	if (status == -EINPROGRESS)
-		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
-	else if (status < 0) {
+	if (status < 0 && status != -EINPROGRESS) {
 		/* Inherit results from VM_NameServe, if any */
 		dresp->status = cpu_to_le32(ST_OK);
 		_aac_probe_container2(context, fibptr);
@@ -625,6 +623,7 @@ static int _aac_probe_container(struct s
 		dinfo->count = cpu_to_le32(scmd_id(scsicmd));
 		dinfo->type = cpu_to_le32(FT_FILESYS);
 		scsicmd->SCp.ptr = (char *)callback;
+		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 
 		status = aac_fib_send(ContainerCommand,
 			  fibptr,
@@ -636,10 +635,9 @@ static int _aac_probe_container(struct s
 		/*
 		 *	Check that the command queued to the controller
 		 */
-		if (status == -EINPROGRESS) {
-			scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+		if (status == -EINPROGRESS)
 			return 0;
-		}
+
 		if (status < 0) {
 			scsicmd->SCp.ptr = NULL;
 			aac_fib_complete(fibptr);
@@ -873,6 +871,7 @@ static int aac_get_container_serial(stru
 	dinfo->command = cpu_to_le32(VM_ContainerConfig);
 	dinfo->type = cpu_to_le32(CT_CID_TO_32BITS_UID);
 	dinfo->cid = cpu_to_le32(scmd_id(scsicmd));
+	scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 
 	status = aac_fib_send(ContainerCommand,
 		  cmd_fibcontext,
@@ -885,10 +884,8 @@ static int aac_get_container_serial(stru
 	/*
 	 *	Check that the command queued to the controller
 	 */
-	if (status == -EINPROGRESS) {
-		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+	if (status == -EINPROGRESS)
 		return 0;
-	}
 
 	printk(KERN_WARNING "aac_get_container_serial: aac_fib_send failed with status: %d.\n", status);
 	aac_fib_complete(cmd_fibcontext);
@@ -1774,16 +1771,14 @@ static int aac_read(struct scsi_cmnd * s
 		printk(KERN_WARNING "aac_read: fib allocation failed\n");
 		return -1;
 	}
-
+	scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 	status = aac_adapter_read(cmd_fibcontext, scsicmd, lba, count);
 
 	/*
 	 *	Check that the command queued to the controller
 	 */
-	if (status == -EINPROGRESS) {
-		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+	if (status == -EINPROGRESS)
 		return 0;
-	}
 
 	printk(KERN_WARNING "aac_read: aac_fib_send failed with status: %d.\n", status);
 	/*
@@ -1877,16 +1872,14 @@ static int aac_write(struct scsi_cmnd *
 		printk(KERN_WARNING "aac_write: fib allocation failed\n");
 		return -1;
 	}
-
+	scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 	status = aac_adapter_write(cmd_fibcontext, scsicmd, lba, count, fua);
 
 	/*
 	 *	Check that the command queued to the controller
 	 */
-	if (status == -EINPROGRESS) {
-		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+	if (status == -EINPROGRESS)
 		return 0;
-	}
 
 	printk(KERN_WARNING "aac_write: aac_fib_send failed with status: %d\n", status);
 	/*
@@ -2036,6 +2029,7 @@ static int aac_synchronize(struct scsi_c
 	synchronizecmd->cid = cpu_to_le32(scmd_id(scsicmd));
 	synchronizecmd->count =
 	     cpu_to_le32(sizeof(((struct aac_synchronize_reply *)NULL)->data));
+	scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 
 	/*
 	 *	Now send the Fib to the adapter
@@ -2051,10 +2045,8 @@ static int aac_synchronize(struct scsi_c
 	/*
 	 *	Check that the command queued to the controller
 	 */
-	if (status == -EINPROGRESS) {
-		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+	if (status == -EINPROGRESS)
 		return 0;
-	}
 
 	printk(KERN_WARNING
 		"aac_synchronize: aac_fib_send failed with status: %d.\n", status);
@@ -2116,6 +2108,7 @@ static int aac_start_stop(struct scsi_cm
 	pmcmd->cid = cpu_to_le32(sdev_id(sdev));
 	pmcmd->parm = (scsicmd->cmnd[1] & 1) ?
 		cpu_to_le32(CT_PM_UNIT_IMMEDIATE) : 0;
+	scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 
 	/*
 	 *	Now send the Fib to the adapter
@@ -2131,10 +2124,8 @@ static int aac_start_stop(struct scsi_cm
 	/*
 	 *	Check that the command queued to the controller
 	 */
-	if (status == -EINPROGRESS) {
-		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+	if (status == -EINPROGRESS)
 		return 0;
-	}
 
 	aac_fib_complete(cmd_fibcontext);
 	aac_fib_free(cmd_fibcontext);
@@ -2889,15 +2880,14 @@ static int aac_send_srb_fib(struct scsi_
 	if (!(cmd_fibcontext = aac_fib_alloc(dev))) {
 		return -1;
 	}
+	scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
 	status = aac_adapter_scsi(cmd_fibcontext, scsicmd);
 
 	/*
 	 *	Check that the command queued to the controller
 	 */
-	if (status == -EINPROGRESS) {
-		scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+	if (status == -EINPROGRESS)
 		return 0;
-	}
 
 	printk(KERN_WARNING "aac_srb: aac_fib_send failed with status: %d\n", status);
 	aac_fib_complete(cmd_fibcontext);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/scsi/mac_esp.c linux-libre-3.16.51-gnu/drivers/scsi/mac_esp.c
--- linux-libre-3.16.50-gnu/drivers/scsi/mac_esp.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/scsi/mac_esp.c	2017-11-26 08:50:43.000000000 -0500
@@ -348,25 +348,23 @@ static void mac_esp_send_pio_cmd(struct
 {
 	struct mac_esp_priv *mep = MAC_ESP_GET_PRIV(esp);
 	u8 *fifo = esp->regs + ESP_FDATA * 16;
+	u8 phase = esp->sreg & ESP_STAT_PMASK;
 
 	cmd &= ~ESP_CMD_DMA;
 	mep->error = 0;
 
 	if (write) {
+		u8 *dst = (u8 *)addr;
+		u8 mask = ~(phase == ESP_MIP ? ESP_INTR_FDONE : ESP_INTR_BSERV);
+
 		scsi_esp_cmd(esp, cmd);
 
 		while (1) {
-			unsigned int n;
-
-			n = mac_esp_wait_for_fifo(esp);
-			if (!n)
+			if (!mac_esp_wait_for_fifo(esp))
 				break;
 
-			if (n > esp_count)
-				n = esp_count;
-			esp_count -= n;
-
-			MAC_ESP_PIO_LOOP("%2@,%0@+", n);
+			*dst++ = esp_read8(ESP_FDATA);
+			--esp_count;
 
 			if (!esp_count)
 				break;
@@ -374,14 +372,17 @@ static void mac_esp_send_pio_cmd(struct
 			if (mac_esp_wait_for_intr(esp))
 				break;
 
-			if (((esp->sreg & ESP_STAT_PMASK) != ESP_DIP) &&
-			    ((esp->sreg & ESP_STAT_PMASK) != ESP_MIP))
+			if ((esp->sreg & ESP_STAT_PMASK) != phase)
 				break;
 
 			esp->ireg = esp_read8(ESP_INTRPT);
-			if ((esp->ireg & (ESP_INTR_DC | ESP_INTR_BSERV)) !=
-			    ESP_INTR_BSERV)
+			if (esp->ireg & mask) {
+				mep->error = 1;
 				break;
+			}
+
+			if (phase == ESP_MIP)
+				scsi_esp_cmd(esp, ESP_CMD_MOK);
 
 			scsi_esp_cmd(esp, ESP_CMD_TI);
 		}
@@ -401,14 +402,14 @@ static void mac_esp_send_pio_cmd(struct
 			if (mac_esp_wait_for_intr(esp))
 				break;
 
-			if (((esp->sreg & ESP_STAT_PMASK) != ESP_DOP) &&
-			    ((esp->sreg & ESP_STAT_PMASK) != ESP_MOP))
+			if ((esp->sreg & ESP_STAT_PMASK) != phase)
 				break;
 
 			esp->ireg = esp_read8(ESP_INTRPT);
-			if ((esp->ireg & (ESP_INTR_DC | ESP_INTR_BSERV)) !=
-			    ESP_INTR_BSERV)
+			if (esp->ireg & ~ESP_INTR_BSERV) {
+				mep->error = 1;
 				break;
+			}
 
 			n = MAC_ESP_FIFO_SIZE -
 			    (esp_read8(ESP_FFLAGS) & ESP_FF_FBYTES);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/scsi/qla2xxx/qla_attr.c linux-libre-3.16.51-gnu/drivers/scsi/qla2xxx/qla_attr.c
--- linux-libre-3.16.50-gnu/drivers/scsi/qla2xxx/qla_attr.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/scsi/qla2xxx/qla_attr.c	2017-11-26 08:50:43.000000000 -0500
@@ -396,6 +396,8 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
 		return -EINVAL;
 	if (start > ha->optrom_size)
 		return -EINVAL;
+	if (size > ha->optrom_size - start)
+		size = ha->optrom_size - start;
 
 	mutex_lock(&ha->optrom_mutex);
 	switch (val) {
@@ -421,8 +423,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
 		}
 
 		ha->optrom_region_start = start;
-		ha->optrom_region_size = start + size > ha->optrom_size ?
-		    ha->optrom_size - start : size;
+		ha->optrom_region_size = start + size;
 
 		ha->optrom_state = QLA_SREADING;
 		ha->optrom_buffer = vmalloc(ha->optrom_region_size);
@@ -494,8 +495,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
 		}
 
 		ha->optrom_region_start = start;
-		ha->optrom_region_size = start + size > ha->optrom_size ?
-		    ha->optrom_size - start : size;
+		ha->optrom_region_size = start + size;
 
 		ha->optrom_state = QLA_SWRITING;
 		ha->optrom_buffer = vmalloc(ha->optrom_region_size);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/staging/lustre/lustre/obdclass/class_obd.c linux-libre-3.16.51-gnu/drivers/staging/lustre/lustre/obdclass/class_obd.c
--- linux-libre-3.16.50-gnu/drivers/staging/lustre/lustre/obdclass/class_obd.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/staging/lustre/lustre/obdclass/class_obd.c	2017-11-26 08:50:43.000000000 -0500
@@ -232,8 +232,8 @@ int class_handle_ioctl(unsigned int cmd,
 		OBD_ALLOC(lcfg, data->ioc_plen1);
 		if (lcfg == NULL)
 			GOTO(out, err = -ENOMEM);
-		err = copy_from_user(lcfg, data->ioc_pbuf1,
-					 data->ioc_plen1);
+		if (copy_from_user(lcfg, data->ioc_pbuf1, data->ioc_plen1))
+			err = -EFAULT;
 		if (!err)
 			err = lustre_cfg_sanity_check(lcfg, data->ioc_plen1);
 		if (!err)
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/staging/media/lirc/lirc_zilog.c linux-libre-3.16.51-gnu/drivers/staging/media/lirc/lirc_zilog.c
--- linux-libre-3.16.50-gnu/drivers/staging/media/lirc/lirc_zilog.c	2017-11-13 09:19:26.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/staging/media/lirc/lirc_zilog.c	2017-11-26 13:37:19.000000000 -0500
@@ -300,7 +300,7 @@ static void release_ir_tx(struct kref *r
 	struct IR_tx *tx = container_of(ref, struct IR_tx, ref);
 	struct IR *ir = tx->ir;
 
-	ir->l.features &= ~LIRC_CAN_SEND_PULSE;
+	ir->l.features &= ~LIRC_CAN_SEND_LIRCCODE;
 	/* Don't put_ir_device(tx->ir) here, so our lock doesn't get freed */
 	ir->tx = NULL;
 	kfree(tx);
@@ -1271,14 +1271,14 @@ static long ioctl(struct file *filep, un
 		if (!(features&LIRC_CAN_SEND_MASK))
 			return -ENOSYS;
 
-		result = put_user(LIRC_MODE_PULSE, uptr);
+		result = put_user(LIRC_MODE_LIRCCODE, uptr);
 		break;
 	case LIRC_SET_SEND_MODE:
 		if (!(features&LIRC_CAN_SEND_MASK))
 			return -ENOSYS;
 
 		result = get_user(mode, uptr);
-		if (!result && mode != LIRC_MODE_PULSE)
+		if (!result && mode != LIRC_MODE_LIRCCODE)
 			return -EINVAL;
 		break;
 	default:
@@ -1516,7 +1516,7 @@ static int ir_probe(struct i2c_client *c
 		kref_init(&tx->ref);
 		ir->tx = tx;
 
-		ir->l.features |= LIRC_CAN_SEND_PULSE;
+		ir->l.features |= LIRC_CAN_SEND_LIRCCODE;
 		mutex_init(&tx->client_lock);
 		tx->c = client;
 		tx->need_boot = 1;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/staging/rtl8821ae/rtl8821ae/hw.c linux-libre-3.16.51-gnu/drivers/staging/rtl8821ae/rtl8821ae/hw.c
--- linux-libre-3.16.50-gnu/drivers/staging/rtl8821ae/rtl8821ae/hw.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/staging/rtl8821ae/rtl8821ae/hw.c	2017-11-26 08:50:43.000000000 -0500
@@ -760,7 +760,7 @@ void rtl8821ae_set_hw_reg(struct ieee802
 
 		}
 	case HW_VAR_NAV_UPPER: {
-			u32	us_nav_upper = ((u32)*val);
+			u32	us_nav_upper = *(u32 *)val;
 
 			if(us_nav_upper > HAL_92C_NAV_UPPER_UNIT * 0xFF)
 			{
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/staging/rts5208/rtsx_scsi.c linux-libre-3.16.51-gnu/drivers/staging/rts5208/rtsx_scsi.c
--- linux-libre-3.16.50-gnu/drivers/staging/rts5208/rtsx_scsi.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/staging/rts5208/rtsx_scsi.c	2017-11-26 08:50:43.000000000 -0500
@@ -417,7 +417,7 @@ void set_sense_data(struct rtsx_chip *ch
 	sense->ascq = ascq;
 	if (sns_key_info0 != 0) {
 		sense->sns_key_info[0] = SKSV | sns_key_info0;
-		sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 8;
+		sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 4;
 		sense->sns_key_info[2] = sns_key_info1 & 0x0f;
 	}
 }
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/usb/core/devio.c linux-libre-3.16.51-gnu/drivers/usb/core/devio.c
--- linux-libre-3.16.50-gnu/drivers/usb/core/devio.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/usb/core/devio.c	2017-11-26 08:50:43.000000000 -0500
@@ -519,6 +519,8 @@ static void async_completed(struct urb *
 	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
 			as->status != -ENOENT)
 		cancel_bulk_urbs(ps, as->bulk_addr);
+
+	wake_up(&ps->wait);
 	spin_unlock(&ps->lock);
 
 	if (signr) {
@@ -526,8 +528,6 @@ static void async_completed(struct urb *
 		put_pid(pid);
 		put_cred(cred);
 	}
-
-	wake_up(&ps->wait);
 }
 
 static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/usb/core/quirks.c linux-libre-3.16.51-gnu/drivers/usb/core/quirks.c
--- linux-libre-3.16.50-gnu/drivers/usb/core/quirks.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/usb/core/quirks.c	2017-11-26 08:50:43.000000000 -0500
@@ -57,8 +57,9 @@ static const struct usb_device_id usb_qu
 	/* Microsoft LifeCam-VX700 v2.0 */
 	{ USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
-	/* Logitech HD Pro Webcams C920 and C930e */
+	/* Logitech HD Pro Webcams C920, C920-C and C930e */
 	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+	{ USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
 	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
 
 	/* Logitech ConferenceCam CC3000e */
@@ -214,6 +215,9 @@ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x1a0a, 0x0200), .driver_info =
 			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+	/* Corsair Strafe RGB */
+	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+
 	/* Acer C120 LED Projector */
 	{ USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/usb/host/pci-quirks.c linux-libre-3.16.51-gnu/drivers/usb/host/pci-quirks.c
--- linux-libre-3.16.50-gnu/drivers/usb/host/pci-quirks.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/usb/host/pci-quirks.c	2017-11-26 08:50:43.000000000 -0500
@@ -143,29 +143,30 @@ static int amd_chipset_sb_type_init(stru
 			pinfo->sb_type.gen = AMD_CHIPSET_SB700;
 		else if (rev >= 0x40 && rev <= 0x4f)
 			pinfo->sb_type.gen = AMD_CHIPSET_SB800;
-	}
-	pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
-					  0x145c, NULL);
-	if (pinfo->smbus_dev) {
-		pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
 	} else {
 		pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
 				PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
 
-		if (!pinfo->smbus_dev) {
-			pinfo->sb_type.gen = NOT_AMD_CHIPSET;
-			return 0;
+		if (pinfo->smbus_dev) {
+			rev = pinfo->smbus_dev->revision;
+			if (rev >= 0x11 && rev <= 0x14)
+				pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
+			else if (rev >= 0x15 && rev <= 0x18)
+				pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
+			else if (rev >= 0x39 && rev <= 0x3a)
+				pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
+		} else {
+			pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+							  0x145c, NULL);
+			if (pinfo->smbus_dev) {
+				rev = pinfo->smbus_dev->revision;
+				pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
+			} else {
+				pinfo->sb_type.gen = NOT_AMD_CHIPSET;
+				return 0;
+			}
 		}
-
-		rev = pinfo->smbus_dev->revision;
-		if (rev >= 0x11 && rev <= 0x14)
-			pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
-		else if (rev >= 0x15 && rev <= 0x18)
-			pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
-		else if (rev >= 0x39 && rev <= 0x3a)
-			pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
 	}
-
 	pinfo->sb_type.rev = rev;
 	return 1;
 }
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/usb/serial/console.c linux-libre-3.16.51-gnu/drivers/usb/serial/console.c
--- linux-libre-3.16.50-gnu/drivers/usb/serial/console.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/usb/serial/console.c	2017-11-26 08:50:43.000000000 -0500
@@ -187,6 +187,7 @@ static int usb_console_setup(struct cons
 	tty_kref_put(tty);
  reset_open_count:
 	port->port.count = 0;
+	info->port = NULL;
 	usb_autopm_put_interface(serial->interface);
  error_get_interface:
 	usb_serial_put(serial);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/usb/serial/option.c linux-libre-3.16.51-gnu/drivers/usb/serial/option.c
--- linux-libre-3.16.50-gnu/drivers/usb/serial/option.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/usb/serial/option.c	2017-11-26 08:50:43.000000000 -0500
@@ -2034,6 +2034,7 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) },			/* D-Link DWM-158 */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) },			/* D-Link DWM-157 C1 */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff),			/* D-Link DWM-221 B1 */
 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),			/* D-Link DWM-222 */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/video/backlight/lm3630a_bl.c linux-libre-3.16.51-gnu/drivers/video/backlight/lm3630a_bl.c
--- linux-libre-3.16.50-gnu/drivers/video/backlight/lm3630a_bl.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/video/backlight/lm3630a_bl.c	2017-11-26 08:50:43.000000000 -0500
@@ -31,7 +31,8 @@
 #define REG_FAULT	0x0B
 #define REG_PWM_OUTLOW	0x12
 #define REG_PWM_OUTHIGH	0x13
-#define REG_MAX		0x1F
+#define REG_FILTER_STRENGTH	0x50
+#define REG_MAX		0x50
 
 #define INT_DEBOUNCE_MSEC	10
 struct lm3630a_chip {
@@ -80,7 +81,7 @@ static int lm3630a_chip_init(struct lm36
 
 	usleep_range(1000, 2000);
 	/* set Filter Strength Register */
-	rval = lm3630a_write(pchip, 0x50, 0x03);
+	rval = lm3630a_write(pchip, REG_FILTER_STRENGTH, 0x03);
 	/* set Cofig. register */
 	rval |= lm3630a_update(pchip, REG_CONFIG, 0x07, pdata->pwm_ctrl);
 	/* set boost control */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/drivers/xen/events/events_fifo.c linux-libre-3.16.51-gnu/drivers/xen/events/events_fifo.c
--- linux-libre-3.16.50-gnu/drivers/xen/events/events_fifo.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/drivers/xen/events/events_fifo.c	2017-11-26 08:50:43.000000000 -0500
@@ -445,19 +445,18 @@ static struct notifier_block evtchn_fifo
 
 int __init xen_evtchn_fifo_init(void)
 {
-	int cpu = get_cpu();
+	int cpu = smp_processor_id();
 	int ret;
 
 	ret = evtchn_fifo_alloc_control_block(cpu);
 	if (ret < 0)
-		goto out;
+		return ret;
 
 	pr_info("Using FIFO-based ABI\n");
 
 	evtchn_ops = &evtchn_ops_fifo;
 
 	register_cpu_notifier(&evtchn_fifo_cpu_notifier);
-out:
-	put_cpu();
+
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.16.50-gnu/fs/btrfs/super.c linux-libre-3.16.51-gnu/fs/btrfs/super.c
--- linux-libre-3.16.50-gnu/fs/btrfs/super.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/fs/btrfs/super.c	2017-11-26 08:50:43.000000000 -0500
@@ -59,6 +59,7 @@
 #include "free-space-cache.h"
 #include "backref.h"
 #include "tests/btrfs-tests.h"
+#include "qgroup.h"
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/btrfs.h>
@@ -1495,6 +1496,8 @@ static int btrfs_remount(struct super_bl
 			goto restore;
 		}
 
+		btrfs_qgroup_rescan_resume(fs_info);
+
 		if (!fs_info->uuid_root) {
 			btrfs_info(fs_info, "creating UUID tree");
 			ret = btrfs_create_uuid_tree(fs_info);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/fs/dlm/user.c linux-libre-3.16.51-gnu/fs/dlm/user.c
--- linux-libre-3.16.50-gnu/fs/dlm/user.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/fs/dlm/user.c	2017-11-26 08:50:43.000000000 -0500
@@ -346,6 +346,10 @@ static int dlm_device_register(struct dl
 	error = misc_register(&ls->ls_device);
 	if (error) {
 		kfree(ls->ls_device.name);
+		/* this has to be set to NULL
+		 * to avoid a double-free in dlm_device_deregister
+		 */
+		ls->ls_device.name = NULL;
 	}
 fail:
 	return error;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/fs/f2fs/recovery.c linux-libre-3.16.51-gnu/fs/f2fs/recovery.c
--- linux-libre-3.16.50-gnu/fs/f2fs/recovery.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/fs/f2fs/recovery.c	2017-11-26 08:50:43.000000000 -0500
@@ -239,7 +239,7 @@ static int check_index_in_prev_nodes(str
 		return 0;
 
 	/* Get the previous summary */
-	for (i = CURSEG_WARM_DATA; i <= CURSEG_COLD_DATA; i++) {
+	for (i = CURSEG_HOT_DATA; i <= CURSEG_COLD_DATA; i++) {
 		struct curseg_info *curseg = CURSEG_I(sbi, i);
 		if (curseg->segno == segno) {
 			sum = curseg->sum_blk->entries[blkoff];
diff -druNp --no-dereference linux-libre-3.16.50-gnu/fs/fcntl.c linux-libre-3.16.51-gnu/fs/fcntl.c
--- linux-libre-3.16.50-gnu/fs/fcntl.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/fs/fcntl.c	2017-11-26 08:50:43.000000000 -0500
@@ -472,10 +472,21 @@ static void send_sigio_to_task(struct ta
 			si.si_signo = signum;
 			si.si_errno = 0;
 		        si.si_code  = reason;
+			/*
+			 * Posix definies POLL_IN and friends to be signal
+			 * specific si_codes for SIG_POLL.  Linux extended
+			 * these si_codes to other signals in a way that is
+			 * ambiguous if other signals also have signal
+			 * specific si_codes.  In that case use SI_SIGIO instead
+			 * to remove the ambiguity.
+			 */
+			if (sig_specific_sicodes(signum))
+				si.si_code = SI_SIGIO;
+
 			/* Make sure we are called with one of the POLL_*
 			   reasons, otherwise we could leak kernel stack into
 			   userspace.  */
-			BUG_ON((reason & __SI_MASK) != __SI_POLL);
+			BUG_ON((reason < POLL_IN) || ((reason - POLL_IN) >= NSIGPOLL));
 			if (reason - POLL_IN >= NSIGPOLL)
 				si.si_band  = ~0L;
 			else
diff -druNp --no-dereference linux-libre-3.16.50-gnu/fs/xfs/xfs_log.c linux-libre-3.16.51-gnu/fs/xfs/xfs_log.c
--- linux-libre-3.16.50-gnu/fs/xfs/xfs_log.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/fs/xfs/xfs_log.c	2017-11-26 08:50:43.000000000 -0500
@@ -3257,8 +3257,6 @@ maybe_sleep:
 		 */
 		if (iclog->ic_state & XLOG_STATE_IOERROR)
 			return XFS_ERROR(EIO);
-		if (log_flushed)
-			*log_flushed = 1;
 	} else {
 
 no_sleep:
@@ -3366,8 +3364,6 @@ try_again:
 
 				xlog_wait(&iclog->ic_prev->ic_write_wait,
 							&log->l_icloglock);
-				if (log_flushed)
-					*log_flushed = 1;
 				already_slept = 1;
 				goto try_again;
 			}
@@ -3401,9 +3397,6 @@ try_again:
 			 */
 			if (iclog->ic_state & XLOG_STATE_IOERROR)
 				return XFS_ERROR(EIO);
-
-			if (log_flushed)
-				*log_flushed = 1;
 		} else {		/* just return */
 			spin_unlock(&log->l_icloglock);
 		}
diff -druNp --no-dereference linux-libre-3.16.50-gnu/include/asm-generic/sections.h linux-libre-3.16.51-gnu/include/asm-generic/sections.h
--- linux-libre-3.16.50-gnu/include/asm-generic/sections.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/include/asm-generic/sections.h	2017-11-26 08:50:43.000000000 -0500
@@ -4,6 +4,7 @@
 /* References to section boundaries */
 
 #include <linux/compiler.h>
+#include <linux/types.h>
 
 /*
  * Usage guidelines:
@@ -63,4 +64,68 @@ static inline int arch_is_kernel_data(un
 }
 #endif
 
+/**
+ * memory_contains - checks if an object is contained within a memory region
+ * @begin: virtual address of the beginning of the memory region
+ * @end: virtual address of the end of the memory region
+ * @virt: virtual address of the memory object
+ * @size: size of the memory object
+ *
+ * Returns: true if the object specified by @virt and @size is entirely
+ * contained within the memory region defined by @begin and @end, false
+ * otherwise.
+ */
+static inline bool memory_contains(void *begin, void *end, void *virt,
+				   size_t size)
+{
+	return virt >= begin && virt + size <= end;
+}
+
+/**
+ * memory_intersects - checks if the region occupied by an object intersects
+ *                     with another memory region
+ * @begin: virtual address of the beginning of the memory regien
+ * @end: virtual address of the end of the memory region
+ * @virt: virtual address of the memory object
+ * @size: size of the memory object
+ *
+ * Returns: true if an object's memory region, specified by @virt and @size,
+ * intersects with the region specified by @begin and @end, false otherwise.
+ */
+static inline bool memory_intersects(void *begin, void *end, void *virt,
+				     size_t size)
+{
+	void *vend = virt + size;
+
+	return (virt >= begin && virt < end) || (vend >= begin && vend < end);
+}
+
+/**
+ * init_section_contains - checks if an object is contained within the init
+ *                         section
+ * @virt: virtual address of the memory object
+ * @size: size of the memory object
+ *
+ * Returns: true if the object specified by @virt and @size is entirely
+ * contained within the init section, false otherwise.
+ */
+static inline bool init_section_contains(void *virt, size_t size)
+{
+	return memory_contains(__init_begin, __init_end, virt, size);
+}
+
+/**
+ * init_section_intersects - checks if the region occupied by an object
+ *                           intersects with the init section
+ * @virt: virtual address of the memory object
+ * @size: size of the memory object
+ *
+ * Returns: true if an object's memory region, specified by @virt and @size,
+ * intersects with the init section, false otherwise.
+ */
+static inline bool init_section_intersects(void *virt, size_t size)
+{
+	return memory_intersects(__init_begin, __init_end, virt, size);
+}
+
 #endif /* _ASM_GENERIC_SECTIONS_H_ */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/include/linux/pci_ids.h linux-libre-3.16.51-gnu/include/linux/pci_ids.h
--- linux-libre-3.16.50-gnu/include/linux/pci_ids.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/include/linux/pci_ids.h	2017-11-26 08:50:43.000000000 -0500
@@ -568,6 +568,7 @@
 #define PCI_DEVICE_ID_AMD_CS5536_EHC    0x2095
 #define PCI_DEVICE_ID_AMD_CS5536_UDC    0x2096
 #define PCI_DEVICE_ID_AMD_CS5536_UOC    0x2097
+#define PCI_DEVICE_ID_AMD_CS5536_DEV_IDE    0x2092
 #define PCI_DEVICE_ID_AMD_CS5536_IDE    0x209A
 #define PCI_DEVICE_ID_AMD_LX_VIDEO  0x2081
 #define PCI_DEVICE_ID_AMD_LX_AES    0x2082
diff -druNp --no-dereference linux-libre-3.16.50-gnu/include/linux/signal.h linux-libre-3.16.51-gnu/include/linux/signal.h
--- linux-libre-3.16.50-gnu/include/linux/signal.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/include/linux/signal.h	2017-11-26 08:50:43.000000000 -0500
@@ -401,7 +401,9 @@ int unhandled_signal(struct task_struct
 #else
 #define rt_sigmask(sig)	sigmask(sig)
 #endif
-#define siginmask(sig, mask) (rt_sigmask(sig) & (mask))
+
+#define siginmask(sig, mask) \
+	((sig) < SIGRTMIN && (rt_sigmask(sig) & (mask)))
 
 #define SIG_KERNEL_ONLY_MASK (\
 	rt_sigmask(SIGKILL)   |  rt_sigmask(SIGSTOP))
@@ -422,14 +424,18 @@ int unhandled_signal(struct task_struct
         rt_sigmask(SIGCONT)   |  rt_sigmask(SIGCHLD)   | \
 	rt_sigmask(SIGWINCH)  |  rt_sigmask(SIGURG)    )
 
-#define sig_kernel_only(sig) \
-	(((sig) < SIGRTMIN) && siginmask(sig, SIG_KERNEL_ONLY_MASK))
-#define sig_kernel_coredump(sig) \
-	(((sig) < SIGRTMIN) && siginmask(sig, SIG_KERNEL_COREDUMP_MASK))
-#define sig_kernel_ignore(sig) \
-	(((sig) < SIGRTMIN) && siginmask(sig, SIG_KERNEL_IGNORE_MASK))
-#define sig_kernel_stop(sig) \
-	(((sig) < SIGRTMIN) && siginmask(sig, SIG_KERNEL_STOP_MASK))
+#define SIG_SPECIFIC_SICODES_MASK (\
+	rt_sigmask(SIGILL)    |  rt_sigmask(SIGFPE)    | \
+	rt_sigmask(SIGSEGV)   |  rt_sigmask(SIGBUS)    | \
+	rt_sigmask(SIGTRAP)   |  rt_sigmask(SIGCHLD)   | \
+	rt_sigmask(SIGPOLL)   |  rt_sigmask(SIGSYS)    | \
+	SIGEMT_MASK                                    )
+
+#define sig_kernel_only(sig)		siginmask(sig, SIG_KERNEL_ONLY_MASK)
+#define sig_kernel_coredump(sig)	siginmask(sig, SIG_KERNEL_COREDUMP_MASK)
+#define sig_kernel_ignore(sig)		siginmask(sig, SIG_KERNEL_IGNORE_MASK)
+#define sig_kernel_stop(sig)		siginmask(sig, SIG_KERNEL_STOP_MASK)
+#define sig_specific_sicodes(sig)	siginmask(sig, SIG_SPECIFIC_SICODES_MASK)
 
 #define sig_user_defined(t, signr) \
 	(((t)->sighand->action[(signr)-1].sa.sa_handler != SIG_DFL) &&	\
diff -druNp --no-dereference linux-libre-3.16.50-gnu/include/net/inet_frag.h linux-libre-3.16.51-gnu/include/net/inet_frag.h
--- linux-libre-3.16.50-gnu/include/net/inet_frag.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/include/net/inet_frag.h	2017-11-26 08:50:43.000000000 -0500
@@ -1,18 +1,13 @@
 #ifndef __NET_FRAG_H__
 #define __NET_FRAG_H__
 
-#include <linux/percpu_counter.h>
-
 struct netns_frags {
 	int			nqueues;
 	struct list_head	lru_list;
 	spinlock_t		lru_lock;
 
-	/* The percpu_counter "mem" need to be cacheline aligned.
-	 *  mem.count must not share cacheline with other writers
-	 */
-	struct percpu_counter   mem ____cacheline_aligned_in_smp;
-
+	/* Keep atomic mem on separate cachelines in structs that include it */
+	atomic_t		mem ____cacheline_aligned_in_smp;
 	/* sysctls */
 	int			timeout;
 	int			high_thresh;
@@ -104,42 +99,29 @@ static inline void inet_frag_put(struct
 
 /* Memory Tracking Functions. */
 
-/* The default percpu_counter batch size is not big enough to scale to
- * fragmentation mem acct sizes.
- * The mem size of a 64K fragment is approx:
- *  (44 fragments * 2944 truesize) + frag_queue struct(200) = 129736 bytes
- */
-static unsigned int frag_percpu_counter_batch = 130000;
-
 static inline int frag_mem_limit(struct netns_frags *nf)
 {
-	return percpu_counter_read(&nf->mem);
+	return atomic_read(&nf->mem);
 }
 
 static inline void sub_frag_mem_limit(struct inet_frag_queue *q, int i)
 {
-	__percpu_counter_add(&q->net->mem, -i, frag_percpu_counter_batch);
+	atomic_sub(i, &q->net->mem);
 }
 
 static inline void add_frag_mem_limit(struct inet_frag_queue *q, int i)
 {
-	__percpu_counter_add(&q->net->mem, i, frag_percpu_counter_batch);
+	atomic_add(i, &q->net->mem);
 }
 
 static inline void init_frag_mem_limit(struct netns_frags *nf)
 {
-	percpu_counter_init(&nf->mem, 0);
+	atomic_set(&nf->mem, 0);
 }
 
 static inline int sum_frag_mem_limit(struct netns_frags *nf)
 {
-	int res;
-
-	local_bh_disable();
-	res = percpu_counter_sum_positive(&nf->mem);
-	local_bh_enable();
-
-	return res;
+	return atomic_read(&nf->mem);
 }
 
 static inline void inet_frag_lru_move(struct inet_frag_queue *q)
diff -druNp --no-dereference linux-libre-3.16.50-gnu/include/uapi/asm-generic/siginfo.h linux-libre-3.16.51-gnu/include/uapi/asm-generic/siginfo.h
--- linux-libre-3.16.50-gnu/include/uapi/asm-generic/siginfo.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/include/uapi/asm-generic/siginfo.h	2017-11-26 08:50:43.000000000 -0500
@@ -161,7 +161,7 @@ typedef struct siginfo {
 #define SI_TIMER __SI_CODE(__SI_TIMER,-2) /* sent by timer expiration */
 #define SI_MESGQ __SI_CODE(__SI_MESGQ,-3) /* sent by real time mesq state change */
 #define SI_ASYNCIO	-4		/* sent by AIO completion */
-#define SI_SIGIO	-5		/* sent by queued SIGIO */
+#define SI_SIGIO __SI_CODE(__SI_POLL,-5) /* sent by queued SIGIO */
 #define SI_TKILL	-6		/* sent by tkill system call */
 #define SI_DETHREAD	-7		/* sent by execve() killing subsidiary threads */
 
@@ -234,7 +234,7 @@ typedef struct siginfo {
 #define NSIGCHLD	6
 
 /*
- * SIGPOLL si_codes
+ * SIGPOLL (or any other signal without signal specific si_codes) si_codes
  */
 #define POLL_IN		(__SI_POLL|1)	/* data input available */
 #define POLL_OUT	(__SI_POLL|2)	/* output buffers available */
diff -druNp --no-dereference linux-libre-3.16.50-gnu/kernel/irq/irqdesc.c linux-libre-3.16.51-gnu/kernel/irq/irqdesc.c
--- linux-libre-3.16.50-gnu/kernel/irq/irqdesc.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/kernel/irq/irqdesc.c	2017-11-26 08:50:43.000000000 -0500
@@ -183,9 +183,7 @@ static void free_desc(unsigned int irq)
 	 * sparse tree we can free it. Access in proc will fail to
 	 * lookup the descriptor.
 	 */
-	mutex_lock(&sparse_irq_lock);
 	delete_irq_desc(irq);
-	mutex_unlock(&sparse_irq_lock);
 
 	free_masks(desc);
 	free_percpu(desc->kstat_irqs);
@@ -202,19 +200,14 @@ static int alloc_descs(unsigned int star
 		desc = alloc_desc(start + i, node, owner);
 		if (!desc)
 			goto err;
-		mutex_lock(&sparse_irq_lock);
 		irq_insert_desc(start + i, desc);
-		mutex_unlock(&sparse_irq_lock);
 	}
+	bitmap_set(allocated_irqs, start, cnt);
 	return start;
 
 err:
 	for (i--; i >= 0; i--)
 		free_desc(start + i);
-
-	mutex_lock(&sparse_irq_lock);
-	bitmap_clear(allocated_irqs, start, cnt);
-	mutex_unlock(&sparse_irq_lock);
 	return -ENOMEM;
 }
 
@@ -312,6 +305,7 @@ static inline int alloc_descs(unsigned i
 
 		desc->owner = owner;
 	}
+	bitmap_set(allocated_irqs, start, cnt);
 	return start;
 }
 
@@ -366,10 +360,10 @@ void irq_free_descs(unsigned int from, u
 	if (from >= nr_irqs || (from + cnt) > nr_irqs)
 		return;
 
+	mutex_lock(&sparse_irq_lock);
 	for (i = 0; i < cnt; i++)
 		free_desc(from + i);
 
-	mutex_lock(&sparse_irq_lock);
 	bitmap_clear(allocated_irqs, from, cnt);
 	mutex_unlock(&sparse_irq_lock);
 }
@@ -413,19 +407,15 @@ __irq_alloc_descs(int irq, unsigned int
 					   from, cnt, 0);
 	ret = -EEXIST;
 	if (irq >=0 && start != irq)
-		goto err;
+		goto unlock;
 
 	if (start + cnt > nr_irqs) {
 		ret = irq_expand_nr_irqs(start + cnt);
 		if (ret)
-			goto err;
+			goto unlock;
 	}
-
-	bitmap_set(allocated_irqs, start, cnt);
-	mutex_unlock(&sparse_irq_lock);
-	return alloc_descs(start, cnt, node, owner);
-
-err:
+	ret = alloc_descs(start, cnt, node, owner);
+unlock:
 	mutex_unlock(&sparse_irq_lock);
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.16.50-gnu/kernel/printk/printk.c linux-libre-3.16.51-gnu/kernel/printk/printk.c
--- linux-libre-3.16.50-gnu/kernel/printk/printk.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/kernel/printk/printk.c	2017-11-26 08:50:43.000000000 -0500
@@ -47,6 +47,7 @@
 #include <linux/utsname.h>
 
 #include <asm/uaccess.h>
+#include <asm-generic/sections.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/printk.h>
@@ -2558,12 +2559,33 @@ int unregister_console(struct console *c
 }
 EXPORT_SYMBOL(unregister_console);
 
+/*
+ * Some boot consoles access data that is in the init section and which will
+ * be discarded after the initcalls have been run. To make sure that no code
+ * will access this data, unregister the boot consoles in a late initcall.
+ *
+ * If for some reason, such as deferred probe or the driver being a loadable
+ * module, the real console hasn't registered yet at this point, there will
+ * be a brief interval in which no messages are logged to the console, which
+ * makes it difficult to diagnose problems that occur during this time.
+ *
+ * To mitigate this problem somewhat, only unregister consoles whose memory
+ * intersects with the init section. Note that all other boot consoles will
+ * get unregistred when the real preferred console is registered.
+ */
 static int __init printk_late_init(void)
 {
 	struct console *con;
 
 	for_each_console(con) {
-		if (!keep_bootcon && con->flags & CON_BOOT) {
+		if ((con->flags & CON_BOOT) &&
+		    init_section_intersects(con, sizeof(*con))) {
+			/*
+			 * Please, consider moving the reported consoles out
+			 * of the init section.
+			 */
+			pr_warn("bootconsole [%s%d] uses init memory and must be disabled even before the real one is ready\n",
+				con->name, con->index);
 			unregister_console(con);
 		}
 	}
diff -druNp --no-dereference linux-libre-3.16.50-gnu/kernel/trace/trace.c linux-libre-3.16.51-gnu/kernel/trace/trace.c
--- linux-libre-3.16.50-gnu/kernel/trace/trace.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/kernel/trace/trace.c	2017-11-26 08:50:43.000000000 -0500
@@ -4945,7 +4945,7 @@ static int tracing_set_clock(struct trac
 	tracing_reset_online_cpus(&tr->trace_buffer);
 
 #ifdef CONFIG_TRACER_MAX_TRACE
-	if (tr->flags & TRACE_ARRAY_FL_GLOBAL && tr->max_buffer.buffer)
+	if (tr->max_buffer.buffer)
 		ring_buffer_set_clock(tr->max_buffer.buffer, trace_clocks[i].func);
 	tracing_reset_online_cpus(&tr->max_buffer);
 #endif
diff -druNp --no-dereference linux-libre-3.16.50-gnu/kernel/trace/trace_selftest.c linux-libre-3.16.51-gnu/kernel/trace/trace_selftest.c
--- linux-libre-3.16.50-gnu/kernel/trace/trace_selftest.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/kernel/trace/trace_selftest.c	2017-11-26 08:50:43.000000000 -0500
@@ -272,7 +272,7 @@ static int trace_selftest_ops(struct tra
 		goto out_free;
 	if (cnt > 1) {
 		if (trace_selftest_test_global_cnt == 0)
-			goto out;
+			goto out_free;
 	}
 	if (trace_selftest_test_dyn_cnt == 0)
 		goto out_free;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/Makefile linux-libre-3.16.51-gnu/Makefile
--- linux-libre-3.16.50-gnu/Makefile	2017-11-13 09:03:56.000000000 -0500
+++ linux-libre-3.16.51-gnu/Makefile	2017-11-26 13:21:10.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 16
-SUBLEVEL = 50
+SUBLEVEL = 51
 EXTRAVERSION =-gnu
 NAME = Museum of Fishiegoodies
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/core/net-sysfs.c linux-libre-3.16.51-gnu/net/core/net-sysfs.c
--- linux-libre-3.16.50-gnu/net/core/net-sysfs.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/core/net-sysfs.c	2017-11-26 08:50:43.000000000 -0500
@@ -786,21 +786,20 @@ static int rx_queue_add_kobject(struct n
 	error = kobject_init_and_add(kobj, &rx_queue_ktype, NULL,
 	    "rx-%u", index);
 	if (error)
-		goto exit;
+		return error;
 
 	if (net->sysfs_rx_queue_group) {
 		error = sysfs_create_group(kobj, net->sysfs_rx_queue_group);
-		if (error)
-			goto exit;
+		if (error) {
+			kobject_put(kobj);
+			return error;
+		}
 	}
 
 	kobject_uevent(kobj, KOBJ_ADD);
 	dev_hold(queue->dev);
 
 	return error;
-exit:
-	kobject_put(kobj);
-	return error;
 }
 #endif /* CONFIG_SYSFS */
 
@@ -1145,21 +1144,20 @@ static int netdev_queue_add_kobject(stru
 	error = kobject_init_and_add(kobj, &netdev_queue_ktype, NULL,
 	    "tx-%u", index);
 	if (error)
-		goto exit;
+		return error;
 
 #ifdef CONFIG_BQL
 	error = sysfs_create_group(kobj, &dql_group);
-	if (error)
-		goto exit;
+	if (error) {
+		kobject_put(kobj);
+		return error;
+	}
 #endif
 
 	kobject_uevent(kobj, KOBJ_ADD);
 	dev_hold(queue->dev);
 
 	return 0;
-exit:
-	kobject_put(kobj);
-	return error;
 }
 #endif /* CONFIG_SYSFS */
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/ipv4/inet_fragment.c linux-libre-3.16.51-gnu/net/ipv4/inet_fragment.c
--- linux-libre-3.16.50-gnu/net/ipv4/inet_fragment.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/ipv4/inet_fragment.c	2017-11-26 08:50:43.000000000 -0500
@@ -122,8 +122,6 @@ void inet_frags_exit_net(struct netns_fr
 	local_bh_disable();
 	inet_frag_evictor(nf, f, true);
 	local_bh_enable();
-
-	percpu_counter_destroy(&nf->mem);
 }
 EXPORT_SYMBOL(inet_frags_exit_net);
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/ipv6/ip6_fib.c linux-libre-3.16.51-gnu/net/ipv6/ip6_fib.c
--- linux-libre-3.16.50-gnu/net/ipv6/ip6_fib.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/ipv6/ip6_fib.c	2017-11-26 08:50:43.000000000 -0500
@@ -174,6 +174,12 @@ static __inline__ void rt6_release(struc
 		dst_free(&rt->dst);
 }
 
+static void fib6_free_table(struct fib6_table *table)
+{
+	inetpeer_invalidate_tree(&table->tb6_peers);
+	kfree(table);
+}
+
 static void fib6_link_table(struct net *net, struct fib6_table *tb)
 {
 	unsigned int h;
@@ -1836,15 +1842,22 @@ out_timer:
 
 static void fib6_net_exit(struct net *net)
 {
+	unsigned int i;
+
 	rt6_ifdown(net, NULL);
 	del_timer_sync(&net->ipv6.ip6_fib_timer);
 
-#ifdef CONFIG_IPV6_MULTIPLE_TABLES
-	inetpeer_invalidate_tree(&net->ipv6.fib6_local_tbl->tb6_peers);
-	kfree(net->ipv6.fib6_local_tbl);
-#endif
-	inetpeer_invalidate_tree(&net->ipv6.fib6_main_tbl->tb6_peers);
-	kfree(net->ipv6.fib6_main_tbl);
+	for (i = 0; i < FIB6_TABLE_HASHSZ; i++) {
+		struct hlist_head *head = &net->ipv6.fib_table_hash[i];
+		struct hlist_node *tmp;
+		struct fib6_table *tb;
+
+		hlist_for_each_entry_safe(tb, tmp, head, tb6_hlist) {
+			hlist_del(&tb->tb6_hlist);
+			fib6_free_table(tb);
+		}
+	}
+
 	kfree(net->ipv6.fib_table_hash);
 	kfree(net->ipv6.rt6_stats);
 }
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/l2tp/l2tp_core.c linux-libre-3.16.51-gnu/net/l2tp/l2tp_core.c
--- linux-libre-3.16.50-gnu/net/l2tp/l2tp_core.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/l2tp/l2tp_core.c	2017-11-26 08:50:43.000000000 -0500
@@ -377,13 +377,21 @@ static int l2tp_session_add_to_tunnel(st
 	struct hlist_head *g_head;
 	struct hlist_head *head;
 	struct l2tp_net *pn;
+	int err;
 
 	head = l2tp_session_id_hash(tunnel, session->session_id);
 
 	write_lock_bh(&tunnel->hlist_lock);
+	if (!tunnel->acpt_newsess) {
+		err = -ENODEV;
+		goto err_tlock;
+	}
+
 	hlist_for_each_entry(session_walk, head, hlist)
-		if (session_walk->session_id == session->session_id)
-			goto exist;
+		if (session_walk->session_id == session->session_id) {
+			err = -EEXIST;
+			goto err_tlock;
+		}
 
 	if (tunnel->version == L2TP_HDR_VER_3) {
 		pn = l2tp_pernet(tunnel->l2tp_net);
@@ -391,12 +399,21 @@ static int l2tp_session_add_to_tunnel(st
 						session->session_id);
 
 		spin_lock_bh(&pn->l2tp_session_hlist_lock);
+
 		hlist_for_each_entry(session_walk, g_head, global_hlist)
-			if (session_walk->session_id == session->session_id)
-				goto exist_glob;
+			if (session_walk->session_id == session->session_id) {
+				err = -EEXIST;
+				goto err_tlock_pnlock;
+			}
 
+		l2tp_tunnel_inc_refcount(tunnel);
+		sock_hold(tunnel->sock);
 		hlist_add_head_rcu(&session->global_hlist, g_head);
+
 		spin_unlock_bh(&pn->l2tp_session_hlist_lock);
+	} else {
+		l2tp_tunnel_inc_refcount(tunnel);
+		sock_hold(tunnel->sock);
 	}
 
 	hlist_add_head(&session->hlist, head);
@@ -404,12 +421,12 @@ static int l2tp_session_add_to_tunnel(st
 
 	return 0;
 
-exist_glob:
+err_tlock_pnlock:
 	spin_unlock_bh(&pn->l2tp_session_hlist_lock);
-exist:
+err_tlock:
 	write_unlock_bh(&tunnel->hlist_lock);
 
-	return -EEXIST;
+	return err;
 }
 
 /* Lookup a tunnel by id
@@ -1299,7 +1316,6 @@ static void l2tp_tunnel_destruct(struct
 	/* Remove hooks into tunnel socket */
 	sk->sk_destruct = tunnel->old_sk_destruct;
 	sk->sk_user_data = NULL;
-	tunnel->sock = NULL;
 
 	/* Remove the tunnel struct from the tunnel list */
 	pn = l2tp_pernet(tunnel->l2tp_net);
@@ -1309,6 +1325,8 @@ static void l2tp_tunnel_destruct(struct
 	atomic_dec(&l2tp_tunnel_count);
 
 	l2tp_tunnel_closeall(tunnel);
+
+	tunnel->sock = NULL;
 	l2tp_tunnel_dec_refcount(tunnel);
 
 	/* Call the original destructor */
@@ -1333,6 +1351,7 @@ void l2tp_tunnel_closeall(struct l2tp_tu
 		  tunnel->name);
 
 	write_lock_bh(&tunnel->hlist_lock);
+	tunnel->acpt_newsess = false;
 	for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
 again:
 		hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
@@ -1665,6 +1684,7 @@ int l2tp_tunnel_create(struct net *net,
 	tunnel->magic = L2TP_TUNNEL_MAGIC;
 	sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
 	rwlock_init(&tunnel->hlist_lock);
+	tunnel->acpt_newsess = true;
 
 	/* The net we belong to */
 	tunnel->l2tp_net = net;
@@ -1915,11 +1935,6 @@ struct l2tp_session *l2tp_session_create
 			return ERR_PTR(err);
 		}
 
-		l2tp_tunnel_inc_refcount(tunnel);
-
-		/* Ensure tunnel socket isn't deleted */
-		sock_hold(tunnel->sock);
-
 		/* Ignore management session in session count value */
 		if (session->session_id != 0)
 			atomic_inc(&l2tp_session_count);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/l2tp/l2tp_core.h linux-libre-3.16.51-gnu/net/l2tp/l2tp_core.h
--- linux-libre-3.16.50-gnu/net/l2tp/l2tp_core.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/l2tp/l2tp_core.h	2017-11-26 08:50:43.000000000 -0500
@@ -171,6 +171,10 @@ struct l2tp_tunnel {
 	int			magic;		/* Should be L2TP_TUNNEL_MAGIC */
 	struct rcu_head rcu;
 	rwlock_t		hlist_lock;	/* protect session_hlist */
+	bool			acpt_newsess;	/* Indicates whether this
+						 * tunnel accepts new sessions.
+						 * Protected by hlist_lock.
+						 */
 	struct hlist_head	session_hlist[L2TP_HASH_SIZE];
 						/* hashed list of sessions,
 						 * hashed by id */
@@ -206,7 +210,9 @@ struct l2tp_tunnel {
 };
 
 struct l2tp_nl_cmd_ops {
-	int (*session_create)(struct net *net, u32 tunnel_id, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg);
+	int (*session_create)(struct net *net, struct l2tp_tunnel *tunnel,
+			      u32 session_id, u32 peer_session_id,
+			      struct l2tp_session_cfg *cfg);
 	int (*session_delete)(struct l2tp_session *session);
 };
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/l2tp/l2tp_eth.c linux-libre-3.16.51-gnu/net/l2tp/l2tp_eth.c
--- linux-libre-3.16.50-gnu/net/l2tp/l2tp_eth.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/l2tp/l2tp_eth.c	2017-11-26 08:50:43.000000000 -0500
@@ -206,23 +206,18 @@ static void l2tp_eth_show(struct seq_fil
 }
 #endif
 
-static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
+static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
+			   u32 session_id, u32 peer_session_id,
+			   struct l2tp_session_cfg *cfg)
 {
 	struct net_device *dev;
 	char name[IFNAMSIZ];
-	struct l2tp_tunnel *tunnel;
 	struct l2tp_session *session;
 	struct l2tp_eth *priv;
 	struct l2tp_eth_sess *spriv;
 	int rc;
 	struct l2tp_eth_net *pn;
 
-	tunnel = l2tp_tunnel_find(net, tunnel_id);
-	if (!tunnel) {
-		rc = -ENODEV;
-		goto out;
-	}
-
 	if (cfg->ifname) {
 		dev = dev_get_by_name(net, cfg->ifname);
 		if (dev) {
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/l2tp/l2tp_netlink.c linux-libre-3.16.51-gnu/net/l2tp/l2tp_netlink.c
--- linux-libre-3.16.50-gnu/net/l2tp/l2tp_netlink.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/l2tp/l2tp_netlink.c	2017-11-26 08:50:43.000000000 -0500
@@ -540,10 +540,10 @@ static int l2tp_nl_cmd_session_create(st
 		break;
 	}
 
-	ret = -EPROTONOSUPPORT;
-	if (l2tp_nl_cmd_ops[cfg.pw_type]->session_create)
-		ret = (*l2tp_nl_cmd_ops[cfg.pw_type]->session_create)(net, tunnel_id,
-			session_id, peer_session_id, &cfg);
+	ret = l2tp_nl_cmd_ops[cfg.pw_type]->session_create(net, tunnel,
+							   session_id,
+							   peer_session_id,
+							   &cfg);
 
 out_tunnel:
 	l2tp_tunnel_dec_refcount(tunnel);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/l2tp/l2tp_ppp.c linux-libre-3.16.51-gnu/net/l2tp/l2tp_ppp.c
--- linux-libre-3.16.50-gnu/net/l2tp/l2tp_ppp.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/l2tp/l2tp_ppp.c	2017-11-26 08:50:43.000000000 -0500
@@ -807,25 +807,20 @@ end:
 
 #ifdef CONFIG_L2TP_V3
 
-/* Called when creating sessions via the netlink interface.
- */
-static int pppol2tp_session_create(struct net *net, u32 tunnel_id, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
+/* Called when creating sessions via the netlink interface. */
+static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
+				   u32 session_id, u32 peer_session_id,
+				   struct l2tp_session_cfg *cfg)
 {
 	int error;
-	struct l2tp_tunnel *tunnel;
 	struct l2tp_session *session;
 	struct pppol2tp_session *ps;
 
-	tunnel = l2tp_tunnel_find(net, tunnel_id);
-
-	/* Error if we can't find the tunnel */
-	error = -ENOENT;
-	if (tunnel == NULL)
-		goto out;
-
 	/* Error if tunnel socket is not prepped */
-	if (tunnel->sock == NULL)
+	if (!tunnel->sock) {
+		error = -ENOENT;
 		goto out;
+	}
 
 	/* Default MTU values. */
 	if (cfg->mtu == 0)
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/mac80211/cfg.c linux-libre-3.16.51-gnu/net/mac80211/cfg.c
--- linux-libre-3.16.50-gnu/net/mac80211/cfg.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/mac80211/cfg.c	2017-11-26 08:50:43.000000000 -0500
@@ -2891,6 +2891,8 @@ static int ieee80211_cancel_roc(struct i
 	struct ieee80211_roc_work *roc, *tmp, *found = NULL;
 	int ret;
 
+	flush_work(&local->hw_roc_start);
+
 	mutex_lock(&local->mtx);
 	list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 		struct ieee80211_roc_work *dep, *tmp2;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/mac80211/key.c linux-libre-3.16.51-gnu/net/mac80211/key.c
--- linux-libre-3.16.50-gnu/net/mac80211/key.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/mac80211/key.c	2017-11-26 08:50:43.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 #include <net/mac80211.h>
+#include <crypto/algapi.h>
 #include <asm/unaligned.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -474,6 +475,39 @@ void ieee80211_key_free_unused(struct ie
 	ieee80211_key_free_common(key);
 }
 
+static bool ieee80211_key_identical(struct ieee80211_sub_if_data *sdata,
+				    struct ieee80211_key *old,
+				    struct ieee80211_key *new)
+{
+	u8 tkip_old[WLAN_KEY_LEN_TKIP], tkip_new[WLAN_KEY_LEN_TKIP];
+	u8 *tk_old, *tk_new;
+
+	if (!old || new->conf.keylen != old->conf.keylen)
+		return false;
+
+	tk_old = old->conf.key;
+	tk_new = new->conf.key;
+
+	/*
+	 * In station mode, don't compare the TX MIC key, as it's never used
+	 * and offloaded rekeying may not care to send it to the host. This
+	 * is the case in iwlwifi, for example.
+	 */
+	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+	    new->conf.cipher == WLAN_CIPHER_SUITE_TKIP &&
+	    new->conf.keylen == WLAN_KEY_LEN_TKIP &&
+	    !(new->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+		memcpy(tkip_old, tk_old, WLAN_KEY_LEN_TKIP);
+		memcpy(tkip_new, tk_new, WLAN_KEY_LEN_TKIP);
+		memset(tkip_old + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, 0, 8);
+		memset(tkip_new + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, 0, 8);
+		tk_old = tkip_old;
+		tk_new = tkip_new;
+	}
+
+	return !crypto_memneq(tk_old, tk_new, new->conf.keylen);
+}
+
 int ieee80211_key_link(struct ieee80211_key *key,
 		       struct ieee80211_sub_if_data *sdata,
 		       struct sta_info *sta)
@@ -502,8 +536,7 @@ int ieee80211_key_link(struct ieee80211_
 	 * Silently accept key re-installation without really installing the
 	 * new version of the key to avoid nonce reuse or replay issues.
 	 */
-	if (old_key && key->conf.keylen == old_key->conf.keylen &&
-	    !memcmp(key->conf.key, old_key->conf.key, key->conf.keylen)) {
+	if (ieee80211_key_identical(sdata, old_key, key)) {
 		ieee80211_key_free_unused(key);
 		ret = 0;
 		goto out;
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/sctp/socket.c linux-libre-3.16.51-gnu/net/sctp/socket.c
--- linux-libre-3.16.50-gnu/net/sctp/socket.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/sctp/socket.c	2017-11-26 08:50:43.000000000 -0500
@@ -4328,6 +4328,10 @@ int sctp_do_peeloff(struct sock *sk, sct
 	struct sctp_af *af;
 	int err = 0;
 
+	/* Do not peel off from one netns to another one. */
+	if (!net_eq(current->nsproxy->net_ns, sock_net(sk)))
+		return -EINVAL;
+
 	if (!asoc)
 		return -EINVAL;
 
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/vmw_vsock/vmci_transport.c linux-libre-3.16.51-gnu/net/vmw_vsock/vmci_transport.c
--- linux-libre-3.16.50-gnu/net/vmw_vsock/vmci_transport.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/vmw_vsock/vmci_transport.c	2017-11-26 08:50:43.000000000 -0500
@@ -40,13 +40,11 @@
 
 static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg);
 static int vmci_transport_recv_stream_cb(void *data, struct vmci_datagram *dg);
-static void vmci_transport_peer_attach_cb(u32 sub_id,
-					  const struct vmci_event_data *ed,
-					  void *client_data);
 static void vmci_transport_peer_detach_cb(u32 sub_id,
 					  const struct vmci_event_data *ed,
 					  void *client_data);
 static void vmci_transport_recv_pkt_work(struct work_struct *work);
+static void vmci_transport_cleanup(struct work_struct *work);
 static int vmci_transport_recv_listen(struct sock *sk,
 				      struct vmci_transport_packet *pkt);
 static int vmci_transport_recv_connecting_server(
@@ -75,6 +73,10 @@ struct vmci_transport_recv_pkt_info {
 	struct vmci_transport_packet pkt;
 };
 
+static LIST_HEAD(vmci_transport_cleanup_list);
+static DEFINE_SPINLOCK(vmci_transport_cleanup_lock);
+static DECLARE_WORK(vmci_transport_cleanup_work, vmci_transport_cleanup);
+
 static struct vmci_handle vmci_transport_stream_handle = { VMCI_INVALID_ID,
 							   VMCI_INVALID_ID };
 static u32 vmci_transport_qp_resumed_sub_id = VMCI_INVALID_ID;
@@ -791,44 +793,6 @@ out:
 	return err;
 }
 
-static void vmci_transport_peer_attach_cb(u32 sub_id,
-					  const struct vmci_event_data *e_data,
-					  void *client_data)
-{
-	struct sock *sk = client_data;
-	const struct vmci_event_payload_qp *e_payload;
-	struct vsock_sock *vsk;
-
-	e_payload = vmci_event_data_const_payload(e_data);
-
-	vsk = vsock_sk(sk);
-
-	/* We don't ask for delayed CBs when we subscribe to this event (we
-	 * pass 0 as flags to vmci_event_subscribe()).  VMCI makes no
-	 * guarantees in that case about what context we might be running in,
-	 * so it could be BH or process, blockable or non-blockable.  So we
-	 * need to account for all possible contexts here.
-	 */
-	local_bh_disable();
-	bh_lock_sock(sk);
-
-	/* XXX This is lame, we should provide a way to lookup sockets by
-	 * qp_handle.
-	 */
-	if (vmci_handle_is_equal(vmci_trans(vsk)->qp_handle,
-				 e_payload->handle)) {
-		/* XXX This doesn't do anything, but in the future we may want
-		 * to set a flag here to verify the attach really did occur and
-		 * we weren't just sent a datagram claiming it was.
-		 */
-		goto out;
-	}
-
-out:
-	bh_unlock_sock(sk);
-	local_bh_enable();
-}
-
 static void vmci_transport_handle_detach(struct sock *sk)
 {
 	struct vsock_sock *vsk;
@@ -871,28 +835,38 @@ static void vmci_transport_peer_detach_c
 					  const struct vmci_event_data *e_data,
 					  void *client_data)
 {
-	struct sock *sk = client_data;
+	struct vmci_transport *trans = client_data;
 	const struct vmci_event_payload_qp *e_payload;
-	struct vsock_sock *vsk;
 
 	e_payload = vmci_event_data_const_payload(e_data);
-	vsk = vsock_sk(sk);
-	if (vmci_handle_is_invalid(e_payload->handle))
-		return;
-
-	/* Same rules for locking as for peer_attach_cb(). */
-	local_bh_disable();
-	bh_lock_sock(sk);
 
 	/* XXX This is lame, we should provide a way to lookup sockets by
 	 * qp_handle.
 	 */
-	if (vmci_handle_is_equal(vmci_trans(vsk)->qp_handle,
-				 e_payload->handle))
-		vmci_transport_handle_detach(sk);
+	if (vmci_handle_is_invalid(e_payload->handle) ||
+	    !vmci_handle_is_equal(trans->qp_handle, e_payload->handle))
+		return;
 
-	bh_unlock_sock(sk);
-	local_bh_enable();
+	/* We don't ask for delayed CBs when we subscribe to this event (we
+	 * pass 0 as flags to vmci_event_subscribe()).  VMCI makes no
+	 * guarantees in that case about what context we might be running in,
+	 * so it could be BH or process, blockable or non-blockable.  So we
+	 * need to account for all possible contexts here.
+	 */
+	spin_lock_bh(&trans->lock);
+	if (!trans->sk)
+		goto out;
+
+	/* Apart from here, trans->lock is only grabbed as part of sk destruct,
+	 * where trans->sk isn't locked.
+	 */
+	bh_lock_sock(trans->sk);
+
+	vmci_transport_handle_detach(trans->sk);
+
+	bh_unlock_sock(trans->sk);
+ out:
+	spin_unlock_bh(&trans->lock);
 }
 
 static void vmci_transport_qp_resumed_cb(u32 sub_id,
@@ -1181,7 +1155,7 @@ vmci_transport_recv_connecting_server(st
 	 */
 	err = vmci_event_subscribe(VMCI_EVENT_QP_PEER_DETACH,
 				   vmci_transport_peer_detach_cb,
-				   pending, &detach_sub_id);
+				   vmci_trans(vpending), &detach_sub_id);
 	if (err < VMCI_SUCCESS) {
 		vmci_transport_send_reset(pending, pkt);
 		err = vmci_transport_error_to_vsock_error(err);
@@ -1321,7 +1295,6 @@ vmci_transport_recv_connecting_client(st
 		    || vmci_trans(vsk)->qpair
 		    || vmci_trans(vsk)->produce_size != 0
 		    || vmci_trans(vsk)->consume_size != 0
-		    || vmci_trans(vsk)->attach_sub_id != VMCI_INVALID_ID
 		    || vmci_trans(vsk)->detach_sub_id != VMCI_INVALID_ID) {
 			skerr = EPROTO;
 			err = -EINVAL;
@@ -1389,7 +1362,6 @@ static int vmci_transport_recv_connectin
 	struct vsock_sock *vsk;
 	struct vmci_handle handle;
 	struct vmci_qp *qpair;
-	u32 attach_sub_id;
 	u32 detach_sub_id;
 	bool is_local;
 	u32 flags;
@@ -1399,7 +1371,6 @@ static int vmci_transport_recv_connectin
 
 	vsk = vsock_sk(sk);
 	handle = VMCI_INVALID_HANDLE;
-	attach_sub_id = VMCI_INVALID_ID;
 	detach_sub_id = VMCI_INVALID_ID;
 
 	/* If we have gotten here then we should be past the point where old
@@ -1444,23 +1415,15 @@ static int vmci_transport_recv_connectin
 		goto destroy;
 	}
 
-	/* Subscribe to attach and detach events first.
+	/* Subscribe to detach events first.
 	 *
 	 * XXX We attach once for each queue pair created for now so it is easy
 	 * to find the socket (it's provided), but later we should only
 	 * subscribe once and add a way to lookup sockets by queue pair handle.
 	 */
-	err = vmci_event_subscribe(VMCI_EVENT_QP_PEER_ATTACH,
-				   vmci_transport_peer_attach_cb,
-				   sk, &attach_sub_id);
-	if (err < VMCI_SUCCESS) {
-		err = vmci_transport_error_to_vsock_error(err);
-		goto destroy;
-	}
-
 	err = vmci_event_subscribe(VMCI_EVENT_QP_PEER_DETACH,
 				   vmci_transport_peer_detach_cb,
-				   sk, &detach_sub_id);
+				   vmci_trans(vsk), &detach_sub_id);
 	if (err < VMCI_SUCCESS) {
 		err = vmci_transport_error_to_vsock_error(err);
 		goto destroy;
@@ -1496,7 +1459,6 @@ static int vmci_transport_recv_connectin
 	vmci_trans(vsk)->produce_size = vmci_trans(vsk)->consume_size =
 		pkt->u.size;
 
-	vmci_trans(vsk)->attach_sub_id = attach_sub_id;
 	vmci_trans(vsk)->detach_sub_id = detach_sub_id;
 
 	vmci_trans(vsk)->notify_ops->process_negotiate(sk);
@@ -1504,9 +1466,6 @@ static int vmci_transport_recv_connectin
 	return 0;
 
 destroy:
-	if (attach_sub_id != VMCI_INVALID_ID)
-		vmci_event_unsubscribe(attach_sub_id);
-
 	if (detach_sub_id != VMCI_INVALID_ID)
 		vmci_event_unsubscribe(detach_sub_id);
 
@@ -1607,9 +1566,11 @@ static int vmci_transport_socket_init(st
 	vmci_trans(vsk)->qp_handle = VMCI_INVALID_HANDLE;
 	vmci_trans(vsk)->qpair = NULL;
 	vmci_trans(vsk)->produce_size = vmci_trans(vsk)->consume_size = 0;
-	vmci_trans(vsk)->attach_sub_id = vmci_trans(vsk)->detach_sub_id =
-		VMCI_INVALID_ID;
+	vmci_trans(vsk)->detach_sub_id = VMCI_INVALID_ID;
 	vmci_trans(vsk)->notify_ops = NULL;
+	INIT_LIST_HEAD(&vmci_trans(vsk)->elem);
+	vmci_trans(vsk)->sk = &vsk->sk;
+	spin_lock_init(&vmci_trans(vsk)->lock);
 	if (psk) {
 		vmci_trans(vsk)->queue_pair_size =
 			vmci_trans(psk)->queue_pair_size;
@@ -1629,29 +1590,57 @@ static int vmci_transport_socket_init(st
 	return 0;
 }
 
-static void vmci_transport_destruct(struct vsock_sock *vsk)
+static void vmci_transport_free_resources(struct list_head *transport_list)
 {
-	if (vmci_trans(vsk)->attach_sub_id != VMCI_INVALID_ID) {
-		vmci_event_unsubscribe(vmci_trans(vsk)->attach_sub_id);
-		vmci_trans(vsk)->attach_sub_id = VMCI_INVALID_ID;
-	}
+	while (!list_empty(transport_list)) {
+		struct vmci_transport *transport =
+		    list_first_entry(transport_list, struct vmci_transport,
+				     elem);
+		list_del(&transport->elem);
 
-	if (vmci_trans(vsk)->detach_sub_id != VMCI_INVALID_ID) {
-		vmci_event_unsubscribe(vmci_trans(vsk)->detach_sub_id);
-		vmci_trans(vsk)->detach_sub_id = VMCI_INVALID_ID;
-	}
+		if (transport->detach_sub_id != VMCI_INVALID_ID) {
+			vmci_event_unsubscribe(transport->detach_sub_id);
+			transport->detach_sub_id = VMCI_INVALID_ID;
+		}
 
-	if (!vmci_handle_is_invalid(vmci_trans(vsk)->qp_handle)) {
-		vmci_qpair_detach(&vmci_trans(vsk)->qpair);
-		vmci_trans(vsk)->qp_handle = VMCI_INVALID_HANDLE;
-		vmci_trans(vsk)->produce_size = 0;
-		vmci_trans(vsk)->consume_size = 0;
+		if (!vmci_handle_is_invalid(transport->qp_handle)) {
+			vmci_qpair_detach(&transport->qpair);
+			transport->qp_handle = VMCI_INVALID_HANDLE;
+			transport->produce_size = 0;
+			transport->consume_size = 0;
+		}
+
+		kfree(transport);
 	}
+}
+
+static void vmci_transport_cleanup(struct work_struct *work)
+{
+	LIST_HEAD(pending);
+
+	spin_lock_bh(&vmci_transport_cleanup_lock);
+	list_replace_init(&vmci_transport_cleanup_list, &pending);
+	spin_unlock_bh(&vmci_transport_cleanup_lock);
+	vmci_transport_free_resources(&pending);
+}
+
+static void vmci_transport_destruct(struct vsock_sock *vsk)
+{
+	/* Ensure that the detach callback doesn't use the sk/vsk
+	 * we are about to destruct.
+	 */
+	spin_lock_bh(&vmci_trans(vsk)->lock);
+	vmci_trans(vsk)->sk = NULL;
+	spin_unlock_bh(&vmci_trans(vsk)->lock);
 
 	if (vmci_trans(vsk)->notify_ops)
 		vmci_trans(vsk)->notify_ops->socket_destruct(vsk);
 
-	kfree(vsk->trans);
+	spin_lock_bh(&vmci_transport_cleanup_lock);
+	list_add(&vmci_trans(vsk)->elem, &vmci_transport_cleanup_list);
+	spin_unlock_bh(&vmci_transport_cleanup_lock);
+	schedule_work(&vmci_transport_cleanup_work);
+
 	vsk->trans = NULL;
 }
 
@@ -2148,6 +2137,9 @@ module_init(vmci_transport_init);
 
 static void __exit vmci_transport_exit(void)
 {
+	cancel_work_sync(&vmci_transport_cleanup_work);
+	vmci_transport_free_resources(&vmci_transport_cleanup_list);
+
 	if (!vmci_handle_is_invalid(vmci_transport_stream_handle)) {
 		if (vmci_datagram_destroy_handle(
 			vmci_transport_stream_handle) != VMCI_SUCCESS)
@@ -2166,6 +2158,7 @@ module_exit(vmci_transport_exit);
 
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMCI transport for Virtual Sockets");
+MODULE_VERSION("1.0.3.0-k");
 MODULE_LICENSE("GPL v2");
 MODULE_ALIAS("vmware_vsock");
 MODULE_ALIAS_NETPROTO(PF_VSOCK);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/net/vmw_vsock/vmci_transport.h linux-libre-3.16.51-gnu/net/vmw_vsock/vmci_transport.h
--- linux-libre-3.16.50-gnu/net/vmw_vsock/vmci_transport.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/net/vmw_vsock/vmci_transport.h	2017-11-26 08:50:43.000000000 -0500
@@ -119,10 +119,12 @@ struct vmci_transport {
 	u64 queue_pair_size;
 	u64 queue_pair_min_size;
 	u64 queue_pair_max_size;
-	u32 attach_sub_id;
 	u32 detach_sub_id;
 	union vmci_transport_notify notify;
 	struct vmci_transport_notify_ops *notify_ops;
+	struct list_head elem;
+	struct sock *sk;
+	spinlock_t lock; /* protects sk. */
 };
 
 int vmci_transport_register(void);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/tools/perf/Documentation/Makefile linux-libre-3.16.51-gnu/tools/perf/Documentation/Makefile
--- linux-libre-3.16.50-gnu/tools/perf/Documentation/Makefile	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/tools/perf/Documentation/Makefile	2017-11-26 08:50:43.000000000 -0500
@@ -192,7 +192,7 @@ do-install-man: man
 #		$(INSTALL) -m 644 $(DOC_MAN5) $(DESTDIR)$(man5dir); \
 #		$(INSTALL) -m 644 $(DOC_MAN7) $(DESTDIR)$(man7dir)
 
-install-man: check-man-tools man
+install-man: check-man-tools man do-install-man
 
 ifdef missing_tools
   DO_INSTALL_MAN = $(warning Please install $(missing_tools) to have the man pages installed)
diff -druNp --no-dereference linux-libre-3.16.50-gnu/tools/perf/tests/attr/test-record-no-buffering linux-libre-3.16.51-gnu/tools/perf/tests/attr/test-record-no-buffering
--- linux-libre-3.16.50-gnu/tools/perf/tests/attr/test-record-no-buffering	1969-12-31 19:00:00.000000000 -0500
+++ linux-libre-3.16.51-gnu/tools/perf/tests/attr/test-record-no-buffering	2017-11-26 08:50:43.000000000 -0500
@@ -0,0 +1,9 @@
+[config]
+command = record
+args    = --no-buffering kill >/dev/null 2>&1
+
+[event:base-record]
+sample_period=4000
+sample_type=263
+watermark=0
+wakeup_events=1
diff -druNp --no-dereference linux-libre-3.16.50-gnu/tools/perf/tests/attr/test-record-no-delay linux-libre-3.16.51-gnu/tools/perf/tests/attr/test-record-no-delay
--- linux-libre-3.16.50-gnu/tools/perf/tests/attr/test-record-no-delay	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/tools/perf/tests/attr/test-record-no-delay	1969-12-31 19:00:00.000000000 -0500
@@ -1,9 +0,0 @@
-[config]
-command = record
-args    = -D kill >/dev/null 2>&1
-
-[event:base-record]
-sample_period=4000
-sample_type=263
-watermark=0
-wakeup_events=1
diff -druNp --no-dereference linux-libre-3.16.50-gnu/tools/perf/util/parse-events.c linux-libre-3.16.51-gnu/tools/perf/util/parse-events.c
--- linux-libre-3.16.50-gnu/tools/perf/util/parse-events.c	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/tools/perf/util/parse-events.c	2017-11-26 08:50:43.000000000 -0500
@@ -908,7 +908,7 @@ static int parse_events__scanner(const c
  */
 int parse_events_terms(struct list_head *terms, const char *str)
 {
-	struct parse_events_terms data = {
+	struct parse_events_state data = {
 		.terms = NULL,
 	};
 	int ret;
@@ -927,7 +927,7 @@ int parse_events_terms(struct list_head
 
 int parse_events(struct perf_evlist *evlist, const char *str)
 {
-	struct parse_events_evlist data = {
+	struct parse_events_state data = {
 		.list = LIST_HEAD_INIT(data.list),
 		.idx  = evlist->nr_entries,
 	};
diff -druNp --no-dereference linux-libre-3.16.50-gnu/tools/perf/util/parse-events.h linux-libre-3.16.51-gnu/tools/perf/util/parse-events.h
--- linux-libre-3.16.50-gnu/tools/perf/util/parse-events.h	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/tools/perf/util/parse-events.h	2017-11-26 08:50:43.000000000 -0500
@@ -61,14 +61,11 @@ struct parse_events_term {
 	struct list_head list;
 };
 
-struct parse_events_evlist {
+struct parse_events_state {
 	struct list_head list;
 	int idx;
 	int nr_groups;
-};
-
-struct parse_events_terms {
-	struct list_head *terms;
+	struct list_head	  *terms;
 };
 
 int parse_events__is_hardcoded_term(struct parse_events_term *term);
diff -druNp --no-dereference linux-libre-3.16.50-gnu/tools/perf/util/parse-events.y linux-libre-3.16.51-gnu/tools/perf/util/parse-events.y
--- linux-libre-3.16.50-gnu/tools/perf/util/parse-events.y	2017-11-11 08:34:06.000000000 -0500
+++ linux-libre-3.16.51-gnu/tools/perf/util/parse-events.y	2017-11-26 08:50:43.000000000 -0500
@@ -30,7 +30,7 @@ do { \
 } while (0)
 
 static inc_group_count(struct list_head *list,
-		       struct parse_events_evlist *data)
+		       struct parse_events_state *data)
 {
 	/* Count groups only have more than 1 members */
 	if (!list_is_last(list->next, list))
@@ -93,7 +93,7 @@ PE_START_TERMS  start_terms
 
 start_events: groups
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 
 	parse_events_update_lists($1, &data->list);
 }
@@ -202,7 +202,7 @@ event_def: event_pmu |
 event_pmu:
 PE_NAME '/' event_config '/'
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -219,7 +219,7 @@ PE_VALUE_SYM_SW
 event_legacy_symbol:
 value_sym '/' event_config '/'
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 	int type = $1 >> 16;
 	int config = $1 & 255;
@@ -233,7 +233,7 @@ value_sym '/' event_config '/'
 |
 value_sym sep_slash_dc
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 	int type = $1 >> 16;
 	int config = $1 & 255;
@@ -247,7 +247,7 @@ value_sym sep_slash_dc
 event_legacy_cache:
 PE_NAME_CACHE_TYPE '-' PE_NAME_CACHE_OP_RESULT '-' PE_NAME_CACHE_OP_RESULT
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -257,7 +257,7 @@ PE_NAME_CACHE_TYPE '-' PE_NAME_CACHE_OP_
 |
 PE_NAME_CACHE_TYPE '-' PE_NAME_CACHE_OP_RESULT
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -267,7 +267,7 @@ PE_NAME_CACHE_TYPE '-' PE_NAME_CACHE_OP_
 |
 PE_NAME_CACHE_TYPE
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -278,7 +278,7 @@ PE_NAME_CACHE_TYPE
 event_legacy_mem:
 PE_PREFIX_MEM PE_VALUE ':' PE_MODIFIER_BP sep_dc
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -289,7 +289,7 @@ PE_PREFIX_MEM PE_VALUE ':' PE_MODIFIER_B
 |
 PE_PREFIX_MEM PE_VALUE sep_dc
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -301,7 +301,7 @@ PE_PREFIX_MEM PE_VALUE sep_dc
 event_legacy_tracepoint:
 PE_NAME '-' PE_NAME ':' PE_NAME
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 	char sys_name[128];
 	snprintf(&sys_name, 128, "%s-%s", $1, $3);
@@ -313,7 +313,7 @@ PE_NAME '-' PE_NAME ':' PE_NAME
 |
 PE_NAME ':' PE_NAME
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -324,7 +324,7 @@ PE_NAME ':' PE_NAME
 event_legacy_numeric:
 PE_VALUE ':' PE_VALUE
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -335,7 +335,7 @@ PE_VALUE ':' PE_VALUE
 event_legacy_raw:
 PE_RAW
 {
-	struct parse_events_evlist *data = _data;
+	struct parse_events_state *data = _data;
 	struct list_head *list;
 
 	ALLOC_LIST(list);
@@ -346,7 +346,7 @@ PE_RAW
 
 start_terms: event_config
 {
-	struct parse_events_terms *data = _data;
+	struct parse_events_state *data = _data;
 	data->terms = $1;
 }
 
