diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/arm/boot/dts/armada-388-gp.dts linux-libre-4.1.44-gnu/arch/arm/boot/dts/armada-388-gp.dts
--- linux-libre-4.1.43-gnu/arch/arm/boot/dts/armada-388-gp.dts	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/arm/boot/dts/armada-388-gp.dts	2017-09-14 11:55:04.000000000 -0400
@@ -91,7 +91,7 @@
 					pinctrl-names = "default";
 					pinctrl-0 = <&pca0_pins>;
 					interrupt-parent = <&gpio0>;
-					interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
+					interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
 					gpio-controller;
 					#gpio-cells = <2>;
 					interrupt-controller;
@@ -103,7 +103,7 @@
 					compatible = "nxp,pca9555";
 					pinctrl-names = "default";
 					interrupt-parent = <&gpio0>;
-					interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
+					interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
 					gpio-controller;
 					#gpio-cells = <2>;
 					interrupt-controller;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/arm/boot/dts/omap3-n900.dts linux-libre-4.1.44-gnu/arch/arm/boot/dts/omap3-n900.dts
--- linux-libre-4.1.43-gnu/arch/arm/boot/dts/omap3-n900.dts	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/arm/boot/dts/omap3-n900.dts	2017-09-14 11:55:04.000000000 -0400
@@ -697,6 +697,8 @@
 	vmmc_aux-supply = <&vsim>;
 	bus-width = <8>;
 	non-removable;
+	no-sdio;
+	no-sd;
 };
 
 &mmc3 {
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/arm/configs/s3c2410_defconfig linux-libre-4.1.44-gnu/arch/arm/configs/s3c2410_defconfig
--- linux-libre-4.1.43-gnu/arch/arm/configs/s3c2410_defconfig	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/arm/configs/s3c2410_defconfig	2017-09-14 11:55:04.000000000 -0400
@@ -87,9 +87,9 @@ CONFIG_IPV6_TUNNEL=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_SCTP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/arm/include/asm/ftrace.h linux-libre-4.1.44-gnu/arch/arm/include/asm/ftrace.h
--- linux-libre-4.1.43-gnu/arch/arm/include/asm/ftrace.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/arm/include/asm/ftrace.h	2017-09-14 11:55:04.000000000 -0400
@@ -54,6 +54,24 @@ static inline void *return_address(unsig
 
 #define ftrace_return_address(n) return_address(n)
 
+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+
+static inline bool arch_syscall_match_sym_name(const char *sym,
+					       const char *name)
+{
+	if (!strcmp(sym, "sys_mmap2"))
+		sym = "sys_mmap_pgoff";
+	else if (!strcmp(sym, "sys_statfs64_wrapper"))
+		sym = "sys_statfs64";
+	else if (!strcmp(sym, "sys_fstatfs64_wrapper"))
+		sym = "sys_fstatfs64";
+	else if (!strcmp(sym, "sys_arm_fadvise64_64"))
+		sym = "sys_fadvise64_64";
+
+	/* Ignore case since sym may start with "SyS" instead of "sys" */
+	return !strcasecmp(sym, name);
+}
+
 #endif /* ifndef __ASSEMBLY__ */
 
 #endif /* _ASM_ARM_FTRACE */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/arm/kvm/mmu.c linux-libre-4.1.44-gnu/arch/arm/kvm/mmu.c
--- linux-libre-4.1.43-gnu/arch/arm/kvm/mmu.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/arm/kvm/mmu.c	2017-09-14 11:55:04.000000000 -0400
@@ -1611,12 +1611,16 @@ static int kvm_test_age_hva_handler(stru
 
 int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
 {
+	if (!kvm->arch.pgd)
+		return 0;
 	trace_kvm_age_hva(start, end);
 	return handle_hva_to_gpa(kvm, start, end, kvm_age_hva_handler, NULL);
 }
 
 int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
 {
+	if (!kvm->arch.pgd)
+		return 0;
 	trace_kvm_test_age_hva(hva);
 	return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL);
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/arm64/boot/dts/xilinx/zynqmp.dtsi linux-libre-4.1.44-gnu/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
--- linux-libre-4.1.43-gnu/arch/arm64/boot/dts/xilinx/zynqmp.dtsi	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/arm64/boot/dts/xilinx/zynqmp.dtsi	2017-09-14 11:55:04.000000000 -0400
@@ -71,7 +71,7 @@
 			     <1 10 0xf01>;
 	};
 
-	amba_apu {
+	amba_apu: amba_apu@0 {
 		compatible = "simple-bus";
 		#address-cells = <2>;
 		#size-cells = <1>;
@@ -251,7 +251,7 @@
 		};
 
 		i2c0: i2c@ff020000 {
-			compatible = "cdns,i2c-r1p10";
+			compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
 			status = "disabled";
 			interrupt-parent = <&gic>;
 			interrupts = <0 17 4>;
@@ -262,7 +262,7 @@
 		};
 
 		i2c1: i2c@ff030000 {
-			compatible = "cdns,i2c-r1p10";
+			compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
 			status = "disabled";
 			interrupt-parent = <&gic>;
 			interrupts = <0 18 4>;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts linux-libre-4.1.44-gnu/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
--- linux-libre-4.1.43-gnu/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts	2017-09-14 11:55:04.000000000 -0400
@@ -26,7 +26,7 @@
 		stdout-path = "serial0:115200n8";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x0 0x0 0x40000000>;
 	};
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/arm64/mm/fault.c linux-libre-4.1.44-gnu/arch/arm64/mm/fault.c
--- linux-libre-4.1.43-gnu/arch/arm64/mm/fault.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/arm64/mm/fault.c	2017-09-14 11:55:04.000000000 -0400
@@ -62,21 +62,21 @@ void show_pte(struct mm_struct *mm, unsi
 			break;
 
 		pud = pud_offset(pgd, addr);
-		printk(", *pud=%016llx", pud_val(*pud));
+		pr_cont(", *pud=%016llx", pud_val(*pud));
 		if (pud_none(*pud) || pud_bad(*pud))
 			break;
 
 		pmd = pmd_offset(pud, addr);
-		printk(", *pmd=%016llx", pmd_val(*pmd));
+		pr_cont(", *pmd=%016llx", pmd_val(*pmd));
 		if (pmd_none(*pmd) || pmd_bad(*pmd))
 			break;
 
 		pte = pte_offset_map(pmd, addr);
-		printk(", *pte=%016llx", pte_val(*pte));
+		pr_cont(", *pte=%016llx", pte_val(*pte));
 		pte_unmap(pte);
 	} while(0);
 
-	printk("\n");
+	pr_cont("\n");
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/include/asm/branch.h linux-libre-4.1.44-gnu/arch/mips/include/asm/branch.h
--- linux-libre-4.1.43-gnu/arch/mips/include/asm/branch.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/include/asm/branch.h	2017-09-14 11:55:04.000000000 -0400
@@ -74,10 +74,7 @@ static inline int compute_return_epc(str
 			return __microMIPS_compute_return_epc(regs);
 		if (cpu_has_mips16)
 			return __MIPS16e_compute_return_epc(regs);
-		return regs->cp0_epc;
-	}
-
-	if (!delay_slot(regs)) {
+	} else if (!delay_slot(regs)) {
 		regs->cp0_epc += 4;
 		return 0;
 	}
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/kernel/branch.c linux-libre-4.1.44-gnu/arch/mips/kernel/branch.c
--- linux-libre-4.1.43-gnu/arch/mips/kernel/branch.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/kernel/branch.c	2017-09-14 11:55:04.000000000 -0400
@@ -399,7 +399,7 @@ int __MIPS16e_compute_return_epc(struct
  *
  * @regs:	Pointer to pt_regs
  * @insn:	branch instruction to decode
- * @returns:	-EFAULT on error and forces SIGBUS, and on success
+ * @returns:	-EFAULT on error and forces SIGILL, and on success
  *		returns 0 or BRANCH_LIKELY_TAKEN as appropriate after
  *		evaluating the branch.
  *
@@ -556,6 +556,7 @@ int __compute_return_epc_for_insn(struct
 	/*
 	 * These are unconditional and in j_format.
 	 */
+	case jalx_op:
 	case jal_op:
 		regs->regs[31] = regs->cp0_epc + 8;
 	case j_op:
@@ -843,8 +844,9 @@ int __compute_return_epc_for_insn(struct
 	return ret;
 
 sigill_dsp:
-	printk("%s: DSP branch but not DSP ASE - sending SIGBUS.\n", current->comm);
-	force_sig(SIGBUS, current);
+	pr_info("%s: DSP branch but not DSP ASE - sending SIGILL.\n",
+		current->comm);
+	force_sig(SIGILL, current);
 	return -EFAULT;
 sigill_r6:
 	pr_info("%s: R2 branch but r2-to-r6 emulator is not preset - sending SIGILL.\n",
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/kernel/proc.c linux-libre-4.1.44-gnu/arch/mips/kernel/proc.c
--- linux-libre-4.1.43-gnu/arch/mips/kernel/proc.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/kernel/proc.c	2017-09-14 11:55:04.000000000 -0400
@@ -83,7 +83,7 @@ static int show_cpuinfo(struct seq_file
 	}
 
 	seq_printf(m, "isa\t\t\t:"); 
-	if (cpu_has_mips_r1)
+	if (cpu_has_mips_1)
 		seq_printf(m, " mips1");
 	if (cpu_has_mips_2)
 		seq_printf(m, "%s", " mips2");
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/kernel/ptrace.c linux-libre-4.1.44-gnu/arch/mips/kernel/ptrace.c
--- linux-libre-4.1.43-gnu/arch/mips/kernel/ptrace.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/kernel/ptrace.c	2017-09-14 11:55:04.000000000 -0400
@@ -838,7 +838,7 @@ asmlinkage void syscall_trace_leave(stru
 	audit_syscall_exit(regs);
 
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
-		trace_sys_exit(regs, regs->regs[2]);
+		trace_sys_exit(regs, regs_return_value(regs));
 
 	if (test_thread_flag(TIF_SYSCALL_TRACE))
 		tracehook_report_syscall_exit(regs, 0);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/kernel/scall32-o32.S linux-libre-4.1.44-gnu/arch/mips/kernel/scall32-o32.S
--- linux-libre-4.1.43-gnu/arch/mips/kernel/scall32-o32.S	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/kernel/scall32-o32.S	2017-09-14 11:55:04.000000000 -0400
@@ -362,7 +362,7 @@ EXPORT(sys_call_table)
 	PTR	sys_writev
 	PTR	sys_cacheflush
 	PTR	sys_cachectl
-	PTR	sys_sysmips
+	PTR	__sys_sysmips
 	PTR	sys_ni_syscall			/* 4150 */
 	PTR	sys_getsid
 	PTR	sys_fdatasync
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/kernel/scall64-64.S linux-libre-4.1.44-gnu/arch/mips/kernel/scall64-64.S
--- linux-libre-4.1.43-gnu/arch/mips/kernel/scall64-64.S	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/kernel/scall64-64.S	2017-09-14 11:55:04.000000000 -0400
@@ -318,7 +318,7 @@ EXPORT(sys_call_table)
 	PTR	sys_sched_getaffinity
 	PTR	sys_cacheflush
 	PTR	sys_cachectl
-	PTR	sys_sysmips
+	PTR	__sys_sysmips
 	PTR	sys_io_setup			/* 5200 */
 	PTR	sys_io_destroy
 	PTR	sys_io_getevents
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/kernel/scall64-n32.S linux-libre-4.1.44-gnu/arch/mips/kernel/scall64-n32.S
--- linux-libre-4.1.43-gnu/arch/mips/kernel/scall64-n32.S	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/kernel/scall64-n32.S	2017-09-14 11:55:04.000000000 -0400
@@ -307,7 +307,7 @@ EXPORT(sysn32_call_table)
 	PTR	compat_sys_sched_getaffinity
 	PTR	sys_cacheflush
 	PTR	sys_cachectl
-	PTR	sys_sysmips
+	PTR	__sys_sysmips
 	PTR	compat_sys_io_setup			/* 6200 */
 	PTR	sys_io_destroy
 	PTR	compat_sys_io_getevents
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/kernel/scall64-o32.S linux-libre-4.1.44-gnu/arch/mips/kernel/scall64-o32.S
--- linux-libre-4.1.43-gnu/arch/mips/kernel/scall64-o32.S	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/kernel/scall64-o32.S	2017-09-14 11:55:04.000000000 -0400
@@ -359,7 +359,7 @@ EXPORT(sys32_call_table)
 	PTR	compat_sys_writev
 	PTR	sys_cacheflush
 	PTR	sys_cachectl
-	PTR	sys_sysmips
+	PTR	__sys_sysmips
 	PTR	sys_ni_syscall			/* 4150 */
 	PTR	sys_getsid
 	PTR	sys_fdatasync
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/kernel/syscall.c linux-libre-4.1.44-gnu/arch/mips/kernel/syscall.c
--- linux-libre-4.1.43-gnu/arch/mips/kernel/syscall.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/kernel/syscall.c	2017-09-14 11:55:04.000000000 -0400
@@ -28,6 +28,7 @@
 #include <linux/elf.h>
 
 #include <asm/asm.h>
+#include <asm/asm-eva.h>
 #include <asm/branch.h>
 #include <asm/cachectl.h>
 #include <asm/cacheflush.h>
@@ -138,10 +139,12 @@ static inline int mips_atomic_set(unsign
 		__asm__ __volatile__ (
 		"	.set	"MIPS_ISA_ARCH_LEVEL"			\n"
 		"	li	%[err], 0				\n"
-		"1:	ll	%[old], (%[addr])			\n"
+		"1:							\n"
+		user_ll("%[old]", "(%[addr])")
 		"	move	%[tmp], %[new]				\n"
-		"2:	sc	%[tmp], (%[addr])			\n"
-		"	bnez	%[tmp], 4f				\n"
+		"2:							\n"
+		user_sc("%[tmp]", "(%[addr])")
+		"	beqz	%[tmp], 4f				\n"
 		"3:							\n"
 		"	.insn						\n"
 		"	.subsection 2					\n"
@@ -199,6 +202,12 @@ static inline int mips_atomic_set(unsign
 	unreachable();
 }
 
+/*
+ * mips_atomic_set() normally returns directly via syscall_exit potentially
+ * clobbering static registers, so be sure to preserve them.
+ */
+save_static_function(sys_sysmips);
+
 SYSCALL_DEFINE3(sysmips, long, cmd, long, arg1, long, arg2)
 {
 	switch (cmd) {
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/mips/math-emu/cp1emu.c linux-libre-4.1.44-gnu/arch/mips/math-emu/cp1emu.c
--- linux-libre-4.1.43-gnu/arch/mips/math-emu/cp1emu.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/mips/math-emu/cp1emu.c	2017-09-14 11:55:04.000000000 -0400
@@ -2140,6 +2140,35 @@ dcopuop:
 	return 0;
 }
 
+/*
+ * Emulate FPU instructions.
+ *
+ * If we use FPU hardware, then we have been typically called to handle
+ * an unimplemented operation, such as where an operand is a NaN or
+ * denormalized.  In that case exit the emulation loop after a single
+ * iteration so as to let hardware execute any subsequent instructions.
+ *
+ * If we have no FPU hardware or it has been disabled, then continue
+ * emulating floating-point instructions until one of these conditions
+ * has occurred:
+ *
+ * - a non-FPU instruction has been encountered,
+ *
+ * - an attempt to emulate has ended with a signal,
+ *
+ * - the ISA mode has been switched.
+ *
+ * We need to terminate the emulation loop if we got switched to the
+ * MIPS16 mode, whether supported or not, so that we do not attempt
+ * to emulate a MIPS16 instruction as a regular MIPS FPU instruction.
+ * Similarly if we got switched to the microMIPS mode and only the
+ * regular MIPS mode is supported, so that we do not attempt to emulate
+ * a microMIPS instruction as a regular MIPS FPU instruction.  Or if
+ * we got switched to the regular MIPS mode and only the microMIPS mode
+ * is supported, so that we do not attempt to emulate a regular MIPS
+ * instruction that should cause an Address Error exception instead.
+ * For simplicity we always terminate upon an ISA mode switch.
+ */
 int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
 	int has_fpu, void *__user *fault_addr)
 {
@@ -2225,6 +2254,15 @@ int fpu_emulator_cop1Handler(struct pt_r
 			break;
 		if (sig)
 			break;
+		/*
+		 * We have to check for the ISA bit explicitly here,
+		 * because `get_isa16_mode' may return 0 if support
+		 * for code compression has been globally disabled,
+		 * or otherwise we may produce the wrong signal or
+		 * even proceed successfully where we must not.
+		 */
+		if ((xcp->cp0_epc ^ prevepc) & 0x1)
+			break;
 
 		cond_resched();
 	} while (xcp->cp0_epc > prevepc);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/openrisc/kernel/vmlinux.lds.S linux-libre-4.1.44-gnu/arch/openrisc/kernel/vmlinux.lds.S
--- linux-libre-4.1.43-gnu/arch/openrisc/kernel/vmlinux.lds.S	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/openrisc/kernel/vmlinux.lds.S	2017-09-14 11:55:04.000000000 -0400
@@ -38,6 +38,8 @@ SECTIONS
         /* Read-only sections, merged into text segment: */
         . = LOAD_BASE ;
 
+	_text = .;
+
 	/* _s_kernel_ro must be page aligned */
 	. = ALIGN(PAGE_SIZE);
 	_s_kernel_ro = .;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/powerpc/include/asm/atomic.h linux-libre-4.1.44-gnu/arch/powerpc/include/asm/atomic.h
--- linux-libre-4.1.43-gnu/arch/powerpc/include/asm/atomic.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/powerpc/include/asm/atomic.h	2017-09-14 11:55:04.000000000 -0400
@@ -453,7 +453,7 @@ static __inline__ int atomic64_add_unles
  * Atomically increments @v by 1, so long as @v is non-zero.
  * Returns non-zero if @v was non-zero, and zero otherwise.
  */
-static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
+static __inline__ int atomic64_inc_not_zero(atomic64_t *v)
 {
 	long t1, t2;
 
@@ -472,7 +472,7 @@ static __inline__ long atomic64_inc_not_
 	: "r" (&v->counter)
 	: "cc", "xer", "memory");
 
-	return t1;
+	return t1 != 0;
 }
 
 #endif /* __powerpc64__ */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/powerpc/include/asm/reg.h linux-libre-4.1.44-gnu/arch/powerpc/include/asm/reg.h
--- linux-libre-4.1.43-gnu/arch/powerpc/include/asm/reg.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/powerpc/include/asm/reg.h	2017-09-14 11:55:04.000000000 -0400
@@ -1237,7 +1237,7 @@ static inline unsigned long mfvtb (void)
 				"	.llong 0\n"			\
 				".previous"				\
 			: "=r" (rval) \
-			: "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL)); \
+			: "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL) : "cr0"); \
 			rval;})
 #else
 #define mftb()		({unsigned long rval;	\
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/powerpc/kvm/book3s_hv.c linux-libre-4.1.44-gnu/arch/powerpc/kvm/book3s_hv.c
--- linux-libre-4.1.43-gnu/arch/powerpc/kvm/book3s_hv.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/powerpc/kvm/book3s_hv.c	2017-09-14 11:55:04.000000000 -0400
@@ -2232,6 +2232,10 @@ static int kvmppc_vcpu_run_hv(struct kvm
 {
 	int r;
 	int srcu_idx;
+	unsigned long ebb_regs[3] = {};	/* shut up GCC */
+	unsigned long user_tar = 0;
+	unsigned long proc_fscr = 0;
+	unsigned int user_vrsave;
 
 	if (!vcpu->arch.sane) {
 		run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
@@ -2281,6 +2285,17 @@ static int kvmppc_vcpu_run_hv(struct kvm
 	flush_fp_to_thread(current);
 	flush_altivec_to_thread(current);
 	flush_vsx_to_thread(current);
+
+	/* Save userspace EBB and other register values */
+	if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+		ebb_regs[0] = mfspr(SPRN_EBBHR);
+		ebb_regs[1] = mfspr(SPRN_EBBRR);
+		ebb_regs[2] = mfspr(SPRN_BESCR);
+		user_tar = mfspr(SPRN_TAR);
+		proc_fscr = mfspr(SPRN_FSCR);
+	}
+	user_vrsave = mfspr(SPRN_VRSAVE);
+
 	vcpu->arch.wqp = &vcpu->arch.vcore->wq;
 	vcpu->arch.pgdir = current->mm->pgd;
 	vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST;
@@ -2302,6 +2317,16 @@ static int kvmppc_vcpu_run_hv(struct kvm
 		}
 	} while (is_kvmppc_resume_guest(r));
 
+	/* Restore userspace EBB and other register values */
+	if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+		mtspr(SPRN_EBBHR, ebb_regs[0]);
+		mtspr(SPRN_EBBRR, ebb_regs[1]);
+		mtspr(SPRN_BESCR, ebb_regs[2]);
+		mtspr(SPRN_TAR, user_tar);
+		mtspr(SPRN_FSCR, proc_fscr);
+	}
+	mtspr(SPRN_VRSAVE, user_vrsave);
+
  out:
 	vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
 	atomic_dec(&vcpu->kvm->arch.vcpus_running);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/powerpc/kvm/book3s_hv_rmhandlers.S linux-libre-4.1.44-gnu/arch/powerpc/kvm/book3s_hv_rmhandlers.S
--- linux-libre-4.1.43-gnu/arch/powerpc/kvm/book3s_hv_rmhandlers.S	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/powerpc/kvm/book3s_hv_rmhandlers.S	2017-09-14 11:55:04.000000000 -0400
@@ -36,6 +36,13 @@
 #define NAPPING_CEDE	1
 #define NAPPING_NOVCPU	2
 
+/* Stack frame offsets for kvmppc_hv_entry */
+#define SFS			112
+#define STACK_SLOT_TRAP		(SFS-4)
+#define STACK_SLOT_CIABR	(SFS-16)
+#define STACK_SLOT_DAWR		(SFS-24)
+#define STACK_SLOT_DAWRX	(SFS-32)
+
 /*
  * Call kvmppc_hv_entry in real mode.
  * Must be called with interrupts hard-disabled.
@@ -265,10 +272,10 @@ kvm_novcpu_exit:
 	bl	kvmhv_accumulate_time
 #endif
 13:	mr	r3, r12
-	stw	r12, 112-4(r1)
+	stw	r12, STACK_SLOT_TRAP(r1)
 	bl	kvmhv_commence_exit
 	nop
-	lwz	r12, 112-4(r1)
+	lwz	r12, STACK_SLOT_TRAP(r1)
 	b	kvmhv_switch_to_host
 
 /*
@@ -404,7 +411,7 @@ kvmppc_hv_entry:
 	 */
 	mflr	r0
 	std	r0, PPC_LR_STKOFF(r1)
-	stdu	r1, -112(r1)
+	stdu	r1, -SFS(r1)
 
 	/* Save R1 in the PACA */
 	std	r1, HSTATE_HOST_R1(r13)
@@ -558,6 +565,16 @@ kvmppc_got_guest:
 	mtspr	SPRN_PURR,r7
 	mtspr	SPRN_SPURR,r8
 
+	/* Save host values of some registers */
+BEGIN_FTR_SECTION
+	mfspr	r5, SPRN_CIABR
+	mfspr	r6, SPRN_DAWR
+	mfspr	r7, SPRN_DAWRX
+	std	r5, STACK_SLOT_CIABR(r1)
+	std	r6, STACK_SLOT_DAWR(r1)
+	std	r7, STACK_SLOT_DAWRX(r1)
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
 BEGIN_FTR_SECTION
 	/* Set partition DABR */
 	/* Do this before re-enabling PMU to avoid P7 DABR corruption bug */
@@ -1169,8 +1186,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
 	 */
 	li	r0, 0
 	mtspr	SPRN_IAMR, r0
-	mtspr	SPRN_CIABR, r0
-	mtspr	SPRN_DAWRX, r0
+	mtspr	SPRN_PSPB, r0
 	mtspr	SPRN_TCSCR, r0
 	mtspr	SPRN_WORT, r0
 	/* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
@@ -1186,6 +1202,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
 	std	r6,VCPU_UAMOR(r9)
 	li	r6,0
 	mtspr	SPRN_AMR,r6
+	mtspr	SPRN_UAMOR, r6
 
 	/* Switch DSCR back to host value */
 	mfspr	r8, SPRN_DSCR
@@ -1327,6 +1344,16 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 	slbia
 	ptesync
 
+	/* Restore host values of some registers */
+BEGIN_FTR_SECTION
+	ld	r5, STACK_SLOT_CIABR(r1)
+	ld	r6, STACK_SLOT_DAWR(r1)
+	ld	r7, STACK_SLOT_DAWRX(r1)
+	mtspr	SPRN_CIABR, r5
+	mtspr	SPRN_DAWR, r6
+	mtspr	SPRN_DAWRX, r7
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
 	/*
 	 * POWER7/POWER8 guest -> host partition switch code.
 	 * We don't have to lock against tlbies but we do
@@ -1431,8 +1458,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 	li	r0, KVM_GUEST_MODE_NONE
 	stb	r0, HSTATE_IN_GUEST(r13)
 
-	ld	r0, 112+PPC_LR_STKOFF(r1)
-	addi	r1, r1, 112
+	ld	r0, SFS+PPC_LR_STKOFF(r1)
+	addi	r1, r1, SFS
 	mtlr	r0
 	blr
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/powerpc/lib/sstep.c linux-libre-4.1.44-gnu/arch/powerpc/lib/sstep.c
--- linux-libre-4.1.43-gnu/arch/powerpc/lib/sstep.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/powerpc/lib/sstep.c	2017-09-14 11:55:04.000000000 -0400
@@ -687,8 +687,10 @@ int __kprobes analyse_instr(struct instr
 	case 19:
 		switch ((instr >> 1) & 0x3ff) {
 		case 0:		/* mcrf */
-			rd = (instr >> 21) & 0x1c;
-			ra = (instr >> 16) & 0x1c;
+			rd = 7 - ((instr >> 23) & 0x7);
+			ra = 7 - ((instr >> 18) & 0x7);
+			rd *= 4;
+			ra *= 4;
 			val = (regs->ccr >> ra) & 0xf;
 			regs->ccr = (regs->ccr & ~(0xfUL << rd)) | (val << rd);
 			goto instr_done;
@@ -967,6 +969,19 @@ int __kprobes analyse_instr(struct instr
 #endif
 
 		case 19:	/* mfcr */
+			if ((instr >> 20) & 1) {
+				imm = 0xf0000000UL;
+				for (sh = 0; sh < 8; ++sh) {
+					if (instr & (0x80000 >> sh)) {
+						regs->gpr[rd] = regs->ccr & imm;
+						break;
+					}
+					imm >>= 4;
+				}
+
+				goto instr_done;
+			}
+
 			regs->gpr[rd] = regs->ccr;
 			regs->gpr[rd] &= 0xffffffffUL;
 			goto instr_done;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/powerpc/platforms/pseries/reconfig.c linux-libre-4.1.44-gnu/arch/powerpc/platforms/pseries/reconfig.c
--- linux-libre-4.1.43-gnu/arch/powerpc/platforms/pseries/reconfig.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/powerpc/platforms/pseries/reconfig.c	2017-09-14 11:55:04.000000000 -0400
@@ -112,7 +112,6 @@ static int pSeries_reconfig_remove_node(
 
 	of_detach_node(np);
 	of_node_put(parent);
-	of_node_put(np); /* Must decrement the refcount */
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/s390/include/asm/syscall.h linux-libre-4.1.44-gnu/arch/s390/include/asm/syscall.h
--- linux-libre-4.1.43-gnu/arch/s390/include/asm/syscall.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/s390/include/asm/syscall.h	2017-09-14 11:55:04.000000000 -0400
@@ -64,6 +64,12 @@ static inline void syscall_get_arguments
 {
 	unsigned long mask = -1UL;
 
+	/*
+	 * No arguments for this syscall, there's nothing to do.
+	 */
+	if (!n)
+		return;
+
 	BUG_ON(i + n > 6);
 #ifdef CONFIG_COMPAT
 	if (test_tsk_thread_flag(task, TIF_31BIT))
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/s390/net/bpf_jit_comp.c linux-libre-4.1.44-gnu/arch/s390/net/bpf_jit_comp.c
--- linux-libre-4.1.43-gnu/arch/s390/net/bpf_jit_comp.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/s390/net/bpf_jit_comp.c	2017-09-14 11:55:04.000000000 -0400
@@ -1139,7 +1139,8 @@ static int bpf_jit_prog(struct bpf_jit *
 		insn_count = bpf_jit_insn(jit, fp, i);
 		if (insn_count < 0)
 			return -1;
-		jit->addrs[i + 1] = jit->prg; /* Next instruction address */
+		/* Next instruction address */
+		jit->addrs[i + insn_count] = jit->prg;
 	}
 	bpf_jit_epilogue(jit);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/sparc/include/asm/mmu_context_64.h linux-libre-4.1.44-gnu/arch/sparc/include/asm/mmu_context_64.h
--- linux-libre-4.1.43-gnu/arch/sparc/include/asm/mmu_context_64.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/sparc/include/asm/mmu_context_64.h	2017-09-14 11:55:04.000000000 -0400
@@ -25,9 +25,11 @@ void destroy_context(struct mm_struct *m
 void __tsb_context_switch(unsigned long pgd_pa,
 			  struct tsb_config *tsb_base,
 			  struct tsb_config *tsb_huge,
-			  unsigned long tsb_descr_pa);
+			  unsigned long tsb_descr_pa,
+			  unsigned long secondary_ctx);
 
-static inline void tsb_context_switch(struct mm_struct *mm)
+static inline void tsb_context_switch_ctx(struct mm_struct *mm,
+					  unsigned long ctx)
 {
 	__tsb_context_switch(__pa(mm->pgd),
 			     &mm->context.tsb_block[0],
@@ -38,9 +40,12 @@ static inline void tsb_context_switch(st
 #else
 			     NULL
 #endif
-			     , __pa(&mm->context.tsb_descr[0]));
+			     , __pa(&mm->context.tsb_descr[0]),
+			     ctx);
 }
 
+#define tsb_context_switch(X) tsb_context_switch_ctx(X, 0)
+
 void tsb_grow(struct mm_struct *mm,
 	      unsigned long tsb_index,
 	      unsigned long mm_rss);
@@ -110,8 +115,7 @@ static inline void switch_mm(struct mm_s
 	 * cpu0 to update it's TSB because at that point the cpu_vm_mask
 	 * only had cpu1 set in it.
 	 */
-	load_secondary_context(mm);
-	tsb_context_switch(mm);
+	tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
 
 	/* Any time a processor runs a context on an address space
 	 * for the first time, we must flush that context out of the
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/sparc/include/asm/trap_block.h linux-libre-4.1.44-gnu/arch/sparc/include/asm/trap_block.h
--- linux-libre-4.1.43-gnu/arch/sparc/include/asm/trap_block.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/sparc/include/asm/trap_block.h	2017-09-14 11:55:04.000000000 -0400
@@ -54,6 +54,7 @@ extern struct trap_per_cpu trap_block[NR
 void init_cur_cpu_trap(struct thread_info *);
 void setup_tba(void);
 extern int ncpus_probed;
+extern u64 cpu_mondo_counter[NR_CPUS];
 
 unsigned long real_hard_smp_processor_id(void);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/sparc/kernel/smp_64.c linux-libre-4.1.44-gnu/arch/sparc/kernel/smp_64.c
--- linux-libre-4.1.43-gnu/arch/sparc/kernel/smp_64.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/sparc/kernel/smp_64.c	2017-09-14 11:55:04.000000000 -0400
@@ -617,22 +617,48 @@ retry:
 	}
 }
 
-/* Multi-cpu list version.  */
+#define	CPU_MONDO_COUNTER(cpuid)	(cpu_mondo_counter[cpuid])
+#define	MONDO_USEC_WAIT_MIN		2
+#define	MONDO_USEC_WAIT_MAX		100
+#define	MONDO_RETRY_LIMIT		500000
+
+/* Multi-cpu list version.
+ *
+ * Deliver xcalls to 'cnt' number of cpus in 'cpu_list'.
+ * Sometimes not all cpus receive the mondo, requiring us to re-send
+ * the mondo until all cpus have received, or cpus are truly stuck
+ * unable to receive mondo, and we timeout.
+ * Occasionally a target cpu strand is borrowed briefly by hypervisor to
+ * perform guest service, such as PCIe error handling. Consider the
+ * service time, 1 second overall wait is reasonable for 1 cpu.
+ * Here two in-between mondo check wait time are defined: 2 usec for
+ * single cpu quick turn around and up to 100usec for large cpu count.
+ * Deliver mondo to large number of cpus could take longer, we adjusts
+ * the retry count as long as target cpus are making forward progress.
+ */
 static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
 {
-	int retries, this_cpu, prev_sent, i, saw_cpu_error;
+	int this_cpu, tot_cpus, prev_sent, i, rem;
+	int usec_wait, retries, tot_retries;
+	u16 first_cpu = 0xffff;
+	unsigned long xc_rcvd = 0;
 	unsigned long status;
+	int ecpuerror_id = 0;
+	int enocpu_id = 0;
 	u16 *cpu_list;
+	u16 cpu;
 
 	this_cpu = smp_processor_id();
-
 	cpu_list = __va(tb->cpu_list_pa);
-
-	saw_cpu_error = 0;
-	retries = 0;
+	usec_wait = cnt * MONDO_USEC_WAIT_MIN;
+	if (usec_wait > MONDO_USEC_WAIT_MAX)
+		usec_wait = MONDO_USEC_WAIT_MAX;
+	retries = tot_retries = 0;
+	tot_cpus = cnt;
 	prev_sent = 0;
+
 	do {
-		int forward_progress, n_sent;
+		int n_sent, mondo_delivered, target_cpu_busy;
 
 		status = sun4v_cpu_mondo_send(cnt,
 					      tb->cpu_list_pa,
@@ -640,94 +666,113 @@ static void hypervisor_xcall_deliver(str
 
 		/* HV_EOK means all cpus received the xcall, we're done.  */
 		if (likely(status == HV_EOK))
-			break;
+			goto xcall_done;
+
+		/* If not these non-fatal errors, panic */
+		if (unlikely((status != HV_EWOULDBLOCK) &&
+			(status != HV_ECPUERROR) &&
+			(status != HV_ENOCPU)))
+			goto fatal_errors;
 
 		/* First, see if we made any forward progress.
 		 *
+		 * Go through the cpu_list, count the target cpus that have
+		 * received our mondo (n_sent), and those that did not (rem).
+		 * Re-pack cpu_list with the cpus remain to be retried in the
+		 * front - this simplifies tracking the truly stalled cpus.
+		 *
 		 * The hypervisor indicates successful sends by setting
 		 * cpu list entries to the value 0xffff.
+		 *
+		 * EWOULDBLOCK means some target cpus did not receive the
+		 * mondo and retry usually helps.
+		 *
+		 * ECPUERROR means at least one target cpu is in error state,
+		 * it's usually safe to skip the faulty cpu and retry.
+		 *
+		 * ENOCPU means one of the target cpu doesn't belong to the
+		 * domain, perhaps offlined which is unexpected, but not
+		 * fatal and it's okay to skip the offlined cpu.
 		 */
+		rem = 0;
 		n_sent = 0;
 		for (i = 0; i < cnt; i++) {
-			if (likely(cpu_list[i] == 0xffff))
+			cpu = cpu_list[i];
+			if (likely(cpu == 0xffff)) {
 				n_sent++;
+			} else if ((status == HV_ECPUERROR) &&
+				(sun4v_cpu_state(cpu) == HV_CPU_STATE_ERROR)) {
+				ecpuerror_id = cpu + 1;
+			} else if (status == HV_ENOCPU && !cpu_online(cpu)) {
+				enocpu_id = cpu + 1;
+			} else {
+				cpu_list[rem++] = cpu;
+			}
 		}
 
-		forward_progress = 0;
-		if (n_sent > prev_sent)
-			forward_progress = 1;
+		/* No cpu remained, we're done. */
+		if (rem == 0)
+			break;
 
-		prev_sent = n_sent;
+		/* Otherwise, update the cpu count for retry. */
+		cnt = rem;
 
-		/* If we get a HV_ECPUERROR, then one or more of the cpus
-		 * in the list are in error state.  Use the cpu_state()
-		 * hypervisor call to find out which cpus are in error state.
+		/* Record the overall number of mondos received by the
+		 * first of the remaining cpus.
 		 */
-		if (unlikely(status == HV_ECPUERROR)) {
-			for (i = 0; i < cnt; i++) {
-				long err;
-				u16 cpu;
+		if (first_cpu != cpu_list[0]) {
+			first_cpu = cpu_list[0];
+			xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
+		}
 
-				cpu = cpu_list[i];
-				if (cpu == 0xffff)
-					continue;
+		/* Was any mondo delivered successfully? */
+		mondo_delivered = (n_sent > prev_sent);
+		prev_sent = n_sent;
 
-				err = sun4v_cpu_state(cpu);
-				if (err == HV_CPU_STATE_ERROR) {
-					saw_cpu_error = (cpu + 1);
-					cpu_list[i] = 0xffff;
-				}
-			}
-		} else if (unlikely(status != HV_EWOULDBLOCK))
-			goto fatal_mondo_error;
+		/* or, was any target cpu busy processing other mondos? */
+		target_cpu_busy = (xc_rcvd < CPU_MONDO_COUNTER(first_cpu));
+		xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
 
-		/* Don't bother rewriting the CPU list, just leave the
-		 * 0xffff and non-0xffff entries in there and the
-		 * hypervisor will do the right thing.
-		 *
-		 * Only advance timeout state if we didn't make any
-		 * forward progress.
+		/* Retry count is for no progress. If we're making progress,
+		 * reset the retry count.
 		 */
-		if (unlikely(!forward_progress)) {
-			if (unlikely(++retries > 10000))
-				goto fatal_mondo_timeout;
-
-			/* Delay a little bit to let other cpus catch up
-			 * on their cpu mondo queue work.
-			 */
-			udelay(2 * cnt);
+		if (likely(mondo_delivered || target_cpu_busy)) {
+			tot_retries += retries;
+			retries = 0;
+		} else if (unlikely(retries > MONDO_RETRY_LIMIT)) {
+			goto fatal_mondo_timeout;
 		}
-	} while (1);
 
-	if (unlikely(saw_cpu_error))
-		goto fatal_mondo_cpu_error;
+		/* Delay a little bit to let other cpus catch up on
+		 * their cpu mondo queue work.
+		 */
+		if (!mondo_delivered)
+			udelay(usec_wait);
 
-	return;
+		retries++;
+	} while (1);
 
-fatal_mondo_cpu_error:
-	printk(KERN_CRIT "CPU[%d]: SUN4V mondo cpu error, some target cpus "
-	       "(including %d) were in error state\n",
-	       this_cpu, saw_cpu_error - 1);
+xcall_done:
+	if (unlikely(ecpuerror_id > 0)) {
+		pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) was in error state\n",
+		       this_cpu, ecpuerror_id - 1);
+	} else if (unlikely(enocpu_id > 0)) {
+		pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) does not belong to the domain\n",
+		       this_cpu, enocpu_id - 1);
+	}
 	return;
 
-fatal_mondo_timeout:
-	printk(KERN_CRIT "CPU[%d]: SUN4V mondo timeout, no forward "
-	       " progress after %d retries.\n",
-	       this_cpu, retries);
-	goto dump_cpu_list_and_out;
-
-fatal_mondo_error:
-	printk(KERN_CRIT "CPU[%d]: Unexpected SUN4V mondo error %lu\n",
-	       this_cpu, status);
-	printk(KERN_CRIT "CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) "
-	       "mondo_block_pa(%lx)\n",
-	       this_cpu, cnt, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
+fatal_errors:
+	/* fatal errors include bad alignment, etc */
+	pr_crit("CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) mondo_block_pa(%lx)\n",
+	       this_cpu, tot_cpus, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
+	panic("Unexpected SUN4V mondo error %lu\n", status);
 
-dump_cpu_list_and_out:
-	printk(KERN_CRIT "CPU[%d]: CPU list [ ", this_cpu);
-	for (i = 0; i < cnt; i++)
-		printk("%u ", cpu_list[i]);
-	printk("]\n");
+fatal_mondo_timeout:
+	/* some cpus being non-responsive to the cpu mondo */
+	pr_crit("CPU[%d]: SUN4V mondo timeout, cpu(%d) made no forward progress after %d retries. Total target cpus(%d).\n",
+	       this_cpu, first_cpu, (tot_retries + retries), tot_cpus);
+	panic("SUN4V mondo timeout panic\n");
 }
 
 static void (*xcall_deliver_impl)(struct trap_per_cpu *, int);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/sparc/kernel/sun4v_ivec.S linux-libre-4.1.44-gnu/arch/sparc/kernel/sun4v_ivec.S
--- linux-libre-4.1.43-gnu/arch/sparc/kernel/sun4v_ivec.S	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/sparc/kernel/sun4v_ivec.S	2017-09-14 11:55:04.000000000 -0400
@@ -26,6 +26,21 @@ sun4v_cpu_mondo:
 	ldxa	[%g0] ASI_SCRATCHPAD, %g4
 	sub	%g4, TRAP_PER_CPU_FAULT_INFO, %g4
 
+	/* Get smp_processor_id() into %g3 */
+	sethi	%hi(trap_block), %g5
+	or	%g5, %lo(trap_block), %g5
+	sub	%g4, %g5, %g3
+	srlx	%g3, TRAP_BLOCK_SZ_SHIFT, %g3
+
+	/* Increment cpu_mondo_counter[smp_processor_id()] */
+	sethi	%hi(cpu_mondo_counter), %g5
+	or	%g5, %lo(cpu_mondo_counter), %g5
+	sllx	%g3, 3, %g3
+	add	%g5, %g3, %g5
+	ldx	[%g5], %g3
+	add	%g3, 1, %g3
+	stx	%g3, [%g5]
+
 	/* Get CPU mondo queue base phys address into %g7.  */
 	ldx	[%g4 + TRAP_PER_CPU_CPU_MONDO_PA], %g7
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/sparc/kernel/traps_64.c linux-libre-4.1.44-gnu/arch/sparc/kernel/traps_64.c
--- linux-libre-4.1.43-gnu/arch/sparc/kernel/traps_64.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/sparc/kernel/traps_64.c	2017-09-14 11:55:04.000000000 -0400
@@ -2659,6 +2659,7 @@ void do_getpsr(struct pt_regs *regs)
 	}
 }
 
+u64 cpu_mondo_counter[NR_CPUS] = {0};
 struct trap_per_cpu trap_block[NR_CPUS];
 EXPORT_SYMBOL(trap_block);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/sparc/kernel/tsb.S linux-libre-4.1.44-gnu/arch/sparc/kernel/tsb.S
--- linux-libre-4.1.43-gnu/arch/sparc/kernel/tsb.S	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/sparc/kernel/tsb.S	2017-09-14 11:55:04.000000000 -0400
@@ -367,6 +367,7 @@ tsb_flush:
 	 * %o1:	TSB base config pointer
 	 * %o2:	TSB huge config pointer, or NULL if none
 	 * %o3:	Hypervisor TSB descriptor physical address
+	 * %o4: Secondary context to load, if non-zero
 	 *
 	 * We have to run this whole thing with interrupts
 	 * disabled so that the current cpu doesn't change
@@ -379,6 +380,17 @@ __tsb_context_switch:
 	rdpr	%pstate, %g1
 	wrpr	%g1, PSTATE_IE, %pstate
 
+	brz,pn	%o4, 1f
+	 mov	SECONDARY_CONTEXT, %o5
+
+661:	stxa	%o4, [%o5] ASI_DMMU
+	.section .sun4v_1insn_patch, "ax"
+	.word	661b
+	stxa	%o4, [%o5] ASI_MMU
+	.previous
+	flush	%g6
+
+1:
 	TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
 
 	stx	%o0, [%g2 + TRAP_PER_CPU_PGD_PADDR]
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/sparc/power/hibernate.c linux-libre-4.1.44-gnu/arch/sparc/power/hibernate.c
--- linux-libre-4.1.43-gnu/arch/sparc/power/hibernate.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/sparc/power/hibernate.c	2017-09-14 11:55:04.000000000 -0400
@@ -35,6 +35,5 @@ void restore_processor_state(void)
 {
 	struct mm_struct *mm = current->active_mm;
 
-	load_secondary_context(mm);
-	tsb_context_switch(mm);
+	tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/x86/boot/string.c linux-libre-4.1.44-gnu/arch/x86/boot/string.c
--- linux-libre-4.1.43-gnu/arch/x86/boot/string.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/x86/boot/string.c	2017-09-14 11:55:04.000000000 -0400
@@ -14,6 +14,7 @@
 
 #include <linux/types.h>
 #include "ctype.h"
+#include "string.h"
 
 int memcmp(const void *s1, const void *s2, size_t len)
 {
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/x86/boot/string.h linux-libre-4.1.44-gnu/arch/x86/boot/string.h
--- linux-libre-4.1.43-gnu/arch/x86/boot/string.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/x86/boot/string.h	2017-09-14 11:55:04.000000000 -0400
@@ -18,4 +18,13 @@ int memcmp(const void *s1, const void *s
 #define memset(d,c,l) __builtin_memset(d,c,l)
 #define memcmp	__builtin_memcmp
 
+extern int strcmp(const char *str1, const char *str2);
+extern int strncmp(const char *cs, const char *ct, size_t count);
+extern size_t strlen(const char *s);
+extern char *strstr(const char *s1, const char *s2);
+extern size_t strnlen(const char *s, size_t maxlen);
+extern unsigned int atou(const char *s);
+extern unsigned long long simple_strtoull(const char *cp, char **endp,
+					  unsigned int base);
+
 #endif /* BOOT_STRING_H */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/x86/include/asm/xen/hypercall.h linux-libre-4.1.44-gnu/arch/x86/include/asm/xen/hypercall.h
--- linux-libre-4.1.43-gnu/arch/x86/include/asm/xen/hypercall.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/x86/include/asm/xen/hypercall.h	2017-09-14 11:55:04.000000000 -0400
@@ -43,6 +43,7 @@
 
 #include <asm/page.h>
 #include <asm/pgtable.h>
+#include <asm/smap.h>
 
 #include <xen/interface/xen.h>
 #include <xen/interface/sched.h>
@@ -213,10 +214,12 @@ privcmd_call(unsigned call,
 	__HYPERCALL_DECLS;
 	__HYPERCALL_5ARG(a1, a2, a3, a4, a5);
 
+	stac();
 	asm volatile("call *%[call]"
 		     : __HYPERCALL_5PARAM
 		     : [call] "a" (&hypercall_page[call])
 		     : __HYPERCALL_CLOBBER5);
+	clac();
 
 	return (long)__res;
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/x86/kernel/acpi/boot.c linux-libre-4.1.44-gnu/arch/x86/kernel/acpi/boot.c
--- linux-libre-4.1.43-gnu/arch/x86/kernel/acpi/boot.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/x86/kernel/acpi/boot.c	2017-09-14 11:55:04.000000000 -0400
@@ -329,6 +329,14 @@ static void __init mp_override_legacy_ir
 	struct mpc_intsrc mp_irq;
 
 	/*
+	 * Check bus_irq boundary.
+	 */
+	if (bus_irq >= NR_IRQS_LEGACY) {
+		pr_warn("Invalid bus_irq %u for legacy override\n", bus_irq);
+		return;
+	}
+
+	/*
 	 * Convert 'gsi' to 'ioapic.pin'.
 	 */
 	ioapic = mp_find_ioapic(gsi);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-libre-4.1.44-gnu/arch/x86/kernel/cpu/mcheck/mce_amd.c
--- linux-libre-4.1.43-gnu/arch/x86/kernel/cpu/mcheck/mce_amd.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/x86/kernel/cpu/mcheck/mce_amd.c	2017-09-14 11:55:04.000000000 -0400
@@ -581,6 +581,9 @@ static int threshold_create_bank(unsigne
 	const char *name = th_names[bank];
 	int err = 0;
 
+	if (!dev)
+		return -ENODEV;
+
 	if (is_shared_bank(bank)) {
 		nb = node_to_amd_nb(amd_get_nb_id(cpu));
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/arch/x86/kernel/kvm.c linux-libre-4.1.44-gnu/arch/x86/kernel/kvm.c
--- linux-libre-4.1.43-gnu/arch/x86/kernel/kvm.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/arch/x86/kernel/kvm.c	2017-09-14 11:55:04.000000000 -0400
@@ -151,6 +151,8 @@ void kvm_async_pf_task_wait(u32 token)
 		if (hlist_unhashed(&n.link))
 			break;
 
+		rcu_irq_exit();
+
 		if (!n.halted) {
 			local_irq_enable();
 			schedule();
@@ -159,11 +161,11 @@ void kvm_async_pf_task_wait(u32 token)
 			/*
 			 * We cannot reschedule. So halt.
 			 */
-			rcu_irq_exit();
 			native_safe_halt();
 			local_irq_disable();
-			rcu_irq_enter();
 		}
+
+		rcu_irq_enter();
 	}
 	if (!n.halted)
 		finish_wait(&n.wq, &wait);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/acpi/glue.c linux-libre-4.1.44-gnu/drivers/acpi/glue.c
--- linux-libre-4.1.43-gnu/drivers/acpi/glue.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/acpi/glue.c	2017-09-14 11:55:04.000000000 -0400
@@ -97,7 +97,15 @@ static int find_child_checks(struct acpi
 	if (check_children && list_empty(&adev->children))
 		return -ENODEV;
 
-	return sta_present ? FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE;
+	/*
+	 * If the device has a _HID (or _CID) returning a valid ACPI/PNP
+	 * device ID, it is better to make it look less attractive here, so that
+	 * the other device with the same _ADR value (that may not have a valid
+	 * device ID) can be matched going forward.  [This means a second spec
+	 * violation in a row, so whatever we do here is best effort anyway.]
+	 */
+	return sta_present && list_empty(&adev->pnp.ids) ?
+			FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE;
 }
 
 struct acpi_device *acpi_find_child_device(struct acpi_device *parent,
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/ata/libata-scsi.c linux-libre-4.1.44-gnu/drivers/ata/libata-scsi.c
--- linux-libre-4.1.43-gnu/drivers/ata/libata-scsi.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/ata/libata-scsi.c	2017-09-14 11:55:04.000000000 -0400
@@ -2834,10 +2834,12 @@ static unsigned int atapi_xlat(struct at
 static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
 {
 	if (!sata_pmp_attached(ap)) {
-		if (likely(devno < ata_link_max_devices(&ap->link)))
+		if (likely(devno >= 0 &&
+			   devno < ata_link_max_devices(&ap->link)))
 			return &ap->link.device[devno];
 	} else {
-		if (likely(devno < ap->nr_pmp_links))
+		if (likely(devno >= 0 &&
+			   devno < ap->nr_pmp_links))
 			return &ap->pmp_link[devno].device[0];
 	}
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/base/power/domain.c linux-libre-4.1.44-gnu/drivers/base/power/domain.c
--- linux-libre-4.1.43-gnu/drivers/base/power/domain.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/base/power/domain.c	2017-09-14 11:55:04.000000000 -0400
@@ -1440,7 +1440,6 @@ static struct generic_pm_domain_data *ge
 	}
 
 	dev->power.subsys_data->domain_data = &gpd_data->base;
-	dev->pm_domain = &genpd->domain;
 
 	spin_unlock_irq(&dev->power.lock);
 
@@ -1459,7 +1458,6 @@ static void genpd_free_dev_data(struct d
 {
 	spin_lock_irq(&dev->power.lock);
 
-	dev->pm_domain = NULL;
 	dev->power.subsys_data->domain_data = NULL;
 
 	spin_unlock_irq(&dev->power.lock);
@@ -1500,6 +1498,8 @@ int __pm_genpd_add_device(struct generic
 	if (ret)
 		goto out;
 
+	dev->pm_domain = &genpd->domain;
+
 	genpd->device_count++;
 	genpd->max_off_time_changed = true;
 
@@ -1563,6 +1563,8 @@ int pm_genpd_remove_device(struct generi
 	if (genpd->detach_dev)
 		genpd->detach_dev(genpd, dev);
 
+	dev->pm_domain = NULL;
+
 	list_del_init(&pdd->list_node);
 
 	genpd_release_lock(genpd);
@@ -1673,7 +1675,7 @@ int pm_genpd_add_subdomain_names(const c
 int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
 			      struct generic_pm_domain *subdomain)
 {
-	struct gpd_link *link;
+	struct gpd_link *l, *link;
 	int ret = -EINVAL;
 
 	if (IS_ERR_OR_NULL(genpd) || IS_ERR_OR_NULL(subdomain))
@@ -1682,7 +1684,7 @@ int pm_genpd_remove_subdomain(struct gen
  start:
 	genpd_acquire_lock(genpd);
 
-	list_for_each_entry(link, &genpd->master_links, master_node) {
+	list_for_each_entry_safe(link, l, &genpd->master_links, master_node) {
 		if (link->slave != subdomain)
 			continue;
 
@@ -2062,10 +2064,10 @@ EXPORT_SYMBOL_GPL(__of_genpd_add_provide
  */
 void of_genpd_del_provider(struct device_node *np)
 {
-	struct of_genpd_provider *cp;
+	struct of_genpd_provider *cp, *tmp;
 
 	mutex_lock(&of_genpd_mutex);
-	list_for_each_entry(cp, &of_genpd_providers, link) {
+	list_for_each_entry_safe(cp, tmp, &of_genpd_providers, link) {
 		if (cp->node == np) {
 			list_del(&cp->link);
 			of_node_put(cp->node);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/block/virtio_blk.c linux-libre-4.1.44-gnu/drivers/block/virtio_blk.c
--- linux-libre-4.1.43-gnu/drivers/block/virtio_blk.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/block/virtio_blk.c	2017-09-14 11:55:04.000000000 -0400
@@ -642,11 +642,12 @@ static int virtblk_probe(struct virtio_d
 	if (err)
 		goto out_put_disk;
 
-	q = vblk->disk->queue = blk_mq_init_queue(&vblk->tag_set);
+	q = blk_mq_init_queue(&vblk->tag_set);
 	if (IS_ERR(q)) {
 		err = -ENOMEM;
 		goto out_free_tags;
 	}
+	vblk->disk->queue = q;
 
 	q->queuedata = vblk;
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/block/xen-blkback/blkback.c linux-libre-4.1.44-gnu/drivers/block/xen-blkback/blkback.c
--- linux-libre-4.1.43-gnu/drivers/block/xen-blkback/blkback.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/block/xen-blkback/blkback.c	2017-09-14 11:55:04.000000000 -0400
@@ -588,8 +588,6 @@ int xen_blkif_schedule(void *arg)
 	unsigned long timeout;
 	int ret;
 
-	xen_blkif_get(blkif);
-
 	while (!kthread_should_stop()) {
 		if (try_to_freeze())
 			continue;
@@ -643,7 +641,6 @@ purge_gnt_list:
 		print_stats(blkif);
 
 	blkif->xenblkd = NULL;
-	xen_blkif_put(blkif);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/block/xen-blkback/xenbus.c linux-libre-4.1.44-gnu/drivers/block/xen-blkback/xenbus.c
--- linux-libre-4.1.43-gnu/drivers/block/xen-blkback/xenbus.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/block/xen-blkback/xenbus.c	2017-09-14 11:55:04.000000000 -0400
@@ -256,7 +256,6 @@ static int xen_blkif_disconnect(struct x
 	if (blkif->xenblkd) {
 		kthread_stop(blkif->xenblkd);
 		wake_up(&blkif->shutdown_wq);
-		blkif->xenblkd = NULL;
 	}
 
 	/* The above kthread_stop() guarantees that at this point we
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/char/ipmi/ipmi_msghandler.c linux-libre-4.1.44-gnu/drivers/char/ipmi/ipmi_msghandler.c
--- linux-libre-4.1.43-gnu/drivers/char/ipmi/ipmi_msghandler.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/char/ipmi/ipmi_msghandler.c	2017-09-14 11:55:04.000000000 -0400
@@ -3871,6 +3871,9 @@ static void smi_recv_tasklet(unsigned lo
 	 * because the lower layer is allowed to hold locks while calling
 	 * message delivery.
 	 */
+
+	rcu_read_lock();
+
 	if (!run_to_completion)
 		spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
 	if (intf->curr_msg == NULL && !intf->in_shutdown) {
@@ -3893,6 +3896,8 @@ static void smi_recv_tasklet(unsigned lo
 	if (newmsg)
 		intf->handlers->sender(intf->send_info, newmsg);
 
+	rcu_read_unlock();
+
 	handle_new_recv_msgs(intf);
 }
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/char/ipmi/ipmi_ssif.c linux-libre-4.1.44-gnu/drivers/char/ipmi/ipmi_ssif.c
--- linux-libre-4.1.43-gnu/drivers/char/ipmi/ipmi_ssif.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/char/ipmi/ipmi_ssif.c	2017-09-14 11:55:04.000000000 -0400
@@ -757,6 +757,11 @@ static void msg_done_handler(struct ssif
 			       result, len, data[2]);
 		} else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
 			   || data[1] != IPMI_GET_MSG_FLAGS_CMD) {
+			/*
+			 * Don't abort here, maybe it was a queued
+			 * response to a previous command.
+			 */
+			ipmi_ssif_unlock_cond(ssif_info, flags);
 			pr_warn(PFX "Invalid response getting flags: %x %x\n",
 				data[0], data[1]);
 		} else {
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/char/ipmi/ipmi_watchdog.c linux-libre-4.1.44-gnu/drivers/char/ipmi/ipmi_watchdog.c
--- linux-libre-4.1.43-gnu/drivers/char/ipmi/ipmi_watchdog.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/char/ipmi/ipmi_watchdog.c	2017-09-14 11:55:04.000000000 -0400
@@ -1156,10 +1156,11 @@ static int wdog_reboot_handler(struct no
 			ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
 			ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
 		} else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
-			/* Set a long timer to let the reboot happens, but
-			   reboot if it hangs, but only if the watchdog
+			/* Set a long timer to let the reboot happen or
+			   reset if it hangs, but only if the watchdog
 			   timer was already running. */
-			timeout = 120;
+			if (timeout < 120)
+				timeout = 120;
 			pretimeout = 0;
 			ipmi_watchdog_state = WDOG_TIMEOUT_RESET;
 			ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/char/tpm/tpm-sysfs.c linux-libre-4.1.44-gnu/drivers/char/tpm/tpm-sysfs.c
--- linux-libre-4.1.43-gnu/drivers/char/tpm/tpm-sysfs.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/char/tpm/tpm-sysfs.c	2017-09-14 11:55:04.000000000 -0400
@@ -38,6 +38,8 @@ static ssize_t pubek_show(struct device
 
 	struct tpm_chip *chip = dev_get_drvdata(dev);
 
+	memset(&tpm_cmd, 0, sizeof(tpm_cmd));
+
 	tpm_cmd.header.in = tpm_readpubek_header;
 	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
 			       "attempting to read the PUBEK");
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/drm_dp_mst_topology.c linux-libre-4.1.44-gnu/drivers/gpu/drm/drm_dp_mst_topology.c
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/drm_dp_mst_topology.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/drm_dp_mst_topology.c	2017-09-14 11:55:04.000000000 -0400
@@ -330,6 +330,13 @@ static bool drm_dp_sideband_msg_build(st
 			return false;
 		}
 
+		/*
+		 * ignore out-of-order messages or messages that are part of a
+		 * failed transaction
+		 */
+		if (!recv_hdr.somt && !msg->have_somt)
+			return false;
+
 		/* get length contained in this portion */
 		msg->curchunk_len = recv_hdr.msg_len;
 		msg->curchunk_hdrlen = hdrlen;
@@ -2161,7 +2168,7 @@ out_unlock:
 }
 EXPORT_SYMBOL(drm_dp_mst_topology_mgr_resume);
 
-static void drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up)
+static bool drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up)
 {
 	int len;
 	u8 replyblock[32];
@@ -2176,12 +2183,12 @@ static void drm_dp_get_one_sb_msg(struct
 			       replyblock, len);
 	if (ret != len) {
 		DRM_DEBUG_KMS("failed to read DPCD down rep %d %d\n", len, ret);
-		return;
+		return false;
 	}
 	ret = drm_dp_sideband_msg_build(msg, replyblock, len, true);
 	if (!ret) {
 		DRM_DEBUG_KMS("sideband msg build failed %d\n", replyblock[0]);
-		return;
+		return false;
 	}
 	replylen = msg->curchunk_len + msg->curchunk_hdrlen;
 
@@ -2193,21 +2200,32 @@ static void drm_dp_get_one_sb_msg(struct
 		ret = drm_dp_dpcd_read(mgr->aux, basereg + curreply,
 				    replyblock, len);
 		if (ret != len) {
-			DRM_DEBUG_KMS("failed to read a chunk\n");
+			DRM_DEBUG_KMS("failed to read a chunk (len %d, ret %d)\n",
+				      len, ret);
+			return false;
 		}
+
 		ret = drm_dp_sideband_msg_build(msg, replyblock, len, false);
-		if (ret == false)
+		if (!ret) {
 			DRM_DEBUG_KMS("failed to build sideband msg\n");
+			return false;
+		}
+
 		curreply += len;
 		replylen -= len;
 	}
+	return true;
 }
 
 static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr)
 {
 	int ret = 0;
 
-	drm_dp_get_one_sb_msg(mgr, false);
+	if (!drm_dp_get_one_sb_msg(mgr, false)) {
+		memset(&mgr->down_rep_recv, 0,
+		       sizeof(struct drm_dp_sideband_msg_rx));
+		return 0;
+	}
 
 	if (mgr->down_rep_recv.have_eomt) {
 		struct drm_dp_sideband_msg_tx *txmsg;
@@ -2263,7 +2281,12 @@ static int drm_dp_mst_handle_down_rep(st
 static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
 {
 	int ret = 0;
-	drm_dp_get_one_sb_msg(mgr, true);
+
+	if (!drm_dp_get_one_sb_msg(mgr, true)) {
+		memset(&mgr->up_req_recv, 0,
+		       sizeof(struct drm_dp_sideband_msg_rx));
+		return 0;
+	}
 
 	if (mgr->up_req_recv.have_eomt) {
 		struct drm_dp_sideband_msg_req_body msg;
@@ -2315,7 +2338,9 @@ static int drm_dp_mst_handle_up_req(stru
 			DRM_DEBUG_KMS("Got RSN: pn: %d avail_pbn %d\n", msg.u.resource_stat.port_number, msg.u.resource_stat.available_pbn);
 		}
 
-		drm_dp_put_mst_branch_device(mstb);
+		if (mstb)
+			drm_dp_put_mst_branch_device(mstb);
+
 		memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
 	}
 	return ret;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/msm/adreno/adreno_gpu.c linux-libre-4.1.44-gnu/drivers/gpu/drm/msm/adreno/adreno_gpu.c
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/msm/adreno/adreno_gpu.c	2017-08-06 01:14:50.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/msm/adreno/adreno_gpu.c	2017-09-19 12:10:32.000000000 -0400
@@ -193,7 +193,14 @@ int adreno_submit(struct msm_gpu *gpu, s
 void adreno_flush(struct msm_gpu *gpu)
 {
 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
-	uint32_t wptr = get_wptr(gpu->rb);
+	uint32_t wptr;
+
+	/*
+	 * Mask wptr value that we calculate to fit in the HW range. This is
+	 * to account for the possibility that the last command fit exactly into
+	 * the ringbuffer and rb->next hasn't wrapped to zero yet
+	 */
+	wptr = get_wptr(gpu->rb) & ((gpu->rb->size / 4) - 1);
 
 	/* ensure writes to ringbuffer have hit system memory: */
 	mb();
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/msm/msm_gem_submit.c linux-libre-4.1.44-gnu/drivers/gpu/drm/msm/msm_gem_submit.c
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/msm/msm_gem_submit.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/msm/msm_gem_submit.c	2017-09-14 11:55:04.000000000 -0400
@@ -90,7 +90,8 @@ static int submit_lookup_objects(struct
 			pagefault_disable();
 		}
 
-		if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
+		if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) ||
+			!(submit_bo.flags & MSM_SUBMIT_BO_FLAGS)) {
 			DRM_ERROR("invalid flags: %x\n", submit_bo.flags);
 			ret = -EINVAL;
 			goto out_unlock;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/msm/msm_ringbuffer.c linux-libre-4.1.44-gnu/drivers/gpu/drm/msm/msm_ringbuffer.c
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/msm/msm_ringbuffer.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/msm/msm_ringbuffer.c	2017-09-14 11:55:04.000000000 -0400
@@ -23,7 +23,8 @@ struct msm_ringbuffer *msm_ringbuffer_ne
 	struct msm_ringbuffer *ring;
 	int ret;
 
-	size = ALIGN(size, 4);   /* size should be dword aligned */
+	if (WARN_ON(!is_power_of_2(size)))
+		return ERR_PTR(-EINVAL);
 
 	ring = kzalloc(sizeof(*ring), GFP_KERNEL);
 	if (!ring) {
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/radeon/atombios_encoders.c linux-libre-4.1.44-gnu/drivers/gpu/drm/radeon/atombios_encoders.c
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/radeon/atombios_encoders.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/radeon/atombios_encoders.c	2017-09-14 11:55:04.000000000 -0400
@@ -30,6 +30,7 @@
 #include "radeon_audio.h"
 #include "atom.h"
 #include <linux/backlight.h>
+#include <linux/dmi.h>
 
 extern int atom_debug;
 
@@ -2183,9 +2184,17 @@ int radeon_atom_pick_dig_encoder(struct
 		goto assigned;
 	}
 
-	/* on DCE32 and encoder can driver any block so just crtc id */
+	/*
+	 * On DCE32 any encoder can drive any block so usually just use crtc id,
+	 * but Apple thinks different at least on iMac10,1, so there use linkb,
+	 * otherwise the internal eDP panel will stay dark.
+	 */
 	if (ASIC_IS_DCE32(rdev)) {
-		enc_idx = radeon_crtc->crtc_id;
+		if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1"))
+			enc_idx = (dig->linkb) ? 1 : 0;
+		else
+			enc_idx = radeon_crtc->crtc_id;
+
 		goto assigned;
 	}
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/rcar-du/rcar_du_crtc.c linux-libre-4.1.44-gnu/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/rcar-du/rcar_du_crtc.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/rcar-du/rcar_du_crtc.c	2017-09-14 11:55:04.000000000 -0400
@@ -277,26 +277,6 @@ static void rcar_du_crtc_update_planes(s
  * Page Flip
  */
 
-void rcar_du_crtc_cancel_page_flip(struct rcar_du_crtc *rcrtc,
-				   struct drm_file *file)
-{
-	struct drm_pending_vblank_event *event;
-	struct drm_device *dev = rcrtc->crtc.dev;
-	unsigned long flags;
-
-	/* Destroy the pending vertical blanking event associated with the
-	 * pending page flip, if any, and disable vertical blanking interrupts.
-	 */
-	spin_lock_irqsave(&dev->event_lock, flags);
-	event = rcrtc->event;
-	if (event && event->base.file_priv == file) {
-		rcrtc->event = NULL;
-		event->base.destroy(&event->base);
-		drm_crtc_vblank_put(&rcrtc->crtc);
-	}
-	spin_unlock_irqrestore(&dev->event_lock, flags);
-}
-
 static void rcar_du_crtc_finish_page_flip(struct rcar_du_crtc *rcrtc)
 {
 	struct drm_pending_vblank_event *event;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/rcar-du/rcar_du_crtc.h linux-libre-4.1.44-gnu/drivers/gpu/drm/rcar-du/rcar_du_crtc.h
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/rcar-du/rcar_du_crtc.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/rcar-du/rcar_du_crtc.h	2017-09-14 11:55:04.000000000 -0400
@@ -53,8 +53,6 @@ enum rcar_du_output {
 
 int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int index);
 void rcar_du_crtc_enable_vblank(struct rcar_du_crtc *rcrtc, bool enable);
-void rcar_du_crtc_cancel_page_flip(struct rcar_du_crtc *rcrtc,
-				   struct drm_file *file);
 void rcar_du_crtc_suspend(struct rcar_du_crtc *rcrtc);
 void rcar_du_crtc_resume(struct rcar_du_crtc *rcrtc);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/rcar-du/rcar_du_drv.c linux-libre-4.1.44-gnu/drivers/gpu/drm/rcar-du/rcar_du_drv.c
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/rcar-du/rcar_du_drv.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/rcar-du/rcar_du_drv.c	2017-09-14 11:55:04.000000000 -0400
@@ -205,15 +205,6 @@ done:
 	return ret;
 }
 
-static void rcar_du_preclose(struct drm_device *dev, struct drm_file *file)
-{
-	struct rcar_du_device *rcdu = dev->dev_private;
-	unsigned int i;
-
-	for (i = 0; i < rcdu->num_crtcs; ++i)
-		rcar_du_crtc_cancel_page_flip(&rcdu->crtcs[i], file);
-}
-
 static void rcar_du_lastclose(struct drm_device *dev)
 {
 	struct rcar_du_device *rcdu = dev->dev_private;
@@ -256,7 +247,6 @@ static struct drm_driver rcar_du_driver
 				| DRIVER_ATOMIC,
 	.load			= rcar_du_load,
 	.unload			= rcar_du_unload,
-	.preclose		= rcar_du_preclose,
 	.lastclose		= rcar_du_lastclose,
 	.set_busid		= drm_platform_set_busid,
 	.get_vblank_counter	= drm_vblank_count,
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c linux-libre-4.1.44-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
--- linux-libre-4.1.43-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c	2017-09-14 11:55:04.000000000 -0400
@@ -285,7 +285,7 @@ static int vmw_cmd_invalid(struct vmw_pr
 			   struct vmw_sw_context *sw_context,
 			   SVGA3dCmdHeader *header)
 {
-	return capable(CAP_SYS_ADMIN) ? : -EINVAL;
+	return -EINVAL;
 }
 
 static int vmw_cmd_ok(struct vmw_private *dev_priv,
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/hid/hid-core.c linux-libre-4.1.44-gnu/drivers/hid/hid-core.c
--- linux-libre-4.1.43-gnu/drivers/hid/hid-core.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/hid/hid-core.c	2017-09-14 11:55:04.000000000 -0400
@@ -2391,6 +2391,7 @@ static const struct hid_device_id hid_ig
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0002) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0003) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0004) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_PETZL, USB_DEVICE_ID_PETZL_HEADLAMP) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PHILIPS, USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_POWERCOM, USB_DEVICE_ID_POWERCOM_UPS) },
 #if defined(CONFIG_MOUSE_SYNAPTICS_USB) || defined(CONFIG_MOUSE_SYNAPTICS_USB_MODULE)
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/hid/hid-ids.h linux-libre-4.1.44-gnu/drivers/hid/hid-ids.h
--- linux-libre-4.1.43-gnu/drivers/hid/hid-ids.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/hid/hid-ids.h	2017-09-14 11:55:04.000000000 -0400
@@ -760,6 +760,9 @@
 #define USB_VENDOR_ID_PETALYNX		0x18b1
 #define USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE	0x0037
 
+#define USB_VENDOR_ID_PETZL		0x2122
+#define USB_DEVICE_ID_PETZL_HEADLAMP	0x1234
+
 #define USB_VENDOR_ID_PHILIPS		0x0471
 #define USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE 0x0617
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/iio/adc/vf610_adc.c linux-libre-4.1.44-gnu/drivers/iio/adc/vf610_adc.c
--- linux-libre-4.1.43-gnu/drivers/iio/adc/vf610_adc.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/iio/adc/vf610_adc.c	2017-09-14 11:55:04.000000000 -0400
@@ -71,7 +71,7 @@
 #define VF610_ADC_ADSTS_MASK		0x300
 #define VF610_ADC_ADLPC_EN		0x80
 #define VF610_ADC_ADHSC_EN		0x400
-#define VF610_ADC_REFSEL_VALT		0x100
+#define VF610_ADC_REFSEL_VALT		0x800
 #define VF610_ADC_REFSEL_VBG		0x1000
 #define VF610_ADC_ADTRG_HARD		0x2000
 #define VF610_ADC_AVGS_8		0x4000
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/iio/light/tsl2563.c linux-libre-4.1.44-gnu/drivers/iio/light/tsl2563.c
--- linux-libre-4.1.43-gnu/drivers/iio/light/tsl2563.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/iio/light/tsl2563.c	2017-09-14 11:55:04.000000000 -0400
@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler
 	struct tsl2563_chip *chip = iio_priv(dev_info);
 
 	iio_push_event(dev_info,
-		       IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
+		       IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
 					    0,
 					    IIO_EV_TYPE_THRESH,
 					    IIO_EV_DIR_EITHER),
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/infiniband/ulp/isert/ib_isert.c linux-libre-4.1.44-gnu/drivers/infiniband/ulp/isert/ib_isert.c
--- linux-libre-4.1.43-gnu/drivers/infiniband/ulp/isert/ib_isert.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/infiniband/ulp/isert/ib_isert.c	2017-09-14 11:55:04.000000000 -0400
@@ -1586,7 +1586,7 @@ isert_rcv_completion(struct iser_rx_desc
 		     struct isert_conn *isert_conn,
 		     u32 xfer_len)
 {
-	struct ib_device *ib_dev = isert_conn->cm_id->device;
+	struct ib_device *ib_dev = isert_conn->device->ib_device;
 	struct iscsi_hdr *hdr;
 	u64 rx_dma;
 	int rx_buflen, outstanding;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/input/serio/i8042.c linux-libre-4.1.44-gnu/drivers/input/serio/i8042.c
--- linux-libre-4.1.43-gnu/drivers/input/serio/i8042.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/input/serio/i8042.c	2017-09-14 11:55:04.000000000 -0400
@@ -397,8 +397,10 @@ static int i8042_start(struct serio *ser
 {
 	struct i8042_port *port = serio->port_data;
 
+	spin_lock_irq(&i8042_lock);
 	port->exists = true;
-	mb();
+	spin_unlock_irq(&i8042_lock);
+
 	return 0;
 }
 
@@ -411,16 +413,20 @@ static void i8042_stop(struct serio *ser
 {
 	struct i8042_port *port = serio->port_data;
 
+	spin_lock_irq(&i8042_lock);
 	port->exists = false;
+	port->serio = NULL;
+	spin_unlock_irq(&i8042_lock);
 
 	/*
+	 * We need to make sure that interrupt handler finishes using
+	 * our serio port before we return from this function.
 	 * We synchronize with both AUX and KBD IRQs because there is
 	 * a (very unlikely) chance that AUX IRQ is raised for KBD port
 	 * and vice versa.
 	 */
 	synchronize_irq(I8042_AUX_IRQ);
 	synchronize_irq(I8042_KBD_IRQ);
-	port->serio = NULL;
 }
 
 /*
@@ -537,7 +543,7 @@ static irqreturn_t i8042_interrupt(int i
 
 	spin_unlock_irqrestore(&i8042_lock, flags);
 
-	if (likely(port->exists && !filtered))
+	if (likely(serio && !filtered))
 		serio_interrupt(serio, data, dfl);
 
  out:
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/isdn/i4l/isdn_ppp.c linux-libre-4.1.44-gnu/drivers/isdn/i4l/isdn_ppp.c
--- linux-libre-4.1.43-gnu/drivers/isdn/i4l/isdn_ppp.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/isdn/i4l/isdn_ppp.c	2017-09-14 11:55:04.000000000 -0400
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn
 		       id);
 		return NULL;
 	} else {
-		rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
+		rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
 		if (!rs)
 			return NULL;
 		rs->state = CCPResetIdle;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/mailbox/mailbox.c linux-libre-4.1.44-gnu/drivers/mailbox/mailbox.c
--- linux-libre-4.1.43-gnu/drivers/mailbox/mailbox.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/mailbox/mailbox.c	2017-09-14 11:55:04.000000000 -0400
@@ -104,11 +104,14 @@ static void tx_tick(struct mbox_chan *ch
 	/* Submit next message */
 	msg_submit(chan);
 
+	if (!mssg)
+		return;
+
 	/* Notify the client */
-	if (mssg && chan->cl->tx_done)
+	if (chan->cl->tx_done)
 		chan->cl->tx_done(chan->cl, mssg, r);
 
-	if (chan->cl->tx_block)
+	if (r != -ETIME && chan->cl->tx_block)
 		complete(&chan->tx_complete);
 }
 
@@ -258,7 +261,7 @@ int mbox_send_message(struct mbox_chan *
 
 	msg_submit(chan);
 
-	if (chan->cl->tx_block && chan->active_req) {
+	if (chan->cl->tx_block) {
 		unsigned long wait;
 		int ret;
 
@@ -269,8 +272,8 @@ int mbox_send_message(struct mbox_chan *
 
 		ret = wait_for_completion_timeout(&chan->tx_complete, wait);
 		if (ret == 0) {
-			t = -EIO;
-			tx_tick(chan, -EIO);
+			t = -ETIME;
+			tx_tick(chan, t);
 		}
 	}
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/md/raid1.c linux-libre-4.1.44-gnu/drivers/md/raid1.c
--- linux-libre-4.1.43-gnu/drivers/md/raid1.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/md/raid1.c	2017-09-14 11:55:04.000000000 -0400
@@ -1118,7 +1118,7 @@ static void make_request(struct mddev *m
 		 */
 		DEFINE_WAIT(w);
 		for (;;) {
-			flush_signals(current);
+			sigset_t full, old;
 			prepare_to_wait(&conf->wait_barrier,
 					&w, TASK_INTERRUPTIBLE);
 			if (bio_end_sector(bio) <= mddev->suspend_lo ||
@@ -1127,7 +1127,10 @@ static void make_request(struct mddev *m
 			     !md_cluster_ops->area_resyncing(mddev,
 				     bio->bi_iter.bi_sector, bio_end_sector(bio))))
 				break;
+			sigfillset(&full);
+			sigprocmask(SIG_BLOCK, &full, &old);
 			schedule();
+			sigprocmask(SIG_SETMASK, &old, NULL);
 		}
 		finish_wait(&conf->wait_barrier, &w);
 	}
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/md/raid5.c linux-libre-4.1.44-gnu/drivers/md/raid5.c
--- linux-libre-4.1.43-gnu/drivers/md/raid5.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/md/raid5.c	2017-09-14 11:55:04.000000000 -0400
@@ -5275,12 +5275,15 @@ static void make_request(struct mddev *m
 				 * userspace, we want an interruptible
 				 * wait.
 				 */
-				flush_signals(current);
 				prepare_to_wait(&conf->wait_for_overlap,
 						&w, TASK_INTERRUPTIBLE);
 				if (logical_sector >= mddev->suspend_lo &&
 				    logical_sector < mddev->suspend_hi) {
+					sigset_t full, old;
+					sigfillset(&full);
+					sigprocmask(SIG_BLOCK, &full, &old);
 					schedule();
+					sigprocmask(SIG_SETMASK, &old, NULL);
 					do_prepare = true;
 				}
 				goto retry;
@@ -5796,6 +5799,8 @@ static void raid5_do_work(struct work_st
 	pr_debug("%d stripes handled\n", handled);
 
 	spin_unlock_irq(&conf->device_lock);
+
+	async_tx_issue_pending_all();
 	blk_finish_plug(&plug);
 
 	pr_debug("--- raid5worker inactive\n");
@@ -7441,12 +7446,10 @@ static void end_reshape(struct r5conf *c
 {
 
 	if (!test_bit(MD_RECOVERY_INTR, &conf->mddev->recovery)) {
-		struct md_rdev *rdev;
 
 		spin_lock_irq(&conf->device_lock);
 		conf->previous_raid_disks = conf->raid_disks;
-		rdev_for_each(rdev, conf->mddev)
-			rdev->data_offset = rdev->new_data_offset;
+		md_finish_reshape(conf->mddev);
 		smp_wmb();
 		conf->reshape_progress = MaxSector;
 		spin_unlock_irq(&conf->device_lock);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c linux-libre-4.1.44-gnu/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c
--- linux-libre-4.1.43-gnu/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c	2017-09-14 11:55:04.000000000 -0400
@@ -211,7 +211,7 @@ static int s5c73m3_3a_lock(struct s5c73m
 	}
 
 	if ((ctrl->val ^ ctrl->cur.val) & V4L2_LOCK_FOCUS)
-		ret = s5c73m3_af_run(state, ~af_lock);
+		ret = s5c73m3_af_run(state, !af_lock);
 
 	return ret;
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/media/pci/cx88/cx88-cards.c linux-libre-4.1.44-gnu/drivers/media/pci/cx88/cx88-cards.c
--- linux-libre-4.1.43-gnu/drivers/media/pci/cx88/cx88-cards.c	2017-08-06 01:16:07.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/media/pci/cx88/cx88-cards.c	2017-09-19 12:12:06.000000000 -0400
@@ -3691,7 +3691,14 @@ struct cx88_core *cx88_core_create(struc
 	core->nr = nr;
 	sprintf(core->name, "cx88[%d]", core->nr);
 
-	core->tvnorm = V4L2_STD_NTSC_M;
+	/*
+	 * Note: Setting initial standard here would cause first call to
+	 * cx88_set_tvnorm() to return without programming any registers.  Leave
+	 * it blank for at this point and it will get set later in
+	 * cx8800_initdev()
+	 */
+	core->tvnorm  = 0;
+
 	core->width   = 320;
 	core->height  = 240;
 	core->field   = V4L2_FIELD_INTERLACED;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/media/pci/cx88/cx88-video.c linux-libre-4.1.44-gnu/drivers/media/pci/cx88/cx88-video.c
--- linux-libre-4.1.43-gnu/drivers/media/pci/cx88/cx88-video.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/media/pci/cx88/cx88-video.c	2017-09-14 11:55:04.000000000 -0400
@@ -1429,7 +1429,7 @@ static int cx8800_initdev(struct pci_dev
 
 	/* initial device configuration */
 	mutex_lock(&core->lock);
-	cx88_set_tvnorm(core, core->tvnorm);
+	cx88_set_tvnorm(core, V4L2_STD_NTSC_M);
 	v4l2_ctrl_handler_setup(&core->video_hdl);
 	v4l2_ctrl_handler_setup(&core->audio_hdl);
 	cx88_video_mux(core, 0);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/media/pci/saa7164/saa7164-bus.c linux-libre-4.1.44-gnu/drivers/media/pci/saa7164/saa7164-bus.c
--- linux-libre-4.1.43-gnu/drivers/media/pci/saa7164/saa7164-bus.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/media/pci/saa7164/saa7164-bus.c	2017-09-14 11:55:04.000000000 -0400
@@ -393,11 +393,11 @@ int saa7164_bus_get(struct saa7164_dev *
 	msg_tmp.size = le16_to_cpu((__force __le16)msg_tmp.size);
 	msg_tmp.command = le32_to_cpu((__force __le32)msg_tmp.command);
 	msg_tmp.controlselector = le16_to_cpu((__force __le16)msg_tmp.controlselector);
+	memcpy(msg, &msg_tmp, sizeof(*msg));
 
 	/* No need to update the read positions, because this was a peek */
 	/* If the caller specifically want to peek, return */
 	if (peekonly) {
-		memcpy(msg, &msg_tmp, sizeof(*msg));
 		goto peekout;
 	}
 
@@ -442,21 +442,15 @@ int saa7164_bus_get(struct saa7164_dev *
 		space_rem = bus->m_dwSizeGetRing - curr_grp;
 
 		if (space_rem < sizeof(*msg)) {
-			/* msg wraps around the ring */
-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, space_rem);
-			memcpy_fromio((u8 *)msg + space_rem, bus->m_pdwGetRing,
-				sizeof(*msg) - space_rem);
 			if (buf)
 				memcpy_fromio(buf, bus->m_pdwGetRing + sizeof(*msg) -
 					space_rem, buf_size);
 
 		} else if (space_rem == sizeof(*msg)) {
-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
 			if (buf)
 				memcpy_fromio(buf, bus->m_pdwGetRing, buf_size);
 		} else {
 			/* Additional data wraps around the ring */
-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
 			if (buf) {
 				memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp +
 					sizeof(*msg), space_rem - sizeof(*msg));
@@ -469,15 +463,10 @@ int saa7164_bus_get(struct saa7164_dev *
 
 	} else {
 		/* No wrapping */
-		memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
 		if (buf)
 			memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp + sizeof(*msg),
 				buf_size);
 	}
-	/* Convert from little endian to CPU */
-	msg->size = le16_to_cpu((__force __le16)msg->size);
-	msg->command = le32_to_cpu((__force __le32)msg->command);
-	msg->controlselector = le16_to_cpu((__force __le16)msg->controlselector);
 
 	/* Update the read positions, adjusting the ring */
 	saa7164_writel(bus->m_dwGetReadPos, new_grp);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/media/platform/davinci/vpfe_capture.c linux-libre-4.1.44-gnu/drivers/media/platform/davinci/vpfe_capture.c
--- linux-libre-4.1.43-gnu/drivers/media/platform/davinci/vpfe_capture.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/media/platform/davinci/vpfe_capture.c	2017-09-14 11:55:04.000000000 -0400
@@ -1706,27 +1706,9 @@ static long vpfe_param_handler(struct fi
 
 	switch (cmd) {
 	case VPFE_CMD_S_CCDC_RAW_PARAMS:
+		ret = -EINVAL;
 		v4l2_warn(&vpfe_dev->v4l2_dev,
-			  "VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n");
-		if (ccdc_dev->hw_ops.set_params) {
-			ret = ccdc_dev->hw_ops.set_params(param);
-			if (ret) {
-				v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
-					"Error setting parameters in CCDC\n");
-				goto unlock_out;
-			}
-			ret = vpfe_get_ccdc_image_format(vpfe_dev,
-							 &vpfe_dev->fmt);
-			if (ret < 0) {
-				v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
-					"Invalid image format at CCDC\n");
-				goto unlock_out;
-			}
-		} else {
-			ret = -EINVAL;
-			v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
-				"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
-		}
+			"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
 		break;
 	default:
 		ret = -ENOTTY;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/media/rc/imon.c linux-libre-4.1.44-gnu/drivers/media/rc/imon.c
--- linux-libre-4.1.43-gnu/drivers/media/rc/imon.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/media/rc/imon.c	2017-09-14 11:55:04.000000000 -0400
@@ -1629,7 +1629,7 @@ static void imon_incoming_packet(struct
 	if (kc == KEY_KEYBOARD && !ictx->release_code) {
 		ictx->last_keycode = kc;
 		if (!nomouse) {
-			ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1;
+			ictx->pad_mouse = !ictx->pad_mouse;
 			dev_dbg(dev, "toggling to %s mode\n",
 				ictx->pad_mouse ? "mouse" : "keyboard");
 			spin_unlock_irqrestore(&ictx->kc_lock, flags);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/media/rc/ir-lirc-codec.c linux-libre-4.1.44-gnu/drivers/media/rc/ir-lirc-codec.c
--- linux-libre-4.1.43-gnu/drivers/media/rc/ir-lirc-codec.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/media/rc/ir-lirc-codec.c	2017-09-14 11:55:04.000000000 -0400
@@ -257,7 +257,7 @@ static long ir_lirc_ioctl(struct file *f
 		return 0;
 
 	case LIRC_GET_REC_RESOLUTION:
-		val = dev->rx_resolution;
+		val = dev->rx_resolution / 1000;
 		break;
 
 	case LIRC_SET_WIDEBAND_RECEIVER:
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/misc/enclosure.c linux-libre-4.1.44-gnu/drivers/misc/enclosure.c
--- linux-libre-4.1.43-gnu/drivers/misc/enclosure.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/misc/enclosure.c	2017-09-14 11:55:04.000000000 -0400
@@ -375,6 +375,7 @@ int enclosure_add_device(struct enclosur
 			 struct device *dev)
 {
 	struct enclosure_component *cdev;
+	int err;
 
 	if (!edev || component >= edev->components)
 		return -EINVAL;
@@ -384,12 +385,17 @@ int enclosure_add_device(struct enclosur
 	if (cdev->dev == dev)
 		return -EEXIST;
 
-	if (cdev->dev)
+	if (cdev->dev) {
 		enclosure_remove_links(cdev);
-
-	put_device(cdev->dev);
+		put_device(cdev->dev);
+	}
 	cdev->dev = get_device(dev);
-	return enclosure_add_links(cdev);
+	err = enclosure_add_links(cdev);
+	if (err) {
+		put_device(cdev->dev);
+		cdev->dev = NULL;
+	}
+	return err;
 }
 EXPORT_SYMBOL_GPL(enclosure_add_device);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/mtd/spi-nor/fsl-quadspi.c linux-libre-4.1.44-gnu/drivers/mtd/spi-nor/fsl-quadspi.c
--- linux-libre-4.1.43-gnu/drivers/mtd/spi-nor/fsl-quadspi.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/mtd/spi-nor/fsl-quadspi.c	2017-09-14 11:55:04.000000000 -0400
@@ -140,15 +140,15 @@
 #define LUT_MODE		4
 #define LUT_MODE2		5
 #define LUT_MODE4		6
-#define LUT_READ		7
-#define LUT_WRITE		8
+#define LUT_FSL_READ		7
+#define LUT_FSL_WRITE		8
 #define LUT_JMP_ON_CS		9
 #define LUT_ADDR_DDR		10
 #define LUT_MODE_DDR		11
 #define LUT_MODE2_DDR		12
 #define LUT_MODE4_DDR		13
-#define LUT_READ_DDR		14
-#define LUT_WRITE_DDR		15
+#define LUT_FSL_READ_DDR		14
+#define LUT_FSL_WRITE_DDR		15
 #define LUT_DATA_LEARN		16
 
 /*
@@ -312,7 +312,7 @@ static void fsl_qspi_init_lut(struct fsl
 
 	writel(LUT0(CMD, PAD1, cmd) | LUT1(ADDR, PAD1, addrlen),
 			base + QUADSPI_LUT(lut_base));
-	writel(LUT0(DUMMY, PAD1, dummy) | LUT1(READ, PAD4, rxfifo),
+	writel(LUT0(DUMMY, PAD1, dummy) | LUT1(FSL_READ, PAD4, rxfifo),
 			base + QUADSPI_LUT(lut_base + 1));
 
 	/* Write enable */
@@ -333,11 +333,11 @@ static void fsl_qspi_init_lut(struct fsl
 
 	writel(LUT0(CMD, PAD1, cmd) | LUT1(ADDR, PAD1, addrlen),
 			base + QUADSPI_LUT(lut_base));
-	writel(LUT0(WRITE, PAD1, 0), base + QUADSPI_LUT(lut_base + 1));
+	writel(LUT0(FSL_WRITE, PAD1, 0), base + QUADSPI_LUT(lut_base + 1));
 
 	/* Read Status */
 	lut_base = SEQID_RDSR * 4;
-	writel(LUT0(CMD, PAD1, SPINOR_OP_RDSR) | LUT1(READ, PAD1, 0x1),
+	writel(LUT0(CMD, PAD1, SPINOR_OP_RDSR) | LUT1(FSL_READ, PAD1, 0x1),
 			base + QUADSPI_LUT(lut_base));
 
 	/* Erase a sector */
@@ -362,17 +362,17 @@ static void fsl_qspi_init_lut(struct fsl
 
 	/* READ ID */
 	lut_base = SEQID_RDID * 4;
-	writel(LUT0(CMD, PAD1, SPINOR_OP_RDID) | LUT1(READ, PAD1, 0x8),
+	writel(LUT0(CMD, PAD1, SPINOR_OP_RDID) | LUT1(FSL_READ, PAD1, 0x8),
 			base + QUADSPI_LUT(lut_base));
 
 	/* Write Register */
 	lut_base = SEQID_WRSR * 4;
-	writel(LUT0(CMD, PAD1, SPINOR_OP_WRSR) | LUT1(WRITE, PAD1, 0x2),
+	writel(LUT0(CMD, PAD1, SPINOR_OP_WRSR) | LUT1(FSL_WRITE, PAD1, 0x2),
 			base + QUADSPI_LUT(lut_base));
 
 	/* Read Configuration Register */
 	lut_base = SEQID_RDCR * 4;
-	writel(LUT0(CMD, PAD1, SPINOR_OP_RDCR) | LUT1(READ, PAD1, 0x1),
+	writel(LUT0(CMD, PAD1, SPINOR_OP_RDCR) | LUT1(FSL_READ, PAD1, 0x1),
 			base + QUADSPI_LUT(lut_base));
 
 	/* Write disable */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/ethernet/broadcom/tg3.c linux-libre-4.1.44-gnu/drivers/net/ethernet/broadcom/tg3.c
--- linux-libre-4.1.43-gnu/drivers/net/ethernet/broadcom/tg3.c	2017-08-06 01:22:26.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/ethernet/broadcom/tg3.c	2017-09-19 12:18:29.000000000 -0400
@@ -8713,11 +8713,14 @@ static void tg3_free_consistent(struct t
 	tg3_mem_rx_release(tp);
 	tg3_mem_tx_release(tp);
 
+	/* Protect tg3_get_stats64() from reading freed tp->hw_stats. */
+	tg3_full_lock(tp, 0);
 	if (tp->hw_stats) {
 		dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats),
 				  tp->hw_stats, tp->stats_mapping);
 		tp->hw_stats = NULL;
 	}
+	tg3_full_unlock(tp);
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/ethernet/mellanox/mlx4/icm.c linux-libre-4.1.44-gnu/drivers/net/ethernet/mellanox/mlx4/icm.c
--- linux-libre-4.1.43-gnu/drivers/net/ethernet/mellanox/mlx4/icm.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/ethernet/mellanox/mlx4/icm.c	2017-09-14 11:55:04.000000000 -0400
@@ -118,8 +118,13 @@ static int mlx4_alloc_icm_coherent(struc
 	if (!buf)
 		return -ENOMEM;
 
+	if (offset_in_page(buf)) {
+		dma_free_coherent(dev, PAGE_SIZE << order,
+				  buf, sg_dma_address(mem));
+		return -ENOMEM;
+	}
+
 	sg_set_buf(mem, buf, PAGE_SIZE << order);
-	BUG_ON(mem->offset);
 	sg_dma_len(mem) = PAGE_SIZE << order;
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/ethernet/realtek/r8169.c linux-libre-4.1.44-gnu/drivers/net/ethernet/realtek/r8169.c
--- linux-libre-4.1.43-gnu/drivers/net/ethernet/realtek/r8169.c	2017-08-06 01:22:04.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/ethernet/realtek/r8169.c	2017-09-19 12:18:04.000000000 -0400
@@ -326,6 +326,7 @@ enum cfg_version {
 static const struct pci_device_id rtl8169_pci_tbl[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8129), 0, 0, RTL_CFG_0 },
 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8136), 0, 0, RTL_CFG_2 },
+	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8161), 0, 0, RTL_CFG_1 },
 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8167), 0, 0, RTL_CFG_0 },
 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8168), 0, 0, RTL_CFG_1 },
 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8169), 0, 0, RTL_CFG_0 },
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/ethernet/renesas/sh_eth.c linux-libre-4.1.44-gnu/drivers/net/ethernet/renesas/sh_eth.c
--- linux-libre-4.1.43-gnu/drivers/net/ethernet/renesas/sh_eth.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/ethernet/renesas/sh_eth.c	2017-09-14 11:55:04.000000000 -0400
@@ -726,6 +726,7 @@ static struct sh_eth_cpu_data sh7734_dat
 	.tsu		= 1,
 	.hw_crc		= 1,
 	.select_mii	= 1,
+	.shift_rd0	= 1,
 };
 
 /* SH7763 */
@@ -794,6 +795,7 @@ static struct sh_eth_cpu_data r8a7740_da
 	.rpadir_value   = 2 << 16,
 	.no_trimd	= 1,
 	.no_ade		= 1,
+	.hw_crc		= 1,
 	.tsu		= 1,
 	.select_mii	= 1,
 	.shift_rd0	= 1,
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/irda/mcs7780.c linux-libre-4.1.44-gnu/drivers/net/irda/mcs7780.c
--- linux-libre-4.1.43-gnu/drivers/net/irda/mcs7780.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/irda/mcs7780.c	2017-09-14 11:55:04.000000000 -0400
@@ -141,9 +141,19 @@ static int mcs_set_reg(struct mcs_cb *mc
 static int mcs_get_reg(struct mcs_cb *mcs, __u16 reg, __u16 * val)
 {
 	struct usb_device *dev = mcs->usbdev;
-	int ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
-				  MCS_RD_RTYPE, 0, reg, val, 2,
-				  msecs_to_jiffies(MCS_CTRL_TIMEOUT));
+	void *dmabuf;
+	int ret;
+
+	dmabuf = kmalloc(sizeof(__u16), GFP_KERNEL);
+	if (!dmabuf)
+		return -ENOMEM;
+
+	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
+			      MCS_RD_RTYPE, 0, reg, dmabuf, 2,
+			      msecs_to_jiffies(MCS_CTRL_TIMEOUT));
+
+	memcpy(val, dmabuf, sizeof(__u16));
+	kfree(dmabuf);
 
 	return ret;
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/phy/phy.c linux-libre-4.1.44-gnu/drivers/net/phy/phy.c
--- linux-libre-4.1.43-gnu/drivers/net/phy/phy.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/phy/phy.c	2017-09-14 11:55:04.000000000 -0400
@@ -512,6 +512,9 @@ void phy_stop_machine(struct phy_device
 	if (phydev->state > PHY_UP && phydev->state != PHY_HALTED)
 		phydev->state = PHY_UP;
 	mutex_unlock(&phydev->lock);
+
+	/* Now we can run the state machine synchronously */
+	phy_state_machine(&phydev->state_queue.work);
 }
 
 /**
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/phy/phy_device.c linux-libre-4.1.44-gnu/drivers/net/phy/phy_device.c
--- linux-libre-4.1.43-gnu/drivers/net/phy/phy_device.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/phy/phy_device.c	2017-09-14 11:55:04.000000000 -0400
@@ -1281,6 +1281,8 @@ static int phy_remove(struct device *dev
 {
 	struct phy_device *phydev = to_phy_device(dev);
 
+	cancel_delayed_work_sync(&phydev->state_queue);
+
 	mutex_lock(&phydev->lock);
 	phydev->state = PHY_DOWN;
 	mutex_unlock(&phydev->lock);
@@ -1355,7 +1357,7 @@ static struct phy_driver genphy_driver[]
 	.phy_id		= 0xffffffff,
 	.phy_id_mask	= 0xffffffff,
 	.name		= "Generic PHY",
-	.soft_reset	= genphy_soft_reset,
+	.soft_reset	= genphy_no_soft_reset,
 	.config_init	= genphy_config_init,
 	.features	= PHY_GBIT_FEATURES | SUPPORTED_MII |
 			  SUPPORTED_AUI | SUPPORTED_FIBRE |
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/usb/kaweth.c linux-libre-4.1.44-gnu/drivers/net/usb/kaweth.c
--- linux-libre-4.1.43-gnu/drivers/net/usb/kaweth.c	2017-08-06 01:22:50.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/usb/kaweth.c	2017-09-19 12:18:53.000000000 -0400
@@ -1006,6 +1006,7 @@ static int kaweth_probe(
 	struct net_device *netdev;
 	const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 	int result = 0;
+	int rv = -EIO;
 
 	dev_dbg(dev,
 		"Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -1026,6 +1027,7 @@ static int kaweth_probe(
 	kaweth = netdev_priv(netdev);
 	kaweth->dev = udev;
 	kaweth->net = netdev;
+	kaweth->intf = intf;
 
 	spin_lock_init(&kaweth->device_lock);
 	init_waitqueue_head(&kaweth->term_wait);
@@ -1045,6 +1047,10 @@ static int kaweth_probe(
 		/* Download the firmware */
 		dev_info(dev, "Downloading firmware...\n");
 		kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
+		if (!kaweth->firmware_buf) {
+			rv = -ENOMEM;
+			goto err_free_netdev;
+		}
 		if ((result = kaweth_download_firmware(kaweth,
 						      "/*(DEBLOBBED)*/",
 						      100,
@@ -1136,8 +1142,6 @@ err_fw:
 
 	dev_dbg(dev, "Initializing net device.\n");
 
-	kaweth->intf = intf;
-
 	kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (!kaweth->tx_urb)
 		goto err_free_netdev;
@@ -1207,7 +1211,7 @@ err_only_tx:
 err_free_netdev:
 	free_netdev(netdev);
 
-	return -EIO;
+	return rv;
 }
 
 /****************************************************************
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/wireless/ath/ath10k/wmi-ops.h linux-libre-4.1.44-gnu/drivers/net/wireless/ath/ath10k/wmi-ops.h
--- linux-libre-4.1.43-gnu/drivers/net/wireless/ath/ath10k/wmi-ops.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/wireless/ath/ath10k/wmi-ops.h	2017-09-14 11:55:04.000000000 -0400
@@ -562,6 +562,9 @@ ath10k_wmi_vdev_spectral_conf(struct ath
 	struct sk_buff *skb;
 	u32 cmd_id;
 
+	if (!ar->wmi.ops->gen_vdev_spectral_conf)
+		return -EOPNOTSUPP;
+
 	skb = ar->wmi.ops->gen_vdev_spectral_conf(ar, arg);
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
@@ -577,6 +580,9 @@ ath10k_wmi_vdev_spectral_enable(struct a
 	struct sk_buff *skb;
 	u32 cmd_id;
 
+	if (!ar->wmi.ops->gen_vdev_spectral_enable)
+		return -EOPNOTSUPP;
+
 	skb = ar->wmi.ops->gen_vdev_spectral_enable(ar, vdev_id, trigger,
 						    enable);
 	if (IS_ERR(skb))
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/wireless/ath/ath9k/ar9003_phy.c linux-libre-4.1.44-gnu/drivers/net/wireless/ath/ath9k/ar9003_phy.c
--- linux-libre-4.1.43-gnu/drivers/net/wireless/ath/ath9k/ar9003_phy.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/wireless/ath/ath9k/ar9003_phy.c	2017-09-14 11:55:04.000000000 -0400
@@ -1816,8 +1816,6 @@ static void ar9003_hw_spectral_scan_wait
 static void ar9003_hw_tx99_start(struct ath_hw *ah, u32 qnum)
 {
 	REG_SET_BIT(ah, AR_PHY_TEST, PHY_AGC_CLR);
-	REG_SET_BIT(ah, 0x9864, 0x7f000);
-	REG_SET_BIT(ah, 0x9924, 0x7f00fe);
 	REG_CLR_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_DIS);
 	REG_WRITE(ah, AR_CR, AR_CR_RXD);
 	REG_WRITE(ah, AR_DLCL_IFS(qnum), 0);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/wireless/ath/ath9k/tx99.c linux-libre-4.1.44-gnu/drivers/net/wireless/ath/ath9k/tx99.c
--- linux-libre-4.1.43-gnu/drivers/net/wireless/ath/ath9k/tx99.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/wireless/ath/ath9k/tx99.c	2017-09-14 11:55:04.000000000 -0400
@@ -190,22 +190,27 @@ static ssize_t write_file_tx99(struct fi
 	if (strtobool(buf, &start))
 		return -EINVAL;
 
+	mutex_lock(&sc->mutex);
+
 	if (start == sc->tx99_state) {
 		if (!start)
-			return count;
+			goto out;
 		ath_dbg(common, XMIT, "Resetting TX99\n");
 		ath9k_tx99_deinit(sc);
 	}
 
 	if (!start) {
 		ath9k_tx99_deinit(sc);
-		return count;
+		goto out;
 	}
 
 	r = ath9k_tx99_init(sc);
-	if (r)
+	if (r) {
+		mutex_unlock(&sc->mutex);
 		return r;
-
+	}
+out:
+	mutex_unlock(&sc->mutex);
 	return count;
 }
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/wireless/ath/wil6210/main.c linux-libre-4.1.44-gnu/drivers/net/wireless/ath/wil6210/main.c
--- linux-libre-4.1.43-gnu/drivers/net/wireless/ath/wil6210/main.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/wireless/ath/wil6210/main.c	2017-09-14 11:55:04.000000000 -0400
@@ -323,18 +323,19 @@ static void wil_fw_error_worker(struct w
 
 	wil->last_fw_recovery = jiffies;
 
+	wil_info(wil, "fw error recovery requested (try %d)...\n",
+		 wil->recovery_count);
+	if (!no_fw_recovery)
+		wil->recovery_state = fw_recovery_running;
+	if (wil_wait_for_recovery(wil) != 0)
+		return;
+
 	mutex_lock(&wil->mutex);
 	switch (wdev->iftype) {
 	case NL80211_IFTYPE_STATION:
 	case NL80211_IFTYPE_P2P_CLIENT:
 	case NL80211_IFTYPE_MONITOR:
-		wil_info(wil, "fw error recovery requested (try %d)...\n",
-			 wil->recovery_count);
-		if (!no_fw_recovery)
-			wil->recovery_state = fw_recovery_running;
-		if (0 != wil_wait_for_recovery(wil))
-			break;
-
+		/* silent recovery, upper layers will see disconnect */
 		__wil_down(wil);
 		__wil_up(wil);
 		break;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/xen-netback/common.h linux-libre-4.1.44-gnu/drivers/net/xen-netback/common.h
--- linux-libre-4.1.43-gnu/drivers/net/xen-netback/common.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/xen-netback/common.h	2017-09-14 11:55:04.000000000 -0400
@@ -195,6 +195,7 @@ struct xenvif_queue { /* Per-queue data
 	unsigned long   remaining_credit;
 	struct timer_list credit_timeout;
 	u64 credit_window_start;
+	bool rate_limited;
 
 	/* Statistics */
 	struct xenvif_stats stats;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/xen-netback/interface.c linux-libre-4.1.44-gnu/drivers/net/xen-netback/interface.c
--- linux-libre-4.1.43-gnu/drivers/net/xen-netback/interface.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/xen-netback/interface.c	2017-09-14 11:55:04.000000000 -0400
@@ -99,7 +99,11 @@ static int xenvif_poll(struct napi_struc
 
 	if (work_done < budget) {
 		napi_complete(napi);
-		xenvif_napi_schedule_or_enable_events(queue);
+		/* If the queue is rate-limited, it shall be
+		 * rescheduled in the timer callback.
+		 */
+		if (likely(!queue->rate_limited))
+			xenvif_napi_schedule_or_enable_events(queue);
 	}
 
 	return work_done;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/net/xen-netback/netback.c linux-libre-4.1.44-gnu/drivers/net/xen-netback/netback.c
--- linux-libre-4.1.43-gnu/drivers/net/xen-netback/netback.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/net/xen-netback/netback.c	2017-09-14 11:55:04.000000000 -0400
@@ -640,6 +640,7 @@ static void tx_add_credit(struct xenvif_
 		max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */
 
 	queue->remaining_credit = min(max_credit, max_burst);
+	queue->rate_limited = false;
 }
 
 void xenvif_tx_credit_callback(unsigned long data)
@@ -1152,8 +1153,10 @@ static bool tx_credit_exceeded(struct xe
 		msecs_to_jiffies(queue->credit_usec / 1000);
 
 	/* Timer could already be pending in rare cases. */
-	if (timer_pending(&queue->credit_timeout))
+	if (timer_pending(&queue->credit_timeout)) {
+		queue->rate_limited = true;
 		return true;
+	}
 
 	/* Passed the point where we can replenish credit? */
 	if (time_after_eq64(now, next_credit)) {
@@ -1168,6 +1171,7 @@ static bool tx_credit_exceeded(struct xe
 		mod_timer(&queue->credit_timeout,
 			  next_credit);
 		queue->credit_window_start = next_credit;
+		queue->rate_limited = true;
 
 		return true;
 	}
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/of/device.c linux-libre-4.1.44-gnu/drivers/of/device.c
--- linux-libre-4.1.43-gnu/drivers/of/device.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/of/device.c	2017-09-14 11:55:04.000000000 -0400
@@ -212,6 +212,7 @@ ssize_t of_device_get_modalias(struct de
 
 	return tsize;
 }
+EXPORT_SYMBOL_GPL(of_device_get_modalias);
 
 /**
  * of_device_uevent - Display OF related uevent information
@@ -274,3 +275,4 @@ int of_device_uevent_modalias(struct dev
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(of_device_uevent_modalias);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/pci/pci-driver.c linux-libre-4.1.44-gnu/drivers/pci/pci-driver.c
--- linux-libre-4.1.43-gnu/drivers/pci/pci-driver.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/pci/pci-driver.c	2017-09-14 11:55:04.000000000 -0400
@@ -937,6 +937,7 @@ static int pci_pm_thaw_noirq(struct devi
 		return pci_legacy_resume_early(dev);
 
 	pci_update_current_state(pci_dev, PCI_D0);
+	pci_restore_state(pci_dev);
 
 	if (drv && drv->pm && drv->pm->thaw_noirq)
 		error = drv->pm->thaw_noirq(dev);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/pinctrl/samsung/pinctrl-exynos.c linux-libre-4.1.44-gnu/drivers/pinctrl/samsung/pinctrl-exynos.c
--- linux-libre-4.1.43-gnu/drivers/pinctrl/samsung/pinctrl-exynos.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/pinctrl/samsung/pinctrl-exynos.c	2017-09-14 11:55:04.000000000 -0400
@@ -194,8 +194,6 @@ static int exynos_irq_request_resources(
 
 	spin_unlock_irqrestore(&bank->slock, flags);
 
-	exynos_irq_unmask(irqd);
-
 	return 0;
 }
 
@@ -216,8 +214,6 @@ static void exynos_irq_release_resources
 	shift = irqd->hwirq * bank_type->fld_width[PINCFG_TYPE_FUNC];
 	mask = (1 << bank_type->fld_width[PINCFG_TYPE_FUNC]) - 1;
 
-	exynos_irq_mask(irqd);
-
 	spin_lock_irqsave(&bank->slock, flags);
 
 	con = readl(d->virt_base + reg_con);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c linux-libre-4.1.44-gnu/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
--- linux-libre-4.1.43-gnu/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c	2017-09-14 11:55:04.000000000 -0400
@@ -800,6 +800,7 @@ static const struct sunxi_desc_pin sun4i
 		  SUNXI_FUNCTION(0x2, "lcd1"),		/* D16 */
 		  SUNXI_FUNCTION(0x3, "pata"),		/* ATAD12 */
 		  SUNXI_FUNCTION(0x4, "keypad"),	/* IN6 */
+		  SUNXI_FUNCTION(0x5, "sim"),		/* DET */
 		  SUNXI_FUNCTION_IRQ(0x6, 16),		/* EINT16 */
 		  SUNXI_FUNCTION(0x7, "csi1")),		/* D16 */
 	SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 17),
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/scsi/fnic/fnic.h linux-libre-4.1.44-gnu/drivers/scsi/fnic/fnic.h
--- linux-libre-4.1.43-gnu/drivers/scsi/fnic/fnic.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/scsi/fnic/fnic.h	2017-09-14 11:55:04.000000000 -0400
@@ -248,6 +248,7 @@ struct fnic {
 	struct completion *remove_wait; /* device remove thread blocks */
 
 	atomic_t in_flight;		/* io counter */
+	bool internal_reset_inprogress;
 	u32 _reserved;			/* fill hole */
 	unsigned long state_flags;	/* protected by host lock */
 	enum fnic_state state;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/scsi/fnic/fnic_scsi.c linux-libre-4.1.44-gnu/drivers/scsi/fnic/fnic_scsi.c
--- linux-libre-4.1.43-gnu/drivers/scsi/fnic/fnic_scsi.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/scsi/fnic/fnic_scsi.c	2017-09-14 11:55:04.000000000 -0400
@@ -2517,6 +2517,19 @@ int fnic_host_reset(struct scsi_cmnd *sc
 	unsigned long wait_host_tmo;
 	struct Scsi_Host *shost = sc->device->host;
 	struct fc_lport *lp = shost_priv(shost);
+	struct fnic *fnic = lport_priv(lp);
+	unsigned long flags;
+
+	spin_lock_irqsave(&fnic->fnic_lock, flags);
+	if (fnic->internal_reset_inprogress == 0) {
+		fnic->internal_reset_inprogress = 1;
+	} else {
+		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+		FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+			"host reset in progress skipping another host reset\n");
+		return SUCCESS;
+	}
+	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
 	/*
 	 * If fnic_reset is successful, wait for fabric login to complete
@@ -2537,6 +2550,9 @@ int fnic_host_reset(struct scsi_cmnd *sc
 		}
 	}
 
+	spin_lock_irqsave(&fnic->fnic_lock, flags);
+	fnic->internal_reset_inprogress = 0;
+	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/scsi/mpt3sas/mpt3sas_base.c linux-libre-4.1.44-gnu/drivers/scsi/mpt3sas/mpt3sas_base.c
--- linux-libre-4.1.43-gnu/drivers/scsi/mpt3sas/mpt3sas_base.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/scsi/mpt3sas/mpt3sas_base.c	2017-09-14 11:55:04.000000000 -0400
@@ -4410,14 +4410,13 @@ _base_make_ioc_ready(struct MPT3SAS_ADAP
 static int
 _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
 {
-	int r, i;
+	int r, i, index;
 	unsigned long	flags;
 	u32 reply_address;
 	u16 smid;
 	struct _tr_list *delayed_tr, *delayed_tr_next;
 	struct adapter_reply_queue *reply_q;
-	long reply_post_free;
-	u32 reply_post_free_sz, index = 0;
+	Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig;
 
 	dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name,
 	    __func__));
@@ -4488,27 +4487,27 @@ _base_make_ioc_operational(struct MPT3SA
 		_base_assign_reply_queues(ioc);
 
 	/* initialize Reply Post Free Queue */
-	reply_post_free_sz = ioc->reply_post_queue_depth *
-	    sizeof(Mpi2DefaultReplyDescriptor_t);
-	reply_post_free = (long)ioc->reply_post[index].reply_post_free;
+	index = 0;
+	reply_post_free_contig = ioc->reply_post[0].reply_post_free;
 	list_for_each_entry(reply_q, &ioc->reply_queue_list, list) {
+		/*
+		 * If RDPQ is enabled, switch to the next allocation.
+		 * Otherwise advance within the contiguous region.
+		 */
+		if (ioc->rdpq_array_enable) {
+			reply_q->reply_post_free =
+				ioc->reply_post[index++].reply_post_free;
+		} else {
+			reply_q->reply_post_free = reply_post_free_contig;
+			reply_post_free_contig += ioc->reply_post_queue_depth;
+		}
+
 		reply_q->reply_post_host_index = 0;
-		reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *)
-		    reply_post_free;
 		for (i = 0; i < ioc->reply_post_queue_depth; i++)
 			reply_q->reply_post_free[i].Words =
 			    cpu_to_le64(ULLONG_MAX);
 		if (!_base_is_controller_msix_enabled(ioc))
 			goto skip_init_reply_post_free_queue;
-		/*
-		 * If RDPQ is enabled, switch to the next allocation.
-		 * Otherwise advance within the contiguous region.
-		 */
-		if (ioc->rdpq_array_enable)
-			reply_post_free = (long)
-			    ioc->reply_post[++index].reply_post_free;
-		else
-			reply_post_free += reply_post_free_sz;
 	}
  skip_init_reply_post_free_queue:
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/scsi/qla2xxx/qla_attr.c linux-libre-4.1.44-gnu/drivers/scsi/qla2xxx/qla_attr.c
--- linux-libre-4.1.43-gnu/drivers/scsi/qla2xxx/qla_attr.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/scsi/qla2xxx/qla_attr.c	2017-09-14 11:55:04.000000000 -0400
@@ -329,12 +329,15 @@ qla2x00_sysfs_read_optrom(struct file *f
 	struct qla_hw_data *ha = vha->hw;
 	ssize_t rval = 0;
 
+	mutex_lock(&ha->optrom_mutex);
+
 	if (ha->optrom_state != QLA_SREADING)
-		return 0;
+		goto out;
 
-	mutex_lock(&ha->optrom_mutex);
 	rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer,
 	    ha->optrom_region_size);
+
+out:
 	mutex_unlock(&ha->optrom_mutex);
 
 	return rval;
@@ -349,14 +352,19 @@ qla2x00_sysfs_write_optrom(struct file *
 	    struct device, kobj)));
 	struct qla_hw_data *ha = vha->hw;
 
-	if (ha->optrom_state != QLA_SWRITING)
+	mutex_lock(&ha->optrom_mutex);
+
+	if (ha->optrom_state != QLA_SWRITING) {
+		mutex_unlock(&ha->optrom_mutex);
 		return -EINVAL;
-	if (off > ha->optrom_region_size)
+	}
+	if (off > ha->optrom_region_size) {
+		mutex_unlock(&ha->optrom_mutex);
 		return -ERANGE;
+	}
 	if (off + count > ha->optrom_region_size)
 		count = ha->optrom_region_size - off;
 
-	mutex_lock(&ha->optrom_mutex);
 	memcpy(&ha->optrom_buffer[off], buf, count);
 	mutex_unlock(&ha->optrom_mutex);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/spi/spi-dw.c linux-libre-4.1.44-gnu/drivers/spi/spi-dw.c
--- linux-libre-4.1.43-gnu/drivers/spi/spi-dw.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/spi/spi-dw.c	2017-09-14 11:55:04.000000000 -0400
@@ -113,7 +113,10 @@ static const struct file_operations dw_s
 
 static int dw_spi_debugfs_init(struct dw_spi *dws)
 {
-	dws->debugfs = debugfs_create_dir("dw_spi", NULL);
+	char name[128];
+
+	snprintf(name, 128, "dw_spi-%s", dev_name(&dws->master->dev));
+	dws->debugfs = debugfs_create_dir(name, NULL);
 	if (!dws->debugfs)
 		return -ENOMEM;
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/spmi/spmi.c linux-libre-4.1.44-gnu/drivers/spmi/spmi.c
--- linux-libre-4.1.43-gnu/drivers/spmi/spmi.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/spmi/spmi.c	2017-09-14 11:55:04.000000000 -0400
@@ -348,11 +348,23 @@ static int spmi_drv_remove(struct device
 	return 0;
 }
 
+static int spmi_drv_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+	int ret;
+
+	ret = of_device_uevent_modalias(dev, env);
+	if (ret != -ENODEV)
+		return ret;
+
+	return 0;
+}
+
 static struct bus_type spmi_bus_type = {
 	.name		= "spmi",
 	.match		= spmi_device_match,
 	.probe		= spmi_drv_probe,
 	.remove		= spmi_drv_remove,
+	.uevent		= spmi_drv_uevent,
 };
 
 /**
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/staging/comedi/comedi_fops.c linux-libre-4.1.44-gnu/drivers/staging/comedi/comedi_fops.c
--- linux-libre-4.1.43-gnu/drivers/staging/comedi/comedi_fops.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/staging/comedi/comedi_fops.c	2017-09-14 11:55:04.000000000 -0400
@@ -2875,9 +2875,6 @@ static int __init comedi_init(void)
 
 	comedi_class->dev_groups = comedi_dev_groups;
 
-	/* XXX requires /proc interface */
-	comedi_proc_init();
-
 	/* create devices files for legacy/manual use */
 	for (i = 0; i < comedi_num_legacy_minors; i++) {
 		struct comedi_device *dev;
@@ -2895,6 +2892,9 @@ static int __init comedi_init(void)
 		mutex_unlock(&dev->mutex);
 	}
 
+	/* XXX requires /proc interface */
+	comedi_proc_init();
+
 	return 0;
 }
 module_init(comedi_init);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/staging/iio/resolver/ad2s1210.c linux-libre-4.1.44-gnu/drivers/staging/iio/resolver/ad2s1210.c
--- linux-libre-4.1.43-gnu/drivers/staging/iio/resolver/ad2s1210.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/staging/iio/resolver/ad2s1210.c	2017-09-14 11:55:04.000000000 -0400
@@ -468,7 +468,7 @@ static int ad2s1210_read_raw(struct iio_
 			     long m)
 {
 	struct ad2s1210_state *st = iio_priv(indio_dev);
-	bool negative;
+	u16 negative;
 	int ret = 0;
 	u16 pos;
 	s16 vel;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c linux-libre-4.1.44-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c
--- linux-libre-4.1.43-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c	2017-09-14 11:55:04.000000000 -0400
@@ -48,6 +48,7 @@ static struct usb_device_id rtw_usb_id_t
 	{USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
 	{USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
 	{USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+	{USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
 	{USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
 	{}	/* Terminating entry */
 };
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/target/iscsi/iscsi_target.c linux-libre-4.1.44-gnu/drivers/target/iscsi/iscsi_target.c
--- linux-libre-4.1.43-gnu/drivers/target/iscsi/iscsi_target.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/target/iscsi/iscsi_target.c	2017-09-14 11:55:04.000000000 -0400
@@ -426,6 +426,7 @@ int iscsit_reset_np_thread(
 		return 0;
 	}
 	np->np_thread_state = ISCSI_NP_THREAD_RESET;
+	atomic_inc(&np->np_reset_count);
 
 	if (np->np_thread) {
 		spin_unlock_bh(&np->np_thread_lock);
@@ -1992,6 +1993,7 @@ iscsit_setup_text_cmd(struct iscsi_conn
 	cmd->cmd_sn		= be32_to_cpu(hdr->cmdsn);
 	cmd->exp_stat_sn	= be32_to_cpu(hdr->exp_statsn);
 	cmd->data_direction	= DMA_NONE;
+	kfree(cmd->text_in_ptr);
 	cmd->text_in_ptr	= NULL;
 
 	return 0;
@@ -4589,8 +4591,11 @@ static void iscsit_logout_post_handler_c
 	 * always sleep waiting for RX/TX thread shutdown to complete
 	 * within iscsit_close_connection().
 	 */
-	if (conn->conn_transport->transport_type == ISCSI_TCP)
+	if (conn->conn_transport->transport_type == ISCSI_TCP) {
 		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+		if (!sleep)
+			return;
+	}
 
 	atomic_set(&conn->conn_logout_remove, 0);
 	complete(&conn->conn_logout_comp);
@@ -4606,8 +4611,11 @@ static void iscsit_logout_post_handler_s
 {
 	int sleep = 1;
 
-	if (conn->conn_transport->transport_type == ISCSI_TCP)
+	if (conn->conn_transport->transport_type == ISCSI_TCP) {
 		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+		if (!sleep)
+			return;
+	}
 
 	atomic_set(&conn->conn_logout_remove, 0);
 	complete(&conn->conn_logout_comp);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/target/iscsi/iscsi_target_login.c linux-libre-4.1.44-gnu/drivers/target/iscsi/iscsi_target_login.c
--- linux-libre-4.1.43-gnu/drivers/target/iscsi/iscsi_target_login.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/target/iscsi/iscsi_target_login.c	2017-09-14 11:55:04.000000000 -0400
@@ -1290,9 +1290,11 @@ static int __iscsi_target_login_thread(s
 	flush_signals(current);
 
 	spin_lock_bh(&np->np_thread_lock);
-	if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+	if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
 		np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+		spin_unlock_bh(&np->np_thread_lock);
 		complete(&np->np_restart_comp);
+		return 1;
 	} else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
 		spin_unlock_bh(&np->np_thread_lock);
 		goto exit;
@@ -1325,7 +1327,8 @@ static int __iscsi_target_login_thread(s
 		goto exit;
 	} else if (rc < 0) {
 		spin_lock_bh(&np->np_thread_lock);
-		if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+		if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
+			np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
 			spin_unlock_bh(&np->np_thread_lock);
 			complete(&np->np_restart_comp);
 			iscsit_put_transport(conn->conn_transport);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/target/target_core_transport.c linux-libre-4.1.44-gnu/drivers/target/target_core_transport.c
--- linux-libre-4.1.43-gnu/drivers/target/target_core_transport.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/target/target_core_transport.c	2017-09-14 11:55:04.000000000 -0400
@@ -733,6 +733,15 @@ void target_complete_cmd(struct se_cmd *
 	if (cmd->transport_state & CMD_T_ABORTED ||
 	    cmd->transport_state & CMD_T_STOP) {
 		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+		/*
+		 * If COMPARE_AND_WRITE was stopped by __transport_wait_for_tasks(),
+		 * release se_device->caw_sem obtained by sbc_compare_and_write()
+		 * since target_complete_ok_work() or target_complete_failure_work()
+		 * won't be called to invoke the normal CAW completion callbacks.
+		 */
+		if (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) {
+			up(&dev->caw_sem);
+		}
 		complete_all(&cmd->t_transport_stop_comp);
 		return;
 	} else if (!success) {
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/class/cdc-acm.c linux-libre-4.1.44-gnu/drivers/usb/class/cdc-acm.c
--- linux-libre-4.1.43-gnu/drivers/usb/class/cdc-acm.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/class/cdc-acm.c	2017-09-14 11:55:04.000000000 -0400
@@ -1771,6 +1771,9 @@ static const struct usb_device_id acm_id
 	{ USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
 	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
 	},
+	{ USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
+	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+	},
 
 	{ USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
 	.driver_info = CLEAR_HALT_CONDITIONS,
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/core/hcd.c linux-libre-4.1.44-gnu/drivers/usb/core/hcd.c
--- linux-libre-4.1.43-gnu/drivers/usb/core/hcd.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/core/hcd.c	2017-09-14 11:55:04.000000000 -0400
@@ -2397,6 +2397,8 @@ void usb_hc_died (struct usb_hcd *hcd)
 	}
 	if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) {
 		hcd = hcd->shared_hcd;
+		clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
+		set_bit(HCD_FLAG_DEAD, &hcd->flags);
 		if (hcd->rh_registered) {
 			clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/core/hub.c linux-libre-4.1.44-gnu/drivers/usb/core/hub.c
--- linux-libre-4.1.43-gnu/drivers/usb/core/hub.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/core/hub.c	2017-09-14 11:55:04.000000000 -0400
@@ -4618,7 +4618,8 @@ hub_power_remaining (struct usb_hub *hub
 static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
 		u16 portchange)
 {
-	int status, i;
+	int status = -ENODEV;
+	int i;
 	unsigned unit_load;
 	struct usb_device *hdev = hub->hdev;
 	struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
@@ -4822,9 +4823,10 @@ loop:
 
 done:
 	hub_port_disable(hub, port1, 1);
-	if (hcd->driver->relinquish_port && !hub->hdev->parent)
-		hcd->driver->relinquish_port(hcd, port1);
-
+	if (hcd->driver->relinquish_port && !hub->hdev->parent) {
+		if (status != -ENOTCONN && status != -ENODEV)
+			hcd->driver->relinquish_port(hcd, port1);
+	}
 }
 
 /* Handle physical or logical connection change events.
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/core/quirks.c linux-libre-4.1.44-gnu/drivers/usb/core/quirks.c
--- linux-libre-4.1.43-gnu/drivers/usb/core/quirks.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/core/quirks.c	2017-09-14 11:55:04.000000000 -0400
@@ -150,6 +150,9 @@ static const struct usb_device_id usb_qu
 	/* appletouch */
 	{ USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
 
+	/* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
+	{ USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
+
 	/* Avision AV600U */
 	{ USB_DEVICE(0x0638, 0x0a13), .driver_info =
 	  USB_QUIRK_STRING_FETCH_255 },
@@ -249,6 +252,7 @@ static const struct usb_device_id usb_am
 	{ USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME },
 	{ USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME },
 	{ USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME },
+	{ USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME },
 
 	/* Logitech Optical Mouse M90/M100 */
 	{ USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME },
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/gadget/function/f_hid.c linux-libre-4.1.44-gnu/drivers/usb/gadget/function/f_hid.c
--- linux-libre-4.1.43-gnu/drivers/usb/gadget/function/f_hid.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/gadget/function/f_hid.c	2017-09-14 11:55:04.000000000 -0400
@@ -544,7 +544,7 @@ static int hidg_set_alt(struct usb_funct
 		}
 		status = usb_ep_enable(hidg->out_ep);
 		if (status < 0) {
-			ERROR(cdev, "Enable IN endpoint FAILED!\n");
+			ERROR(cdev, "Enable OUT endpoint FAILED!\n");
 			goto fail;
 		}
 		hidg->out_ep->driver_data = hidg;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/host/pci-quirks.c linux-libre-4.1.44-gnu/drivers/usb/host/pci-quirks.c
--- linux-libre-4.1.43-gnu/drivers/usb/host/pci-quirks.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/host/pci-quirks.c	2017-09-14 11:55:04.000000000 -0400
@@ -89,6 +89,7 @@ enum amd_chipset_gen {
 	AMD_CHIPSET_HUDSON2,
 	AMD_CHIPSET_BOLTON,
 	AMD_CHIPSET_YANGTZE,
+	AMD_CHIPSET_TAISHAN,
 	AMD_CHIPSET_UNKNOWN,
 };
 
@@ -132,6 +133,11 @@ static int amd_chipset_sb_type_init(stru
 			pinfo->sb_type.gen = AMD_CHIPSET_SB700;
 		else if (rev >= 0x40 && rev <= 0x4f)
 			pinfo->sb_type.gen = AMD_CHIPSET_SB800;
+	}
+	pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+					  0x145c, NULL);
+	if (pinfo->smbus_dev) {
+		pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
 	} else {
 		pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
 				PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
@@ -251,11 +257,12 @@ int usb_hcd_amd_remote_wakeup_quirk(stru
 {
 	/* Make sure amd chipset type has already been initialized */
 	usb_amd_find_chipset_info();
-	if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE)
-		return 0;
-
-	dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
-	return 1;
+	if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE ||
+	    amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) {
+		dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
+		return 1;
+	}
+	return 0;
 }
 EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/host/xhci-hub.c linux-libre-4.1.44-gnu/drivers/usb/host/xhci-hub.c
--- linux-libre-4.1.43-gnu/drivers/usb/host/xhci-hub.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/host/xhci-hub.c	2017-09-14 11:55:04.000000000 -0400
@@ -651,6 +651,9 @@ static u32 xhci_get_port_status(struct u
 			clear_bit(wIndex, &bus_state->resuming_ports);
 
 			set_bit(wIndex, &bus_state->rexit_ports);
+
+			xhci_test_and_clear_bit(xhci, port_array, wIndex,
+						PORT_PLC);
 			xhci_set_link_state(xhci, port_array, wIndex,
 					XDEV_U0);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/host/xhci-ring.c linux-libre-4.1.44-gnu/drivers/usb/host/xhci-ring.c
--- linux-libre-4.1.43-gnu/drivers/usb/host/xhci-ring.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/host/xhci-ring.c	2017-09-14 11:55:04.000000000 -0400
@@ -789,13 +789,16 @@ static void xhci_kill_endpoint_urbs(stru
 			(ep->ep_state & EP_GETTING_NO_STREAMS)) {
 		int stream_id;
 
-		for (stream_id = 0; stream_id < ep->stream_info->num_streams;
+		for (stream_id = 1; stream_id < ep->stream_info->num_streams;
 				stream_id++) {
+			ring = ep->stream_info->stream_rings[stream_id];
+			if (!ring)
+				continue;
+
 			xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
 					"Killing URBs for slot ID %u, ep index %u, stream %u",
-					slot_id, ep_index, stream_id + 1);
-			xhci_kill_ring_urbs(xhci,
-					ep->stream_info->stream_rings[stream_id]);
+					slot_id, ep_index, stream_id);
+			xhci_kill_ring_urbs(xhci, ring);
 		}
 	} else {
 		ring = ep->ring;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/renesas_usbhs/common.c linux-libre-4.1.44-gnu/drivers/usb/renesas_usbhs/common.c
--- linux-libre-4.1.43-gnu/drivers/usb/renesas_usbhs/common.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/renesas_usbhs/common.c	2017-09-14 11:55:04.000000000 -0400
@@ -731,8 +731,10 @@ static int usbhsc_resume(struct device *
 	struct usbhs_priv *priv = dev_get_drvdata(dev);
 	struct platform_device *pdev = usbhs_priv_to_pdev(priv);
 
-	if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL))
+	if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL)) {
 		usbhsc_power_ctrl(priv, 1);
+		usbhs_mod_autonomy_mode(priv);
+	}
 
 	usbhs_platform_call(priv, phy_reset, pdev);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/serial/cp210x.c linux-libre-4.1.44-gnu/drivers/usb/serial/cp210x.c
--- linux-libre-4.1.43-gnu/drivers/usb/serial/cp210x.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/serial/cp210x.c	2017-09-14 11:55:04.000000000 -0400
@@ -133,6 +133,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
 	{ USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
 	{ USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
+	{ USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/serial/option.c linux-libre-4.1.44-gnu/drivers/usb/serial/option.c
--- linux-libre-4.1.43-gnu/drivers/usb/serial/option.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/serial/option.c	2017-09-14 11:55:04.000000000 -0400
@@ -2022,6 +2022,8 @@ static const struct usb_device_id option
 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) },			/* D-Link DWM-158 */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff),			/* D-Link DWM-221 B1 */
 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),			/* D-Link DWM-222 */
+	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/serial/pl2303.c linux-libre-4.1.44-gnu/drivers/usb/serial/pl2303.c
--- linux-libre-4.1.43-gnu/drivers/usb/serial/pl2303.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/serial/pl2303.c	2017-09-14 11:55:04.000000000 -0400
@@ -49,6 +49,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
 	{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
+	{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485) },
 	{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
 	{ USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
 	{ USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/serial/pl2303.h linux-libre-4.1.44-gnu/drivers/usb/serial/pl2303.h
--- linux-libre-4.1.43-gnu/drivers/usb/serial/pl2303.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/serial/pl2303.h	2017-09-14 11:55:04.000000000 -0400
@@ -27,6 +27,7 @@
 #define ATEN_VENDOR_ID		0x0557
 #define ATEN_VENDOR_ID2		0x0547
 #define ATEN_PRODUCT_ID		0x2008
+#define ATEN_PRODUCT_UC485	0x2021
 #define ATEN_PRODUCT_ID2	0x2118
 
 #define IODATA_VENDOR_ID	0x04bb
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/storage/isd200.c linux-libre-4.1.44-gnu/drivers/usb/storage/isd200.c
--- linux-libre-4.1.43-gnu/drivers/usb/storage/isd200.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/storage/isd200.c	2017-09-14 11:55:04.000000000 -0400
@@ -1522,8 +1522,11 @@ static void isd200_ata_command(struct sc
 
 	/* Make sure driver was initialized */
 
-	if (us->extra == NULL)
+	if (us->extra == NULL) {
 		usb_stor_dbg(us, "ERROR Driver not initialized\n");
+		srb->result = DID_ERROR << 16;
+		return;
+	}
 
 	scsi_set_resid(srb, 0);
 	/* scsi_bufflen might change in protocol translation to ata */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/usb/storage/unusual_uas.h linux-libre-4.1.44-gnu/drivers/usb/storage/unusual_uas.h
--- linux-libre-4.1.43-gnu/drivers/usb/storage/unusual_uas.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/usb/storage/unusual_uas.h	2017-09-14 11:55:04.000000000 -0400
@@ -123,9 +123,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99
 /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
 UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
 		"Initio Corporation",
-		"",
+		"INIC-3069",
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-		US_FL_NO_ATA_1X),
+		US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE),
 
 /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/vfio/pci/vfio_pci.c linux-libre-4.1.44-gnu/drivers/vfio/pci/vfio_pci.c
--- linux-libre-4.1.43-gnu/drivers/vfio/pci/vfio_pci.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/vfio/pci/vfio_pci.c	2017-09-14 11:55:04.000000000 -0400
@@ -902,6 +902,10 @@ static int vfio_pci_mmap(void *device_da
 			return ret;
 
 		vdev->barmap[index] = pci_iomap(pdev, index, 0);
+		if (!vdev->barmap[index]) {
+			pci_release_selected_regions(pdev, 1 << index);
+			return -ENOMEM;
+		}
 	}
 
 	vma->vm_private_data = vdev;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/vfio/pci/vfio_pci_rdwr.c linux-libre-4.1.44-gnu/drivers/vfio/pci/vfio_pci_rdwr.c
--- linux-libre-4.1.43-gnu/drivers/vfio/pci/vfio_pci_rdwr.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/vfio/pci/vfio_pci_rdwr.c	2017-09-14 11:55:04.000000000 -0400
@@ -190,7 +190,10 @@ ssize_t vfio_pci_vga_rw(struct vfio_pci_
 	if (!vdev->has_vga)
 		return -EINVAL;
 
-	switch (pos) {
+	if (pos > 0xbfffful)
+		return -EINVAL;
+
+	switch ((u32)pos) {
 	case 0xa0000 ... 0xbffff:
 		count = min(count, (size_t)(0xc0000 - pos));
 		iomem = ioremap_nocache(0xa0000, 0xbffff - 0xa0000 + 1);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/vfio/vfio.c linux-libre-4.1.44-gnu/drivers/vfio/vfio.c
--- linux-libre-4.1.43-gnu/drivers/vfio/vfio.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/vfio/vfio.c	2017-09-14 11:55:04.000000000 -0400
@@ -295,6 +295,34 @@ static void vfio_group_put(struct vfio_g
 	kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock);
 }
 
+struct vfio_group_put_work {
+	struct work_struct work;
+	struct vfio_group *group;
+};
+
+static void vfio_group_put_bg(struct work_struct *work)
+{
+	struct vfio_group_put_work *do_work;
+
+	do_work = container_of(work, struct vfio_group_put_work, work);
+
+	vfio_group_put(do_work->group);
+	kfree(do_work);
+}
+
+static void vfio_group_schedule_put(struct vfio_group *group)
+{
+	struct vfio_group_put_work *do_work;
+
+	do_work = kmalloc(sizeof(*do_work), GFP_KERNEL);
+	if (WARN_ON(!do_work))
+		return;
+
+	INIT_WORK(&do_work->work, vfio_group_put_bg);
+	do_work->group = group;
+	schedule_work(&do_work->work);
+}
+
 /* Assume group_lock or group reference is held */
 static void vfio_group_get(struct vfio_group *group)
 {
@@ -601,7 +629,14 @@ static int vfio_iommu_group_notifier(str
 		break;
 	}
 
-	vfio_group_put(group);
+	/*
+	 * If we're the last reference to the group, the group will be
+	 * released, which includes unregistering the iommu group notifier.
+	 * We hold a read-lock on that notifier list, unregistering needs
+	 * a write-lock... deadlock.  Release our reference asynchronously
+	 * to avoid that situation.
+	 */
+	vfio_group_schedule_put(group);
 	return NOTIFY_OK;
 }
 
@@ -1504,6 +1539,15 @@ void vfio_group_put_external_user(struct
 }
 EXPORT_SYMBOL_GPL(vfio_group_put_external_user);
 
+bool vfio_external_group_match_file(struct vfio_group *test_group,
+				    struct file *filep)
+{
+	struct vfio_group *group = filep->private_data;
+
+	return (filep->f_op == &vfio_group_fops) && (group == test_group);
+}
+EXPORT_SYMBOL_GPL(vfio_external_group_match_file);
+
 int vfio_external_user_iommu_id(struct vfio_group *group)
 {
 	return iommu_group_id(group->iommu_group);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/drivers/video/fbdev/cobalt_lcdfb.c linux-libre-4.1.44-gnu/drivers/video/fbdev/cobalt_lcdfb.c
--- linux-libre-4.1.43-gnu/drivers/video/fbdev/cobalt_lcdfb.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/drivers/video/fbdev/cobalt_lcdfb.c	2017-09-14 11:55:04.000000000 -0400
@@ -350,6 +350,11 @@ static int cobalt_lcdfb_probe(struct pla
 	info->screen_size = resource_size(res);
 	info->screen_base = devm_ioremap(&dev->dev, res->start,
 					 info->screen_size);
+	if (!info->screen_base) {
+		framebuffer_release(info);
+		return -ENOMEM;
+	}
+
 	info->fbops = &cobalt_lcd_fbops;
 	info->fix = cobalt_lcdfb_fix;
 	info->fix.smem_start = res->start;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/ext4/file.c linux-libre-4.1.44-gnu/fs/ext4/file.c
--- linux-libre-4.1.43-gnu/fs/ext4/file.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/ext4/file.c	2017-09-14 11:55:04.000000000 -0400
@@ -391,6 +391,8 @@ static int ext4_find_unwritten_pgoff(str
 				lastoff = page_offset(page);
 				bh = head = page_buffers(page);
 				do {
+					if (lastoff + bh->b_size <= startoff)
+						goto next;
 					if (buffer_uptodate(bh) ||
 					    buffer_unwritten(bh)) {
 						if (whence == SEEK_DATA)
@@ -405,6 +407,7 @@ static int ext4_find_unwritten_pgoff(str
 						unlock_page(page);
 						goto out;
 					}
+next:
 					lastoff += bh->b_size;
 					bh = bh->b_this_page;
 				} while (bh != head);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/ext4/resize.c linux-libre-4.1.44-gnu/fs/ext4/resize.c
--- linux-libre-4.1.43-gnu/fs/ext4/resize.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/ext4/resize.c	2017-09-14 11:55:04.000000000 -0400
@@ -1932,7 +1932,8 @@ retry:
 			n_desc_blocks = o_desc_blocks +
 				le16_to_cpu(es->s_reserved_gdt_blocks);
 			n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb);
-			n_blocks_count = n_group * EXT4_BLOCKS_PER_GROUP(sb);
+			n_blocks_count = (ext4_fsblk_t)n_group *
+				EXT4_BLOCKS_PER_GROUP(sb);
 			n_group--; /* set to last group number */
 		}
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/f2fs/acl.c linux-libre-4.1.44-gnu/fs/f2fs/acl.c
--- linux-libre-4.1.43-gnu/fs/f2fs/acl.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/f2fs/acl.c	2017-09-14 11:55:04.000000000 -0400
@@ -213,7 +213,7 @@ static int __f2fs_set_acl(struct inode *
 	switch (type) {
 	case ACL_TYPE_ACCESS:
 		name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS;
-		if (acl) {
+		if (acl && !ipage) {
 			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
 			if (error)
 				return error;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/f2fs/super.c linux-libre-4.1.44-gnu/fs/f2fs/super.c
--- linux-libre-4.1.43-gnu/fs/f2fs/super.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/f2fs/super.c	2017-09-14 11:55:04.000000000 -0400
@@ -979,6 +979,8 @@ static int sanity_check_ckpt(struct f2fs
 	unsigned int total, fsmeta;
 	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
 	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
+	unsigned int main_segs, blocks_per_seg;
+	int i;
 
 	total = le32_to_cpu(raw_super->segment_count);
 	fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
@@ -990,6 +992,20 @@ static int sanity_check_ckpt(struct f2fs
 	if (unlikely(fsmeta >= total))
 		return 1;
 
+	main_segs = le32_to_cpu(raw_super->segment_count_main);
+	blocks_per_seg = sbi->blocks_per_seg;
+
+	for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
+		if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||
+			le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg)
+			return 1;
+	}
+	for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
+		if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||
+			le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)
+			return 1;
+	}
+
 	if (unlikely(f2fs_cp_error(sbi))) {
 		f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");
 		return 1;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/fuse/file.c linux-libre-4.1.44-gnu/fs/fuse/file.c
--- linux-libre-4.1.43-gnu/fs/fuse/file.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/fuse/file.c	2017-09-14 11:55:04.000000000 -0400
@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct
 {
 	struct fuse_file *ff;
 
-	ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
+	ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL);
 	if (unlikely(!ff))
 		return NULL;
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/nfs/dir.c linux-libre-4.1.44-gnu/fs/nfs/dir.c
--- linux-libre-4.1.43-gnu/fs/nfs/dir.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/nfs/dir.c	2017-09-14 11:55:04.000000000 -0400
@@ -1154,11 +1154,13 @@ static int nfs_lookup_revalidate(struct
 	/* Force a full look up iff the parent directory has changed */
 	if (!nfs_is_exclusive_create(dir, flags) &&
 	    nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU)) {
-
-		if (nfs_lookup_verify_inode(inode, flags)) {
+		error = nfs_lookup_verify_inode(inode, flags);
+		if (error) {
 			if (flags & LOOKUP_RCU)
 				return -ECHILD;
-			goto out_zap_parent;
+			if (error == -ESTALE)
+				goto out_zap_parent;
+			goto out_error;
 		}
 		goto out_valid;
 	}
@@ -1182,8 +1184,10 @@ static int nfs_lookup_revalidate(struct
 	trace_nfs_lookup_revalidate_enter(dir, dentry, flags);
 	error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
 	trace_nfs_lookup_revalidate_exit(dir, dentry, flags, error);
-	if (error)
+	if (error == -ESTALE || error == -ENOENT)
 		goto out_bad;
+	if (error)
+		goto out_error;
 	if (nfs_compare_fh(NFS_FH(inode), fhandle))
 		goto out_bad;
 	if ((error = nfs_refresh_inode(inode, fattr)) != 0)
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/nfs/flexfilelayout/flexfilelayoutdev.c linux-libre-4.1.44-gnu/fs/nfs/flexfilelayout/flexfilelayoutdev.c
--- linux-libre-4.1.43-gnu/fs/nfs/flexfilelayout/flexfilelayoutdev.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/nfs/flexfilelayout/flexfilelayoutdev.c	2017-09-14 11:55:04.000000000 -0400
@@ -30,6 +30,7 @@ void nfs4_ff_layout_free_deviceid(struct
 {
 	nfs4_print_deviceid(&mirror_ds->id_node.deviceid);
 	nfs4_pnfs_ds_put(mirror_ds->ds);
+	kfree(mirror_ds->ds_versions);
 	kfree_rcu(mirror_ds, id_node.rcu);
 }
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/nfs/inode.c linux-libre-4.1.44-gnu/fs/nfs/inode.c
--- linux-libre-4.1.43-gnu/fs/nfs/inode.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/nfs/inode.c	2017-09-14 11:55:04.000000000 -0400
@@ -1227,9 +1227,9 @@ static int nfs_check_inode_attributes(st
 		return 0;
 	/* Has the inode gone and changed behind our back? */
 	if ((fattr->valid & NFS_ATTR_FATTR_FILEID) && nfsi->fileid != fattr->fileid)
-		return -EIO;
+		return -ESTALE;
 	if ((fattr->valid & NFS_ATTR_FATTR_TYPE) && (inode->i_mode & S_IFMT) != (fattr->mode & S_IFMT))
-		return -EIO;
+		return -ESTALE;
 
 	if ((fattr->valid & NFS_ATTR_FATTR_CHANGE) != 0 &&
 			inode->i_version != fattr->change_attr)
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/nfs/Kconfig linux-libre-4.1.44-gnu/fs/nfs/Kconfig
--- linux-libre-4.1.43-gnu/fs/nfs/Kconfig	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/nfs/Kconfig	2017-09-14 11:55:04.000000000 -0400
@@ -121,6 +121,7 @@ config PNFS_FILE_LAYOUT
 config PNFS_BLOCK
 	tristate
 	depends on NFS_V4_1 && BLK_DEV_DM
+	depends on 64BIT || LBDAF
 	default NFS_V4
 
 config PNFS_OBJLAYOUT
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/seq_file.c linux-libre-4.1.44-gnu/fs/seq_file.c
--- linux-libre-4.1.43-gnu/fs/seq_file.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/seq_file.c	2017-09-14 11:55:04.000000000 -0400
@@ -62,9 +62,10 @@ int seq_open(struct file *file, const st
 	memset(p, 0, sizeof(*p));
 	mutex_init(&p->lock);
 	p->op = op;
-#ifdef CONFIG_USER_NS
-	p->user_ns = file->f_cred->user_ns;
-#endif
+
+	// No refcounting: the lifetime of 'p' is constrained
+	// to the lifetime of the file.
+	p->file = file;
 
 	/*
 	 * Wrappers around seq_open(e.g. swaps_open) need to be
diff -druNp --no-dereference linux-libre-4.1.43-gnu/fs/udf/inode.c linux-libre-4.1.44-gnu/fs/udf/inode.c
--- linux-libre-4.1.43-gnu/fs/udf/inode.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/fs/udf/inode.c	2017-09-14 11:55:04.000000000 -0400
@@ -1235,8 +1235,8 @@ int udf_setsize(struct inode *inode, lof
 			return err;
 		}
 set_size:
-		truncate_setsize(inode, newsize);
 		up_write(&iinfo->i_data_sem);
+		truncate_setsize(inode, newsize);
 	} else {
 		if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
 			down_write(&iinfo->i_data_sem);
@@ -1253,9 +1253,9 @@ set_size:
 					  udf_get_block);
 		if (err)
 			return err;
+		truncate_setsize(inode, newsize);
 		down_write(&iinfo->i_data_sem);
 		udf_clear_extent_cache(inode);
-		truncate_setsize(inode, newsize);
 		udf_truncate_extents(inode);
 		up_write(&iinfo->i_data_sem);
 	}
diff -druNp --no-dereference linux-libre-4.1.43-gnu/include/linux/phy.h linux-libre-4.1.44-gnu/include/linux/phy.h
--- linux-libre-4.1.43-gnu/include/linux/phy.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/include/linux/phy.h	2017-09-14 11:55:04.000000000 -0400
@@ -751,6 +751,10 @@ int genphy_read_status(struct phy_device
 int genphy_suspend(struct phy_device *phydev);
 int genphy_resume(struct phy_device *phydev);
 int genphy_soft_reset(struct phy_device *phydev);
+static inline int genphy_no_soft_reset(struct phy_device *phydev)
+{
+	return 0;
+}
 void phy_driver_unregister(struct phy_driver *drv);
 void phy_drivers_unregister(struct phy_driver *drv, int n);
 int phy_driver_register(struct phy_driver *new_driver);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/include/linux/sched.h linux-libre-4.1.44-gnu/include/linux/sched.h
--- linux-libre-4.1.43-gnu/include/linux/sched.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/include/linux/sched.h	2017-09-14 11:55:04.000000000 -0400
@@ -774,6 +774,16 @@ struct signal_struct {
 
 #define SIGNAL_UNKILLABLE	0x00000040 /* for init: ignore fatal signals */
 
+#define SIGNAL_STOP_MASK (SIGNAL_CLD_MASK | SIGNAL_STOP_STOPPED | \
+			  SIGNAL_STOP_CONTINUED)
+
+static inline void signal_set_stop_flags(struct signal_struct *sig,
+					 unsigned int flags)
+{
+	WARN_ON(sig->flags & (SIGNAL_GROUP_EXIT|SIGNAL_GROUP_COREDUMP));
+	sig->flags = (sig->flags & ~SIGNAL_STOP_MASK) | flags;
+}
+
 /* If true, all threads except ->group_exit_task have pending SIGKILL */
 static inline int signal_group_exit(const struct signal_struct *sig)
 {
diff -druNp --no-dereference linux-libre-4.1.43-gnu/include/linux/seq_file.h linux-libre-4.1.44-gnu/include/linux/seq_file.h
--- linux-libre-4.1.43-gnu/include/linux/seq_file.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/include/linux/seq_file.h	2017-09-14 11:55:04.000000000 -0400
@@ -7,13 +7,10 @@
 #include <linux/mutex.h>
 #include <linux/cpumask.h>
 #include <linux/nodemask.h>
+#include <linux/fs.h>
+#include <linux/cred.h>
 
 struct seq_operations;
-struct file;
-struct path;
-struct inode;
-struct dentry;
-struct user_namespace;
 
 struct seq_file {
 	char *buf;
@@ -27,9 +24,7 @@ struct seq_file {
 	struct mutex lock;
 	const struct seq_operations *op;
 	int poll_event;
-#ifdef CONFIG_USER_NS
-	struct user_namespace *user_ns;
-#endif
+	const struct file *file;
 	void *private;
 };
 
@@ -141,7 +136,7 @@ int seq_put_decimal_ll(struct seq_file *
 static inline struct user_namespace *seq_user_ns(struct seq_file *seq)
 {
 #ifdef CONFIG_USER_NS
-	return seq->user_ns;
+	return seq->file->f_cred->user_ns;
 #else
 	extern struct user_namespace init_user_ns;
 	return &init_user_ns;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/include/linux/slab.h linux-libre-4.1.44-gnu/include/linux/slab.h
--- linux-libre-4.1.43-gnu/include/linux/slab.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/include/linux/slab.h	2017-09-14 11:55:04.000000000 -0400
@@ -185,7 +185,7 @@ size_t ksize(const void *);
  * (PAGE_SIZE*2).  Larger requests are passed to the page allocator.
  */
 #define KMALLOC_SHIFT_HIGH	(PAGE_SHIFT + 1)
-#define KMALLOC_SHIFT_MAX	(MAX_ORDER + PAGE_SHIFT)
+#define KMALLOC_SHIFT_MAX	(MAX_ORDER + PAGE_SHIFT - 1)
 #ifndef KMALLOC_SHIFT_LOW
 #define KMALLOC_SHIFT_LOW	3
 #endif
@@ -198,7 +198,7 @@ size_t ksize(const void *);
  * be allocated from the same page.
  */
 #define KMALLOC_SHIFT_HIGH	PAGE_SHIFT
-#define KMALLOC_SHIFT_MAX	30
+#define KMALLOC_SHIFT_MAX	(MAX_ORDER + PAGE_SHIFT - 1)
 #ifndef KMALLOC_SHIFT_LOW
 #define KMALLOC_SHIFT_LOW	3
 #endif
diff -druNp --no-dereference linux-libre-4.1.43-gnu/include/linux/vfio.h linux-libre-4.1.44-gnu/include/linux/vfio.h
--- linux-libre-4.1.43-gnu/include/linux/vfio.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/include/linux/vfio.h	2017-09-14 11:55:04.000000000 -0400
@@ -85,6 +85,8 @@ extern void vfio_unregister_iommu_driver
  */
 extern struct vfio_group *vfio_group_get_external_user(struct file *filep);
 extern void vfio_group_put_external_user(struct vfio_group *group);
+extern bool vfio_external_group_match_file(struct vfio_group *group,
+					   struct file *filep);
 extern int vfio_external_user_iommu_id(struct vfio_group *group);
 extern long vfio_external_check_extension(struct vfio_group *group,
 					  unsigned long arg);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/include/net/iw_handler.h linux-libre-4.1.44-gnu/include/net/iw_handler.h
--- linux-libre-4.1.43-gnu/include/net/iw_handler.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/include/net/iw_handler.h	2017-09-14 11:55:04.000000000 -0400
@@ -556,7 +556,8 @@ iwe_stream_add_point(struct iw_request_i
 		memcpy(stream + lcp_len,
 		       ((char *) &iwe->u) + IW_EV_POINT_OFF,
 		       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
-		memcpy(stream + point_len, extra, iwe->u.data.length);
+		if (iwe->u.data.length && extra)
+			memcpy(stream + point_len, extra, iwe->u.data.length);
 		stream += event_len;
 	}
 	return stream;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/include/net/sctp/sctp.h linux-libre-4.1.44-gnu/include/net/sctp/sctp.h
--- linux-libre-4.1.43-gnu/include/net/sctp/sctp.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/include/net/sctp/sctp.h	2017-09-14 11:55:04.000000000 -0400
@@ -444,6 +444,8 @@ _sctp_walk_params((pos), (chunk), ntohs(
 
 #define _sctp_walk_params(pos, chunk, end, member)\
 for (pos.v = chunk->member;\
+     (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\
+      (void *)chunk + end) &&\
      pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
      ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
      pos.v += WORD_ROUND(ntohs(pos.p->length)))
@@ -454,6 +456,8 @@ _sctp_walk_errors((err), (chunk_hdr), nt
 #define _sctp_walk_errors(err, chunk_hdr, end)\
 for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
 	    sizeof(sctp_chunkhdr_t));\
+     ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\
+      (void *)chunk_hdr + end) &&\
      (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
      ntohs(err->length) >= sizeof(sctp_errhdr_t); \
      err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))
diff -druNp --no-dereference linux-libre-4.1.43-gnu/include/target/iscsi/iscsi_target_core.h linux-libre-4.1.44-gnu/include/target/iscsi/iscsi_target_core.h
--- linux-libre-4.1.43-gnu/include/target/iscsi/iscsi_target_core.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/include/target/iscsi/iscsi_target_core.h	2017-09-14 11:55:04.000000000 -0400
@@ -785,6 +785,7 @@ struct iscsi_np {
 	int			np_sock_type;
 	enum np_thread_state_table np_thread_state;
 	bool                    enabled;
+	atomic_t		np_reset_count;
 	enum iscsi_timer_flags_table np_login_timer_flags;
 	u32			np_exports;
 	enum np_flags_table	np_flags;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/kernel/events/core.c linux-libre-4.1.44-gnu/kernel/events/core.c
--- linux-libre-4.1.43-gnu/kernel/events/core.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/kernel/events/core.c	2017-09-14 11:55:04.000000000 -0400
@@ -6111,21 +6111,6 @@ static void perf_log_itrace_start(struct
 	perf_output_end(&handle);
 }
 
-static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs)
-{
-	/*
-	 * Due to interrupt latency (AKA "skid"), we may enter the
-	 * kernel before taking an overflow, even if the PMU is only
-	 * counting user events.
-	 * To avoid leaking information to userspace, we must always
-	 * reject kernel samples when exclude_kernel is set.
-	 */
-	if (event->attr.exclude_kernel && !user_mode(regs))
-		return false;
-
-	return true;
-}
-
 /*
  * Generic event overflow handling, sampling.
  */
@@ -6173,12 +6158,6 @@ static int __perf_event_overflow(struct
 	}
 
 	/*
-	 * For security, drop the skid kernel samples if necessary.
-	 */
-	if (!sample_is_allowed(event, regs))
-		return ret;
-
-	/*
 	 * XXX event_limit might not quite work as expected on inherited
 	 * events
 	 */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/kernel/resource.c linux-libre-4.1.44-gnu/kernel/resource.c
--- linux-libre-4.1.43-gnu/kernel/resource.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/kernel/resource.c	2017-09-14 11:55:04.000000000 -0400
@@ -105,16 +105,25 @@ static int r_show(struct seq_file *m, vo
 {
 	struct resource *root = m->private;
 	struct resource *r = v, *p;
+	unsigned long long start, end;
 	int width = root->end < 0x10000 ? 4 : 8;
 	int depth;
 
 	for (depth = 0, p = r; depth < MAX_IORES_LEVEL; depth++, p = p->parent)
 		if (p->parent == root)
 			break;
+
+	if (file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) {
+		start = r->start;
+		end = r->end;
+	} else {
+		start = end = 0;
+	}
+
 	seq_printf(m, "%*s%0*llx-%0*llx : %s\n",
 			depth * 2, "",
-			width, (unsigned long long) r->start,
-			width, (unsigned long long) r->end,
+			width, start,
+			width, end,
 			r->name ? r->name : "<BAD>");
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/kernel/signal.c linux-libre-4.1.44-gnu/kernel/signal.c
--- linux-libre-4.1.43-gnu/kernel/signal.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/kernel/signal.c	2017-09-14 11:55:04.000000000 -0400
@@ -346,7 +346,7 @@ static bool task_participate_group_stop(
 	 * fresh group stop.  Read comment in do_signal_stop() for details.
 	 */
 	if (!sig->group_stop_count && !(sig->flags & SIGNAL_STOP_STOPPED)) {
-		sig->flags = SIGNAL_STOP_STOPPED;
+		signal_set_stop_flags(sig, SIGNAL_STOP_STOPPED);
 		return true;
 	}
 	return false;
@@ -888,7 +888,7 @@ static bool prepare_signal(int sig, stru
 			 * will take ->siglock, notice SIGNAL_CLD_MASK, and
 			 * notify its parent. See get_signal_to_deliver().
 			 */
-			signal->flags = why | SIGNAL_STOP_CONTINUED;
+			signal_set_stop_flags(signal, why | SIGNAL_STOP_CONTINUED);
 			signal->group_stop_count = 0;
 			signal->group_exit_code = 0;
 		}
diff -druNp --no-dereference linux-libre-4.1.43-gnu/kernel/workqueue.c linux-libre-4.1.44-gnu/kernel/workqueue.c
--- linux-libre-4.1.43-gnu/kernel/workqueue.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/kernel/workqueue.c	2017-09-14 11:55:04.000000000 -0400
@@ -3854,6 +3854,16 @@ struct workqueue_struct *__alloc_workque
 	struct workqueue_struct *wq;
 	struct pool_workqueue *pwq;
 
+	/*
+	 * Unbound && max_active == 1 used to imply ordered, which is no
+	 * longer the case on NUMA machines due to per-node pools.  While
+	 * alloc_ordered_workqueue() is the right way to create an ordered
+	 * workqueue, keep the previous behavior to avoid subtle breakages
+	 * on NUMA.
+	 */
+	if ((flags & WQ_UNBOUND) && max_active == 1)
+		flags |= __WQ_ORDERED;
+
 	/* see the comment above the definition of WQ_POWER_EFFICIENT */
 	if ((flags & WQ_POWER_EFFICIENT) && wq_power_efficient)
 		flags |= WQ_UNBOUND;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/lib/Kconfig.debug linux-libre-4.1.44-gnu/lib/Kconfig.debug
--- linux-libre-4.1.43-gnu/lib/Kconfig.debug	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/lib/Kconfig.debug	2017-09-14 11:55:04.000000000 -0400
@@ -145,7 +145,7 @@ config DEBUG_INFO_REDUCED
 
 config DEBUG_INFO_SPLIT
 	bool "Produce split debuginfo in .dwo files"
-	depends on DEBUG_INFO
+	depends on DEBUG_INFO && !FRV
 	help
 	  Generate debug info into separate .dwo files. This significantly
 	  reduces the build directory size for builds with DEBUG_INFO,
diff -druNp --no-dereference linux-libre-4.1.43-gnu/Makefile linux-libre-4.1.44-gnu/Makefile
--- linux-libre-4.1.43-gnu/Makefile	2017-08-06 01:12:42.000000000 -0400
+++ linux-libre-4.1.44-gnu/Makefile	2017-09-19 12:08:23.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 1
-SUBLEVEL = 43
+SUBLEVEL = 44
 EXTRAVERSION = -gnu
 NAME = Series 4800
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/mm/mempool.c linux-libre-4.1.44-gnu/mm/mempool.c
--- linux-libre-4.1.43-gnu/mm/mempool.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/mm/mempool.c	2017-09-14 11:55:04.000000000 -0400
@@ -135,8 +135,8 @@ static void *remove_element(mempool_t *p
 	void *element = pool->elements[--pool->curr_nr];
 
 	BUG_ON(pool->curr_nr < 0);
-	check_element(pool, element);
 	kasan_unpoison_element(pool, element);
+	check_element(pool, element);
 	return element;
 }
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/mm/page_alloc.c linux-libre-4.1.44-gnu/mm/page_alloc.c
--- linux-libre-4.1.43-gnu/mm/page_alloc.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/mm/page_alloc.c	2017-09-14 11:55:04.000000000 -0400
@@ -1106,14 +1106,14 @@ int move_freepages(struct zone *zone,
 #endif
 
 	for (page = start_page; page <= end_page;) {
-		/* Make sure we are not inadvertently changing nodes */
-		VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
-
 		if (!pfn_valid_within(page_to_pfn(page))) {
 			page++;
 			continue;
 		}
 
+		/* Make sure we are not inadvertently changing nodes */
+		VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
+
 		if (!PageBuddy(page)) {
 			page++;
 			continue;
@@ -5555,8 +5555,8 @@ unsigned long free_reserved_area(void *s
 	}
 
 	if (pages && s)
-		pr_info("Freeing %s memory: %ldK (%p - %p)\n",
-			s, pages << (PAGE_SHIFT - 10), start, end);
+		pr_info("Freeing %s memory: %ldK\n",
+			s, pages << (PAGE_SHIFT - 10));
 
 	return pages;
 }
@@ -6513,7 +6513,7 @@ int alloc_contig_range(unsigned long sta
 
 	/* Make sure the range is really isolated. */
 	if (test_pages_isolated(outer_start, end, false)) {
-		pr_info("%s: [%lx, %lx) PFNs busy\n",
+		pr_info_ratelimited("%s: [%lx, %lx) PFNs busy\n",
 			__func__, outer_start, end);
 		ret = -EBUSY;
 		goto done;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/8021q/vlan.c linux-libre-4.1.44-gnu/net/8021q/vlan.c
--- linux-libre-4.1.43-gnu/net/8021q/vlan.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/8021q/vlan.c	2017-09-14 11:55:04.000000000 -0400
@@ -292,6 +292,10 @@ static void vlan_sync_address(struct net
 	if (ether_addr_equal(vlan->real_dev_addr, dev->dev_addr))
 		return;
 
+	/* vlan continues to inherit address of lower device */
+	if (vlan_dev_inherit_address(vlandev, dev))
+		goto out;
+
 	/* vlan address was different from the old address and is equal to
 	 * the new address */
 	if (!ether_addr_equal(vlandev->dev_addr, vlan->real_dev_addr) &&
@@ -304,6 +308,7 @@ static void vlan_sync_address(struct net
 	    !ether_addr_equal(vlandev->dev_addr, dev->dev_addr))
 		dev_uc_add(dev, vlandev->dev_addr);
 
+out:
 	ether_addr_copy(vlan->real_dev_addr, dev->dev_addr);
 }
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/8021q/vlan_dev.c linux-libre-4.1.44-gnu/net/8021q/vlan_dev.c
--- linux-libre-4.1.43-gnu/net/8021q/vlan_dev.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/8021q/vlan_dev.c	2017-09-14 11:55:04.000000000 -0400
@@ -244,6 +244,17 @@ void vlan_dev_get_realdev_name(const str
 	strncpy(result, vlan_dev_priv(dev)->real_dev->name, 23);
 }
 
+bool vlan_dev_inherit_address(struct net_device *dev,
+			      struct net_device *real_dev)
+{
+	if (dev->addr_assign_type != NET_ADDR_STOLEN)
+		return false;
+
+	ether_addr_copy(dev->dev_addr, real_dev->dev_addr);
+	call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+	return true;
+}
+
 static int vlan_dev_open(struct net_device *dev)
 {
 	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
@@ -254,7 +265,8 @@ static int vlan_dev_open(struct net_devi
 	    !(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
 		return -ENETDOWN;
 
-	if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr)) {
+	if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr) &&
+	    !vlan_dev_inherit_address(dev, real_dev)) {
 		err = dev_uc_add(real_dev, dev->dev_addr);
 		if (err < 0)
 			goto out;
@@ -558,8 +570,10 @@ static int vlan_dev_init(struct net_devi
 	/* ipv6 shared card related stuff */
 	dev->dev_id = real_dev->dev_id;
 
-	if (is_zero_ether_addr(dev->dev_addr))
-		eth_hw_addr_inherit(dev, real_dev);
+	if (is_zero_ether_addr(dev->dev_addr)) {
+		ether_addr_copy(dev->dev_addr, real_dev->dev_addr);
+		dev->addr_assign_type = NET_ADDR_STOLEN;
+	}
 	if (is_zero_ether_addr(dev->broadcast))
 		memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/8021q/vlan.h linux-libre-4.1.44-gnu/net/8021q/vlan.h
--- linux-libre-4.1.43-gnu/net/8021q/vlan.h	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/8021q/vlan.h	2017-09-14 11:55:04.000000000 -0400
@@ -109,6 +109,8 @@ int vlan_check_real_dev(struct net_devic
 void vlan_setup(struct net_device *dev);
 int register_vlan_dev(struct net_device *dev);
 void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
+bool vlan_dev_inherit_address(struct net_device *dev,
+			      struct net_device *real_dev);
 
 static inline u32 vlan_get_ingress_priority(struct net_device *dev,
 					    u16 vlan_tci)
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/bluetooth/smp.c linux-libre-4.1.44-gnu/net/bluetooth/smp.c
--- linux-libre-4.1.43-gnu/net/bluetooth/smp.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/bluetooth/smp.c	2017-09-14 11:55:04.000000000 -0400
@@ -23,6 +23,7 @@
 #include <linux/debugfs.h>
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
+#include <crypto/algapi.h>
 #include <crypto/b128ops.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -506,7 +507,7 @@ bool smp_irk_matches(struct hci_dev *hde
 	if (err)
 		return false;
 
-	return !memcmp(bdaddr->b, hash, 3);
+	return !crypto_memneq(bdaddr->b, hash, 3);
 }
 
 int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa)
@@ -559,7 +560,7 @@ int smp_generate_oob(struct hci_dev *hde
 			/* This is unlikely, but we need to check that
 			 * we didn't accidentially generate a debug key.
 			 */
-			if (memcmp(smp->local_sk, debug_sk, 32))
+			if (crypto_memneq(smp->local_sk, debug_sk, 32))
 				break;
 		}
 		smp->debug_key = false;
@@ -973,7 +974,7 @@ static u8 smp_random(struct smp_chan *sm
 	if (ret)
 		return SMP_UNSPECIFIED;
 
-	if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
+	if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
 		BT_ERR("Pairing failed (confirmation values mismatch)");
 		return SMP_CONFIRM_FAILED;
 	}
@@ -1490,7 +1491,7 @@ static u8 sc_passkey_round(struct smp_ch
 			   smp->rrnd, r, cfm))
 			return SMP_UNSPECIFIED;
 
-		if (memcmp(smp->pcnf, cfm, 16))
+		if (crypto_memneq(smp->pcnf, cfm, 16))
 			return SMP_CONFIRM_FAILED;
 
 		smp->passkey_round++;
@@ -1874,7 +1875,7 @@ static u8 sc_send_public_key(struct smp_
 			/* This is unlikely, but we need to check that
 			 * we didn't accidentially generate a debug key.
 			 */
-			if (memcmp(smp->local_sk, debug_sk, 32))
+			if (crypto_memneq(smp->local_sk, debug_sk, 32))
 				break;
 		}
 	}
@@ -2139,7 +2140,7 @@ static u8 smp_cmd_pairing_random(struct
 		if (err)
 			return SMP_UNSPECIFIED;
 
-		if (memcmp(smp->pcnf, cfm, 16))
+		if (crypto_memneq(smp->pcnf, cfm, 16))
 			return SMP_CONFIRM_FAILED;
 	} else {
 		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
@@ -2594,7 +2595,7 @@ static int smp_cmd_public_key(struct l2c
 		if (err)
 			return SMP_UNSPECIFIED;
 
-		if (memcmp(cfm.confirm_val, smp->pcnf, 16))
+		if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16))
 			return SMP_CONFIRM_FAILED;
 	}
 
@@ -2627,7 +2628,7 @@ static int smp_cmd_public_key(struct l2c
 	else
 		hcon->pending_sec_level = BT_SECURITY_FIPS;
 
-	if (!memcmp(debug_pk, smp->remote_pk, 64))
+	if (!crypto_memneq(debug_pk, smp->remote_pk, 64))
 		set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
 
 	if (smp->method == DSP_PASSKEY) {
@@ -2726,7 +2727,7 @@ static int smp_cmd_dhkey_check(struct l2
 	if (err)
 		return SMP_UNSPECIFIED;
 
-	if (memcmp(check->e, e, 16))
+	if (crypto_memneq(check->e, e, 16))
 		return SMP_DHKEY_CHECK_FAILED;
 
 	if (!hcon->out) {
@@ -3336,7 +3337,7 @@ static int __init test_ah(struct crypto_
 	if (err)
 		return err;
 
-	if (memcmp(res, exp, 3))
+	if (crypto_memneq(res, exp, 3))
 		return -EINVAL;
 
 	return 0;
@@ -3366,7 +3367,7 @@ static int __init test_c1(struct crypto_
 	if (err)
 		return err;
 
-	if (memcmp(res, exp, 16))
+	if (crypto_memneq(res, exp, 16))
 		return -EINVAL;
 
 	return 0;
@@ -3391,7 +3392,7 @@ static int __init test_s1(struct crypto_
 	if (err)
 		return err;
 
-	if (memcmp(res, exp, 16))
+	if (crypto_memneq(res, exp, 16))
 		return -EINVAL;
 
 	return 0;
@@ -3423,7 +3424,7 @@ static int __init test_f4(struct crypto_
 	if (err)
 		return err;
 
-	if (memcmp(res, exp, 16))
+	if (crypto_memneq(res, exp, 16))
 		return -EINVAL;
 
 	return 0;
@@ -3457,10 +3458,10 @@ static int __init test_f5(struct crypto_
 	if (err)
 		return err;
 
-	if (memcmp(mackey, exp_mackey, 16))
+	if (crypto_memneq(mackey, exp_mackey, 16))
 		return -EINVAL;
 
-	if (memcmp(ltk, exp_ltk, 16))
+	if (crypto_memneq(ltk, exp_ltk, 16))
 		return -EINVAL;
 
 	return 0;
@@ -3493,7 +3494,7 @@ static int __init test_f6(struct crypto_
 	if (err)
 		return err;
 
-	if (memcmp(res, exp, 16))
+	if (crypto_memneq(res, exp, 16))
 		return -EINVAL;
 
 	return 0;
@@ -3547,7 +3548,7 @@ static int __init test_h6(struct crypto_
 	if (err)
 		return err;
 
-	if (memcmp(res, exp, 16))
+	if (crypto_memneq(res, exp, 16))
 		return -EINVAL;
 
 	return 0;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/core/dev.c linux-libre-4.1.44-gnu/net/core/dev.c
--- linux-libre-4.1.43-gnu/net/core/dev.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/core/dev.c	2017-09-14 11:55:04.000000000 -0400
@@ -2465,9 +2465,10 @@ EXPORT_SYMBOL(skb_mac_gso_segment);
 static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
 {
 	if (tx_path)
-		return skb->ip_summed != CHECKSUM_PARTIAL;
-	else
-		return skb->ip_summed == CHECKSUM_NONE;
+		return skb->ip_summed != CHECKSUM_PARTIAL &&
+		       skb->ip_summed != CHECKSUM_UNNECESSARY;
+
+	return skb->ip_summed == CHECKSUM_NONE;
 }
 
 /**
@@ -2486,11 +2487,12 @@ static inline bool skb_needs_check(struc
 struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
 				  netdev_features_t features, bool tx_path)
 {
+	struct sk_buff *segs;
+
 	if (unlikely(skb_needs_check(skb, tx_path))) {
 		int err;
 
-		skb_warn_bad_offload(skb);
-
+		/* We're going to init ->check field in TCP or UDP header */
 		err = skb_cow_head(skb, 0);
 		if (err < 0)
 			return ERR_PTR(err);
@@ -2505,7 +2507,12 @@ struct sk_buff *__skb_gso_segment(struct
 	skb_reset_mac_header(skb);
 	skb_reset_mac_len(skb);
 
-	return skb_mac_gso_segment(skb, features);
+	segs = skb_mac_gso_segment(skb, features);
+
+	if (unlikely(skb_needs_check(skb, tx_path)))
+		skb_warn_bad_offload(skb);
+
+	return segs;
 }
 EXPORT_SYMBOL(__skb_gso_segment);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/core/dev_ioctl.c linux-libre-4.1.44-gnu/net/core/dev_ioctl.c
--- linux-libre-4.1.43-gnu/net/core/dev_ioctl.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/core/dev_ioctl.c	2017-09-14 11:55:04.000000000 -0400
@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, s
 
 	if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
 		return -EFAULT;
+	ifr.ifr_name[IFNAMSIZ-1] = 0;
 
 	error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
 	if (error)
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/core/rtnetlink.c linux-libre-4.1.44-gnu/net/core/rtnetlink.c
--- linux-libre-4.1.43-gnu/net/core/rtnetlink.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/core/rtnetlink.c	2017-09-14 11:55:04.000000000 -0400
@@ -1628,7 +1628,8 @@ static int do_setlink(const struct sk_bu
 		struct sockaddr *sa;
 		int len;
 
-		len = sizeof(sa_family_t) + dev->addr_len;
+		len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
+						  sizeof(*sa));
 		sa = kmalloc(len, GFP_KERNEL);
 		if (!sa) {
 			err = -ENOMEM;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/dccp/feat.c linux-libre-4.1.44-gnu/net/dccp/feat.c
--- linux-libre-4.1.43-gnu/net/dccp/feat.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/dccp/feat.c	2017-09-14 11:55:04.000000000 -0400
@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk)
 	 * singleton values (which always leads to failure).
 	 * These settings can still (later) be overridden via sockopts.
 	 */
-	if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
-	    ccid_get_builtin_ccids(&rx.val, &rx.len))
+	if (ccid_get_builtin_ccids(&tx.val, &tx.len))
 		return -ENOBUFS;
+	if (ccid_get_builtin_ccids(&rx.val, &rx.len)) {
+		kfree(tx.val);
+		return -ENOBUFS;
+	}
 
 	if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
 	    !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/dccp/ipv4.c linux-libre-4.1.44-gnu/net/dccp/ipv4.c
--- linux-libre-4.1.43-gnu/net/dccp/ipv4.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/dccp/ipv4.c	2017-09-14 11:55:04.000000000 -0400
@@ -661,6 +661,7 @@ int dccp_v4_conn_request(struct sock *sk
 		goto drop_and_free;
 
 	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
+	reqsk_put(req);
 	return 0;
 
 drop_and_free:
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/ipv4/fib_frontend.c linux-libre-4.1.44-gnu/net/ipv4/fib_frontend.c
--- linux-libre-4.1.43-gnu/net/ipv4/fib_frontend.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/ipv4/fib_frontend.c	2017-09-14 11:55:04.000000000 -0400
@@ -1247,13 +1247,14 @@ static struct pernet_operations fib_net_
 
 void __init ip_fib_init(void)
 {
-	rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
-	rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
-	rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
+	fib_trie_init();
 
 	register_pernet_subsys(&fib_net_ops);
+
 	register_netdevice_notifier(&fib_netdev_notifier);
 	register_inetaddr_notifier(&fib_inetaddr_notifier);
 
-	fib_trie_init();
+	rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+	rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+	rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/ipv4/ip_output.c linux-libre-4.1.44-gnu/net/ipv4/ip_output.c
--- linux-libre-4.1.43-gnu/net/ipv4/ip_output.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/ipv4/ip_output.c	2017-09-14 11:55:04.000000000 -0400
@@ -891,7 +891,7 @@ static int __ip_append_data(struct sock
 		csummode = CHECKSUM_PARTIAL;
 
 	cork->length += length;
-	if (((length > mtu) || (skb && skb_is_gso(skb))) &&
+	if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
 	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
 	    (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/ipv4/tcp_input.c linux-libre-4.1.44-gnu/net/ipv4/tcp_input.c
--- linux-libre-4.1.43-gnu/net/ipv4/tcp_input.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/ipv4/tcp_input.c	2017-09-14 11:55:04.000000000 -0400
@@ -2536,8 +2536,8 @@ static inline void tcp_end_cwnd_reductio
 	struct tcp_sock *tp = tcp_sk(sk);
 
 	/* Reset cwnd to ssthresh in CWR or Recovery (unless it's undone) */
-	if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR ||
-	    (tp->undo_marker && tp->snd_ssthresh < TCP_INFINITE_SSTHRESH)) {
+	if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH &&
+	    (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR || tp->undo_marker)) {
 		tp->snd_cwnd = tp->snd_ssthresh;
 		tp->snd_cwnd_stamp = tcp_time_stamp;
 	}
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/ipv4/udp_offload.c linux-libre-4.1.44-gnu/net/ipv4/udp_offload.c
--- linux-libre-4.1.43-gnu/net/ipv4/udp_offload.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/ipv4/udp_offload.c	2017-09-14 11:55:04.000000000 -0400
@@ -231,7 +231,7 @@ static struct sk_buff *udp4_ufo_fragment
 	if (uh->check == 0)
 		uh->check = CSUM_MANGLED_0;
 
-	skb->ip_summed = CHECKSUM_NONE;
+	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
 	/* Fragment the skb. IP headers of the fragments are updated in
 	 * inet_gso_segment()
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/ipv6/ip6_output.c linux-libre-4.1.44-gnu/net/ipv6/ip6_output.c
--- linux-libre-4.1.43-gnu/net/ipv6/ip6_output.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/ipv6/ip6_output.c	2017-09-14 11:55:04.000000000 -0400
@@ -1340,7 +1340,7 @@ emsgsize:
 	 */
 
 	cork->length += length;
-	if (((length > mtu) ||
+	if ((((length + fragheaderlen) > mtu) ||
 	     (skb && skb_is_gso(skb))) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
 	    (rt->dst.dev->features & NETIF_F_UFO) &&
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/ipv6/output_core.c linux-libre-4.1.44-gnu/net/ipv6/output_core.c
--- linux-libre-4.1.43-gnu/net/ipv6/output_core.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/ipv6/output_core.c	2017-09-14 11:55:04.000000000 -0400
@@ -76,7 +76,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
 
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
-	u16 offset = sizeof(struct ipv6hdr);
+	unsigned int offset = sizeof(struct ipv6hdr);
 	unsigned int packet_len = skb_tail_pointer(skb) -
 		skb_network_header(skb);
 	int found_rhdr = 0;
@@ -84,6 +84,7 @@ int ip6_find_1stfragopt(struct sk_buff *
 
 	while (offset <= packet_len) {
 		struct ipv6_opt_hdr *exthdr;
+		unsigned int len;
 
 		switch (**nexthdr) {
 
@@ -109,7 +110,10 @@ int ip6_find_1stfragopt(struct sk_buff *
 
 		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
 						 offset);
-		offset += ipv6_optlen(exthdr);
+		len = ipv6_optlen(exthdr);
+		if (len + offset >= IPV6_MAXPLEN)
+			return -EINVAL;
+		offset += len;
 		*nexthdr = &exthdr->nexthdr;
 	}
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/ipv6/udp_offload.c linux-libre-4.1.44-gnu/net/ipv6/udp_offload.c
--- linux-libre-4.1.43-gnu/net/ipv6/udp_offload.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/ipv6/udp_offload.c	2017-09-14 11:55:04.000000000 -0400
@@ -86,7 +86,7 @@ static struct sk_buff *udp6_ufo_fragment
 		if (uh->check == 0)
 			uh->check = CSUM_MANGLED_0;
 
-		skb->ip_summed = CHECKSUM_NONE;
+		skb->ip_summed = CHECKSUM_UNNECESSARY;
 
 		/* Check if there is enough headroom to insert fragment header. */
 		tnl_hlen = skb_tnl_header_len(skb);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/key/af_key.c linux-libre-4.1.44-gnu/net/key/af_key.c
--- linux-libre-4.1.43-gnu/net/key/af_key.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/key/af_key.c	2017-09-14 11:55:04.000000000 -0400
@@ -63,8 +63,13 @@ struct pfkey_sock {
 		} u;
 		struct sk_buff	*skb;
 	} dump;
+	struct mutex dump_lock;
 };
 
+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+			       xfrm_address_t *saddr, xfrm_address_t *daddr,
+			       u16 *family);
+
 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
 {
 	return (struct pfkey_sock *)sk;
@@ -139,6 +144,7 @@ static int pfkey_create(struct net *net,
 {
 	struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
 	struct sock *sk;
+	struct pfkey_sock *pfk;
 	int err;
 
 	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
@@ -153,6 +159,9 @@ static int pfkey_create(struct net *net,
 	if (sk == NULL)
 		goto out;
 
+	pfk = pfkey_sk(sk);
+	mutex_init(&pfk->dump_lock);
+
 	sock->ops = &pfkey_ops;
 	sock_init_data(sock, sk);
 
@@ -281,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_so
 	struct sadb_msg *hdr;
 	int rc;
 
+	mutex_lock(&pfk->dump_lock);
+	if (!pfk->dump.dump) {
+		rc = 0;
+		goto out;
+	}
+
 	rc = pfk->dump.dump(pfk);
-	if (rc == -ENOBUFS)
-		return 0;
+	if (rc == -ENOBUFS) {
+		rc = 0;
+		goto out;
+	}
 
 	if (pfk->dump.skb) {
-		if (!pfkey_can_dump(&pfk->sk))
-			return 0;
+		if (!pfkey_can_dump(&pfk->sk)) {
+			rc = 0;
+			goto out;
+		}
 
 		hdr = (struct sadb_msg *) pfk->dump.skb->data;
 		hdr->sadb_msg_seq = 0;
@@ -298,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_so
 	}
 
 	pfkey_terminate_dump(pfk);
+
+out:
+	mutex_unlock(&pfk->dump_lock);
 	return rc;
 }
 
@@ -1801,19 +1823,26 @@ static int pfkey_dump(struct sock *sk, s
 	struct xfrm_address_filter *filter = NULL;
 	struct pfkey_sock *pfk = pfkey_sk(sk);
 
-	if (pfk->dump.dump != NULL)
+	mutex_lock(&pfk->dump_lock);
+	if (pfk->dump.dump != NULL) {
+		mutex_unlock(&pfk->dump_lock);
 		return -EBUSY;
+	}
 
 	proto = pfkey_satype2proto(hdr->sadb_msg_satype);
-	if (proto == 0)
+	if (proto == 0) {
+		mutex_unlock(&pfk->dump_lock);
 		return -EINVAL;
+	}
 
 	if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
 		struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
 
 		filter = kmalloc(sizeof(*filter), GFP_KERNEL);
-		if (filter == NULL)
+		if (filter == NULL) {
+			mutex_unlock(&pfk->dump_lock);
 			return -ENOMEM;
+		}
 
 		memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
 		       sizeof(xfrm_address_t));
@@ -1829,6 +1858,7 @@ static int pfkey_dump(struct sock *sk, s
 	pfk->dump.dump = pfkey_dump_sa;
 	pfk->dump.done = pfkey_dump_sa_done;
 	xfrm_state_walk_init(&pfk->dump.u.state, proto, filter);
+	mutex_unlock(&pfk->dump_lock);
 
 	return pfkey_do_dump(pfk);
 }
@@ -1921,19 +1951,14 @@ parse_ipsecrequest(struct xfrm_policy *x
 
 	/* addresses present only in tunnel mode */
 	if (t->mode == XFRM_MODE_TUNNEL) {
-		u8 *sa = (u8 *) (rq + 1);
-		int family, socklen;
-
-		family = pfkey_sockaddr_extract((struct sockaddr *)sa,
-						&t->saddr);
-		if (!family)
-			return -EINVAL;
+		int err;
 
-		socklen = pfkey_sockaddr_len(family);
-		if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
-					   &t->id.daddr) != family)
-			return -EINVAL;
-		t->encap_family = family;
+		err = parse_sockaddr_pair(
+			(struct sockaddr *)(rq + 1),
+			rq->sadb_x_ipsecrequest_len - sizeof(*rq),
+			&t->saddr, &t->id.daddr, &t->encap_family);
+		if (err)
+			return err;
 	} else
 		t->encap_family = xp->family;
 
@@ -1953,7 +1978,11 @@ parse_ipsecrequests(struct xfrm_policy *
 	if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
 		return -EINVAL;
 
-	while (len >= sizeof(struct sadb_x_ipsecrequest)) {
+	while (len >= sizeof(*rq)) {
+		if (len < rq->sadb_x_ipsecrequest_len ||
+		    rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+			return -EINVAL;
+
 		if ((err = parse_ipsecrequest(xp, rq)) < 0)
 			return err;
 		len -= rq->sadb_x_ipsecrequest_len;
@@ -2416,7 +2445,6 @@ out:
 	return err;
 }
 
-#ifdef CONFIG_NET_KEY_MIGRATE
 static int pfkey_sockaddr_pair_size(sa_family_t family)
 {
 	return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
@@ -2428,7 +2456,7 @@ static int parse_sockaddr_pair(struct so
 {
 	int af, socklen;
 
-	if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
+	if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
 		return -EINVAL;
 
 	af = pfkey_sockaddr_extract(sa, saddr);
@@ -2444,6 +2472,7 @@ static int parse_sockaddr_pair(struct so
 	return 0;
 }
 
+#ifdef CONFIG_NET_KEY_MIGRATE
 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
 				    struct xfrm_migrate *m)
 {
@@ -2451,13 +2480,14 @@ static int ipsecrequests_to_migrate(stru
 	struct sadb_x_ipsecrequest *rq2;
 	int mode;
 
-	if (len <= sizeof(struct sadb_x_ipsecrequest) ||
-	    len < rq1->sadb_x_ipsecrequest_len)
+	if (len < sizeof(*rq1) ||
+	    len < rq1->sadb_x_ipsecrequest_len ||
+	    rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
 		return -EINVAL;
 
 	/* old endoints */
 	err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
-				  rq1->sadb_x_ipsecrequest_len,
+				  rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
 				  &m->old_saddr, &m->old_daddr,
 				  &m->old_family);
 	if (err)
@@ -2466,13 +2496,14 @@ static int ipsecrequests_to_migrate(stru
 	rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
 	len -= rq1->sadb_x_ipsecrequest_len;
 
-	if (len <= sizeof(struct sadb_x_ipsecrequest) ||
-	    len < rq2->sadb_x_ipsecrequest_len)
+	if (len <= sizeof(*rq2) ||
+	    len < rq2->sadb_x_ipsecrequest_len ||
+	    rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
 		return -EINVAL;
 
 	/* new endpoints */
 	err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
-				  rq2->sadb_x_ipsecrequest_len,
+				  rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
 				  &m->new_saddr, &m->new_daddr,
 				  &m->new_family);
 	if (err)
@@ -2687,14 +2718,18 @@ static int pfkey_spddump(struct sock *sk
 {
 	struct pfkey_sock *pfk = pfkey_sk(sk);
 
-	if (pfk->dump.dump != NULL)
+	mutex_lock(&pfk->dump_lock);
+	if (pfk->dump.dump != NULL) {
+		mutex_unlock(&pfk->dump_lock);
 		return -EBUSY;
+	}
 
 	pfk->dump.msg_version = hdr->sadb_msg_version;
 	pfk->dump.msg_portid = hdr->sadb_msg_pid;
 	pfk->dump.dump = pfkey_dump_sp;
 	pfk->dump.done = pfkey_dump_sp_done;
 	xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN);
+	mutex_unlock(&pfk->dump_lock);
 
 	return pfkey_do_dump(pfk);
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/nfc/core.c linux-libre-4.1.44-gnu/net/nfc/core.c
--- linux-libre-4.1.43-gnu/net/nfc/core.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/nfc/core.c	2017-09-14 11:55:04.000000000 -0400
@@ -969,6 +969,8 @@ static void nfc_release(struct device *d
 			kfree(se);
 	}
 
+	ida_simple_remove(&nfc_index_ida, dev->idx);
+
 	kfree(dev);
 }
 
@@ -1043,6 +1045,7 @@ struct nfc_dev *nfc_allocate_device(stru
 				    int tx_headroom, int tx_tailroom)
 {
 	struct nfc_dev *dev;
+	int rc;
 
 	if (!ops->start_poll || !ops->stop_poll || !ops->activate_target ||
 	    !ops->deactivate_target || !ops->im_transceive)
@@ -1055,6 +1058,15 @@ struct nfc_dev *nfc_allocate_device(stru
 	if (!dev)
 		return NULL;
 
+	rc = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
+	if (rc < 0)
+		goto err_free_dev;
+	dev->idx = rc;
+
+	dev->dev.class = &nfc_class;
+	dev_set_name(&dev->dev, "nfc%d", dev->idx);
+	device_initialize(&dev->dev);
+
 	dev->ops = ops;
 	dev->supported_protocols = supported_protocols;
 	dev->tx_headroom = tx_headroom;
@@ -1077,6 +1089,11 @@ struct nfc_dev *nfc_allocate_device(stru
 	}
 
 	return dev;
+
+err_free_dev:
+	kfree(dev);
+
+	return ERR_PTR(rc);
 }
 EXPORT_SYMBOL(nfc_allocate_device);
 
@@ -1091,14 +1108,6 @@ int nfc_register_device(struct nfc_dev *
 
 	pr_debug("dev_name=%s\n", dev_name(&dev->dev));
 
-	dev->idx = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
-	if (dev->idx < 0)
-		return dev->idx;
-
-	dev->dev.class = &nfc_class;
-	dev_set_name(&dev->dev, "nfc%d", dev->idx);
-	device_initialize(&dev->dev);
-
 	mutex_lock(&nfc_devlist_mutex);
 	nfc_devlist_generation++;
 	rc = device_add(&dev->dev);
@@ -1136,12 +1145,10 @@ EXPORT_SYMBOL(nfc_register_device);
  */
 void nfc_unregister_device(struct nfc_dev *dev)
 {
-	int rc, id;
+	int rc;
 
 	pr_debug("dev_name=%s\n", dev_name(&dev->dev));
 
-	id = dev->idx;
-
 	if (dev->rfkill) {
 		rfkill_unregister(dev->rfkill);
 		rfkill_destroy(dev->rfkill);
@@ -1166,8 +1173,6 @@ void nfc_unregister_device(struct nfc_de
 	nfc_devlist_generation++;
 	device_del(&dev->dev);
 	mutex_unlock(&nfc_devlist_mutex);
-
-	ida_simple_remove(&nfc_index_ida, id);
 }
 EXPORT_SYMBOL(nfc_unregister_device);
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/nfc/llcp_sock.c linux-libre-4.1.44-gnu/net/nfc/llcp_sock.c
--- linux-libre-4.1.43-gnu/net/nfc/llcp_sock.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/nfc/llcp_sock.c	2017-09-14 11:55:04.000000000 -0400
@@ -76,7 +76,8 @@ static int llcp_sock_bind(struct socket
 	struct sockaddr_nfc_llcp llcp_addr;
 	int len, ret = 0;
 
-	if (!addr || addr->sa_family != AF_NFC)
+	if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
+	    addr->sa_family != AF_NFC)
 		return -EINVAL;
 
 	pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
@@ -150,7 +151,8 @@ static int llcp_raw_sock_bind(struct soc
 	struct sockaddr_nfc_llcp llcp_addr;
 	int len, ret = 0;
 
-	if (!addr || addr->sa_family != AF_NFC)
+	if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
+	    addr->sa_family != AF_NFC)
 		return -EINVAL;
 
 	pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
@@ -655,8 +657,7 @@ static int llcp_sock_connect(struct sock
 
 	pr_debug("sock %p sk %p flags 0x%x\n", sock, sk, flags);
 
-	if (!addr || len < sizeof(struct sockaddr_nfc) ||
-	    addr->sa_family != AF_NFC)
+	if (!addr || len < sizeof(*addr) || addr->sa_family != AF_NFC)
 		return -EINVAL;
 
 	if (addr->service_name_len == 0 && addr->dsap == 0)
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/nfc/nci/core.c linux-libre-4.1.44-gnu/net/nfc/nci/core.c
--- linux-libre-4.1.43-gnu/net/nfc/nci/core.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/nfc/nci/core.c	2017-09-14 11:55:04.000000000 -0400
@@ -981,8 +981,7 @@ struct nci_dev *nci_allocate_device(stru
 	return ndev;
 
 free_nfc:
-	kfree(ndev->nfc_dev);
-
+	nfc_free_device(ndev->nfc_dev);
 free_nci:
 	kfree(ndev);
 	return NULL;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/nfc/netlink.c linux-libre-4.1.44-gnu/net/nfc/netlink.c
--- linux-libre-4.1.43-gnu/net/nfc/netlink.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/nfc/netlink.c	2017-09-14 11:55:04.000000000 -0400
@@ -865,7 +865,9 @@ static int nfc_genl_activate_target(stru
 	u32 device_idx, target_idx, protocol;
 	int rc;
 
-	if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+	if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+	    !info->attrs[NFC_ATTR_TARGET_INDEX] ||
+	    !info->attrs[NFC_ATTR_PROTOCOLS])
 		return -EINVAL;
 
 	device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/net/packet/af_packet.c linux-libre-4.1.44-gnu/net/packet/af_packet.c
--- linux-libre-4.1.43-gnu/net/packet/af_packet.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/net/packet/af_packet.c	2017-09-14 11:55:04.000000000 -0400
@@ -3370,14 +3370,19 @@ packet_setsockopt(struct socket *sock, i
 
 		if (optlen != sizeof(val))
 			return -EINVAL;
-		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-			return -EBUSY;
 		if (copy_from_user(&val, optval, sizeof(val)))
 			return -EFAULT;
 		if (val > INT_MAX)
 			return -EINVAL;
-		po->tp_reserve = val;
-		return 0;
+		lock_sock(sk);
+		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+			ret = -EBUSY;
+		} else {
+			po->tp_reserve = val;
+			ret = 0;
+		}
+		release_sock(sk);
+		return ret;
 	}
 	case PACKET_LOSS:
 	{
@@ -3954,7 +3959,7 @@ static int packet_set_ring(struct sock *
 		register_prot_hook(sk);
 	}
 	spin_unlock(&po->bind_lock);
-	if (closing && (po->tp_version > TPACKET_V2)) {
+	if (pg_vec && (po->tp_version > TPACKET_V2)) {
 		/* Because we don't support block-based V3 on tx-ring */
 		if (!tx_ring)
 			prb_shutdown_retire_blk_timer(po, tx_ring, rb_queue);
diff -druNp --no-dereference linux-libre-4.1.43-gnu/sound/pci/hda/patch_realtek.c linux-libre-4.1.44-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-4.1.43-gnu/sound/pci/hda/patch_realtek.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/sound/pci/hda/patch_realtek.c	2017-09-14 11:55:04.000000000 -0400
@@ -2228,6 +2228,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
+	SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/sound/soc/codecs/tlv320aic3x.c linux-libre-4.1.44-gnu/sound/soc/codecs/tlv320aic3x.c
--- linux-libre-4.1.43-gnu/sound/soc/codecs/tlv320aic3x.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/sound/soc/codecs/tlv320aic3x.c	2017-09-14 11:55:04.000000000 -0400
@@ -125,6 +125,16 @@ static const struct reg_default aic3x_re
 	{ 108, 0x00 }, { 109, 0x00 },
 };
 
+static bool aic3x_volatile_reg(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case AIC3X_RESET:
+		return true;
+	default:
+		return false;
+	}
+}
+
 static const struct regmap_config aic3x_regmap = {
 	.reg_bits = 8,
 	.val_bits = 8,
@@ -132,6 +142,9 @@ static const struct regmap_config aic3x_
 	.max_register = DAC_ICC_ADJ,
 	.reg_defaults = aic3x_reg,
 	.num_reg_defaults = ARRAY_SIZE(aic3x_reg),
+
+	.volatile_reg = aic3x_volatile_reg,
+
 	.cache_type = REGCACHE_RBTREE,
 };
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/sound/soc/soc-compress.c linux-libre-4.1.44-gnu/sound/soc/soc-compress.c
--- linux-libre-4.1.43-gnu/sound/soc/soc-compress.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/sound/soc/soc-compress.c	2017-09-14 11:55:04.000000000 -0400
@@ -68,7 +68,8 @@ out:
 static int soc_compr_open_fe(struct snd_compr_stream *cstream)
 {
 	struct snd_soc_pcm_runtime *fe = cstream->private_data;
-	struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream;
+	struct snd_pcm_substream *fe_substream =
+		 fe->pcm->streams[cstream->direction].substream;
 	struct snd_soc_platform *platform = fe->platform;
 	struct snd_soc_dpcm *dpcm;
 	struct snd_soc_dapm_widget_list *list;
@@ -412,7 +413,8 @@ static int soc_compr_set_params_fe(struc
 					struct snd_compr_params *params)
 {
 	struct snd_soc_pcm_runtime *fe = cstream->private_data;
-	struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream;
+	struct snd_pcm_substream *fe_substream =
+		 fe->pcm->streams[cstream->direction].substream;
 	struct snd_soc_platform *platform = fe->platform;
 	int ret = 0, stream;
 
diff -druNp --no-dereference linux-libre-4.1.43-gnu/sound/soc/soc-pcm.c linux-libre-4.1.44-gnu/sound/soc/soc-pcm.c
--- linux-libre-4.1.43-gnu/sound/soc/soc-pcm.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/sound/soc/soc-pcm.c	2017-09-14 11:55:04.000000000 -0400
@@ -163,6 +163,10 @@ int dpcm_dapm_stream_event(struct snd_so
 		dev_dbg(be->dev, "ASoC: BE %s event %d dir %d\n",
 				be->dai_link->name, event, dir);
 
+		if ((event == SND_SOC_DAPM_STREAM_STOP) &&
+		    (be->dpcm[dir].users >= 1))
+			continue;
+
 		snd_soc_dapm_stream_event(be, dir, event);
 	}
 
@@ -1991,9 +1995,11 @@ static int dpcm_fe_dai_do_trigger(struct
 		break;
 	case SNDRV_PCM_TRIGGER_STOP:
 	case SNDRV_PCM_TRIGGER_SUSPEND:
-	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
 		fe->dpcm[stream].state = SND_SOC_DPCM_STATE_STOP;
 		break;
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+		fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PAUSED;
+		break;
 	}
 
 out:
diff -druNp --no-dereference linux-libre-4.1.43-gnu/sound/usb/endpoint.c linux-libre-4.1.44-gnu/sound/usb/endpoint.c
--- linux-libre-4.1.43-gnu/sound/usb/endpoint.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/sound/usb/endpoint.c	2017-09-14 11:55:04.000000000 -0400
@@ -361,6 +361,9 @@ static void snd_complete_urb(struct urb
 	if (unlikely(atomic_read(&ep->chip->shutdown)))
 		goto exit_clear;
 
+	if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags)))
+		goto exit_clear;
+
 	if (usb_pipeout(ep->pipe)) {
 		retire_outbound_urb(ep, ctx);
 		/* can be stopped during retire callback */
diff -druNp --no-dereference linux-libre-4.1.43-gnu/tools/lib/traceevent/plugin_sched_switch.c linux-libre-4.1.44-gnu/tools/lib/traceevent/plugin_sched_switch.c
--- linux-libre-4.1.43-gnu/tools/lib/traceevent/plugin_sched_switch.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/tools/lib/traceevent/plugin_sched_switch.c	2017-09-14 11:55:04.000000000 -0400
@@ -111,7 +111,7 @@ static int sched_switch_handler(struct t
 	trace_seq_printf(s, "%lld ", val);
 
 	if (pevent_get_field_val(s, event, "prev_prio", record, &val, 0) == 0)
-		trace_seq_printf(s, "[%lld] ", val);
+		trace_seq_printf(s, "[%d] ", (int) val);
 
 	if (pevent_get_field_val(s,  event, "prev_state", record, &val, 0) == 0)
 		write_state(s, val);
@@ -129,7 +129,7 @@ static int sched_switch_handler(struct t
 	trace_seq_printf(s, "%lld", val);
 
 	if (pevent_get_field_val(s, event, "next_prio", record, &val, 0) == 0)
-		trace_seq_printf(s, " [%lld]", val);
+		trace_seq_printf(s, " [%d]", (int) val);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.43-gnu/tools/perf/ui/browser.c linux-libre-4.1.44-gnu/tools/perf/ui/browser.c
--- linux-libre-4.1.43-gnu/tools/perf/ui/browser.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/tools/perf/ui/browser.c	2017-09-14 11:55:04.000000000 -0400
@@ -673,7 +673,7 @@ static void __ui_browser__line_arrow_dow
 		ui_browser__gotorc(browser, row, column + 1);
 		SLsmg_draw_hline(2);
 
-		if (row++ == 0)
+		if (++row == 0)
 			goto out;
 	} else
 		row = 0;
diff -druNp --no-dereference linux-libre-4.1.43-gnu/tools/perf/util/symbol-elf.c linux-libre-4.1.44-gnu/tools/perf/util/symbol-elf.c
--- linux-libre-4.1.43-gnu/tools/perf/util/symbol-elf.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/tools/perf/util/symbol-elf.c	2017-09-14 11:55:04.000000000 -0400
@@ -488,6 +488,12 @@ int sysfs__read_build_id(const char *fil
 				break;
 		} else {
 			int n = namesz + descsz;
+
+			if (n > (int)sizeof(bf)) {
+				n = sizeof(bf);
+				pr_debug("%s: truncating reading of build id in sysfs file %s: n_namesz=%u, n_descsz=%u.\n",
+					 __func__, filename, nhdr.n_namesz, nhdr.n_descsz);
+			}
 			if (read(fd, bf, n) != n)
 				break;
 		}
diff -druNp --no-dereference linux-libre-4.1.43-gnu/virt/kvm/vfio.c linux-libre-4.1.44-gnu/virt/kvm/vfio.c
--- linux-libre-4.1.43-gnu/virt/kvm/vfio.c	2017-08-05 19:56:14.000000000 -0400
+++ linux-libre-4.1.44-gnu/virt/kvm/vfio.c	2017-09-14 11:55:04.000000000 -0400
@@ -47,6 +47,22 @@ static struct vfio_group *kvm_vfio_group
 	return vfio_group;
 }
 
+static bool kvm_vfio_external_group_match_file(struct vfio_group *group,
+					       struct file *filep)
+{
+	bool ret, (*fn)(struct vfio_group *, struct file *);
+
+	fn = symbol_get(vfio_external_group_match_file);
+	if (!fn)
+		return false;
+
+	ret = fn(group, filep);
+
+	symbol_put(vfio_external_group_match_file);
+
+	return ret;
+}
+
 static void kvm_vfio_group_put_external_user(struct vfio_group *vfio_group)
 {
 	void (*fn)(struct vfio_group *);
@@ -169,18 +185,13 @@ static int kvm_vfio_set_group(struct kvm
 		if (!f.file)
 			return -EBADF;
 
-		vfio_group = kvm_vfio_group_get_external_user(f.file);
-		fdput(f);
-
-		if (IS_ERR(vfio_group))
-			return PTR_ERR(vfio_group);
-
 		ret = -ENOENT;
 
 		mutex_lock(&kv->lock);
 
 		list_for_each_entry(kvg, &kv->group_list, node) {
-			if (kvg->vfio_group != vfio_group)
+			if (!kvm_vfio_external_group_match_file(kvg->vfio_group,
+								f.file))
 				continue;
 
 			list_del(&kvg->node);
@@ -192,7 +203,7 @@ static int kvm_vfio_set_group(struct kvm
 
 		mutex_unlock(&kv->lock);
 
-		kvm_vfio_group_put_external_user(vfio_group);
+		fdput(f);
 
 		kvm_vfio_update_coherency(dev);
 
