diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/configs/omap2plus_defconfig linux-libre-4.1.47-gnu/arch/arm/configs/omap2plus_defconfig
--- linux-libre-4.1.46-gnu/arch/arm/configs/omap2plus_defconfig	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/configs/omap2plus_defconfig	2017-12-06 21:20:16.000000000 -0500
@@ -215,6 +215,7 @@ CONFIG_SERIO=m
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=32
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/include/asm/Kbuild linux-libre-4.1.47-gnu/arch/arm/include/asm/Kbuild
--- linux-libre-4.1.46-gnu/arch/arm/include/asm/Kbuild	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/include/asm/Kbuild	2017-12-06 21:20:16.000000000 -0500
@@ -36,4 +36,3 @@ generic-y += termbits.h
 generic-y += termios.h
 generic-y += timex.h
 generic-y += trace_clock.h
-generic-y += unaligned.h
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/include/asm/unaligned.h linux-libre-4.1.47-gnu/arch/arm/include/asm/unaligned.h
--- linux-libre-4.1.46-gnu/arch/arm/include/asm/unaligned.h	1969-12-31 19:00:00.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/include/asm/unaligned.h	2017-12-06 21:20:16.000000000 -0500
@@ -0,0 +1,27 @@
+#ifndef __ASM_ARM_UNALIGNED_H
+#define __ASM_ARM_UNALIGNED_H
+
+/*
+ * We generally want to set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS on ARMv6+,
+ * but we don't want to use linux/unaligned/access_ok.h since that can lead
+ * to traps on unaligned stm/ldm or strd/ldrd.
+ */
+#include <asm/byteorder.h>
+
+#if defined(__LITTLE_ENDIAN)
+# include <linux/unaligned/le_struct.h>
+# include <linux/unaligned/be_byteshift.h>
+# include <linux/unaligned/generic.h>
+# define get_unaligned	__get_unaligned_le
+# define put_unaligned	__put_unaligned_le
+#elif defined(__BIG_ENDIAN)
+# include <linux/unaligned/be_struct.h>
+# include <linux/unaligned/le_byteshift.h>
+# include <linux/unaligned/generic.h>
+# define get_unaligned	__get_unaligned_be
+# define put_unaligned	__put_unaligned_be
+#else
+# error need to define endianess
+#endif
+
+#endif /* __ASM_ARM_UNALIGNED_H */
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/kernel/traps.c linux-libre-4.1.47-gnu/arch/arm/kernel/traps.c
--- linux-libre-4.1.46-gnu/arch/arm/kernel/traps.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/kernel/traps.c	2017-12-06 21:20:16.000000000 -0500
@@ -132,30 +132,26 @@ static void dump_mem(const char *lvl, co
 	set_fs(fs);
 }
 
-static void dump_instr(const char *lvl, struct pt_regs *regs)
+static void __dump_instr(const char *lvl, struct pt_regs *regs)
 {
 	unsigned long addr = instruction_pointer(regs);
 	const int thumb = thumb_mode(regs);
 	const int width = thumb ? 4 : 8;
-	mm_segment_t fs;
 	char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
 	int i;
 
 	/*
-	 * We need to switch to kernel mode so that we can use __get_user
-	 * to safely read from kernel space.  Note that we now dump the
-	 * code first, just in case the backtrace kills us.
+	 * Note that we now dump the code first, just in case the backtrace
+	 * kills us.
 	 */
-	fs = get_fs();
-	set_fs(KERNEL_DS);
 
 	for (i = -4; i < 1 + !!thumb; i++) {
 		unsigned int val, bad;
 
 		if (thumb)
-			bad = __get_user(val, &((u16 *)addr)[i]);
+			bad = get_user(val, &((u16 *)addr)[i]);
 		else
-			bad = __get_user(val, &((u32 *)addr)[i]);
+			bad = get_user(val, &((u32 *)addr)[i]);
 
 		if (!bad)
 			p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
@@ -166,8 +162,20 @@ static void dump_instr(const char *lvl,
 		}
 	}
 	printk("%sCode: %s\n", lvl, str);
+}
 
-	set_fs(fs);
+static void dump_instr(const char *lvl, struct pt_regs *regs)
+{
+	mm_segment_t fs;
+
+	if (!user_mode(regs)) {
+		fs = get_fs();
+		set_fs(KERNEL_DS);
+		__dump_instr(lvl, regs);
+		set_fs(fs);
+	} else {
+		__dump_instr(lvl, regs);
+	}
 }
 
 #ifdef CONFIG_ARM_UNWIND
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/mach-omap2/pdata-quirks.c linux-libre-4.1.47-gnu/arch/arm/mach-omap2/pdata-quirks.c
--- linux-libre-4.1.46-gnu/arch/arm/mach-omap2/pdata-quirks.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/mach-omap2/pdata-quirks.c	2017-12-06 21:20:16.000000000 -0500
@@ -372,7 +372,6 @@ static void pdata_quirks_check(struct pd
 		if (of_machine_is_compatible(quirks->compatible)) {
 			if (quirks->fn)
 				quirks->fn();
-			break;
 		}
 		quirks++;
 	}
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/mach-pxa/balloon3.c linux-libre-4.1.47-gnu/arch/arm/mach-pxa/balloon3.c
--- linux-libre-4.1.46-gnu/arch/arm/mach-pxa/balloon3.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/mach-pxa/balloon3.c	2017-12-06 21:20:16.000000000 -0500
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
+#include <linux/leds.h>
 #include <linux/sched.h>
 #include <linux/bitops.h>
 #include <linux/fb.h>
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/mach-pxa/colibri-pxa270-income.c linux-libre-4.1.47-gnu/arch/arm/mach-pxa/colibri-pxa270-income.c
--- linux-libre-4.1.46-gnu/arch/arm/mach-pxa/colibri-pxa270-income.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/mach-pxa/colibri-pxa270-income.c	2017-12-06 21:20:16.000000000 -0500
@@ -17,6 +17,7 @@
 #include <linux/gpio.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/leds.h>
 #include <linux/ioport.h>
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/mach-pxa/corgi.c linux-libre-4.1.47-gnu/arch/arm/mach-pxa/corgi.c
--- linux-libre-4.1.46-gnu/arch/arm/mach-pxa/corgi.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/mach-pxa/corgi.c	2017-12-06 21:20:16.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/interrupt.h>
+#include <linux/leds.h>
 #include <linux/mmc/host.h>
 #include <linux/mtd/physmap.h>
 #include <linux/pm.h>
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/mach-pxa/trizeps4.c linux-libre-4.1.47-gnu/arch/arm/mach-pxa/trizeps4.c
--- linux-libre-4.1.46-gnu/arch/arm/mach-pxa/trizeps4.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/mach-pxa/trizeps4.c	2017-12-06 21:20:16.000000000 -0500
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
+#include <linux/leds.h>
 #include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/bitops.h>
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/mach-pxa/vpac270.c linux-libre-4.1.47-gnu/arch/arm/mach-pxa/vpac270.c
--- linux-libre-4.1.46-gnu/arch/arm/mach-pxa/vpac270.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/mach-pxa/vpac270.c	2017-12-06 21:20:16.000000000 -0500
@@ -15,6 +15,7 @@
 #include <linux/irq.h>
 #include <linux/gpio_keys.h>
 #include <linux/input.h>
+#include <linux/leds.h>
 #include <linux/gpio.h>
 #include <linux/usb/gpio_vbus.h>
 #include <linux/mtd/mtd.h>
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/mach-pxa/zeus.c linux-libre-4.1.47-gnu/arch/arm/mach-pxa/zeus.c
--- linux-libre-4.1.46-gnu/arch/arm/mach-pxa/zeus.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/mach-pxa/zeus.c	2017-12-06 21:20:16.000000000 -0500
@@ -13,6 +13,7 @@
 
 #include <linux/cpufreq.h>
 #include <linux/interrupt.h>
+#include <linux/leds.h>
 #include <linux/irq.h>
 #include <linux/pm.h>
 #include <linux/gpio.h>
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/mach-pxa/zylonite.c linux-libre-4.1.47-gnu/arch/arm/mach-pxa/zylonite.c
--- linux-libre-4.1.46-gnu/arch/arm/mach-pxa/zylonite.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/mach-pxa/zylonite.c	2017-12-06 21:20:16.000000000 -0500
@@ -16,6 +16,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
+#include <linux/leds.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/gpio.h>
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm/xen/mm.c linux-libre-4.1.47-gnu/arch/arm/xen/mm.c
--- linux-libre-4.1.46-gnu/arch/arm/xen/mm.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm/xen/mm.c	2017-12-06 21:20:16.000000000 -0500
@@ -180,6 +180,7 @@ static struct dma_map_ops xen_swiotlb_dm
 	.unmap_page = xen_swiotlb_unmap_page,
 	.dma_supported = xen_swiotlb_dma_supported,
 	.set_dma_mask = xen_swiotlb_set_dma_mask,
+	.mmap = xen_swiotlb_dma_mmap,
 };
 
 int __init xen_mm_init(void)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/arm64/kernel/traps.c linux-libre-4.1.47-gnu/arch/arm64/kernel/traps.c
--- linux-libre-4.1.46-gnu/arch/arm64/kernel/traps.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/arm64/kernel/traps.c	2017-12-06 21:20:16.000000000 -0500
@@ -116,7 +116,7 @@ static void dump_instr(const char *lvl,
 	for (i = -4; i < 1; i++) {
 		unsigned int val, bad;
 
-		bad = __get_user(val, &((u32 *)addr)[i]);
+		bad = get_user(val, &((u32 *)addr)[i]);
 
 		if (!bad)
 			p += sprintf(p, i == 0 ? "(%08x) " : "%08x ", val);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/ar7/platform.c linux-libre-4.1.47-gnu/arch/mips/ar7/platform.c
--- linux-libre-4.1.46-gnu/arch/mips/ar7/platform.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/ar7/platform.c	2017-12-06 21:20:16.000000000 -0500
@@ -577,6 +577,7 @@ static int __init ar7_register_uarts(voi
 	uart_port.type		= PORT_AR7;
 	uart_port.uartclk	= clk_get_rate(bus_clk) / 2;
 	uart_port.iotype	= UPIO_MEM32;
+	uart_port.flags		= UPF_FIXED_TYPE;
 	uart_port.regshift	= 2;
 
 	uart_port.line		= 0;
@@ -655,6 +656,10 @@ static int __init ar7_register_devices(v
 	u32 val;
 	int res;
 
+	res = ar7_gpio_init();
+	if (res)
+		pr_warn("unable to register gpios: %d\n", res);
+
 	res = ar7_register_uarts();
 	if (res)
 		pr_err("unable to setup uart(s): %d\n", res);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/ar7/prom.c linux-libre-4.1.47-gnu/arch/mips/ar7/prom.c
--- linux-libre-4.1.46-gnu/arch/mips/ar7/prom.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/ar7/prom.c	2017-12-06 21:20:16.000000000 -0500
@@ -246,8 +246,6 @@ void __init prom_init(void)
 	ar7_init_cmdline(fw_arg0, (char **)fw_arg1);
 	ar7_init_env((struct env_var *)fw_arg2);
 	console_config();
-
-	ar7_gpio_init();
 }
 
 #define PORT(offset) (KSEG1ADDR(AR7_REGS_UART0 + (offset * 4)))
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/include/asm/asm.h linux-libre-4.1.47-gnu/arch/mips/include/asm/asm.h
--- linux-libre-4.1.46-gnu/arch/mips/include/asm/asm.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/include/asm/asm.h	2017-12-06 21:20:16.000000000 -0500
@@ -54,7 +54,8 @@
 		.align	2;				\
 		.type	symbol, @function;		\
 		.ent	symbol, 0;			\
-symbol:		.frame	sp, 0, ra
+symbol:		.frame	sp, 0, ra;			\
+		.insn
 
 /*
  * NESTED - declare nested routine entry point
@@ -63,8 +64,9 @@ symbol:		.frame	sp, 0, ra
 		.globl	symbol;				\
 		.align	2;				\
 		.type	symbol, @function;		\
-		.ent	symbol, 0;			 \
-symbol:		.frame	sp, framesize, rpc
+		.ent	symbol, 0;			\
+symbol:		.frame	sp, framesize, rpc;		\
+		.insn
 
 /*
  * END - mark end of function
@@ -86,7 +88,7 @@ symbol:
 #define FEXPORT(symbol)					\
 		.globl	symbol;				\
 		.type	symbol, @function;		\
-symbol:
+symbol:		.insn
 
 /*
  * ABS - export absolute symbol
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/include/asm/mips-cm.h linux-libre-4.1.47-gnu/arch/mips/include/asm/mips-cm.h
--- linux-libre-4.1.46-gnu/arch/mips/include/asm/mips-cm.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/include/asm/mips-cm.h	2017-12-06 21:20:16.000000000 -0500
@@ -173,8 +173,8 @@ BUILD_CM_Cx_R_(tcid_8_priority,	0x80)
 #define CM_GCR_BASE_GCRBASE_MSK			(_ULCAST_(0x1ffff) << 15)
 #define CM_GCR_BASE_CMDEFTGT_SHF		0
 #define CM_GCR_BASE_CMDEFTGT_MSK		(_ULCAST_(0x3) << 0)
-#define  CM_GCR_BASE_CMDEFTGT_DISABLED		0
-#define  CM_GCR_BASE_CMDEFTGT_MEM		1
+#define  CM_GCR_BASE_CMDEFTGT_MEM		0
+#define  CM_GCR_BASE_CMDEFTGT_RESERVED		1
 #define  CM_GCR_BASE_CMDEFTGT_IOCU0		2
 #define  CM_GCR_BASE_CMDEFTGT_IOCU1		3
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/kernel/process.c linux-libre-4.1.47-gnu/arch/mips/kernel/process.c
--- linux-libre-4.1.46-gnu/arch/mips/kernel/process.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/kernel/process.c	2017-12-06 21:20:16.000000000 -0500
@@ -48,9 +48,7 @@
 #ifdef CONFIG_HOTPLUG_CPU
 void arch_cpu_idle_dead(void)
 {
-	/* What the heck is this check doing ? */
-	if (!cpumask_test_cpu(smp_processor_id(), &cpu_callin_map))
-		play_dead();
+	play_dead();
 }
 #endif
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/kernel/setup.c linux-libre-4.1.47-gnu/arch/mips/kernel/setup.c
--- linux-libre-4.1.46-gnu/arch/mips/kernel/setup.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/kernel/setup.c	2017-12-06 21:20:16.000000000 -0500
@@ -147,6 +147,35 @@ void __init detect_memory_region(phys_ad
 	add_memory_region(start, size, BOOT_MEM_RAM);
 }
 
+bool __init memory_region_available(phys_addr_t start, phys_addr_t size)
+{
+	int i;
+	bool in_ram = false, free = true;
+
+	for (i = 0; i < boot_mem_map.nr_map; i++) {
+		phys_addr_t start_, end_;
+
+		start_ = boot_mem_map.map[i].addr;
+		end_ = boot_mem_map.map[i].addr + boot_mem_map.map[i].size;
+
+		switch (boot_mem_map.map[i].type) {
+		case BOOT_MEM_RAM:
+			if (start >= start_ && start + size <= end_)
+				in_ram = true;
+			break;
+		case BOOT_MEM_RESERVED:
+			if ((start >= start_ && start < end_) ||
+			    (start < start_ && start + size >= start_))
+				free = false;
+			break;
+		default:
+			continue;
+		}
+	}
+
+	return in_ram && free;
+}
+
 static void __init print_memory_map(void)
 {
 	int i;
@@ -295,11 +324,19 @@ static void __init bootmem_init(void)
 
 #else  /* !CONFIG_SGI_IP27 */
 
+static unsigned long __init bootmap_bytes(unsigned long pages)
+{
+	unsigned long bytes = DIV_ROUND_UP(pages, 8);
+
+	return ALIGN(bytes, sizeof(long));
+}
+
 static void __init bootmem_init(void)
 {
 	unsigned long reserved_end;
 	unsigned long mapstart = ~0UL;
 	unsigned long bootmap_size;
+	bool bootmap_valid = false;
 	int i;
 
 	/*
@@ -375,11 +412,42 @@ static void __init bootmem_init(void)
 #endif
 
 	/*
-	 * Initialize the boot-time allocator with low memory only.
+	 * check that mapstart doesn't overlap with any of
+	 * memory regions that have been reserved through eg. DTB
 	 */
-	bootmap_size = init_bootmem_node(NODE_DATA(0), mapstart,
-					 min_low_pfn, max_low_pfn);
+	bootmap_size = bootmap_bytes(max_low_pfn - min_low_pfn);
+
+	bootmap_valid = memory_region_available(PFN_PHYS(mapstart),
+						bootmap_size);
+	for (i = 0; i < boot_mem_map.nr_map && !bootmap_valid; i++) {
+		unsigned long mapstart_addr;
 
+		switch (boot_mem_map.map[i].type) {
+		case BOOT_MEM_RESERVED:
+			mapstart_addr = PFN_ALIGN(boot_mem_map.map[i].addr +
+						boot_mem_map.map[i].size);
+			if (PHYS_PFN(mapstart_addr) < mapstart)
+				break;
+
+			bootmap_valid = memory_region_available(mapstart_addr,
+								bootmap_size);
+			if (bootmap_valid)
+				mapstart = PHYS_PFN(mapstart_addr);
+			break;
+		default:
+			break;
+		}
+	}
+
+	if (!bootmap_valid)
+		panic("No memory area to place a bootmap bitmap");
+
+	/*
+	 * Initialize the boot-time allocator with low memory only.
+	 */
+	if (bootmap_size != init_bootmem_node(NODE_DATA(0), mapstart,
+					 min_low_pfn, max_low_pfn))
+		panic("Unexpected memory size required for bootmap");
 
 	for (i = 0; i < boot_mem_map.nr_map; i++) {
 		unsigned long start, end;
@@ -428,6 +496,10 @@ static void __init bootmem_init(void)
 			continue;
 		default:
 			/* Not usable memory */
+			if (start > min_low_pfn && end < max_low_pfn)
+				reserve_bootmem(boot_mem_map.map[i].addr,
+						boot_mem_map.map[i].size,
+						BOOTMEM_DEFAULT);
 			continue;
 		}
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/kernel/smp.c linux-libre-4.1.47-gnu/arch/mips/kernel/smp.c
--- linux-libre-4.1.46-gnu/arch/mips/kernel/smp.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/kernel/smp.c	2017-12-06 21:20:16.000000000 -0500
@@ -63,6 +63,9 @@ EXPORT_SYMBOL(cpu_sibling_map);
 cpumask_t cpu_core_map[NR_CPUS] __read_mostly;
 EXPORT_SYMBOL(cpu_core_map);
 
+static DECLARE_COMPLETION(cpu_starting);
+static DECLARE_COMPLETION(cpu_running);
+
 /*
  * A logcal cpu mask containing only one VPE per core to
  * reduce the number of IPIs on large MT systems.
@@ -172,9 +175,12 @@ asmlinkage void start_secondary(void)
 	cpumask_set_cpu(cpu, &cpu_coherent_mask);
 	notify_cpu_starting(cpu);
 
-	cpumask_set_cpu(cpu, &cpu_callin_map);
+	/* Notify boot CPU that we're starting & ready to sync counters */
+	complete(&cpu_starting);
+
 	synchronise_count_slave(cpu);
 
+	/* The CPU is running and counters synchronised, now mark it online */
 	set_cpu_online(cpu, true);
 
 	set_cpu_sibling_map(cpu);
@@ -183,6 +189,12 @@ asmlinkage void start_secondary(void)
 	calculate_cpu_foreign_map();
 
 	/*
+	 * Notify boot CPU that we're up & online and it can safely return
+	 * from __cpu_up
+	 */
+	complete(&cpu_running);
+
+	/*
 	 * irq will be enabled in ->smp_finish(), enabling it too early
 	 * is dangerous.
 	 */
@@ -250,22 +262,23 @@ void smp_prepare_boot_cpu(void)
 {
 	set_cpu_possible(0, true);
 	set_cpu_online(0, true);
-	cpumask_set_cpu(0, &cpu_callin_map);
 }
 
 int __cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
 	mp_ops->boot_secondary(cpu, tidle);
 
-	/*
-	 * Trust is futile.  We should really have timeouts ...
-	 */
-	while (!cpumask_test_cpu(cpu, &cpu_callin_map)) {
-		udelay(100);
-		schedule();
+	/* Wait for CPU to start and be ready to sync counters */
+	if (!wait_for_completion_timeout(&cpu_starting,
+					 msecs_to_jiffies(1000))) {
+		pr_crit("CPU%u: failed to start\n", cpu);
+		return -EIO;
 	}
 
 	synchronise_count_master(cpu);
+
+	/* Wait for CPU to finish startup & mark itself online before return */
+	wait_for_completion(&cpu_running);
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/mm/uasm-micromips.c linux-libre-4.1.47-gnu/arch/mips/mm/uasm-micromips.c
--- linux-libre-4.1.46-gnu/arch/mips/mm/uasm-micromips.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/mm/uasm-micromips.c	2017-12-06 21:20:16.000000000 -0500
@@ -75,7 +75,7 @@ static struct insn insn_table_MM[] = {
 	{ insn_jr, M(mm_pool32a_op, 0, 0, 0, mm_jalr_op, mm_pool32axf_op), RS },
 	{ insn_lb, M(mm_lb32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
 	{ insn_ld, 0, 0 },
-	{ insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RS | RS | SIMM },
+	{ insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
 	{ insn_ll, M(mm_pool32c_op, 0, 0, (mm_ll_func << 1), 0, 0), RS | RT | SIMM },
 	{ insn_lld, 0, 0 },
 	{ insn_lui, M(mm_pool32i_op, mm_lui_op, 0, 0, 0, 0), RS | SIMM },
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/mips/netlogic/common/irq.c linux-libre-4.1.47-gnu/arch/mips/netlogic/common/irq.c
--- linux-libre-4.1.46-gnu/arch/mips/netlogic/common/irq.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/mips/netlogic/common/irq.c	2017-12-06 21:20:16.000000000 -0500
@@ -275,7 +275,7 @@ asmlinkage void plat_irq_dispatch(void)
 	do_IRQ(nlm_irq_to_xirq(node, i));
 }
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_CPU_XLP
 static const struct irq_domain_ops xlp_pic_irq_domain_ops = {
 	.xlate = irq_domain_xlate_onetwocell,
 };
@@ -348,7 +348,7 @@ void __init arch_init_irq(void)
 #if defined(CONFIG_CPU_XLR)
 	nlm_setup_fmn_irq();
 #endif
-#if defined(CONFIG_OF)
+#ifdef CONFIG_CPU_XLP
 	of_irq_init(xlp_pic_irq_ids);
 #endif
 }
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/powerpc/Kconfig linux-libre-4.1.47-gnu/arch/powerpc/Kconfig
--- linux-libre-4.1.46-gnu/arch/powerpc/Kconfig	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/powerpc/Kconfig	2017-12-06 21:20:16.000000000 -0500
@@ -1079,11 +1079,6 @@ source "arch/powerpc/Kconfig.debug"
 
 source "security/Kconfig"
 
-config KEYS_COMPAT
-	bool
-	depends on COMPAT && KEYS
-	default y
-
 source "crypto/Kconfig"
 
 config PPC_LIB_RHEAP
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/powerpc/kvm/book3s_hv_rm_xics.c linux-libre-4.1.47-gnu/arch/powerpc/kvm/book3s_hv_rm_xics.c
--- linux-libre-4.1.46-gnu/arch/powerpc/kvm/book3s_hv_rm_xics.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/powerpc/kvm/book3s_hv_rm_xics.c	2017-12-06 21:20:16.000000000 -0500
@@ -282,6 +282,7 @@ static void icp_rm_deliver_irq(struct kv
 		 */
 		if (reject && reject != XICS_IPI) {
 			arch_spin_unlock(&ics->lock);
+			icp->n_reject++;
 			new_irq = reject;
 			goto again;
 		}
@@ -613,10 +614,8 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcp
 	state = &ics->irq_state[src];
 
 	/* Still asserted, resend it */
-	if (state->asserted) {
-		icp->n_reject++;
+	if (state->asserted)
 		icp_rm_deliver_irq(xics, icp, irq);
-	}
 
 	if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) {
 		icp->rm_action |= XICS_RM_NOTIFY_EOI;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/s390/Kconfig linux-libre-4.1.47-gnu/arch/s390/Kconfig
--- linux-libre-4.1.46-gnu/arch/s390/Kconfig	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/s390/Kconfig	2017-12-06 21:20:16.000000000 -0500
@@ -338,9 +338,6 @@ config COMPAT
 config SYSVIPC_COMPAT
 	def_bool y if COMPAT && SYSVIPC
 
-config KEYS_COMPAT
-	def_bool y if COMPAT && KEYS
-
 config SMP
 	def_bool y
 	prompt "Symmetric multi-processing support"
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/sh/kernel/cpu/sh3/setup-sh770x.c linux-libre-4.1.47-gnu/arch/sh/kernel/cpu/sh3/setup-sh770x.c
--- linux-libre-4.1.46-gnu/arch/sh/kernel/cpu/sh3/setup-sh770x.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/sh/kernel/cpu/sh3/setup-sh770x.c	2017-12-06 21:20:16.000000000 -0500
@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platfo
 	.scscr		= SCSCR_TE | SCSCR_RE,
 	.type		= PORT_IRDA,
 	.ops		= &sh770x_sci_port_ops,
-	.regshift	= 1,
 };
 
 static struct resource scif2_resources[] = {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/sparc/Kconfig linux-libre-4.1.47-gnu/arch/sparc/Kconfig
--- linux-libre-4.1.46-gnu/arch/sparc/Kconfig	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/sparc/Kconfig	2017-12-06 21:20:16.000000000 -0500
@@ -549,9 +549,6 @@ config SYSVIPC_COMPAT
 	depends on COMPAT && SYSVIPC
 	default y
 
-config KEYS_COMPAT
-	def_bool y if COMPAT && KEYS
-
 endmenu
 
 source "net/Kconfig"
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S linux-libre-4.1.47-gnu/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S
--- linux-libre-4.1.46-gnu/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S	2017-12-06 21:20:16.000000000 -0500
@@ -174,8 +174,8 @@ LABEL skip_ %I
 .endr
 
 	# Find min length
-	vmovdqa _lens+0*16(state), %xmm0
-	vmovdqa _lens+1*16(state), %xmm1
+	vmovdqu _lens+0*16(state), %xmm0
+	vmovdqu _lens+1*16(state), %xmm1
 
 	vpminud %xmm1, %xmm0, %xmm2     # xmm2 has {D,C,B,A}
 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
@@ -195,8 +195,8 @@ LABEL skip_ %I
 	vpsubd  %xmm2, %xmm0, %xmm0
 	vpsubd  %xmm2, %xmm1, %xmm1
 
-	vmovdqa %xmm0, _lens+0*16(state)
-	vmovdqa %xmm1, _lens+1*16(state)
+	vmovdqu %xmm0, _lens+0*16(state)
+	vmovdqu %xmm1, _lens+1*16(state)
 
 	# "state" and "args" are the same address, arg1
 	# len is arg2
@@ -260,8 +260,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2)
 	jc      .return_null
 
 	# Find min length
-	vmovdqa _lens(state), %xmm0
-	vmovdqa _lens+1*16(state), %xmm1
+	vmovdqu _lens(state), %xmm0
+	vmovdqu _lens+1*16(state), %xmm1
 
 	vpminud %xmm1, %xmm0, %xmm2        # xmm2 has {D,C,B,A}
 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/x86/include/asm/kvm_emulate.h linux-libre-4.1.47-gnu/arch/x86/include/asm/kvm_emulate.h
--- linux-libre-4.1.46-gnu/arch/x86/include/asm/kvm_emulate.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/x86/include/asm/kvm_emulate.h	2017-12-06 21:20:16.000000000 -0500
@@ -277,6 +277,7 @@ struct x86_emulate_ctxt {
 	bool guest_mode; /* guest running a nested guest */
 	bool perm_ok; /* do not check permissions if true */
 	bool ud;	/* inject an #UD if host doesn't support insn */
+	bool tf;	/* TF value before instruction (after for syscall/sysret) */
 
 	bool have_exception;
 	struct x86_exception exception;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/x86/Kconfig linux-libre-4.1.47-gnu/arch/x86/Kconfig
--- linux-libre-4.1.46-gnu/arch/x86/Kconfig	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/x86/Kconfig	2017-12-06 21:20:16.000000000 -0500
@@ -2552,10 +2552,6 @@ config COMPAT_FOR_U64_ALIGNMENT
 config SYSVIPC_COMPAT
 	def_bool y
 	depends on SYSVIPC
-
-config KEYS_COMPAT
-	def_bool y
-	depends on KEYS
 endif
 
 endmenu
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/x86/kvm/emulate.c linux-libre-4.1.47-gnu/arch/x86/kvm/emulate.c
--- linux-libre-4.1.46-gnu/arch/x86/kvm/emulate.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/x86/kvm/emulate.c	2017-12-06 21:20:16.000000000 -0500
@@ -2400,6 +2400,7 @@ static int em_syscall(struct x86_emulate
 		ctxt->eflags &= ~(X86_EFLAGS_VM | X86_EFLAGS_IF);
 	}
 
+	ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0;
 	return X86EMUL_CONTINUE;
 }
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/x86/kvm/x86.c linux-libre-4.1.47-gnu/arch/x86/kvm/x86.c
--- linux-libre-4.1.46-gnu/arch/x86/kvm/x86.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/x86/kvm/x86.c	2017-12-06 21:20:16.000000000 -0500
@@ -5132,6 +5132,8 @@ static void init_emulate_ctxt(struct kvm
 	kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
 
 	ctxt->eflags = kvm_get_rflags(vcpu);
+	ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0;
+
 	ctxt->eip = kvm_rip_read(vcpu);
 	ctxt->mode = (!is_protmode(vcpu))		? X86EMUL_MODE_REAL :
 		     (ctxt->eflags & X86_EFLAGS_VM)	? X86EMUL_MODE_VM86 :
@@ -5322,37 +5324,26 @@ static int kvm_vcpu_check_hw_bp(unsigned
 	return dr6;
 }
 
-static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, unsigned long rflags, int *r)
+static void kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu, int *r)
 {
 	struct kvm_run *kvm_run = vcpu->run;
 
-	/*
-	 * rflags is the old, "raw" value of the flags.  The new value has
-	 * not been saved yet.
-	 *
-	 * This is correct even for TF set by the guest, because "the
-	 * processor will not generate this exception after the instruction
-	 * that sets the TF flag".
-	 */
-	if (unlikely(rflags & X86_EFLAGS_TF)) {
-		if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
-			kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 |
-						  DR6_RTM;
-			kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip;
-			kvm_run->debug.arch.exception = DB_VECTOR;
-			kvm_run->exit_reason = KVM_EXIT_DEBUG;
-			*r = EMULATE_USER_EXIT;
-		} else {
-			vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF;
-			/*
-			 * "Certain debug exceptions may clear bit 0-3.  The
-			 * remaining contents of the DR6 register are never
-			 * cleared by the processor".
-			 */
-			vcpu->arch.dr6 &= ~15;
-			vcpu->arch.dr6 |= DR6_BS | DR6_RTM;
-			kvm_queue_exception(vcpu, DB_VECTOR);
-		}
+	if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
+		kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | DR6_RTM;
+		kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip;
+		kvm_run->debug.arch.exception = DB_VECTOR;
+		kvm_run->exit_reason = KVM_EXIT_DEBUG;
+		*r = EMULATE_USER_EXIT;
+	} else {
+		vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF;
+		/*
+		 * "Certain debug exceptions may clear bit 0-3.  The
+		 * remaining contents of the DR6 register are never
+		 * cleared by the processor".
+		 */
+		vcpu->arch.dr6 &= ~15;
+		vcpu->arch.dr6 |= DR6_BS | DR6_RTM;
+		kvm_queue_exception(vcpu, DB_VECTOR);
 	}
 }
 
@@ -5507,8 +5498,9 @@ restart:
 		toggle_interruptibility(vcpu, ctxt->interruptibility);
 		vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
 		kvm_rip_write(vcpu, ctxt->eip);
-		if (r == EMULATE_DONE)
-			kvm_vcpu_check_singlestep(vcpu, rflags, &r);
+		if (r == EMULATE_DONE &&
+		    (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
+			kvm_vcpu_do_singlestep(vcpu, &r);
 		if (!ctxt->have_exception ||
 		    exception_type(ctxt->exception.vector) == EXCPT_TRAP)
 			__kvm_set_rflags(vcpu, ctxt->eflags);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/arch/x86/oprofile/op_model_ppro.c linux-libre-4.1.47-gnu/arch/x86/oprofile/op_model_ppro.c
--- linux-libre-4.1.46-gnu/arch/x86/oprofile/op_model_ppro.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/arch/x86/oprofile/op_model_ppro.c	2017-12-06 21:20:16.000000000 -0500
@@ -212,8 +212,8 @@ static void arch_perfmon_setup_counters(
 	eax.full = cpuid_eax(0xa);
 
 	/* Workaround for BIOS bugs in 6/15. Taken from perfmon2 */
-	if (eax.split.version_id == 0 && __this_cpu_read(cpu_info.x86) == 6 &&
-		__this_cpu_read(cpu_info.x86_model) == 15) {
+	if (eax.split.version_id == 0 && boot_cpu_data.x86 == 6 &&
+	    boot_cpu_data.x86_model == 15) {
 		eax.split.version_id = 2;
 		eax.split.num_counters = 2;
 		eax.split.bit_width = 40;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/ata/Kconfig linux-libre-4.1.47-gnu/drivers/ata/Kconfig
--- linux-libre-4.1.46-gnu/drivers/ata/Kconfig	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/ata/Kconfig	2017-12-06 21:20:16.000000000 -0500
@@ -245,6 +245,7 @@ config SATA_SX4
 
 config ATA_BMDMA
 	bool "ATA BMDMA support"
+	depends on HAS_DMA
 	default y
 	help
 	  This option adds support for SFF ATA controllers with BMDMA
@@ -291,6 +292,7 @@ config SATA_DWC_VDEBUG
 
 config SATA_HIGHBANK
 	tristate "Calxeda Highbank SATA support"
+	depends on HAS_DMA
 	depends on ARCH_HIGHBANK || COMPILE_TEST
 	help
 	  This option enables support for the Calxeda Highbank SoC's
@@ -300,6 +302,7 @@ config SATA_HIGHBANK
 
 config SATA_MV
 	tristate "Marvell SATA support"
+	depends on HAS_DMA
 	depends on PCI || ARCH_DOVE || ARCH_MV78XX0 || \
 		   ARCH_MVEBU || ARCH_ORION5X || COMPILE_TEST
 	select GENERIC_PHY
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/block/rbd.c linux-libre-4.1.47-gnu/drivers/block/rbd.c
--- linux-libre-4.1.46-gnu/drivers/block/rbd.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/block/rbd.c	2017-12-06 21:20:16.000000000 -0500
@@ -2712,7 +2712,7 @@ static int rbd_img_obj_parent_read_full(
 	 * from the parent.
 	 */
 	page_count = (u32)calc_pages_for(0, length);
-	pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
+	pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
 	if (IS_ERR(pages)) {
 		result = PTR_ERR(pages);
 		pages = NULL;
@@ -2839,7 +2839,7 @@ static int rbd_img_obj_exists_submit(str
 	 */
 	size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32);
 	page_count = (u32)calc_pages_for(0, size);
-	pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
+	pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
 	if (IS_ERR(pages))
 		return PTR_ERR(pages);
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/block/xen-blkback/blkback.c linux-libre-4.1.47-gnu/drivers/block/xen-blkback/blkback.c
--- linux-libre-4.1.46-gnu/drivers/block/xen-blkback/blkback.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/block/xen-blkback/blkback.c	2017-12-06 21:20:16.000000000 -0500
@@ -1394,33 +1394,34 @@ static int dispatch_rw_block_io(struct x
 static void make_response(struct xen_blkif *blkif, u64 id,
 			  unsigned short op, int st)
 {
-	struct blkif_response  resp;
+	struct blkif_response *resp;
 	unsigned long     flags;
 	union blkif_back_rings *blk_rings = &blkif->blk_rings;
 	int notify;
 
-	resp.id        = id;
-	resp.operation = op;
-	resp.status    = st;
-
 	spin_lock_irqsave(&blkif->blk_ring_lock, flags);
 	/* Place on the response ring for the relevant domain. */
 	switch (blkif->blk_protocol) {
 	case BLKIF_PROTOCOL_NATIVE:
-		memcpy(RING_GET_RESPONSE(&blk_rings->native, blk_rings->native.rsp_prod_pvt),
-		       &resp, sizeof(resp));
+		resp = RING_GET_RESPONSE(&blk_rings->native,
+					 blk_rings->native.rsp_prod_pvt);
 		break;
 	case BLKIF_PROTOCOL_X86_32:
-		memcpy(RING_GET_RESPONSE(&blk_rings->x86_32, blk_rings->x86_32.rsp_prod_pvt),
-		       &resp, sizeof(resp));
+		resp = RING_GET_RESPONSE(&blk_rings->x86_32,
+					 blk_rings->x86_32.rsp_prod_pvt);
 		break;
 	case BLKIF_PROTOCOL_X86_64:
-		memcpy(RING_GET_RESPONSE(&blk_rings->x86_64, blk_rings->x86_64.rsp_prod_pvt),
-		       &resp, sizeof(resp));
+		resp = RING_GET_RESPONSE(&blk_rings->x86_64,
+					 blk_rings->x86_64.rsp_prod_pvt);
 		break;
 	default:
 		BUG();
 	}
+
+	resp->id        = id;
+	resp->operation = op;
+	resp->status    = st;
+
 	blk_rings->common.rsp_prod_pvt++;
 	RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blk_rings->common, notify);
 	spin_unlock_irqrestore(&blkif->blk_ring_lock, flags);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/block/xen-blkback/common.h linux-libre-4.1.47-gnu/drivers/block/xen-blkback/common.h
--- linux-libre-4.1.46-gnu/drivers/block/xen-blkback/common.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/block/xen-blkback/common.h	2017-12-06 21:20:16.000000000 -0500
@@ -64,9 +64,8 @@
 struct blkif_common_request {
 	char dummy;
 };
-struct blkif_common_response {
-	char dummy;
-};
+
+/* i386 protocol version */
 
 struct blkif_x86_32_request_rw {
 	uint8_t        nr_segments;  /* number of segments                   */
@@ -118,14 +117,6 @@ struct blkif_x86_32_request {
 	} u;
 } __attribute__((__packed__));
 
-/* i386 protocol version */
-#pragma pack(push, 4)
-struct blkif_x86_32_response {
-	uint64_t        id;              /* copied from request */
-	uint8_t         operation;       /* copied from request */
-	int16_t         status;          /* BLKIF_RSP_???       */
-};
-#pragma pack(pop)
 /* x86_64 protocol version */
 
 struct blkif_x86_64_request_rw {
@@ -182,18 +173,12 @@ struct blkif_x86_64_request {
 	} u;
 } __attribute__((__packed__));
 
-struct blkif_x86_64_response {
-	uint64_t       __attribute__((__aligned__(8))) id;
-	uint8_t         operation;       /* copied from request */
-	int16_t         status;          /* BLKIF_RSP_???       */
-};
-
 DEFINE_RING_TYPES(blkif_common, struct blkif_common_request,
-		  struct blkif_common_response);
+		  struct blkif_response);
 DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request,
-		  struct blkif_x86_32_response);
+		  struct blkif_response __packed);
 DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request,
-		  struct blkif_x86_64_response);
+		  struct blkif_response);
 
 union blkif_back_rings {
 	struct blkif_back_ring        native;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/char/ipmi/ipmi_msghandler.c linux-libre-4.1.47-gnu/drivers/char/ipmi/ipmi_msghandler.c
--- linux-libre-4.1.46-gnu/drivers/char/ipmi/ipmi_msghandler.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/char/ipmi/ipmi_msghandler.c	2017-12-06 21:20:16.000000000 -0500
@@ -4019,7 +4019,8 @@ smi_from_recv_msg(ipmi_smi_t intf, struc
 }
 
 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
-			      struct list_head *timeouts, long timeout_period,
+			      struct list_head *timeouts,
+			      unsigned long timeout_period,
 			      int slot, unsigned long *flags,
 			      unsigned int *waiting_msgs)
 {
@@ -4032,8 +4033,8 @@ static void check_msg_timeout(ipmi_smi_t
 	if (!ent->inuse)
 		return;
 
-	ent->timeout -= timeout_period;
-	if (ent->timeout > 0) {
+	if (timeout_period < ent->timeout) {
+		ent->timeout -= timeout_period;
 		(*waiting_msgs)++;
 		return;
 	}
@@ -4099,7 +4100,8 @@ static void check_msg_timeout(ipmi_smi_t
 	}
 }
 
-static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, long timeout_period)
+static unsigned int ipmi_timeout_handler(ipmi_smi_t intf,
+					 unsigned long timeout_period)
 {
 	struct list_head     timeouts;
 	struct ipmi_recv_msg *msg, *msg2;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/dma/dmatest.c linux-libre-4.1.47-gnu/drivers/dma/dmatest.c
--- linux-libre-4.1.46-gnu/drivers/dma/dmatest.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/dma/dmatest.c	2017-12-06 21:20:16.000000000 -0500
@@ -634,6 +634,7 @@ static int dmatest_func(void *data)
 			 * free it this time?" dancing.  For now, just
 			 * leave it dangling.
 			 */
+			WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
 			dmaengine_unmap_put(um);
 			result("test timed out", total_tests, src_off, dst_off,
 			       len, 0);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/extcon/extcon-palmas.c linux-libre-4.1.47-gnu/drivers/extcon/extcon-palmas.c
--- linux-libre-4.1.46-gnu/drivers/extcon/extcon-palmas.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/extcon/extcon-palmas.c	2017-12-06 21:20:16.000000000 -0500
@@ -150,6 +150,11 @@ static int palmas_usb_probe(struct platf
 	struct palmas_usb *palmas_usb;
 	int status;
 
+	if (!palmas) {
+		dev_err(&pdev->dev, "failed to get valid parent\n");
+		return -EINVAL;
+	}
+
 	palmas_usb = devm_kzalloc(&pdev->dev, sizeof(*palmas_usb), GFP_KERNEL);
 	if (!palmas_usb)
 		return -ENOMEM;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/gpu/drm/drm_drv.c linux-libre-4.1.47-gnu/drivers/gpu/drm/drm_drv.c
--- linux-libre-4.1.46-gnu/drivers/gpu/drm/drm_drv.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/gpu/drm/drm_drv.c	2017-12-06 21:20:16.000000000 -0500
@@ -325,7 +325,7 @@ static int drm_minor_register(struct drm
 	ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root);
 	if (ret) {
 		DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n");
-		return ret;
+		goto err_debugfs;
 	}
 
 	ret = device_add(minor->kdev);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/gpu/drm/mgag200/mgag200_main.c linux-libre-4.1.47-gnu/drivers/gpu/drm/mgag200/mgag200_main.c
--- linux-libre-4.1.46-gnu/drivers/gpu/drm/mgag200/mgag200_main.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/gpu/drm/mgag200/mgag200_main.c	2017-12-06 21:20:16.000000000 -0500
@@ -138,6 +138,8 @@ static int mga_vram_init(struct mga_devi
 	}
 
 	mem = pci_iomap(mdev->dev->pdev, 0, 0);
+	if (!mem)
+		return -ENOMEM;
 
 	mdev->mc.vram_size = mga_probe_vram(mdev, mem);
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/gpu/drm/msm/msm_gem_submit.c linux-libre-4.1.47-gnu/drivers/gpu/drm/msm/msm_gem_submit.c
--- linux-libre-4.1.46-gnu/drivers/gpu/drm/msm/msm_gem_submit.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/gpu/drm/msm/msm_gem_submit.c	2017-12-06 21:20:16.000000000 -0500
@@ -34,10 +34,13 @@ static inline void __user *to_user_ptr(u
 }
 
 static struct msm_gem_submit *submit_create(struct drm_device *dev,
-		struct msm_gpu *gpu, int nr)
+		struct msm_gpu *gpu, uint32_t nr)
 {
 	struct msm_gem_submit *submit;
-	int sz = sizeof(*submit) + (nr * sizeof(submit->bos[0]));
+	uint64_t sz = sizeof(*submit) + ((u64)nr * sizeof(submit->bos[0]));
+
+	if (sz > SIZE_MAX)
+		return NULL;
 
 	submit = kmalloc(sz, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY);
 	if (submit) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/gpu/drm/sti/sti_vtg.c linux-libre-4.1.47-gnu/drivers/gpu/drm/sti/sti_vtg.c
--- linux-libre-4.1.46-gnu/drivers/gpu/drm/sti/sti_vtg.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/gpu/drm/sti/sti_vtg.c	2017-12-06 21:20:16.000000000 -0500
@@ -328,6 +328,10 @@ static int vtg_probe(struct platform_dev
 		return -ENOMEM;
 	}
 	vtg->regs = devm_ioremap_nocache(dev, res->start, resource_size(res));
+	if (!vtg->regs) {
+		DRM_ERROR("failed to remap I/O memory\n");
+		return -ENOMEM;
+	}
 
 	np = of_parse_phandle(pdev->dev.of_node, "st,slave", 0);
 	if (np) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/i2c/busses/i2c-riic.c linux-libre-4.1.47-gnu/drivers/i2c/busses/i2c-riic.c
--- linux-libre-4.1.46-gnu/drivers/i2c/busses/i2c-riic.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/i2c/busses/i2c-riic.c	2017-12-06 21:20:16.000000000 -0500
@@ -80,6 +80,7 @@
 #define ICIER_TEIE	0x40
 #define ICIER_RIE	0x20
 #define ICIER_NAKIE	0x10
+#define ICIER_SPIE	0x08
 
 #define ICSR2_NACKF	0x10
 
@@ -216,11 +217,10 @@ static irqreturn_t riic_tend_isr(int irq
 		return IRQ_NONE;
 	}
 
-	if (riic->is_last || riic->err)
+	if (riic->is_last || riic->err) {
+		riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER);
 		writeb(ICCR2_SP, riic->base + RIIC_ICCR2);
-
-	writeb(0, riic->base + RIIC_ICIER);
-	complete(&riic->msg_done);
+	}
 
 	return IRQ_HANDLED;
 }
@@ -240,13 +240,13 @@ static irqreturn_t riic_rdrf_isr(int irq
 
 	if (riic->bytes_left == 1) {
 		/* STOP must come before we set ACKBT! */
-		if (riic->is_last)
+		if (riic->is_last) {
+			riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER);
 			writeb(ICCR2_SP, riic->base + RIIC_ICCR2);
+		}
 
 		riic_clear_set_bit(riic, 0, ICMR3_ACKBT, RIIC_ICMR3);
 
-		writeb(0, riic->base + RIIC_ICIER);
-		complete(&riic->msg_done);
 	} else {
 		riic_clear_set_bit(riic, ICMR3_ACKBT, 0, RIIC_ICMR3);
 	}
@@ -259,6 +259,21 @@ static irqreturn_t riic_rdrf_isr(int irq
 	return IRQ_HANDLED;
 }
 
+static irqreturn_t riic_stop_isr(int irq, void *data)
+{
+	struct riic_dev *riic = data;
+
+	/* read back registers to confirm writes have fully propagated */
+	writeb(0, riic->base + RIIC_ICSR2);
+	readb(riic->base + RIIC_ICSR2);
+	writeb(0, riic->base + RIIC_ICIER);
+	readb(riic->base + RIIC_ICIER);
+
+	complete(&riic->msg_done);
+
+	return IRQ_HANDLED;
+}
+
 static u32 riic_func(struct i2c_adapter *adap)
 {
 	return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
@@ -326,6 +341,7 @@ static struct riic_irq_desc riic_irqs[]
 	{ .res_num = 0, .isr = riic_tend_isr, .name = "riic-tend" },
 	{ .res_num = 1, .isr = riic_rdrf_isr, .name = "riic-rdrf" },
 	{ .res_num = 2, .isr = riic_tdre_isr, .name = "riic-tdre" },
+	{ .res_num = 3, .isr = riic_stop_isr, .name = "riic-stop" },
 	{ .res_num = 5, .isr = riic_tend_isr, .name = "riic-nack" },
 };
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/iio/trigger/iio-trig-interrupt.c linux-libre-4.1.47-gnu/drivers/iio/trigger/iio-trig-interrupt.c
--- linux-libre-4.1.46-gnu/drivers/iio/trigger/iio-trig-interrupt.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/iio/trigger/iio-trig-interrupt.c	2017-12-06 21:20:16.000000000 -0500
@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(s
 	trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL);
 	if (!trig_info) {
 		ret = -ENOMEM;
-		goto error_put_trigger;
+		goto error_free_trigger;
 	}
 	iio_trigger_set_drvdata(trig, trig_info);
 	trig_info->irq = irq;
@@ -83,8 +83,8 @@ error_release_irq:
 	free_irq(irq, trig);
 error_free_trig_info:
 	kfree(trig_info);
-error_put_trigger:
-	iio_trigger_put(trig);
+error_free_trigger:
+	iio_trigger_free(trig);
 error_ret:
 	return ret;
 }
@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(
 	iio_trigger_unregister(trig);
 	free_irq(trig_info->irq, trig);
 	kfree(trig_info);
-	iio_trigger_put(trig);
+	iio_trigger_free(trig);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/iio/trigger/iio-trig-sysfs.c linux-libre-4.1.47-gnu/drivers/iio/trigger/iio-trig-sysfs.c
--- linux-libre-4.1.46-gnu/drivers/iio/trigger/iio-trig-sysfs.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/iio/trigger/iio-trig-sysfs.c	2017-12-06 21:20:16.000000000 -0500
@@ -174,7 +174,7 @@ static int iio_sysfs_trigger_probe(int i
 	return 0;
 
 out2:
-	iio_trigger_put(t->trig);
+	iio_trigger_free(t->trig);
 free_t:
 	kfree(t);
 out1:
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c linux-libre-4.1.47-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c
--- linux-libre-4.1.46-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c	2017-12-06 21:20:16.000000000 -0500
@@ -1362,7 +1362,7 @@ static void ipoib_cm_tx_reap(struct work
 
 	while (!list_empty(&priv->cm.reap_list)) {
 		p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
-		list_del(&p->list);
+		list_del_init(&p->list);
 		spin_unlock_irqrestore(&priv->lock, flags);
 		netif_tx_unlock_bh(dev);
 		ipoib_cm_tx_destroy(p);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/input/keyboard/mpr121_touchkey.c linux-libre-4.1.47-gnu/drivers/input/keyboard/mpr121_touchkey.c
--- linux-libre-4.1.46-gnu/drivers/input/keyboard/mpr121_touchkey.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/input/keyboard/mpr121_touchkey.c	2017-12-06 21:20:16.000000000 -0500
@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrup
 	struct mpr121_touchkey *mpr121 = dev_id;
 	struct i2c_client *client = mpr121->client;
 	struct input_dev *input = mpr121->input_dev;
-	unsigned int key_num, key_val, pressed;
+	unsigned long bit_changed;
+	unsigned int key_num;
 	int reg;
 
 	reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR);
@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrup
 
 	reg &= TOUCH_STATUS_MASK;
 	/* use old press bit to figure out which bit changed */
-	key_num = ffs(reg ^ mpr121->statusbits) - 1;
-	pressed = reg & (1 << key_num);
+	bit_changed = reg ^ mpr121->statusbits;
 	mpr121->statusbits = reg;
+	for_each_set_bit(key_num, &bit_changed, mpr121->keycount) {
+		unsigned int key_val, pressed;
 
-	key_val = mpr121->keycodes[key_num];
+		pressed = reg & BIT(key_num);
+		key_val = mpr121->keycodes[key_num];
 
-	input_event(input, EV_MSC, MSC_SCAN, key_num);
-	input_report_key(input, key_val, pressed);
-	input_sync(input);
+		input_event(input, EV_MSC, MSC_SCAN, key_num);
+		input_report_key(input, key_val, pressed);
 
-	dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
-		pressed ? "pressed" : "released");
+		dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
+			pressed ? "pressed" : "released");
+
+	}
+	input_sync(input);
 
 out:
 	return IRQ_HANDLED;
@@ -231,6 +236,7 @@ static int mpr_touchkey_probe(struct i2c
 	input_dev->id.bustype = BUS_I2C;
 	input_dev->dev.parent = &client->dev;
 	input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+	input_set_capability(input_dev, EV_MSC, MSC_SCAN);
 
 	input_dev->keycode = mpr121->keycodes;
 	input_dev->keycodesize = sizeof(mpr121->keycodes[0]);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/input/misc/ims-pcu.c linux-libre-4.1.47-gnu/drivers/input/misc/ims-pcu.c
--- linux-libre-4.1.46-gnu/drivers/input/misc/ims-pcu.c	2017-11-09 10:51:23.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/input/misc/ims-pcu.c	2017-12-07 13:31:40.000000000 -0500
@@ -1635,13 +1635,25 @@ ims_pcu_get_cdc_union_desc(struct usb_in
 		return NULL;
 	}
 
-	while (buflen > 0) {
+	while (buflen >= sizeof(*union_desc)) {
 		union_desc = (struct usb_cdc_union_desc *)buf;
 
+		if (union_desc->bLength > buflen) {
+			dev_err(&intf->dev, "Too large descriptor\n");
+			return NULL;
+		}
+
 		if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE &&
 		    union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) {
 			dev_dbg(&intf->dev, "Found union header\n");
-			return union_desc;
+
+			if (union_desc->bLength >= sizeof(*union_desc))
+				return union_desc;
+
+			dev_err(&intf->dev,
+				"Union descriptor to short (%d vs %zd\n)",
+				union_desc->bLength, sizeof(*union_desc));
+			return NULL;
 		}
 
 		buflen -= union_desc->bLength;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/media/i2c/adv7604.c linux-libre-4.1.47-gnu/drivers/media/i2c/adv7604.c
--- linux-libre-4.1.46-gnu/drivers/media/i2c/adv7604.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/media/i2c/adv7604.c	2017-12-06 21:20:16.000000000 -0500
@@ -2669,6 +2669,9 @@ static int adv76xx_parse_dt(struct adv76
 	state->pdata.alt_data_sat = 1;
 	state->pdata.op_format_mode_sel = ADV7604_OP_FORMAT_MODE0;
 	state->pdata.bus_order = ADV7604_BUS_ORDER_RGB;
+	state->pdata.dr_str_data = ADV76XX_DR_STR_MEDIUM_HIGH;
+	state->pdata.dr_str_clk = ADV76XX_DR_STR_MEDIUM_HIGH;
+	state->pdata.dr_str_sync = ADV76XX_DR_STR_MEDIUM_HIGH;
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/media/pci/bt8xx/dvb-bt8xx.c linux-libre-4.1.47-gnu/drivers/media/pci/bt8xx/dvb-bt8xx.c
--- linux-libre-4.1.46-gnu/drivers/media/pci/bt8xx/dvb-bt8xx.c	2017-11-09 10:38:05.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/media/pci/bt8xx/dvb-bt8xx.c	2017-12-07 13:19:41.000000000 -0500
@@ -680,6 +680,7 @@ static void frontend_init(struct dvb_bt8
 		/*	DST is not a frontend, attaching the ASIC	*/
 		if (dvb_attach(dst_attach, state, &card->dvb_adapter) == NULL) {
 			pr_err("%s: Could not find a Twinhan DST\n", __func__);
+			kfree(state);
 			break;
 		}
 		/*	Attach other DST peripherals if any		*/
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/media/platform/exynos4-is/fimc-is.c linux-libre-4.1.47-gnu/drivers/media/platform/exynos4-is/fimc-is.c
--- linux-libre-4.1.46-gnu/drivers/media/platform/exynos4-is/fimc-is.c	2017-11-09 10:41:27.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/media/platform/exynos4-is/fimc-is.c	2017-12-07 13:23:05.000000000 -0500
@@ -815,12 +815,13 @@ static int fimc_is_probe(struct platform
 	is->irq = irq_of_parse_and_map(dev->of_node, 0);
 	if (!is->irq) {
 		dev_err(dev, "no irq found\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_iounmap;
 	}
 
 	ret = fimc_is_get_clocks(is);
 	if (ret < 0)
-		return ret;
+		goto err_iounmap;
 
 	platform_set_drvdata(pdev, is);
 
@@ -880,6 +881,8 @@ err_irq:
 	free_irq(is->irq, is);
 err_clk:
 	fimc_is_put_clocks(is);
+err_iounmap:
+	iounmap(is->pmu_regs);
 	return ret;
 }
 
@@ -935,6 +938,7 @@ static int fimc_is_remove(struct platfor
 	fimc_is_unregister_subdevs(is);
 	vb2_dma_contig_cleanup_ctx(is->alloc_ctx);
 	fimc_is_put_clocks(is);
+	iounmap(is->pmu_regs);
 	fimc_is_debugfs_remove(is);
 	release_firmware(is->fw.f_w);
 	fimc_is_free_cpu_memory(is);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/media/rc/imon.c linux-libre-4.1.47-gnu/drivers/media/rc/imon.c
--- linux-libre-4.1.46-gnu/drivers/media/rc/imon.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/media/rc/imon.c	2017-12-06 21:20:16.000000000 -0500
@@ -2419,6 +2419,11 @@ static int imon_probe(struct usb_interfa
 	mutex_lock(&driver_lock);
 
 	first_if = usb_ifnum_to_if(usbdev, 0);
+	if (!first_if) {
+		ret = -ENODEV;
+		goto fail;
+	}
+
 	first_if_ctx = usb_get_intfdata(first_if);
 
 	if (ifnum == 0) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/media/usb/cx231xx/cx231xx-core.c linux-libre-4.1.47-gnu/drivers/media/usb/cx231xx/cx231xx-core.c
--- linux-libre-4.1.46-gnu/drivers/media/usb/cx231xx/cx231xx-core.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/media/usb/cx231xx/cx231xx-core.c	2017-12-06 21:20:16.000000000 -0500
@@ -356,7 +356,12 @@ int cx231xx_send_vendor_cmd(struct cx231
 	 */
 	if ((ven_req->wLength > 4) && ((ven_req->bRequest == 0x4) ||
 					(ven_req->bRequest == 0x5) ||
-					(ven_req->bRequest == 0x6))) {
+					(ven_req->bRequest == 0x6) ||
+
+					/* Internal Master 3 Bus can send
+					 * and receive only 4 bytes per time
+					 */
+					(ven_req->bRequest == 0x2))) {
 		unsend_size = 0;
 		pdata = ven_req->pBuff;
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/media/usb/dvb-usb/dib0700_devices.c linux-libre-4.1.47-gnu/drivers/media/usb/dvb-usb/dib0700_devices.c
--- linux-libre-4.1.46-gnu/drivers/media/usb/dvb-usb/dib0700_devices.c	2017-11-09 10:38:36.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/media/usb/dvb-usb/dib0700_devices.c	2017-12-07 13:20:09.000000000 -0500
@@ -292,7 +292,7 @@ static int stk7700P2_frontend_attach(str
 					     stk7700d_dib7000p_mt2266_config)
 		    != 0) {
 			err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
-			dvb_detach(&state->dib7000p_ops);
+			dvb_detach(state->dib7000p_ops.set_wbd_ref);
 			return -ENODEV;
 		}
 	}
@@ -326,7 +326,7 @@ static int stk7700d_frontend_attach(stru
 					     stk7700d_dib7000p_mt2266_config)
 		    != 0) {
 			err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
-			dvb_detach(&state->dib7000p_ops);
+			dvb_detach(state->dib7000p_ops.set_wbd_ref);
 			return -ENODEV;
 		}
 	}
@@ -479,7 +479,7 @@ static int stk7700ph_frontend_attach(str
 				     &stk7700ph_dib7700_xc3028_config) != 0) {
 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
 		    __func__);
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 
@@ -1010,7 +1010,7 @@ static int stk7070p_frontend_attach(stru
 				     &dib7070p_dib7000p_config) != 0) {
 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
 		    __func__);
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 
@@ -1068,7 +1068,7 @@ static int stk7770p_frontend_attach(stru
 				     &dib7770p_dib7000p_config) != 0) {
 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
 		    __func__);
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 
@@ -3036,7 +3036,7 @@ static int nim7090_frontend_attach(struc
 
 	if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x10, &nim7090_dib7000p_config) != 0) {
 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 	adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap, 0x80, &nim7090_dib7000p_config);
@@ -3089,7 +3089,7 @@ static int tfe7090pvr_frontend0_attach(s
 	/* initialize IC 0 */
 	if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, &tfe7090pvr_dib7000p_config[0]) != 0) {
 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 
@@ -3119,7 +3119,7 @@ static int tfe7090pvr_frontend1_attach(s
 	i2c = state->dib7000p_ops.get_i2c_master(adap->dev->adapter[0].fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_6_7, 1);
 	if (state->dib7000p_ops.i2c_enumeration(i2c, 1, 0x10, &tfe7090pvr_dib7000p_config[1]) != 0) {
 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n", __func__);
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 
@@ -3194,7 +3194,7 @@ static int tfe7790p_frontend_attach(stru
 				1, 0x10, &tfe7790p_dib7000p_config) != 0) {
 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
 				__func__);
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 	adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap,
@@ -3289,7 +3289,7 @@ static int stk7070pd_frontend_attach0(st
 				     stk7070pd_dib7000p_config) != 0) {
 		err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
 		    __func__);
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 
@@ -3364,7 +3364,7 @@ static int novatd_frontend_attach(struct
 					     stk7070pd_dib7000p_config) != 0) {
 			err("%s: state->dib7000p_ops.i2c_enumeration failed.  Cannot continue\n",
 			    __func__);
-			dvb_detach(&state->dib7000p_ops);
+			dvb_detach(state->dib7000p_ops.set_wbd_ref);
 			return -ENODEV;
 		}
 	}
@@ -3600,7 +3600,7 @@ static int pctv340e_frontend_attach(stru
 
 	if (state->dib7000p_ops.dib7000pc_detection(&adap->dev->i2c_adap) == 0) {
 		/* Demodulator not found for some reason? */
-		dvb_detach(&state->dib7000p_ops);
+		dvb_detach(state->dib7000p_ops.set_wbd_ref);
 		return -ENODEV;
 	}
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/mfd/ab8500-sysctrl.c linux-libre-4.1.47-gnu/drivers/mfd/ab8500-sysctrl.c
--- linux-libre-4.1.46-gnu/drivers/mfd/ab8500-sysctrl.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/mfd/ab8500-sysctrl.c	2017-12-06 21:20:16.000000000 -0500
@@ -99,7 +99,7 @@ int ab8500_sysctrl_read(u16 reg, u8 *val
 	u8 bank;
 
 	if (sysctrl_dev == NULL)
-		return -EINVAL;
+		return -EPROBE_DEFER;
 
 	bank = (reg >> 8);
 	if (!valid_bank(bank))
@@ -115,11 +115,13 @@ int ab8500_sysctrl_write(u16 reg, u8 mas
 	u8 bank;
 
 	if (sysctrl_dev == NULL)
-		return -EINVAL;
+		return -EPROBE_DEFER;
 
 	bank = (reg >> 8);
-	if (!valid_bank(bank))
+	if (!valid_bank(bank)) {
+		pr_err("invalid bank\n");
 		return -EINVAL;
+	}
 
 	return abx500_mask_and_set_register_interruptible(sysctrl_dev, bank,
 		(u8)(reg & 0xFF), mask, value);
@@ -180,9 +182,15 @@ static int ab8500_sysctrl_remove(struct
 	return 0;
 }
 
+static const struct of_device_id ab8500_sysctrl_match[] = {
+	{ .compatible = "stericsson,ab8500-sysctrl", },
+	{}
+};
+
 static struct platform_driver ab8500_sysctrl_driver = {
 	.driver = {
 		.name = "ab8500-sysctrl",
+		.of_match_table = ab8500_sysctrl_match,
 	},
 	.probe = ab8500_sysctrl_probe,
 	.remove = ab8500_sysctrl_remove,
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/mmc/host/s3cmci.c linux-libre-4.1.47-gnu/drivers/mmc/host/s3cmci.c
--- linux-libre-4.1.46-gnu/drivers/mmc/host/s3cmci.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/mmc/host/s3cmci.c	2017-12-06 21:20:16.000000000 -0500
@@ -21,6 +21,7 @@
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
 #include <linux/gpio.h>
+#include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/io.h>
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/bonding/bond_main.c linux-libre-4.1.47-gnu/drivers/net/bonding/bond_main.c
--- linux-libre-4.1.46-gnu/drivers/net/bonding/bond_main.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/bonding/bond_main.c	2017-12-06 21:20:16.000000000 -0500
@@ -3151,7 +3151,7 @@ u32 bond_xmit_hash(struct bonding *bond,
 	hash ^= (hash >> 16);
 	hash ^= (hash >> 8);
 
-	return hash;
+	return hash >> 1;
 }
 
 /*-------------------------- Device entry points ----------------------------*/
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/can/c_can/c_can_pci.c linux-libre-4.1.47-gnu/drivers/net/can/c_can/c_can_pci.c
--- linux-libre-4.1.46-gnu/drivers/net/can/c_can/c_can_pci.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/can/c_can/c_can_pci.c	2017-12-06 21:20:16.000000000 -0500
@@ -178,7 +178,6 @@ static int c_can_pci_probe(struct pci_de
 		break;
 	case BOSCH_D_CAN:
 		priv->regs = reg_map_d_can;
-		priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
 		break;
 	default:
 		ret = -EINVAL;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/can/c_can/c_can_platform.c linux-libre-4.1.47-gnu/drivers/net/can/c_can/c_can_platform.c
--- linux-libre-4.1.46-gnu/drivers/net/can/c_can/c_can_platform.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/can/c_can/c_can_platform.c	2017-12-06 21:20:16.000000000 -0500
@@ -320,7 +320,6 @@ static int c_can_plat_probe(struct platf
 		break;
 	case BOSCH_D_CAN:
 		priv->regs = reg_map_d_can;
-		priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
 		priv->read_reg = c_can_plat_read_reg_aligned_to_16bit;
 		priv->write_reg = c_can_plat_write_reg_aligned_to_16bit;
 		priv->read_reg32 = d_can_plat_read_reg32;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/ethernet/fealnx.c linux-libre-4.1.47-gnu/drivers/net/ethernet/fealnx.c
--- linux-libre-4.1.46-gnu/drivers/net/ethernet/fealnx.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/ethernet/fealnx.c	2017-12-06 21:20:16.000000000 -0500
@@ -257,8 +257,8 @@ enum rx_desc_status_bits {
 	RXFSD = 0x00000800,	/* first descriptor */
 	RXLSD = 0x00000400,	/* last descriptor */
 	ErrorSummary = 0x80,	/* error summary */
-	RUNT = 0x40,		/* runt packet received */
-	LONG = 0x20,		/* long packet received */
+	RUNTPKT = 0x40,		/* runt packet received */
+	LONGPKT = 0x20,		/* long packet received */
 	FAE = 0x10,		/* frame align error */
 	CRC = 0x08,		/* crc error */
 	RXER = 0x04,		/* receive error */
@@ -1633,7 +1633,7 @@ static int netdev_rx(struct net_device *
 					       dev->name, rx_status);
 
 				dev->stats.rx_errors++;	/* end of a packet. */
-				if (rx_status & (LONG | RUNT))
+				if (rx_status & (LONGPKT | RUNTPKT))
 					dev->stats.rx_length_errors++;
 				if (rx_status & RXER)
 					dev->stats.rx_frame_errors++;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c
--- linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c	2017-12-06 21:20:16.000000000 -0500
@@ -1967,9 +1967,10 @@ static void fm10k_sm_mbx_create_reply(st
  *  function can also be used to respond to an error as the connection
  *  resetting would also be a means of dealing with errors.
  **/
-static void fm10k_sm_mbx_process_reset(struct fm10k_hw *hw,
-				       struct fm10k_mbx_info *mbx)
+static s32 fm10k_sm_mbx_process_reset(struct fm10k_hw *hw,
+				      struct fm10k_mbx_info *mbx)
 {
+	s32 err = 0;
 	const enum fm10k_mbx_state state = mbx->state;
 
 	switch (state) {
@@ -1982,6 +1983,7 @@ static void fm10k_sm_mbx_process_reset(s
 	case FM10K_STATE_OPEN:
 		/* flush any incomplete work */
 		fm10k_sm_mbx_connect_reset(mbx);
+		err = FM10K_ERR_RESET_REQUESTED;
 		break;
 	case FM10K_STATE_CONNECT:
 		/* Update remote value to match local value */
@@ -1991,6 +1993,8 @@ static void fm10k_sm_mbx_process_reset(s
 	}
 
 	fm10k_sm_mbx_create_reply(hw, mbx, mbx->tail);
+
+	return err;
 }
 
 /**
@@ -2071,7 +2075,7 @@ static s32 fm10k_sm_mbx_process(struct f
 
 	switch (FM10K_MSG_HDR_FIELD_GET(mbx->mbx_hdr, SM_VER)) {
 	case 0:
-		fm10k_sm_mbx_process_reset(hw, mbx);
+		err = fm10k_sm_mbx_process_reset(hw, mbx);
 		break;
 	case FM10K_SM_MBX_VERSION:
 		err = fm10k_sm_mbx_process_version_1(hw, mbx);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/fm10k/fm10k_pci.c linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
--- linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/fm10k/fm10k_pci.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/fm10k/fm10k_pci.c	2017-12-06 21:20:16.000000000 -0500
@@ -990,6 +990,7 @@ static irqreturn_t fm10k_msix_mbx_pf(int
 	struct fm10k_hw *hw = &interface->hw;
 	struct fm10k_mbx_info *mbx = &hw->mbx;
 	u32 eicr;
+	s32 err = 0;
 
 	/* unmask any set bits related to this interrupt */
 	eicr = fm10k_read_reg(hw, FM10K_EICR);
@@ -1005,12 +1006,15 @@ static irqreturn_t fm10k_msix_mbx_pf(int
 
 	/* service mailboxes */
 	if (fm10k_mbx_trylock(interface)) {
-		mbx->ops.process(hw, mbx);
+		err = mbx->ops.process(hw, mbx);
 		/* handle VFLRE events */
 		fm10k_iov_event(interface);
 		fm10k_mbx_unlock(interface);
 	}
 
+	if (err == FM10K_ERR_RESET_REQUESTED)
+		interface->flags |= FM10K_FLAG_RESET_REQUESTED;
+
 	/* if switch toggled state we should reset GLORTs */
 	if (eicr & FM10K_EICR_SWITCHNOTREADY) {
 		/* force link down for at least 4 seconds */
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/igb/e1000_82575.c linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/igb/e1000_82575.c
--- linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/igb/e1000_82575.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/igb/e1000_82575.c	2017-12-06 21:20:16.000000000 -0500
@@ -215,6 +215,17 @@ static s32 igb_init_phy_params_82575(str
 	hw->bus.func = (rd32(E1000_STATUS) & E1000_STATUS_FUNC_MASK) >>
 			E1000_STATUS_FUNC_SHIFT;
 
+	/* Make sure the PHY is in a good state. Several people have reported
+	 * firmware leaving the PHY's page select register set to something
+	 * other than the default of zero, which causes the PHY ID read to
+	 * access something other than the intended register.
+	 */
+	ret_val = hw->phy.ops.reset(hw);
+	if (ret_val) {
+		hw_dbg("Error resetting the PHY.\n");
+		goto out;
+	}
+
 	/* Set phy->phy_addr and phy->id. */
 	ret_val = igb_get_phy_id_82575(hw);
 	if (ret_val)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/igb/e1000_i210.c linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/igb/e1000_i210.c
--- linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/igb/e1000_i210.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/igb/e1000_i210.c	2017-12-06 21:20:16.000000000 -0500
@@ -699,9 +699,9 @@ static s32 igb_update_flash_i210(struct
 
 	ret_val = igb_pool_flash_update_done_i210(hw);
 	if (ret_val)
-		hw_dbg("Flash update complete\n");
-	else
 		hw_dbg("Flash update time out\n");
+	else
+		hw_dbg("Flash update complete\n");
 
 out:
 	return ret_val;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/igb/igb_main.c linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/igb/igb_main.c
--- linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/igb/igb_main.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/igb/igb_main.c	2017-12-06 21:20:16.000000000 -0500
@@ -3167,7 +3167,9 @@ static int __igb_close(struct net_device
 
 static int igb_close(struct net_device *netdev)
 {
-	return __igb_close(netdev, false);
+	if (netif_device_present(netdev))
+		return __igb_close(netdev, false);
+	return 0;
 }
 
 /**
@@ -7363,12 +7365,14 @@ static int __igb_shutdown(struct pci_dev
 	int retval = 0;
 #endif
 
+	rtnl_lock();
 	netif_device_detach(netdev);
 
 	if (netif_running(netdev))
 		__igb_close(netdev, true);
 
 	igb_clear_interrupt_scheme(adapter);
+	rtnl_unlock();
 
 #ifdef CONFIG_PM
 	retval = pci_save_state(pdev);
@@ -7487,16 +7491,15 @@ static int igb_resume(struct device *dev
 
 	wr32(E1000_WUS, ~0);
 
-	if (netdev->flags & IFF_UP) {
-		rtnl_lock();
+	rtnl_lock();
+	if (!err && netif_running(netdev))
 		err = __igb_open(netdev, true);
-		rtnl_unlock();
-		if (err)
-			return err;
-	}
 
-	netif_device_attach(netdev);
-	return 0;
+	if (!err)
+		netif_device_attach(netdev);
+	rtnl_unlock();
+
+	return err;
 }
 
 static int igb_runtime_idle(struct device *dev)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
--- linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c	2017-12-06 21:20:16.000000000 -0500
@@ -307,6 +307,7 @@ static void ixgbe_cache_ring_register(st
 	ixgbe_cache_ring_rss(adapter);
 }
 
+#define IXGBE_RSS_64Q_MASK	0x3F
 #define IXGBE_RSS_16Q_MASK	0xF
 #define IXGBE_RSS_8Q_MASK	0x7
 #define IXGBE_RSS_4Q_MASK	0x3
@@ -602,6 +603,7 @@ static bool ixgbe_set_sriov_queues(struc
  **/
 static bool ixgbe_set_rss_queues(struct ixgbe_adapter *adapter)
 {
+	struct ixgbe_hw *hw = &adapter->hw;
 	struct ixgbe_ring_feature *f;
 	u16 rss_i;
 
@@ -610,7 +612,11 @@ static bool ixgbe_set_rss_queues(struct
 	rss_i = f->limit;
 
 	f->indices = rss_i;
-	f->mask = IXGBE_RSS_16Q_MASK;
+
+	if (hw->mac.type < ixgbe_mac_X550)
+		f->mask = IXGBE_RSS_16Q_MASK;
+	else
+		f->mask = IXGBE_RSS_64Q_MASK;
 
 	/* disable ATR by default, it will be configured below */
 	adapter->flags &= ~IXGBE_FLAG_FDIR_HASH_CAPABLE;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
--- linux-libre-4.1.46-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c	2017-12-06 21:20:16.000000000 -0500
@@ -5765,7 +5765,8 @@ static int ixgbe_close(struct net_device
 
 	ixgbe_ptp_stop(adapter);
 
-	ixgbe_close_suspend(adapter);
+	if (netif_device_present(netdev))
+		ixgbe_close_suspend(adapter);
 
 	ixgbe_fdir_filter_exit(adapter);
 
@@ -5810,14 +5811,12 @@ static int ixgbe_resume(struct pci_dev *
 	if (!err && netif_running(netdev))
 		err = ixgbe_open(netdev);
 
-	rtnl_unlock();
-
-	if (err)
-		return err;
 
-	netif_device_attach(netdev);
+	if (!err)
+		netif_device_attach(netdev);
+	rtnl_unlock();
 
-	return 0;
+	return err;
 }
 #endif /* CONFIG_PM */
 
@@ -5832,14 +5831,14 @@ static int __ixgbe_shutdown(struct pci_d
 	int retval = 0;
 #endif
 
+	rtnl_lock();
 	netif_device_detach(netdev);
 
-	rtnl_lock();
 	if (netif_running(netdev))
 		ixgbe_close_suspend(adapter);
-	rtnl_unlock();
 
 	ixgbe_clear_interrupt_scheme(adapter);
+	rtnl_unlock();
 
 #ifdef CONFIG_PM
 	retval = pci_save_state(pdev);
@@ -8963,7 +8962,7 @@ skip_bad_vf_detection:
 	}
 
 	if (netif_running(netdev))
-		ixgbe_down(adapter);
+		ixgbe_close_suspend(adapter);
 
 	if (!test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
 		pci_disable_device(pdev);
@@ -9033,10 +9032,12 @@ static void ixgbe_io_resume(struct pci_d
 	}
 
 #endif
+	rtnl_lock();
 	if (netif_running(netdev))
-		ixgbe_up(adapter);
+		ixgbe_open(netdev);
 
 	netif_device_attach(netdev);
+	rtnl_unlock();
 }
 
 static const struct pci_error_handlers ixgbe_err_handler = {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/macvtap.c linux-libre-4.1.47-gnu/drivers/net/macvtap.c
--- linux-libre-4.1.46-gnu/drivers/net/macvtap.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/macvtap.c	2017-12-06 21:20:16.000000000 -0500
@@ -1059,6 +1059,8 @@ static long macvtap_ioctl(struct file *f
 	case TUNSETSNDBUF:
 		if (get_user(s, sp))
 			return -EFAULT;
+		if (s <= 0)
+			return -EINVAL;
 
 		q->sk.sk_sndbuf = s;
 		return 0;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/tun.c linux-libre-4.1.47-gnu/drivers/net/tun.c
--- linux-libre-4.1.46-gnu/drivers/net/tun.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/tun.c	2017-12-06 21:20:16.000000000 -0500
@@ -1637,6 +1637,9 @@ static int tun_set_iff(struct net *net,
 
 		if (!dev)
 			return -ENOMEM;
+		err = dev_get_valid_name(net, dev, name);
+		if (err < 0)
+			goto err_free_dev;
 
 		dev_net_set(dev, net);
 		dev->rtnl_link_ops = &tun_link_ops;
@@ -2017,6 +2020,10 @@ static long __tun_chr_ioctl(struct file
 			ret = -EFAULT;
 			break;
 		}
+		if (sndbuf <= 0) {
+			ret = -EINVAL;
+			break;
+		}
 
 		tun->sndbuf = sndbuf;
 		tun_set_sndbuf(tun);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/usb/qmi_wwan.c linux-libre-4.1.47-gnu/drivers/net/usb/qmi_wwan.c
--- linux-libre-4.1.46-gnu/drivers/net/usb/qmi_wwan.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/usb/qmi_wwan.c	2017-12-06 21:20:16.000000000 -0500
@@ -316,7 +316,7 @@ next_desc:
 	}
 
 	/* errors aren't fatal - we can live with the dynamic address */
-	if (cdc_ether) {
+	if (cdc_ether && cdc_ether->wMaxSegmentSize) {
 		dev->hard_mtu = le16_to_cpu(cdc_ether->wMaxSegmentSize);
 		usbnet_get_ethernet_addr(dev, cdc_ether->iMACAddress);
 	}
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c linux-libre-4.1.47-gnu/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
--- linux-libre-4.1.46-gnu/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c	2017-12-06 21:20:16.000000000 -0500
@@ -4207,9 +4207,6 @@ static int brcmf_cfg80211_stop_ap(struct
 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
 		if (err < 0)
 			brcmf_err("setting AP mode failed %d\n", err);
-		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
-		if (err < 0)
-			brcmf_err("setting INFRA mode failed %d\n", err);
 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
 			brcmf_fil_iovar_int_set(ifp, "mbss", 0);
 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/net/xen-netback/netback.c linux-libre-4.1.47-gnu/drivers/net/xen-netback/netback.c
--- linux-libre-4.1.46-gnu/drivers/net/xen-netback/netback.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/net/xen-netback/netback.c	2017-12-06 21:20:16.000000000 -0500
@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uin
 unsigned int rx_stall_timeout_msecs = 60000;
 module_param(rx_stall_timeout_msecs, uint, 0444);
 
+#define MAX_QUEUES_DEFAULT 8
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -2011,11 +2012,12 @@ static int __init netback_init(void)
 	if (!xen_domain())
 		return -ENODEV;
 
-	/* Allow as many queues as there are CPUs if user has not
+	/* Allow as many queues as there are CPUs but max. 8 if user has not
 	 * specified a value.
 	 */
 	if (xenvif_max_queues == 0)
-		xenvif_max_queues = num_online_cpus();
+		xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT,
+					  num_online_cpus());
 
 	if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
 		pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/pci/host/pci-mvebu.c linux-libre-4.1.47-gnu/drivers/pci/host/pci-mvebu.c
--- linux-libre-4.1.46-gnu/drivers/pci/host/pci-mvebu.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/pci/host/pci-mvebu.c	2017-12-06 21:20:16.000000000 -0500
@@ -107,6 +107,12 @@ struct mvebu_pcie {
 	int nports;
 };
 
+struct mvebu_pcie_window {
+	phys_addr_t base;
+	phys_addr_t remap;
+	size_t size;
+};
+
 /* Structure representing one PCIe interface */
 struct mvebu_pcie_port {
 	char *name;
@@ -125,10 +131,8 @@ struct mvebu_pcie_port {
 	struct mvebu_sw_pci_bridge bridge;
 	struct device_node *dn;
 	struct mvebu_pcie *pcie;
-	phys_addr_t memwin_base;
-	size_t memwin_size;
-	phys_addr_t iowin_base;
-	size_t iowin_size;
+	struct mvebu_pcie_window memwin;
+	struct mvebu_pcie_window iowin;
 	u32 saved_pcie_stat;
 };
 
@@ -345,23 +349,45 @@ static void mvebu_pcie_add_windows(struc
 	}
 }
 
+static void mvebu_pcie_set_window(struct mvebu_pcie_port *port,
+				  unsigned int target, unsigned int attribute,
+				  const struct mvebu_pcie_window *desired,
+				  struct mvebu_pcie_window *cur)
+{
+	if (desired->base == cur->base && desired->remap == cur->remap &&
+	    desired->size == cur->size)
+		return;
+
+	if (cur->size != 0) {
+		mvebu_pcie_del_windows(port, cur->base, cur->size);
+		cur->size = 0;
+		cur->base = 0;
+
+		/*
+		 * If something tries to change the window while it is enabled
+		 * the change will not be done atomically. That would be
+		 * difficult to do in the general case.
+		 */
+	}
+
+	if (desired->size == 0)
+		return;
+
+	mvebu_pcie_add_windows(port, target, attribute, desired->base,
+			       desired->size, desired->remap);
+	*cur = *desired;
+}
+
 static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
 {
-	phys_addr_t iobase;
+	struct mvebu_pcie_window desired = {};
 
 	/* Are the new iobase/iolimit values invalid? */
 	if (port->bridge.iolimit < port->bridge.iobase ||
 	    port->bridge.iolimitupper < port->bridge.iobaseupper ||
 	    !(port->bridge.command & PCI_COMMAND_IO)) {
-
-		/* If a window was configured, remove it */
-		if (port->iowin_base) {
-			mvebu_pcie_del_windows(port, port->iowin_base,
-					       port->iowin_size);
-			port->iowin_base = 0;
-			port->iowin_size = 0;
-		}
-
+		mvebu_pcie_set_window(port, port->io_target, port->io_attr,
+				      &desired, &port->iowin);
 		return;
 	}
 
@@ -378,32 +404,27 @@ static void mvebu_pcie_handle_iobase_cha
 	 * specifications. iobase is the bus address, port->iowin_base
 	 * is the CPU address.
 	 */
-	iobase = ((port->bridge.iobase & 0xF0) << 8) |
-		(port->bridge.iobaseupper << 16);
-	port->iowin_base = port->pcie->io.start + iobase;
-	port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
-			    (port->bridge.iolimitupper << 16)) -
-			    iobase) + 1;
+	desired.remap = ((port->bridge.iobase & 0xF0) << 8) |
+			(port->bridge.iobaseupper << 16);
+	desired.base = port->pcie->io.start + desired.remap;
+	desired.size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
+			 (port->bridge.iolimitupper << 16)) -
+			desired.remap) +
+		       1;
 
-	mvebu_pcie_add_windows(port, port->io_target, port->io_attr,
-			       port->iowin_base, port->iowin_size,
-			       iobase);
+	mvebu_pcie_set_window(port, port->io_target, port->io_attr, &desired,
+			      &port->iowin);
 }
 
 static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
 {
+	struct mvebu_pcie_window desired = {.remap = MVEBU_MBUS_NO_REMAP};
+
 	/* Are the new membase/memlimit values invalid? */
 	if (port->bridge.memlimit < port->bridge.membase ||
 	    !(port->bridge.command & PCI_COMMAND_MEMORY)) {
-
-		/* If a window was configured, remove it */
-		if (port->memwin_base) {
-			mvebu_pcie_del_windows(port, port->memwin_base,
-					       port->memwin_size);
-			port->memwin_base = 0;
-			port->memwin_size = 0;
-		}
-
+		mvebu_pcie_set_window(port, port->mem_target, port->mem_attr,
+				      &desired, &port->memwin);
 		return;
 	}
 
@@ -413,14 +434,12 @@ static void mvebu_pcie_handle_membase_ch
 	 * window to setup, according to the PCI-to-PCI bridge
 	 * specifications.
 	 */
-	port->memwin_base  = ((port->bridge.membase & 0xFFF0) << 16);
-	port->memwin_size  =
-		(((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
-		port->memwin_base + 1;
+	desired.base = ((port->bridge.membase & 0xFFF0) << 16);
+	desired.size = (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
+		       desired.base + 1;
 
-	mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr,
-			       port->memwin_base, port->memwin_size,
-			       MVEBU_MBUS_NO_REMAP);
+	mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, &desired,
+			      &port->memwin);
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/platform/x86/hp-wmi.c linux-libre-4.1.47-gnu/drivers/platform/x86/hp-wmi.c
--- linux-libre-4.1.46-gnu/drivers/platform/x86/hp-wmi.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/platform/x86/hp-wmi.c	2017-12-06 21:20:16.000000000 -0500
@@ -249,7 +249,7 @@ static int hp_wmi_display_state(void)
 	int ret = hp_wmi_perform_query(HPWMI_DISPLAY_QUERY, 0, &state,
 				       sizeof(state), sizeof(state));
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 	return state;
 }
 
@@ -259,7 +259,7 @@ static int hp_wmi_hddtemp_state(void)
 	int ret = hp_wmi_perform_query(HPWMI_HDDTEMP_QUERY, 0, &state,
 				       sizeof(state), sizeof(state));
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 	return state;
 }
 
@@ -269,7 +269,7 @@ static int hp_wmi_als_state(void)
 	int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 0, &state,
 				       sizeof(state), sizeof(state));
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 	return state;
 }
 
@@ -280,7 +280,7 @@ static int hp_wmi_dock_state(void)
 				       sizeof(state), sizeof(state));
 
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 
 	return state & 0x1;
 }
@@ -291,7 +291,7 @@ static int hp_wmi_tablet_state(void)
 	int ret = hp_wmi_perform_query(HPWMI_HARDWARE_QUERY, 0, &state,
 				       sizeof(state), sizeof(state));
 	if (ret)
-		return ret;
+		return ret < 0 ? ret : -EINVAL;
 
 	return (state & 0x4) ? 1 : 0;
 }
@@ -324,7 +324,7 @@ static int __init hp_wmi_enable_hotkeys(
 	int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value,
 				       sizeof(value), 0);
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 	return 0;
 }
 
@@ -337,7 +337,7 @@ static int hp_wmi_set_block(void *data,
 	ret = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1,
 				   &query, sizeof(query), 0);
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 	return 0;
 }
 
@@ -429,7 +429,7 @@ static int hp_wmi_post_code_state(void)
 	int ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 0, &state,
 				       sizeof(state), sizeof(state));
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 	return state;
 }
 
@@ -495,7 +495,7 @@ static ssize_t set_als(struct device *de
 	int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 1, &tmp,
 				       sizeof(tmp), sizeof(tmp));
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 
 	return count;
 }
@@ -516,7 +516,7 @@ static ssize_t set_postcode(struct devic
 	ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 1, &tmp,
 				       sizeof(tmp), sizeof(tmp));
 	if (ret)
-		return -EINVAL;
+		return ret < 0 ? ret : -EINVAL;
 
 	return count;
 }
@@ -573,10 +573,12 @@ static void hp_wmi_notify(u32 value, voi
 
 	switch (event_id) {
 	case HPWMI_DOCK_EVENT:
-		input_report_switch(hp_wmi_input_dev, SW_DOCK,
-				    hp_wmi_dock_state());
-		input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-				    hp_wmi_tablet_state());
+		if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit))
+			input_report_switch(hp_wmi_input_dev, SW_DOCK,
+					    hp_wmi_dock_state());
+		if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit))
+			input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+					    hp_wmi_tablet_state());
 		input_sync(hp_wmi_input_dev);
 		break;
 	case HPWMI_PARK_HDD:
@@ -649,6 +651,7 @@ static int __init hp_wmi_input_setup(voi
 {
 	acpi_status status;
 	int err;
+	int val;
 
 	hp_wmi_input_dev = input_allocate_device();
 	if (!hp_wmi_input_dev)
@@ -659,17 +662,26 @@ static int __init hp_wmi_input_setup(voi
 	hp_wmi_input_dev->id.bustype = BUS_HOST;
 
 	__set_bit(EV_SW, hp_wmi_input_dev->evbit);
-	__set_bit(SW_DOCK, hp_wmi_input_dev->swbit);
-	__set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
+
+	/* Dock */
+	val = hp_wmi_dock_state();
+	if (!(val < 0)) {
+		__set_bit(SW_DOCK, hp_wmi_input_dev->swbit);
+		input_report_switch(hp_wmi_input_dev, SW_DOCK, val);
+	}
+
+	/* Tablet mode */
+	val = hp_wmi_tablet_state();
+	if (!(val < 0)) {
+		__set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
+		input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
+	}
 
 	err = sparse_keymap_setup(hp_wmi_input_dev, hp_wmi_keymap, NULL);
 	if (err)
 		goto err_free_dev;
 
 	/* Set initial hardware state */
-	input_report_switch(hp_wmi_input_dev, SW_DOCK, hp_wmi_dock_state());
-	input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-			    hp_wmi_tablet_state());
 	input_sync(hp_wmi_input_dev);
 
 	if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later())
@@ -982,10 +994,12 @@ static int hp_wmi_resume_handler(struct
 	 * changed.
 	 */
 	if (hp_wmi_input_dev) {
-		input_report_switch(hp_wmi_input_dev, SW_DOCK,
-				    hp_wmi_dock_state());
-		input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-				    hp_wmi_tablet_state());
+		if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit))
+			input_report_switch(hp_wmi_input_dev, SW_DOCK,
+					    hp_wmi_dock_state());
+		if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit))
+			input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+					    hp_wmi_tablet_state());
 		input_sync(hp_wmi_input_dev);
 	}
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/platform/x86/intel_mid_thermal.c linux-libre-4.1.47-gnu/drivers/platform/x86/intel_mid_thermal.c
--- linux-libre-4.1.46-gnu/drivers/platform/x86/intel_mid_thermal.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/platform/x86/intel_mid_thermal.c	2017-12-06 21:20:16.000000000 -0500
@@ -551,6 +551,7 @@ static const struct platform_device_id t
 	{ "msic_thermal", 1 },
 	{ }
 };
+MODULE_DEVICE_TABLE(platform, therm_id_table);
 
 static struct platform_driver mid_thermal_driver = {
 	.driver = {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/s390/block/dasd.c linux-libre-4.1.47-gnu/drivers/s390/block/dasd.c
--- linux-libre-4.1.46-gnu/drivers/s390/block/dasd.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/s390/block/dasd.c	2017-12-06 21:20:16.000000000 -0500
@@ -1633,8 +1633,11 @@ void dasd_int_handler(struct ccw_device
 	/* check for for attention message */
 	if (scsw_dstat(&irb->scsw) & DEV_STAT_ATTENTION) {
 		device = dasd_device_from_cdev_locked(cdev);
-		device->discipline->check_attention(device, irb->esw.esw1.lpum);
-		dasd_put_device(device);
+		if (!IS_ERR(device)) {
+			device->discipline->check_attention(device,
+							    irb->esw.esw1.lpum);
+			dasd_put_device(device);
+		}
 	}
 
 	if (!cqr)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/s390/net/qeth_core.h linux-libre-4.1.47-gnu/drivers/s390/net/qeth_core.h
--- linux-libre-4.1.46-gnu/drivers/s390/net/qeth_core.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/s390/net/qeth_core.h	2017-12-06 21:20:16.000000000 -0500
@@ -902,7 +902,6 @@ void qeth_clear_thread_running_bit(struc
 int qeth_core_hardsetup_card(struct qeth_card *);
 void qeth_print_status_message(struct qeth_card *);
 int qeth_init_qdio_queues(struct qeth_card *);
-int qeth_send_startlan(struct qeth_card *);
 int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *,
 		  int (*reply_cb)
 		  (struct qeth_card *, struct qeth_reply *, unsigned long),
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/s390/net/qeth_core_main.c linux-libre-4.1.47-gnu/drivers/s390/net/qeth_core_main.c
--- linux-libre-4.1.46-gnu/drivers/s390/net/qeth_core_main.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/s390/net/qeth_core_main.c	2017-12-06 21:20:16.000000000 -0500
@@ -3003,7 +3003,7 @@ int qeth_send_ipa_cmd(struct qeth_card *
 }
 EXPORT_SYMBOL_GPL(qeth_send_ipa_cmd);
 
-int qeth_send_startlan(struct qeth_card *card)
+static int qeth_send_startlan(struct qeth_card *card)
 {
 	int rc;
 	struct qeth_cmd_buffer *iob;
@@ -3016,7 +3016,6 @@ int qeth_send_startlan(struct qeth_card
 	rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
 	return rc;
 }
-EXPORT_SYMBOL_GPL(qeth_send_startlan);
 
 static int qeth_default_setadapterparms_cb(struct qeth_card *card,
 		struct qeth_reply *reply, unsigned long data)
@@ -5130,6 +5129,20 @@ retriable:
 		goto out;
 	}
 
+	rc = qeth_send_startlan(card);
+	if (rc) {
+		QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+		if (rc == IPA_RC_LAN_OFFLINE) {
+			dev_warn(&card->gdev->dev,
+				"The LAN is offline\n");
+			card->lan_online = 0;
+		} else {
+			rc = -ENODEV;
+			goto out;
+		}
+	} else
+		card->lan_online = 1;
+
 	card->options.ipa4.supported_funcs = 0;
 	card->options.adp.supported_funcs = 0;
 	card->options.sbp.supported_funcs = 0;
@@ -5140,14 +5153,14 @@ retriable:
 	if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
 		rc = qeth_query_setadapterparms(card);
 		if (rc < 0) {
-			QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+			QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
 			goto out;
 		}
 	}
 	if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
 		rc = qeth_query_setdiagass(card);
 		if (rc < 0) {
-			QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
+			QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc);
 			goto out;
 		}
 	}
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/s390/net/qeth_l2_main.c linux-libre-4.1.47-gnu/drivers/s390/net/qeth_l2_main.c
--- linux-libre-4.1.46-gnu/drivers/s390/net/qeth_l2_main.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/s390/net/qeth_l2_main.c	2017-12-06 21:20:16.000000000 -0500
@@ -1035,21 +1035,6 @@ static int __qeth_l2_set_online(struct c
 	/* softsetup */
 	QETH_DBF_TEXT(SETUP, 2, "softsetp");
 
-	rc = qeth_send_startlan(card);
-	if (rc) {
-		QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
-		if (rc == 0xe080) {
-			dev_warn(&card->gdev->dev,
-				"The LAN is offline\n");
-			card->lan_online = 0;
-			goto contin;
-		}
-		rc = -ENODEV;
-		goto out_remove;
-	} else
-		card->lan_online = 1;
-
-contin:
 	if ((card->info.type == QETH_CARD_TYPE_OSD) ||
 	    (card->info.type == QETH_CARD_TYPE_OSX)) {
 		/* configure isolation level */
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/s390/net/qeth_l3_main.c linux-libre-4.1.47-gnu/drivers/s390/net/qeth_l3_main.c
--- linux-libre-4.1.46-gnu/drivers/s390/net/qeth_l3_main.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/s390/net/qeth_l3_main.c	2017-12-06 21:20:16.000000000 -0500
@@ -3413,21 +3413,6 @@ static int __qeth_l3_set_online(struct c
 	/* softsetup */
 	QETH_DBF_TEXT(SETUP, 2, "softsetp");
 
-	rc = qeth_send_startlan(card);
-	if (rc) {
-		QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
-		if (rc == 0xe080) {
-			dev_warn(&card->gdev->dev,
-				"The LAN is offline\n");
-			card->lan_online = 0;
-			goto contin;
-		}
-		rc = -ENODEV;
-		goto out_remove;
-	} else
-		card->lan_online = 1;
-
-contin:
 	rc = qeth_l3_setadapter_parms(card);
 	if (rc)
 		QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/scsi/lpfc/lpfc_attr.c linux-libre-4.1.47-gnu/drivers/scsi/lpfc/lpfc_attr.c
--- linux-libre-4.1.46-gnu/drivers/scsi/lpfc/lpfc_attr.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/scsi/lpfc/lpfc_attr.c	2017-12-06 21:20:16.000000000 -0500
@@ -5148,6 +5148,19 @@ lpfc_free_sysfs_attr(struct lpfc_vport *
  */
 
 /**
+ * lpfc_get_host_symbolic_name - Copy symbolic name into the scsi host
+ * @shost: kernel scsi host pointer.
+ **/
+static void
+lpfc_get_host_symbolic_name(struct Scsi_Host *shost)
+{
+	struct lpfc_vport *vport = (struct lpfc_vport *)shost->hostdata;
+
+	lpfc_vport_symbolic_node_name(vport, fc_host_symbolic_name(shost),
+				      sizeof fc_host_symbolic_name(shost));
+}
+
+/**
  * lpfc_get_host_port_id - Copy the vport DID into the scsi host port id
  * @shost: kernel scsi host pointer.
  **/
@@ -5681,6 +5694,8 @@ struct fc_function_template lpfc_transpo
 	.show_host_supported_fc4s = 1,
 	.show_host_supported_speeds = 1,
 	.show_host_maxframe_size = 1,
+
+	.get_host_symbolic_name = lpfc_get_host_symbolic_name,
 	.show_host_symbolic_name = 1,
 
 	/* dynamic attributes the driver supports */
@@ -5748,6 +5763,8 @@ struct fc_function_template lpfc_vport_t
 	.show_host_supported_fc4s = 1,
 	.show_host_supported_speeds = 1,
 	.show_host_maxframe_size = 1,
+
+	.get_host_symbolic_name = lpfc_get_host_symbolic_name,
 	.show_host_symbolic_name = 1,
 
 	/* dynamic attributes the driver supports */
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/scsi/lpfc/lpfc_sli.c linux-libre-4.1.47-gnu/drivers/scsi/lpfc/lpfc_sli.c
--- linux-libre-4.1.46-gnu/drivers/scsi/lpfc/lpfc_sli.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/scsi/lpfc/lpfc_sli.c	2017-12-06 21:20:16.000000000 -0500
@@ -118,6 +118,8 @@ lpfc_sli4_wq_put(struct lpfc_queue *q, u
 	if (q->phba->sli3_options & LPFC_SLI4_PHWQ_ENABLED)
 		bf_set(wqe_wqid, &wqe->generic.wqe_com, q->queue_id);
 	lpfc_sli_pcimem_bcopy(wqe, temp_wqe, q->entry_size);
+	/* ensure WQE bcopy flushed before doorbell write */
+	wmb();
 
 	/* Update the host index before invoking device */
 	host_index = q->host_index;
@@ -9823,6 +9825,7 @@ lpfc_sli_abort_iotag_issue(struct lpfc_h
 		iabt->ulpCommand = CMD_CLOSE_XRI_CN;
 
 	abtsiocbp->iocb_cmpl = lpfc_sli_abort_els_cmpl;
+	abtsiocbp->vport = vport;
 
 	lpfc_printf_vlog(vport, KERN_INFO, LOG_SLI,
 			 "0339 Abort xri x%x, original iotag x%x, "
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/scsi/lpfc/lpfc_vport.c linux-libre-4.1.47-gnu/drivers/scsi/lpfc/lpfc_vport.c
--- linux-libre-4.1.46-gnu/drivers/scsi/lpfc/lpfc_vport.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/scsi/lpfc/lpfc_vport.c	2017-12-06 21:20:16.000000000 -0500
@@ -528,6 +528,12 @@ enable_vport(struct fc_vport *fc_vport)
 
 	spin_lock_irq(shost->host_lock);
 	vport->load_flag |= FC_LOADING;
+	if (vport->fc_flag & FC_VPORT_NEEDS_INIT_VPI) {
+		spin_unlock_irq(shost->host_lock);
+		lpfc_issue_init_vpi(vport);
+		goto out;
+	}
+
 	vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI;
 	spin_unlock_irq(shost->host_lock);
 
@@ -548,6 +554,8 @@ enable_vport(struct fc_vport *fc_vport)
 	} else {
 		lpfc_vport_set_state(vport, FC_VPORT_FAILED);
 	}
+
+out:
 	lpfc_printf_vlog(vport, KERN_ERR, LOG_VPORT,
 			 "1827 Vport Enabled.\n");
 	return VPORT_OK;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/staging/iio/trigger/iio-trig-bfin-timer.c linux-libre-4.1.47-gnu/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
--- linux-libre-4.1.46-gnu/drivers/staging/iio/trigger/iio-trig-bfin-timer.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/staging/iio/trigger/iio-trig-bfin-timer.c	2017-12-06 21:20:16.000000000 -0500
@@ -258,7 +258,7 @@ out_free_irq:
 out1:
 	iio_trigger_unregister(st->trig);
 out:
-	iio_trigger_put(st->trig);
+	iio_trigger_free(st->trig);
 	return ret;
 }
 
@@ -271,7 +271,7 @@ static int iio_bfin_tmr_trigger_remove(s
 		peripheral_free(st->t->pin);
 	free_irq(st->irq, st);
 	iio_trigger_unregister(st->trig);
-	iio_trigger_put(st->trig);
+	iio_trigger_free(st->trig);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/staging/lustre/lustre/include/lustre/lustre_user.h linux-libre-4.1.47-gnu/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
--- linux-libre-4.1.46-gnu/drivers/staging/lustre/lustre/include/lustre/lustre_user.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/staging/lustre/lustre/include/lustre/lustre_user.h	2017-12-06 21:20:16.000000000 -0500
@@ -1066,23 +1066,21 @@ struct hsm_action_item {
  * \retval buffer
  */
 static inline char *hai_dump_data_field(struct hsm_action_item *hai,
-					char *buffer, int len)
+					char *buffer, size_t len)
 {
-	int i, sz, data_len;
+	int i, data_len;
 	char *ptr;
 
 	ptr = buffer;
-	sz = len;
 	data_len = hai->hai_len - sizeof(*hai);
-	for (i = 0 ; (i < data_len) && (sz > 0) ; i++) {
-		int cnt;
-
-		cnt = snprintf(ptr, sz, "%.2X",
-			       (unsigned char)hai->hai_data[i]);
-		ptr += cnt;
-		sz -= cnt;
+	for (i = 0; (i < data_len) && (len > 2); i++) {
+		snprintf(ptr, 3, "%02X", (unsigned char)hai->hai_data[i]);
+		ptr += 2;
+		len -= 2;
 	}
+
 	*ptr = '\0';
+
 	return buffer;
 }
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c linux-libre-4.1.47-gnu/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c
--- linux-libre-4.1.46-gnu/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c	2017-12-06 21:20:16.000000000 -0500
@@ -572,6 +572,13 @@ struct ldlm_lock *__ldlm_handle2lock(con
 	if (lock == NULL)
 		return NULL;
 
+	if (lock->l_export && lock->l_export->exp_failed) {
+		CDEBUG(D_INFO, "lock export failed: lock %p, exp %p\n",
+		       lock, lock->l_export);
+		LDLM_LOCK_PUT(lock);
+		return NULL;
+	}
+
 	/* It's unlikely but possible that someone marked the lock as
 	 * destroyed after we did handle2object on it */
 	if (flags == 0 && ((lock->l_flags & LDLM_FL_DESTROYED) == 0)) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/staging/lustre/lustre/llite/rw26.c linux-libre-4.1.47-gnu/drivers/staging/lustre/lustre/llite/rw26.c
--- linux-libre-4.1.46-gnu/drivers/staging/lustre/lustre/llite/rw26.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/staging/lustre/lustre/llite/rw26.c	2017-12-06 21:20:16.000000000 -0500
@@ -376,6 +376,10 @@ static ssize_t ll_direct_IO_26(struct ki
 	if (!lli->lli_has_smd)
 		return -EBADF;
 
+	/* Check EOF by ourselves */
+	if (iov_iter_rw(iter) == READ && file_offset >= i_size_read(inode))
+		return 0;
+
 	/* FIXME: io smaller than PAGE_SIZE is broken on ia64 ??? */
 	if ((file_offset & ~CFS_PAGE_MASK) || (count & ~CFS_PAGE_MASK))
 		return -EINVAL;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/staging/lustre/lustre/ptlrpc/service.c linux-libre-4.1.47-gnu/drivers/staging/lustre/lustre/ptlrpc/service.c
--- linux-libre-4.1.46-gnu/drivers/staging/lustre/lustre/ptlrpc/service.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/staging/lustre/lustre/ptlrpc/service.c	2017-12-06 21:20:16.000000000 -0500
@@ -1498,20 +1498,15 @@ static int ptlrpc_server_hpreq_init(stru
 		 * it may hit swab race at LU-1044. */
 		if (req->rq_ops->hpreq_check) {
 			rc = req->rq_ops->hpreq_check(req);
-			/**
-			 * XXX: Out of all current
-			 * ptlrpc_hpreq_ops::hpreq_check(), only
-			 * ldlm_cancel_hpreq_check() can return an error code;
-			 * other functions assert in similar places, which seems
-			 * odd. What also does not seem right is that handlers
-			 * for those RPCs do not assert on the same checks, but
-			 * rather handle the error cases. e.g. see
-			 * ost_rw_hpreq_check(), and ost_brw_read(),
-			 * ost_brw_write().
+			if (rc == -ESTALE) {
+				req->rq_status = rc;
+				ptlrpc_error(req);
+			}
+			/** can only return error,
+			 * 0 for normal request,
+			 *  or 1 for high priority request
 			 */
-			if (rc < 0)
-				return rc;
-			LASSERT(rc == 0 || rc == 1);
+			LASSERT(rc <= 1);
 		}
 
 		spin_lock_bh(&req->rq_export->exp_rpc_lock);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/staging/rtl8188eu/include/rtw_debug.h linux-libre-4.1.47-gnu/drivers/staging/rtl8188eu/include/rtw_debug.h
--- linux-libre-4.1.46-gnu/drivers/staging/rtl8188eu/include/rtw_debug.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/staging/rtl8188eu/include/rtw_debug.h	2017-12-06 21:20:16.000000000 -0500
@@ -75,7 +75,7 @@ extern u32 GlobalDebugLevel;
 #define DBG_88E_LEVEL(_level, fmt, arg...)				\
 	do {								\
 		if (_level <= GlobalDebugLevel)				\
-			pr_info(DRIVER_PREFIX"ERROR " fmt, ##arg);	\
+			pr_info(DRIVER_PREFIX fmt, ##arg);	\
 	} while (0)
 
 #define DBG_88E(...)							\
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/staging/rtl8712/ieee80211.h linux-libre-4.1.47-gnu/drivers/staging/rtl8712/ieee80211.h
--- linux-libre-4.1.46-gnu/drivers/staging/rtl8712/ieee80211.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/staging/rtl8712/ieee80211.h	2017-12-06 21:20:16.000000000 -0500
@@ -142,52 +142,52 @@ struct ieee_ibss_seq {
 };
 
 struct ieee80211_hdr {
-	u16 frame_ctl;
-	u16 duration_id;
+	__le16 frame_ctl;
+	__le16 duration_id;
 	u8 addr1[ETH_ALEN];
 	u8 addr2[ETH_ALEN];
 	u8 addr3[ETH_ALEN];
-	u16 seq_ctl;
+	__le16 seq_ctl;
 	u8 addr4[ETH_ALEN];
-} __packed;
+}  __packed __aligned(2);
 
 struct ieee80211_hdr_3addr {
-	u16 frame_ctl;
-	u16 duration_id;
+	__le16 frame_ctl;
+	__le16 duration_id;
 	u8 addr1[ETH_ALEN];
 	u8 addr2[ETH_ALEN];
 	u8 addr3[ETH_ALEN];
-	u16 seq_ctl;
-} __packed;
+	__le16 seq_ctl;
+}  __packed __aligned(2);
 
 
 struct	ieee80211_hdr_qos {
-	u16 frame_ctl;
-	u16 duration_id;
+	__le16 frame_ctl;
+	__le16 duration_id;
 	u8 addr1[ETH_ALEN];
 	u8 addr2[ETH_ALEN];
 	u8 addr3[ETH_ALEN];
-	u16 seq_ctl;
+	__le16 seq_ctl;
 	u8 addr4[ETH_ALEN];
-	u16	qc;
-}  __packed;
+	__le16	qc;
+}   __packed __aligned(2);
 
 struct  ieee80211_hdr_3addr_qos {
-	u16 frame_ctl;
-	u16 duration_id;
+	__le16 frame_ctl;
+	__le16 duration_id;
 	u8  addr1[ETH_ALEN];
 	u8  addr2[ETH_ALEN];
 	u8  addr3[ETH_ALEN];
-	u16 seq_ctl;
-	u16 qc;
+	__le16 seq_ctl;
+	__le16 qc;
 }  __packed;
 
 struct eapol {
 	u8 snap[6];
-	u16 ethertype;
+	__be16 ethertype;
 	u8 version;
 	u8 type;
-	u16 length;
+	__le16 length;
 } __packed;
 
 
@@ -554,13 +554,13 @@ Total: 28-2340 bytes
 */
 
 struct ieee80211_header_data {
-	u16 frame_ctl;
-	u16 duration_id;
+	__le16 frame_ctl;
+	__le16 duration_id;
 	u8 addr1[6];
 	u8 addr2[6];
 	u8 addr3[6];
-	u16 seq_ctrl;
-};
+	__le16 seq_ctrl;
+} __packed __aligned(2);
 
 #define BEACON_PROBE_SSID_ID_POSITION 12
 
@@ -592,18 +592,18 @@ struct ieee80211_info_element {
 /*
  * These are the data types that can make up management packets
  *
-	u16 auth_algorithm;
-	u16 auth_sequence;
-	u16 beacon_interval;
-	u16 capability;
+	__le16 auth_algorithm;
+	__le16 auth_sequence;
+	__le16 beacon_interval;
+	__le16 capability;
 	u8 current_ap[ETH_ALEN];
-	u16 listen_interval;
+	__le16 listen_interval;
 	struct {
 		u16 association_id:14, reserved:2;
 	} __packed;
-	u32 time_stamp[2];
-	u16 reason;
-	u16 status;
+	__le32 time_stamp[2];
+	__le16 reason;
+	__le16 status;
 */
 
 #define IEEE80211_DEFAULT_TX_ESSID "Penguin"
@@ -611,16 +611,16 @@ struct ieee80211_info_element {
 
 struct ieee80211_authentication {
 	struct ieee80211_header_data header;
-	u16 algorithm;
-	u16 transaction;
-	u16 status;
+	__le16 algorithm;
+	__le16 transaction;
+	__le16 status;
 } __packed;
 
 struct ieee80211_probe_response {
 	struct ieee80211_header_data header;
-	u32 time_stamp[2];
-	u16 beacon_interval;
-	u16 capability;
+	__le32 time_stamp[2];
+	__le16 beacon_interval;
+	__le16 capability;
 	struct ieee80211_info_element info_element;
 } __packed;
 
@@ -630,16 +630,16 @@ struct ieee80211_probe_request {
 
 struct ieee80211_assoc_request_frame {
 	struct ieee80211_hdr_3addr header;
-	u16 capability;
-	u16 listen_interval;
+	__le16 capability;
+	__le16 listen_interval;
 	struct ieee80211_info_element_hdr info_element;
 } __packed;
 
 struct ieee80211_assoc_response_frame {
 	struct ieee80211_hdr_3addr header;
-	u16 capability;
-	u16 status;
-	u16 aid;
+	__le16 capability;
+	__le16 status;
+	__le16 aid;
 } __packed;
 
 struct ieee80211_txb {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/target/iscsi/iscsi_target.c linux-libre-4.1.47-gnu/drivers/target/iscsi/iscsi_target.c
--- linux-libre-4.1.46-gnu/drivers/target/iscsi/iscsi_target.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/target/iscsi/iscsi_target.c	2017-12-06 21:20:16.000000000 -0500
@@ -1755,7 +1755,7 @@ iscsit_handle_task_mgt_cmd(struct iscsi_
 	struct iscsi_tm *hdr;
 	int out_of_order_cmdsn = 0, ret;
 	bool sess_ref = false;
-	u8 function;
+	u8 function, tcm_function = TMR_UNKNOWN;
 
 	hdr			= (struct iscsi_tm *) buf;
 	hdr->flags &= ~ISCSI_FLAG_CMD_FINAL;
@@ -1801,10 +1801,6 @@ iscsit_handle_task_mgt_cmd(struct iscsi_
 	 * LIO-Target $FABRIC_MOD
 	 */
 	if (function != ISCSI_TM_FUNC_TASK_REASSIGN) {
-
-		u8 tcm_function;
-		int ret;
-
 		transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops,
 				      conn->sess->se_sess, 0, DMA_NONE,
 				      TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
@@ -1840,15 +1836,14 @@ iscsit_handle_task_mgt_cmd(struct iscsi_
 			return iscsit_add_reject_cmd(cmd,
 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
 		}
-
-		ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req,
-					 tcm_function, GFP_KERNEL);
-		if (ret < 0)
-			return iscsit_add_reject_cmd(cmd,
+	}
+	ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req, tcm_function,
+				 GFP_KERNEL);
+	if (ret < 0)
+		return iscsit_add_reject_cmd(cmd,
 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
 
-		cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req;
-	}
+	cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req;
 
 	cmd->iscsi_opcode	= ISCSI_OP_SCSI_TMFUNC;
 	cmd->i_state		= ISTATE_SEND_TASKMGTRSP;
@@ -3449,7 +3444,7 @@ iscsit_build_sendtargets_response(struct
 
 			if ((tpg->tpg_attrib.generate_node_acls == 0) &&
 			    (tpg->tpg_attrib.demo_mode_discovery == 0) &&
-			    (!core_tpg_get_initiator_node_acl(&tpg->tpg_se_tpg,
+			    (!target_tpg_has_node_acl(&tpg->tpg_se_tpg,
 				cmd->conn->sess->sess_ops->InitiatorName))) {
 				continue;
 			}
@@ -3969,6 +3964,8 @@ int iscsi_target_tx_thread(void *arg)
 {
 	int ret = 0;
 	struct iscsi_conn *conn = arg;
+	bool conn_freed = false;
+
 	/*
 	 * Allow ourselves to be interrupted by SIGINT so that a
 	 * connection recovery / failure event can be triggered externally.
@@ -3994,12 +3991,14 @@ get_immediate:
 			goto transport_err;
 
 		ret = iscsit_handle_response_queue(conn);
-		if (ret == 1)
+		if (ret == 1) {
 			goto get_immediate;
-		else if (ret == -ECONNRESET)
+		} else if (ret == -ECONNRESET) {
+			conn_freed = true;
 			goto out;
-		else if (ret < 0)
+		} else if (ret < 0) {
 			goto transport_err;
+		}
 	}
 
 transport_err:
@@ -4009,8 +4008,13 @@ transport_err:
 	 * responsible for cleaning up the early connection failure.
 	 */
 	if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
-		iscsit_take_action_for_connection_exit(conn);
+		iscsit_take_action_for_connection_exit(conn, &conn_freed);
 out:
+	if (!conn_freed) {
+		while (!kthread_should_stop()) {
+			msleep(100);
+		}
+	}
 	return 0;
 }
 
@@ -4117,6 +4121,7 @@ int iscsi_target_rx_thread(void *arg)
 	u32 checksum = 0, digest = 0;
 	struct iscsi_conn *conn = arg;
 	struct kvec iov;
+	bool conn_freed = false;
 	/*
 	 * Allow ourselves to be interrupted by SIGINT so that a
 	 * connection recovery / failure event can be triggered externally.
@@ -4128,7 +4133,7 @@ int iscsi_target_rx_thread(void *arg)
 	 */
 	rc = wait_for_completion_interruptible(&conn->rx_login_comp);
 	if (rc < 0 || iscsi_target_check_conn_state(conn))
-		return 0;
+		goto out;
 
 	if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
 		struct completion comp;
@@ -4213,7 +4218,13 @@ int iscsi_target_rx_thread(void *arg)
 transport_err:
 	if (!signal_pending(current))
 		atomic_set(&conn->transport_failed, 1);
-	iscsit_take_action_for_connection_exit(conn);
+	iscsit_take_action_for_connection_exit(conn, &conn_freed);
+out:
+	if (!conn_freed) {
+		while (!kthread_should_stop()) {
+			msleep(100);
+		}
+	}
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/target/iscsi/iscsi_target_erl0.c linux-libre-4.1.47-gnu/drivers/target/iscsi/iscsi_target_erl0.c
--- linux-libre-4.1.46-gnu/drivers/target/iscsi/iscsi_target_erl0.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/target/iscsi/iscsi_target_erl0.c	2017-12-06 21:20:16.000000000 -0500
@@ -928,8 +928,10 @@ static void iscsit_handle_connection_cle
 	}
 }
 
-void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
+void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn, bool *conn_freed)
 {
+	*conn_freed = false;
+
 	spin_lock_bh(&conn->state_lock);
 	if (atomic_read(&conn->connection_exit)) {
 		spin_unlock_bh(&conn->state_lock);
@@ -940,6 +942,7 @@ void iscsit_take_action_for_connection_e
 	if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
 		spin_unlock_bh(&conn->state_lock);
 		iscsit_close_connection(conn);
+		*conn_freed = true;
 		return;
 	}
 
@@ -953,6 +956,7 @@ void iscsit_take_action_for_connection_e
 	spin_unlock_bh(&conn->state_lock);
 
 	iscsit_handle_connection_cleanup(conn);
+	*conn_freed = true;
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/target/iscsi/iscsi_target_erl0.h linux-libre-4.1.47-gnu/drivers/target/iscsi/iscsi_target_erl0.h
--- linux-libre-4.1.46-gnu/drivers/target/iscsi/iscsi_target_erl0.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/target/iscsi/iscsi_target_erl0.h	2017-12-06 21:20:16.000000000 -0500
@@ -9,7 +9,7 @@ extern int iscsit_stop_time2retain_timer
 extern void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *);
 extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int);
 extern void iscsit_fall_back_to_erl0(struct iscsi_session *);
-extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *);
+extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *, bool *);
 extern int iscsit_recover_from_unknown_opcode(struct iscsi_conn *);
 
 #endif   /*** ISCSI_TARGET_ERL0_H ***/
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/target/iscsi/iscsi_target_login.c linux-libre-4.1.47-gnu/drivers/target/iscsi/iscsi_target_login.c
--- linux-libre-4.1.46-gnu/drivers/target/iscsi/iscsi_target_login.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/target/iscsi/iscsi_target_login.c	2017-12-06 21:20:16.000000000 -0500
@@ -1510,5 +1510,9 @@ int iscsi_target_login_thread(void *arg)
 			break;
 	}
 
+	while (!kthread_should_stop()) {
+		msleep(100);
+	}
+
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/target/target_core_fabric_configfs.c linux-libre-4.1.47-gnu/drivers/target/target_core_fabric_configfs.c
--- linux-libre-4.1.46-gnu/drivers/target/target_core_fabric_configfs.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/target/target_core_fabric_configfs.c	2017-12-06 21:20:16.000000000 -0500
@@ -98,6 +98,11 @@ static int target_fabric_mappedlun_link(
 				"_tpg does not exist\n");
 		return -EINVAL;
 	}
+	if (lun->lun_shutdown) {
+		pr_err("Unable to create mappedlun symlink because"
+			" lun->lun_shutdown=true\n");
+		return -EINVAL;
+	}
 	se_tpg = lun->lun_sep->sep_tpg;
 
 	nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/target/target_core_sbc.c linux-libre-4.1.47-gnu/drivers/target/target_core_sbc.c
--- linux-libre-4.1.46-gnu/drivers/target/target_core_sbc.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/target/target_core_sbc.c	2017-12-06 21:20:16.000000000 -0500
@@ -768,59 +768,6 @@ sbc_check_dpofua(struct se_device *dev,
 	return 0;
 }
 
-/**
- * sbc_parse_verify - parse VERIFY, VERIFY_16 and WRITE VERIFY commands
- * @cmd:     (in)  structure that describes the SCSI command to be parsed.
- * @sectors: (out) Number of logical blocks on the storage medium that will be
- *           affected by the SCSI command.
- * @bufflen: (out) Expected length of the SCSI Data-Out buffer.
- */
-static sense_reason_t sbc_parse_verify(struct se_cmd *cmd, int *sectors,
-				       u32 *bufflen)
-{
-	struct se_device *dev = cmd->se_dev;
-	u8 *cdb = cmd->t_task_cdb;
-	u8 bytchk = (cdb[1] >> 1) & 3;
-	sense_reason_t ret;
-
-	switch (cdb[0]) {
-	case VERIFY:
-	case WRITE_VERIFY:
-		*sectors = transport_get_sectors_10(cdb);
-		cmd->t_task_lba = transport_lba_32(cdb);
-		break;
-	case VERIFY_16:
-		*sectors = transport_get_sectors_16(cdb);
-		cmd->t_task_lba = transport_lba_64(cdb);
-		break;
-	default:
-		WARN_ON_ONCE(true);
-		return TCM_UNSUPPORTED_SCSI_OPCODE;
-	}
-
-	if (sbc_check_dpofua(dev, cmd, cdb))
-		return TCM_INVALID_CDB_FIELD;
-
-	ret = sbc_check_prot(dev, cmd, cdb, *sectors, true);
-	if (ret)
-		return ret;
-
-	switch (bytchk) {
-	case 0:
-		*bufflen = 0;
-		break;
-	case 1:
-		*bufflen = sbc_get_size(cmd, *sectors);
-		cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
-		break;
-	default:
-		pr_err("Unsupported BYTCHK value %d for SCSI opcode %#x\n",
-		       bytchk, cdb[0]);
-		return TCM_INVALID_CDB_FIELD;
-	}
-	return TCM_NO_SENSE;
-}
-
 sense_reason_t
 sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 {
@@ -891,6 +838,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct
 		cmd->execute_cmd = sbc_execute_rw;
 		break;
 	case WRITE_10:
+	case WRITE_VERIFY:
 		sectors = transport_get_sectors_10(cdb);
 		cmd->t_task_lba = transport_lba_32(cdb);
 
@@ -905,12 +853,6 @@ sbc_parse_cdb(struct se_cmd *cmd, struct
 		cmd->execute_rw = ops->execute_rw;
 		cmd->execute_cmd = sbc_execute_rw;
 		break;
-	case WRITE_VERIFY:
-		ret = sbc_parse_verify(cmd, &sectors, &size);
-		if (ret)
-			return ret;
-		cmd->execute_cmd = sbc_execute_rw;
-		goto check_lba;
 	case WRITE_12:
 		sectors = transport_get_sectors_12(cdb);
 		cmd->t_task_lba = transport_lba_32(cdb);
@@ -1110,9 +1052,14 @@ sbc_parse_cdb(struct se_cmd *cmd, struct
 		break;
 	case VERIFY:
 	case VERIFY_16:
-		ret = sbc_parse_verify(cmd, &sectors, &size);
-		if (ret)
-			return ret;
+		size = 0;
+		if (cdb[0] == VERIFY) {
+			sectors = transport_get_sectors_10(cdb);
+			cmd->t_task_lba = transport_lba_32(cdb);
+		} else {
+			sectors = transport_get_sectors_16(cdb);
+			cmd->t_task_lba = transport_lba_64(cdb);
+		}
 		cmd->execute_cmd = sbc_emulate_noop;
 		goto check_lba;
 	case REZERO_UNIT:
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/target/target_core_tpg.c linux-libre-4.1.47-gnu/drivers/target/target_core_tpg.c
--- linux-libre-4.1.46-gnu/drivers/target/target_core_tpg.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/target/target_core_tpg.c	2017-12-06 21:20:16.000000000 -0500
@@ -110,9 +110,21 @@ struct se_node_acl *core_tpg_get_initiat
 	unsigned char *initiatorname)
 {
 	struct se_node_acl *acl;
-
+	/*
+	 * Obtain se_node_acl->acl_kref using fabric driver provided
+	 * initiatorname[] during node acl endpoint lookup driven by
+	 * new se_session login.
+	 *
+	 * The reference is held until se_session shutdown -> release
+	 * occurs via fabric driver invoked transport_deregister_session()
+	 * or transport_free_session() code.
+	 */
 	spin_lock_irq(&tpg->acl_node_lock);
 	acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname);
+	if (acl) {
+		if (!kref_get_unless_zero(&acl->acl_kref))
+			acl = NULL;
+	}
 	spin_unlock_irq(&tpg->acl_node_lock);
 
 	return acl;
@@ -254,6 +266,25 @@ static int core_create_device_list_for_n
 	return 0;
 }
 
+bool target_tpg_has_node_acl(struct se_portal_group *tpg,
+			     const char *initiatorname)
+{
+	struct se_node_acl *acl;
+	bool found = false;
+
+	spin_lock_irq(&tpg->acl_node_lock);
+	list_for_each_entry(acl, &tpg->acl_node_list, acl_list) {
+		if (!strcmp(acl->initiatorname, initiatorname)) {
+			found = true;
+			break;
+		}
+	}
+	spin_unlock_irq(&tpg->acl_node_lock);
+
+	return found;
+}
+EXPORT_SYMBOL(target_tpg_has_node_acl);
+
 /*	core_tpg_check_initiator_node_acl()
  *
  *
@@ -274,10 +305,19 @@ struct se_node_acl *core_tpg_check_initi
 	acl =  tpg->se_tpg_tfo->tpg_alloc_fabric_acl(tpg);
 	if (!acl)
 		return NULL;
+	/*
+	 * When allocating a dynamically generated node_acl, go ahead
+	 * and take the extra kref now before returning to the fabric
+	 * driver caller.
+	 *
+	 * Note this reference will be released at session shutdown
+	 * time within transport_free_session() code.
+	 */
+	kref_init(&acl->acl_kref);
+	kref_get(&acl->acl_kref);
 
 	INIT_LIST_HEAD(&acl->acl_list);
 	INIT_LIST_HEAD(&acl->acl_sess_list);
-	kref_init(&acl->acl_kref);
 	init_completion(&acl->acl_free_comp);
 	spin_lock_init(&acl->device_list_lock);
 	spin_lock_init(&acl->nacl_sess_lock);
@@ -460,7 +500,7 @@ int core_tpg_del_initiator_node_acl(
 	if (acl->dynamic_node_acl) {
 		acl->dynamic_node_acl = 0;
 	}
-	list_del(&acl->acl_list);
+	list_del_init(&acl->acl_list);
 	tpg->num_node_acls--;
 	spin_unlock_irq(&tpg->acl_node_lock);
 
@@ -761,7 +801,7 @@ int core_tpg_deregister(struct se_portal
 	spin_lock_irq(&se_tpg->acl_node_lock);
 	list_for_each_entry_safe(nacl, nacl_tmp, &se_tpg->acl_node_list,
 			acl_list) {
-		list_del(&nacl->acl_list);
+		list_del_init(&nacl->acl_list);
 		se_tpg->num_node_acls--;
 		spin_unlock_irq(&se_tpg->acl_node_lock);
 
@@ -843,6 +883,8 @@ void core_tpg_remove_lun(
 	struct se_portal_group *tpg,
 	struct se_lun *lun)
 {
+	lun->lun_shutdown = true;
+
 	core_clear_lun_from_tpg(lun, tpg);
 	transport_clear_lun_ref(lun);
 
@@ -850,6 +892,7 @@ void core_tpg_remove_lun(
 
 	spin_lock(&tpg->tpg_lun_lock);
 	lun->lun_status = TRANSPORT_LUN_STATUS_FREE;
+	lun->lun_shutdown = false;
 	spin_unlock(&tpg->tpg_lun_lock);
 
 	percpu_ref_exit(&lun->lun_ref);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/target/target_core_transport.c linux-libre-4.1.47-gnu/drivers/target/target_core_transport.c
--- linux-libre-4.1.46-gnu/drivers/target/target_core_transport.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/target/target_core_transport.c	2017-12-06 21:20:16.000000000 -0500
@@ -359,7 +359,6 @@ void __transport_register_session(
 					&buf[0], PR_REG_ISID_LEN);
 			se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]);
 		}
-		kref_get(&se_nacl->acl_kref);
 
 		spin_lock_irq(&se_nacl->nacl_sess_lock);
 		/*
@@ -448,14 +447,30 @@ static void target_complete_nacl(struct
 {
 	struct se_node_acl *nacl = container_of(kref,
 				struct se_node_acl, acl_kref);
+	struct se_portal_group *se_tpg = nacl->se_tpg;
+	const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo;
+	unsigned long flags;
 
-	complete(&nacl->acl_free_comp);
+	if (!nacl->dynamic_stop) {
+		complete(&nacl->acl_free_comp);
+		return;
+	}
+
+	spin_lock_irqsave(&se_tpg->acl_node_lock, flags);
+	list_del_init(&nacl->acl_list);
+	se_tpg->num_node_acls--;
+	spin_unlock_irqrestore(&se_tpg->acl_node_lock, flags);
+
+	core_tpg_wait_for_nacl_pr_ref(nacl);
+	core_free_device_list_for_node(nacl, se_tpg);
+	se_tfo->tpg_release_fabric_acl(se_tpg, nacl);
 }
 
 void target_put_nacl(struct se_node_acl *nacl)
 {
 	kref_put(&nacl->acl_kref, target_complete_nacl);
 }
+EXPORT_SYMBOL(target_put_nacl);
 
 void transport_deregister_session_configfs(struct se_session *se_sess)
 {
@@ -488,6 +503,42 @@ EXPORT_SYMBOL(transport_deregister_sessi
 
 void transport_free_session(struct se_session *se_sess)
 {
+	struct se_node_acl *se_nacl = se_sess->se_node_acl;
+
+	/*
+	 * Drop the se_node_acl->nacl_kref obtained from within
+	 * core_tpg_get_initiator_node_acl().
+	 */
+	if (se_nacl) {
+		struct se_portal_group *se_tpg = se_nacl->se_tpg;
+		const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo;
+		unsigned long flags;
+
+		se_sess->se_node_acl = NULL;
+
+		/*
+		 * Also determine if we need to drop the extra ->cmd_kref if
+		 * it had been previously dynamically generated, and
+		 * the endpoint is not caching dynamic ACLs.
+		 */
+		spin_lock_irqsave(&se_tpg->acl_node_lock, flags);
+		if (se_nacl->dynamic_node_acl &&
+		    !se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
+			spin_lock(&se_nacl->nacl_sess_lock);
+			if (list_empty(&se_nacl->acl_sess_list))
+				se_nacl->dynamic_stop = true;
+			spin_unlock(&se_nacl->nacl_sess_lock);
+
+			if (se_nacl->dynamic_stop)
+				list_del_init(&se_nacl->acl_list);
+		}
+		spin_unlock_irqrestore(&se_tpg->acl_node_lock, flags);
+
+		if (se_nacl->dynamic_stop)
+			target_put_nacl(se_nacl);
+
+		target_put_nacl(se_nacl);
+	}
 	if (se_sess->sess_cmd_map) {
 		percpu_ida_destroy(&se_sess->sess_tag_pool);
 		if (is_vmalloc_addr(se_sess->sess_cmd_map))
@@ -502,16 +553,12 @@ EXPORT_SYMBOL(transport_free_session);
 void transport_deregister_session(struct se_session *se_sess)
 {
 	struct se_portal_group *se_tpg = se_sess->se_tpg;
-	const struct target_core_fabric_ops *se_tfo;
-	struct se_node_acl *se_nacl;
 	unsigned long flags;
-	bool comp_nacl = true;
 
 	if (!se_tpg) {
 		transport_free_session(se_sess);
 		return;
 	}
-	se_tfo = se_tpg->se_tpg_tfo;
 
 	spin_lock_irqsave(&se_tpg->session_lock, flags);
 	list_del(&se_sess->sess_list);
@@ -519,37 +566,16 @@ void transport_deregister_session(struct
 	se_sess->fabric_sess_ptr = NULL;
 	spin_unlock_irqrestore(&se_tpg->session_lock, flags);
 
-	/*
-	 * Determine if we need to do extra work for this initiator node's
-	 * struct se_node_acl if it had been previously dynamically generated.
-	 */
-	se_nacl = se_sess->se_node_acl;
-
-	spin_lock_irqsave(&se_tpg->acl_node_lock, flags);
-	if (se_nacl && se_nacl->dynamic_node_acl) {
-		if (!se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
-			list_del(&se_nacl->acl_list);
-			se_tpg->num_node_acls--;
-			spin_unlock_irqrestore(&se_tpg->acl_node_lock, flags);
-			core_tpg_wait_for_nacl_pr_ref(se_nacl);
-			core_free_device_list_for_node(se_nacl, se_tpg);
-			se_tfo->tpg_release_fabric_acl(se_tpg, se_nacl);
-
-			comp_nacl = false;
-			spin_lock_irqsave(&se_tpg->acl_node_lock, flags);
-		}
-	}
-	spin_unlock_irqrestore(&se_tpg->acl_node_lock, flags);
-
 	pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
 		se_tpg->se_tpg_tfo->get_fabric_name());
 	/*
 	 * If last kref is dropping now for an explicit NodeACL, awake sleeping
 	 * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group
-	 * removal context.
+	 * removal context from within transport_free_session() code.
+	 *
+	 * For dynamic ACL, target_put_nacl() uses target_complete_nacl()
+	 * to release all remaining generate_node_acl=1 created ACL resources.
 	 */
-	if (se_nacl && comp_nacl)
-		target_put_nacl(se_nacl);
 
 	transport_free_session(se_sess);
 }
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/tty/serial/omap-serial.c linux-libre-4.1.47-gnu/drivers/tty/serial/omap-serial.c
--- linux-libre-4.1.46-gnu/drivers/tty/serial/omap-serial.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/tty/serial/omap-serial.c	2017-12-06 21:20:16.000000000 -0500
@@ -708,7 +708,7 @@ static void serial_omap_set_mctrl(struct
 	if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
 		up->efr |= UART_EFR_RTS;
 	else
-		up->efr &= UART_EFR_RTS;
+		up->efr &= ~UART_EFR_RTS;
 	serial_out(up, UART_EFR, up->efr);
 	serial_out(up, UART_LCR, lcr);
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/tty/serial/sh-sci.c linux-libre-4.1.47-gnu/drivers/tty/serial/sh-sci.c
--- linux-libre-4.1.46-gnu/drivers/tty/serial/sh-sci.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/tty/serial/sh-sci.c	2017-12-06 21:20:16.000000000 -0500
@@ -171,18 +171,17 @@ static struct plat_sci_reg sci_regmap[SC
 	},
 
 	/*
-	 * Common definitions for legacy IrDA ports, dependent on
-	 * regshift value.
+	 * Common definitions for legacy IrDA ports.
 	 */
 	[SCIx_IRDA_REGTYPE] = {
 		[SCSMR]		= { 0x00,  8 },
-		[SCBRR]		= { 0x01,  8 },
-		[SCSCR]		= { 0x02,  8 },
-		[SCxTDR]	= { 0x03,  8 },
-		[SCxSR]		= { 0x04,  8 },
-		[SCxRDR]	= { 0x05,  8 },
-		[SCFCR]		= { 0x06,  8 },
-		[SCFDR]		= { 0x07, 16 },
+		[SCBRR]		= { 0x02,  8 },
+		[SCSCR]		= { 0x04,  8 },
+		[SCxTDR]	= { 0x06,  8 },
+		[SCxSR]		= { 0x08, 16 },
+		[SCxRDR]	= { 0x0a,  8 },
+		[SCFCR]		= { 0x0c,  8 },
+		[SCFDR]		= { 0x0e, 16 },
 		[SCTFDR]	= sci_reg_invalid,
 		[SCRFDR]	= sci_reg_invalid,
 		[SCSPTR]	= sci_reg_invalid,
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/usb/core/devio.c linux-libre-4.1.47-gnu/drivers/usb/core/devio.c
--- linux-libre-4.1.46-gnu/drivers/usb/core/devio.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/usb/core/devio.c	2017-12-06 21:20:16.000000000 -0500
@@ -1649,6 +1649,18 @@ static int proc_unlinkurb(struct usb_dev
 	return 0;
 }
 
+static void compute_isochronous_actual_length(struct urb *urb)
+{
+	unsigned int i;
+
+	if (urb->number_of_packets > 0) {
+		urb->actual_length = 0;
+		for (i = 0; i < urb->number_of_packets; i++)
+			urb->actual_length +=
+					urb->iso_frame_desc[i].actual_length;
+	}
+}
+
 static int processcompl(struct async *as, void __user * __user *arg)
 {
 	struct urb *urb = as->urb;
@@ -1656,6 +1668,7 @@ static int processcompl(struct async *as
 	void __user *addr = as->userurb;
 	unsigned int i;
 
+	compute_isochronous_actual_length(urb);
 	if (as->userbuffer && urb->actual_length) {
 		if (copy_urb_data_to_user(as->userbuffer, urb))
 			goto err_out;
@@ -1825,6 +1838,7 @@ static int processcompl_compat(struct as
 	void __user *addr = as->userurb;
 	unsigned int i;
 
+	compute_isochronous_actual_length(urb);
 	if (as->userbuffer && urb->actual_length) {
 		if (copy_urb_data_to_user(as->userbuffer, urb))
 			return -EFAULT;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/usb/core/hcd.c linux-libre-4.1.47-gnu/drivers/usb/core/hcd.c
--- linux-libre-4.1.46-gnu/drivers/usb/core/hcd.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/usb/core/hcd.c	2017-12-06 21:20:16.000000000 -0500
@@ -2927,6 +2927,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 	}
 
 	usb_put_invalidate_rhdev(hcd);
+	hcd->flags = 0;
 }
 EXPORT_SYMBOL_GPL(usb_remove_hcd);
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/usb/core/quirks.c linux-libre-4.1.47-gnu/drivers/usb/core/quirks.c
--- linux-libre-4.1.46-gnu/drivers/usb/core/quirks.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/usb/core/quirks.c	2017-12-06 21:20:16.000000000 -0500
@@ -221,6 +221,9 @@ static const struct usb_device_id usb_qu
 	/* Corsair Strafe RGB */
 	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
 
+	/* Corsair K70 LUX */
+	{ USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
+
 	/* MIDI keyboard WORLDE MINI */
 	{ USB_DEVICE(0x1c75, 0x0204), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/usb/misc/usbtest.c linux-libre-4.1.47-gnu/drivers/usb/misc/usbtest.c
--- linux-libre-4.1.46-gnu/drivers/usb/misc/usbtest.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/usb/misc/usbtest.c	2017-12-06 21:20:16.000000000 -0500
@@ -183,12 +183,13 @@ found:
 			return tmp;
 	}
 
-	if (in) {
+	if (in)
 		dev->in_pipe = usb_rcvbulkpipe(udev,
 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+	if (out)
 		dev->out_pipe = usb_sndbulkpipe(udev,
 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
-	}
+
 	if (iso_in) {
 		dev->iso_in = &iso_in->desc;
 		dev->in_iso_pipe = usb_rcvisocpipe(udev,
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/usb/serial/garmin_gps.c linux-libre-4.1.47-gnu/drivers/usb/serial/garmin_gps.c
--- linux-libre-4.1.46-gnu/drivers/usb/serial/garmin_gps.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/usb/serial/garmin_gps.c	2017-12-06 21:20:16.000000000 -0500
@@ -138,6 +138,7 @@ struct garmin_data {
 	__u8   privpkt[4*6];
 	spinlock_t lock;
 	struct list_head pktlist;
+	struct usb_anchor write_urbs;
 };
 
 
@@ -906,7 +907,7 @@ static int garmin_init_session(struct us
 					sizeof(GARMIN_START_SESSION_REQ), 0);
 
 			if (status < 0)
-				break;
+				goto err_kill_urbs;
 		}
 
 		if (status > 0)
@@ -914,6 +915,12 @@ static int garmin_init_session(struct us
 	}
 
 	return status;
+
+err_kill_urbs:
+	usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
+	usb_kill_urb(port->interrupt_in_urb);
+
+	return status;
 }
 
 
@@ -931,7 +938,6 @@ static int garmin_open(struct tty_struct
 	spin_unlock_irqrestore(&garmin_data_p->lock, flags);
 
 	/* shutdown any bulk reads that might be going on */
-	usb_kill_urb(port->write_urb);
 	usb_kill_urb(port->read_urb);
 
 	if (garmin_data_p->state == STATE_RESET)
@@ -954,7 +960,7 @@ static void garmin_close(struct usb_seri
 
 	/* shutdown our urbs */
 	usb_kill_urb(port->read_urb);
-	usb_kill_urb(port->write_urb);
+	usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
 
 	/* keep reset state so we know that we must start a new session */
 	if (garmin_data_p->state != STATE_RESET)
@@ -1038,12 +1044,14 @@ static int garmin_write_bulk(struct usb_
 	}
 
 	/* send it down the pipe */
+	usb_anchor_urb(urb, &garmin_data_p->write_urbs);
 	status = usb_submit_urb(urb, GFP_ATOMIC);
 	if (status) {
 		dev_err(&port->dev,
 		   "%s - usb_submit_urb(write bulk) failed with status = %d\n",
 				__func__, status);
 		count = status;
+		usb_unanchor_urb(urb);
 		kfree(buffer);
 	}
 
@@ -1402,9 +1410,16 @@ static int garmin_port_probe(struct usb_
 	garmin_data_p->state = 0;
 	garmin_data_p->flags = 0;
 	garmin_data_p->count = 0;
+	init_usb_anchor(&garmin_data_p->write_urbs);
 	usb_set_serial_port_data(port, garmin_data_p);
 
 	status = garmin_init_session(port);
+	if (status)
+		goto err_free;
+
+	return 0;
+err_free:
+	kfree(garmin_data_p);
 
 	return status;
 }
@@ -1414,6 +1429,7 @@ static int garmin_port_remove(struct usb
 {
 	struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
 
+	usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
 	usb_kill_urb(port->interrupt_in_urb);
 	del_timer_sync(&garmin_data_p->timer);
 	kfree(garmin_data_p);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/usb/serial/qcserial.c linux-libre-4.1.47-gnu/drivers/usb/serial/qcserial.c
--- linux-libre-4.1.46-gnu/drivers/usb/serial/qcserial.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/usb/serial/qcserial.c	2017-12-06 21:20:16.000000000 -0500
@@ -147,6 +147,7 @@ static const struct usb_device_id id_tab
 	{DEVICE_SWI(0x114f, 0x68a2)},	/* Sierra Wireless MC7750 */
 	{DEVICE_SWI(0x1199, 0x68a2)},	/* Sierra Wireless MC7710 */
 	{DEVICE_SWI(0x1199, 0x901c)},	/* Sierra Wireless EM7700 */
+	{DEVICE_SWI(0x1199, 0x901e)},	/* Sierra Wireless EM7355 QDL */
 	{DEVICE_SWI(0x1199, 0x901f)},	/* Sierra Wireless EM7355 */
 	{DEVICE_SWI(0x1199, 0x9040)},	/* Sierra Wireless Modem */
 	{DEVICE_SWI(0x1199, 0x9051)},	/* Netgear AirCard 340U */
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/video/backlight/adp5520_bl.c linux-libre-4.1.47-gnu/drivers/video/backlight/adp5520_bl.c
--- linux-libre-4.1.46-gnu/drivers/video/backlight/adp5520_bl.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/video/backlight/adp5520_bl.c	2017-12-06 21:20:16.000000000 -0500
@@ -332,10 +332,18 @@ static int adp5520_bl_probe(struct platf
 	}
 
 	platform_set_drvdata(pdev, bl);
-	ret |= adp5520_bl_setup(bl);
+	ret = adp5520_bl_setup(bl);
+	if (ret) {
+		dev_err(&pdev->dev, "failed to setup\n");
+		if (data->pdata->en_ambl_sens)
+			sysfs_remove_group(&bl->dev.kobj,
+					&adp5520_bl_attr_group);
+		return ret;
+	}
+
 	backlight_update_status(bl);
 
-	return ret;
+	return 0;
 }
 
 static int adp5520_bl_remove(struct platform_device *pdev)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/video/backlight/lcd.c linux-libre-4.1.47-gnu/drivers/video/backlight/lcd.c
--- linux-libre-4.1.46-gnu/drivers/video/backlight/lcd.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/video/backlight/lcd.c	2017-12-06 21:20:16.000000000 -0500
@@ -226,6 +226,8 @@ struct lcd_device *lcd_device_register(c
 	dev_set_name(&new_ld->dev, "%s", name);
 	dev_set_drvdata(&new_ld->dev, devdata);
 
+	new_ld->ops = ops;
+
 	rc = device_register(&new_ld->dev);
 	if (rc) {
 		put_device(&new_ld->dev);
@@ -238,8 +240,6 @@ struct lcd_device *lcd_device_register(c
 		return ERR_PTR(rc);
 	}
 
-	new_ld->ops = ops;
-
 	return new_ld;
 }
 EXPORT_SYMBOL(lcd_device_register);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/video/fbdev/pmag-ba-fb.c linux-libre-4.1.47-gnu/drivers/video/fbdev/pmag-ba-fb.c
--- linux-libre-4.1.46-gnu/drivers/video/fbdev/pmag-ba-fb.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/video/fbdev/pmag-ba-fb.c	2017-12-06 21:20:16.000000000 -0500
@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = {
 /*
  * Turn the hardware cursor off.
  */
-static void __init pmagbafb_erase_cursor(struct fb_info *info)
+static void pmagbafb_erase_cursor(struct fb_info *info)
 {
 	struct pmagbafb_par *par = info->par;
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/xen/manage.c linux-libre-4.1.47-gnu/drivers/xen/manage.c
--- linux-libre-4.1.46-gnu/drivers/xen/manage.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/xen/manage.c	2017-12-06 21:20:16.000000000 -0500
@@ -275,8 +275,16 @@ static void sysrq_handler(struct xenbus_
 	err = xenbus_transaction_start(&xbt);
 	if (err)
 		return;
-	if (!xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key)) {
-		pr_err("Unable to read sysrq code in control/sysrq\n");
+	err = xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key);
+	if (err < 0) {
+		/*
+		 * The Xenstore watch fires directly after registering it and
+		 * after a suspend/resume cycle. So ENOENT is no error but
+		 * might happen in those cases.
+		 */
+		if (err != -ENOENT)
+			pr_err("Error %d reading sysrq code in control/sysrq\n",
+			       err);
 		xenbus_transaction_end(xbt, 1);
 		return;
 	}
diff -druNp --no-dereference linux-libre-4.1.46-gnu/drivers/xen/swiotlb-xen.c linux-libre-4.1.47-gnu/drivers/xen/swiotlb-xen.c
--- linux-libre-4.1.46-gnu/drivers/xen/swiotlb-xen.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/drivers/xen/swiotlb-xen.c	2017-12-06 21:20:16.000000000 -0500
@@ -687,3 +687,22 @@ xen_swiotlb_set_dma_mask(struct device *
 	return 0;
 }
 EXPORT_SYMBOL_GPL(xen_swiotlb_set_dma_mask);
+
+/*
+ * Create userspace mapping for the DMA-coherent memory.
+ * This function should be called with the pages from the current domain only,
+ * passing pages mapped from other domains would lead to memory corruption.
+ */
+int
+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+		     void *cpu_addr, dma_addr_t dma_addr, size_t size,
+		     unsigned long attrs)
+{
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+	if (__generic_dma_ops(dev)->mmap)
+		return __generic_dma_ops(dev)->mmap(dev, vma, cpu_addr,
+						    dma_addr, size, attrs);
+#endif
+	return dma_common_mmap(dev, vma, cpu_addr, dma_addr, size);
+}
+EXPORT_SYMBOL_GPL(xen_swiotlb_dma_mmap);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/fs/cifs/dir.c linux-libre-4.1.47-gnu/fs/cifs/dir.c
--- linux-libre-4.1.46-gnu/fs/cifs/dir.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/fs/cifs/dir.c	2017-12-06 21:20:16.000000000 -0500
@@ -193,7 +193,8 @@ check_name(struct dentry *direntry, stru
 	struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
 	int i;
 
-	if (unlikely(direntry->d_name.len >
+	if (unlikely(tcon->fsAttrInfo.MaxPathNameComponentLength &&
+		     direntry->d_name.len >
 		     le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength)))
 		return -ENAMETOOLONG;
 
@@ -509,7 +510,7 @@ cifs_atomic_open(struct inode *inode, st
 
 	rc = check_name(direntry, tcon);
 	if (rc)
-		goto out_free_xid;
+		goto out;
 
 	server = tcon->ses->server;
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/fs/coda/upcall.c linux-libre-4.1.47-gnu/fs/coda/upcall.c
--- linux-libre-4.1.46-gnu/fs/coda/upcall.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/fs/coda/upcall.c	2017-12-06 21:20:16.000000000 -0500
@@ -446,8 +446,7 @@ int venus_fsync(struct super_block *sb,
 	UPARG(CODA_FSYNC);
 
 	inp->coda_fsync.VFid = *fid;
-	error = coda_upcall(coda_vcp(sb), sizeof(union inputArgs),
-			    &outsize, inp);
+	error = coda_upcall(coda_vcp(sb), insize, &outsize, inp);
 
 	CODA_FREE(inp, insize);
 	return error;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/fs/ext4/inode.c linux-libre-4.1.47-gnu/fs/ext4/inode.c
--- linux-libre-4.1.46-gnu/fs/ext4/inode.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/fs/ext4/inode.c	2017-12-06 21:20:16.000000000 -0500
@@ -652,6 +652,20 @@ has_zeroout:
 		ret = check_block_validity(inode, map);
 		if (ret != 0)
 			return ret;
+
+		/*
+		 * Inodes with freshly allocated blocks where contents will be
+		 * visible after transaction commit must be on transaction's
+		 * ordered data list.
+		 */
+		if (map->m_flags & EXT4_MAP_NEW &&
+		    !(map->m_flags & EXT4_MAP_UNWRITTEN) &&
+		    !IS_NOQUOTA(inode) &&
+		    ext4_should_order_data(inode)) {
+			ret = ext4_jbd2_file_inode(handle, inode);
+			if (ret)
+				return ret;
+		}
 	}
 	return retval;
 }
@@ -1146,15 +1160,6 @@ static int ext4_write_end(struct file *f
 	int i_size_changed = 0;
 
 	trace_ext4_write_end(inode, pos, len, copied);
-	if (ext4_test_inode_state(inode, EXT4_STATE_ORDERED_MODE)) {
-		ret = ext4_jbd2_file_inode(handle, inode);
-		if (ret) {
-			unlock_page(page);
-			page_cache_release(page);
-			goto errout;
-		}
-	}
-
 	if (ext4_has_inline_data(inode)) {
 		ret = ext4_write_inline_data_end(inode, pos, len,
 						 copied, page);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/fs/ext4/mballoc.c linux-libre-4.1.47-gnu/fs/ext4/mballoc.c
--- linux-libre-4.1.46-gnu/fs/ext4/mballoc.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/fs/ext4/mballoc.c	2017-12-06 21:20:16.000000000 -0500
@@ -2113,8 +2113,10 @@ ext4_mb_regular_allocator(struct ext4_al
 	 * We search using buddy data only if the order of the request
 	 * is greater than equal to the sbi_s_mb_order2_reqs
 	 * You can tune it via /sys/fs/ext4/<partition>/mb_order2_req
+	 * We also support searching for power-of-two requests only for
+	 * requests upto maximum buddy size we have constructed.
 	 */
-	if (i >= sbi->s_mb_order2_reqs) {
+	if (i >= sbi->s_mb_order2_reqs && i <= sb->s_blocksize_bits + 2) {
 		/*
 		 * This should tell if fe_len is exactly power of 2
 		 */
@@ -2176,7 +2178,7 @@ repeat:
 			}
 
 			ac->ac_groups_scanned++;
-			if (cr == 0 && ac->ac_2order < sb->s_blocksize_bits+2)
+			if (cr == 0)
 				ext4_mb_simple_scan_group(ac, &e4b);
 			else if (cr == 1 && sbi->s_stripe &&
 					!(ac->ac_g_ex.fe_len % sbi->s_stripe))
diff -druNp --no-dereference linux-libre-4.1.46-gnu/fs/ext4/super.c linux-libre-4.1.47-gnu/fs/ext4/super.c
--- linux-libre-4.1.46-gnu/fs/ext4/super.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/fs/ext4/super.c	2017-12-06 21:20:16.000000000 -0500
@@ -2469,9 +2469,9 @@ static unsigned long ext4_get_stripe_siz
 
 	if (sbi->s_stripe && sbi->s_stripe <= sbi->s_blocks_per_group)
 		ret = sbi->s_stripe;
-	else if (stripe_width <= sbi->s_blocks_per_group)
+	else if (stripe_width && stripe_width <= sbi->s_blocks_per_group)
 		ret = stripe_width;
-	else if (stride <= sbi->s_blocks_per_group)
+	else if (stride && stride <= sbi->s_blocks_per_group)
 		ret = stride;
 	else
 		ret = 0;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/fs/fscache/object-list.c linux-libre-4.1.47-gnu/fs/fscache/object-list.c
--- linux-libre-4.1.46-gnu/fs/fscache/object-list.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/fs/fscache/object-list.c	2017-12-06 21:20:16.000000000 -0500
@@ -330,6 +330,13 @@ static void fscache_objlist_config(struc
 	rcu_read_lock();
 
 	confkey = key->payload.data;
+	if (!confkey) {
+		/* key was revoked */
+		rcu_read_unlock();
+		key_put(key);
+		goto no_config;
+	}
+
 	buf = confkey->data;
 
 	for (len = confkey->datalen - 1; len >= 0; len--) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/fs/ocfs2/alloc.c linux-libre-4.1.47-gnu/fs/ocfs2/alloc.c
--- linux-libre-4.1.46-gnu/fs/ocfs2/alloc.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/fs/ocfs2/alloc.c	2017-12-06 21:20:16.000000000 -0500
@@ -7245,13 +7245,24 @@ out:
 
 static int ocfs2_trim_extent(struct super_block *sb,
 			     struct ocfs2_group_desc *gd,
-			     u32 start, u32 count)
+			     u64 group, u32 start, u32 count)
 {
 	u64 discard, bcount;
+	struct ocfs2_super *osb = OCFS2_SB(sb);
 
 	bcount = ocfs2_clusters_to_blocks(sb, count);
-	discard = le64_to_cpu(gd->bg_blkno) +
-			ocfs2_clusters_to_blocks(sb, start);
+	discard = ocfs2_clusters_to_blocks(sb, start);
+
+	/*
+	 * For the first cluster group, the gd->bg_blkno is not at the start
+	 * of the group, but at an offset from the start. If we add it while
+	 * calculating discard for first group, we will wrongly start fstrim a
+	 * few blocks after the desried start block and the range can cross
+	 * over into the next cluster group. So, add it only if this is not
+	 * the first cluster group.
+	 */
+	if (group != osb->first_cluster_group_blkno)
+		discard += le64_to_cpu(gd->bg_blkno);
 
 	trace_ocfs2_trim_extent(sb, (unsigned long long)discard, bcount);
 
@@ -7259,7 +7270,7 @@ static int ocfs2_trim_extent(struct supe
 }
 
 static int ocfs2_trim_group(struct super_block *sb,
-			    struct ocfs2_group_desc *gd,
+			    struct ocfs2_group_desc *gd, u64 group,
 			    u32 start, u32 max, u32 minbits)
 {
 	int ret = 0, count = 0, next;
@@ -7278,7 +7289,7 @@ static int ocfs2_trim_group(struct super
 		next = ocfs2_find_next_bit(bitmap, max, start);
 
 		if ((next - start) >= minbits) {
-			ret = ocfs2_trim_extent(sb, gd,
+			ret = ocfs2_trim_extent(sb, gd, group,
 						start, next - start);
 			if (ret < 0) {
 				mlog_errno(ret);
@@ -7376,7 +7387,8 @@ int ocfs2_trim_fs(struct super_block *sb
 		}
 
 		gd = (struct ocfs2_group_desc *)gd_bh->b_data;
-		cnt = ocfs2_trim_group(sb, gd, first_bit, last_bit, minlen);
+		cnt = ocfs2_trim_group(sb, gd, group,
+				       first_bit, last_bit, minlen);
 		brelse(gd_bh);
 		gd_bh = NULL;
 		if (cnt < 0) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/fs/ocfs2/file.c linux-libre-4.1.47-gnu/fs/ocfs2/file.c
--- linux-libre-4.1.46-gnu/fs/ocfs2/file.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/fs/ocfs2/file.c	2017-12-06 21:20:16.000000000 -0500
@@ -1158,6 +1158,13 @@ int ocfs2_setattr(struct dentry *dentry,
 		dquot_initialize(inode);
 	size_change = S_ISREG(inode->i_mode) && attr->ia_valid & ATTR_SIZE;
 	if (size_change) {
+		/*
+		 * Here we should wait dio to finish before inode lock
+		 * to avoid a deadlock between ocfs2_setattr() and
+		 * ocfs2_dio_end_io_write()
+		 */
+		inode_dio_wait(inode);
+
 		status = ocfs2_rw_lock(inode, 1);
 		if (status < 0) {
 			mlog_errno(status);
@@ -1177,8 +1184,6 @@ int ocfs2_setattr(struct dentry *dentry,
 		if (status)
 			goto bail_unlock;
 
-		inode_dio_wait(inode);
-
 		if (i_size_read(inode) >= attr->ia_size) {
 			if (ocfs2_should_order_data(inode)) {
 				status = ocfs2_begin_ordered_truncate(inode,
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/dt-bindings/pinctrl/omap.h linux-libre-4.1.47-gnu/include/dt-bindings/pinctrl/omap.h
--- linux-libre-4.1.46-gnu/include/dt-bindings/pinctrl/omap.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/dt-bindings/pinctrl/omap.h	2017-12-06 21:20:16.000000000 -0500
@@ -45,8 +45,8 @@
 #define PIN_OFF_NONE		0
 #define PIN_OFF_OUTPUT_HIGH	(OFF_EN | OFFOUT_EN | OFFOUT_VAL)
 #define PIN_OFF_OUTPUT_LOW	(OFF_EN | OFFOUT_EN)
-#define PIN_OFF_INPUT_PULLUP	(OFF_EN | OFF_PULL_EN | OFF_PULL_UP)
-#define PIN_OFF_INPUT_PULLDOWN	(OFF_EN | OFF_PULL_EN)
+#define PIN_OFF_INPUT_PULLUP	(OFF_EN | OFFOUT_EN | OFF_PULL_EN | OFF_PULL_UP)
+#define PIN_OFF_INPUT_PULLDOWN	(OFF_EN | OFFOUT_EN | OFF_PULL_EN)
 #define PIN_OFF_WAKEUPENABLE	WAKEUP_EN
 
 /*
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/linux/netdevice.h linux-libre-4.1.47-gnu/include/linux/netdevice.h
--- linux-libre-4.1.46-gnu/include/linux/netdevice.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/linux/netdevice.h	2017-12-06 21:20:16.000000000 -0500
@@ -3380,6 +3380,9 @@ struct net_device *alloc_netdev_mqs(int
 				    unsigned char name_assign_type,
 				    void (*setup)(struct net_device *),
 				    unsigned int txqs, unsigned int rxqs);
+int dev_get_valid_name(struct net *net, struct net_device *dev,
+		       const char *name);
+
 #define alloc_netdev(sizeof_priv, name, name_assign_type, setup) \
 	alloc_netdev_mqs(sizeof_priv, name, name_assign_type, setup, 1, 1)
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/linux/phy.h linux-libre-4.1.47-gnu/include/linux/phy.h
--- linux-libre-4.1.46-gnu/include/linux/phy.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/linux/phy.h	2017-12-06 21:20:16.000000000 -0500
@@ -135,11 +135,7 @@ static inline const char *phy_modes(phy_
 /* Used when trying to connect to a specific phy (mii bus id:phy device id) */
 #define PHY_ID_FMT "%s:%02x"
 
-/*
- * Need to be a little smaller than phydev->dev.bus_id to leave room
- * for the ":%02x"
- */
-#define MII_BUS_ID_SIZE	(20 - 3)
+#define MII_BUS_ID_SIZE	61
 
 /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit
    IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */
@@ -587,7 +583,7 @@ struct phy_driver {
 /* A Structure for boards to register fixups with the PHY Lib */
 struct phy_fixup {
 	struct list_head list;
-	char bus_id[20];
+	char bus_id[MII_BUS_ID_SIZE + 3];
 	u32 phy_uid;
 	u32 phy_uid_mask;
 	int (*run)(struct phy_device *phydev);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/linux/skbuff.h linux-libre-4.1.47-gnu/include/linux/skbuff.h
--- linux-libre-4.1.46-gnu/include/linux/skbuff.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/linux/skbuff.h	2017-12-06 21:20:16.000000000 -0500
@@ -3230,6 +3230,13 @@ static inline void nf_reset_trace(struct
 #endif
 }
 
+static inline void ipvs_reset(struct sk_buff *skb)
+{
+#if IS_ENABLED(CONFIG_IP_VS)
+	skb->ipvs_property = 0;
+#endif
+}
+
 /* Note: This doesn't put any conntrack and bridge info in dst. */
 static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src,
 			     bool copy)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/net/tcp.h linux-libre-4.1.47-gnu/include/net/tcp.h
--- linux-libre-4.1.46-gnu/include/net/tcp.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/net/tcp.h	2017-12-06 21:20:16.000000000 -0500
@@ -1535,12 +1535,12 @@ static inline void tcp_highest_sack_rese
 	tcp_sk(sk)->highest_sack = tcp_write_queue_head(sk);
 }
 
-/* Called when old skb is about to be deleted (to be combined with new skb) */
-static inline void tcp_highest_sack_combine(struct sock *sk,
+/* Called when old skb is about to be deleted and replaced by new skb */
+static inline void tcp_highest_sack_replace(struct sock *sk,
 					    struct sk_buff *old,
 					    struct sk_buff *new)
 {
-	if (tcp_sk(sk)->sacked_out && (old == tcp_sk(sk)->highest_sack))
+	if (old == tcp_highest_sack(sk))
 		tcp_sk(sk)->highest_sack = new;
 }
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/sound/seq_kernel.h linux-libre-4.1.47-gnu/include/sound/seq_kernel.h
--- linux-libre-4.1.46-gnu/include/sound/seq_kernel.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/sound/seq_kernel.h	2017-12-06 21:20:16.000000000 -0500
@@ -49,7 +49,8 @@ typedef union snd_seq_timestamp snd_seq_
 #define SNDRV_SEQ_DEFAULT_CLIENT_EVENTS	200
 
 /* max delivery path length */
-#define SNDRV_SEQ_MAX_HOPS		10
+/* NOTE: this shouldn't be greater than MAX_LOCKDEP_SUBCLASSES */
+#define SNDRV_SEQ_MAX_HOPS		8
 
 /* max size of event size */
 #define SNDRV_SEQ_MAX_EVENT_LEN		0x3fffffff
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/target/target_core_base.h linux-libre-4.1.47-gnu/include/target/target_core_base.h
--- linux-libre-4.1.46-gnu/include/target/target_core_base.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/target/target_core_base.h	2017-12-06 21:20:16.000000000 -0500
@@ -228,6 +228,7 @@ enum tcm_tmreq_table {
 	TMR_LUN_RESET		= 5,
 	TMR_TARGET_WARM_RESET	= 6,
 	TMR_TARGET_COLD_RESET	= 7,
+	TMR_UNKNOWN		= 0xff,
 };
 
 /* fabric independent task management response values */
@@ -590,6 +591,7 @@ struct se_node_acl {
 	/* Used to signal demo mode created ACL, disabled by default */
 	bool			dynamic_node_acl;
 	bool			acl_stop:1;
+	bool			dynamic_stop;
 	u32			queue_depth;
 	u32			acl_index;
 	enum target_prot_type	saved_prot_type;
@@ -723,6 +725,7 @@ struct se_lun {
 	u32			lun_access;
 	u32			lun_flags;
 	u32			unpacked_lun;
+	bool			lun_shutdown;
 	atomic_t		lun_acl_count;
 	spinlock_t		lun_acl_lock;
 	spinlock_t		lun_sep_lock;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/target/target_core_fabric.h linux-libre-4.1.47-gnu/include/target/target_core_fabric.h
--- linux-libre-4.1.46-gnu/include/target/target_core_fabric.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/target/target_core_fabric.h	2017-12-06 21:20:16.000000000 -0500
@@ -171,6 +171,8 @@ int	transport_lookup_tmr_lun(struct se_c
 
 struct se_node_acl *core_tpg_get_initiator_node_acl(struct se_portal_group *tpg,
 		unsigned char *);
+bool	target_tpg_has_node_acl(struct se_portal_group *tpg,
+		const char *);
 struct se_node_acl *core_tpg_check_initiator_node_acl(struct se_portal_group *,
 		unsigned char *);
 void	core_tpg_clear_object_luns(struct se_portal_group *);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/include/xen/swiotlb-xen.h linux-libre-4.1.47-gnu/include/xen/swiotlb-xen.h
--- linux-libre-4.1.46-gnu/include/xen/swiotlb-xen.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/include/xen/swiotlb-xen.h	2017-12-06 21:20:16.000000000 -0500
@@ -58,4 +58,9 @@ xen_swiotlb_dma_supported(struct device
 
 extern int
 xen_swiotlb_set_dma_mask(struct device *dev, u64 dma_mask);
+
+extern int
+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+		     void *cpu_addr, dma_addr_t dma_addr, size_t size,
+		     unsigned long attrs);
 #endif /* __LINUX_SWIOTLB_XEN_H */
diff -druNp --no-dereference linux-libre-4.1.46-gnu/lib/asn1_decoder.c linux-libre-4.1.47-gnu/lib/asn1_decoder.c
--- linux-libre-4.1.46-gnu/lib/asn1_decoder.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/lib/asn1_decoder.c	2017-12-06 21:20:16.000000000 -0500
@@ -219,7 +219,7 @@ next_op:
 		hdr = 2;
 
 		/* Extract a tag from the data */
-		if (unlikely(dp >= datalen - 1))
+		if (unlikely(datalen - dp < 2))
 			goto data_overrun_error;
 		tag = data[dp++];
 		if (unlikely((tag & 0x1f) == ASN1_LONG_TAG))
@@ -265,7 +265,7 @@ next_op:
 				int n = len - 0x80;
 				if (unlikely(n > 2))
 					goto length_too_long;
-				if (unlikely(dp >= datalen - n))
+				if (unlikely(n > datalen - dp))
 					goto data_overrun_error;
 				hdr += n;
 				for (len = 0; n > 0; n--) {
@@ -275,6 +275,9 @@ next_op:
 				if (unlikely(len > datalen - dp))
 					goto data_overrun_error;
 			}
+		} else {
+			if (unlikely(len > datalen - dp))
+				goto data_overrun_error;
 		}
 
 		if (flags & FLAG_CONS) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/lib/test_firmware.c linux-libre-4.1.47-gnu/lib/test_firmware.c
--- linux-libre-4.1.46-gnu/lib/test_firmware.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/lib/test_firmware.c	2017-12-06 21:20:16.000000000 -0500
@@ -65,14 +65,19 @@ static ssize_t trigger_request_store(str
 	release_firmware(test_firmware);
 	test_firmware = NULL;
 	rc = request_firmware(&test_firmware, name, dev);
-	if (rc)
+	if (rc) {
 		pr_info("load of '%s' failed: %d\n", name, rc);
-	pr_info("loaded: %zu\n", test_firmware ? test_firmware->size : 0);
+		goto out;
+	}
+	pr_info("loaded: %zu\n", test_firmware->size);
+	rc = count;
+
+out:
 	mutex_unlock(&test_fw_mutex);
 
 	kfree(name);
 
-	return count;
+	return rc;
 }
 static DEVICE_ATTR_WO(trigger_request);
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/Makefile linux-libre-4.1.47-gnu/Makefile
--- linux-libre-4.1.46-gnu/Makefile	2017-11-09 10:34:18.000000000 -0500
+++ linux-libre-4.1.47-gnu/Makefile	2017-12-07 13:15:45.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 1
-SUBLEVEL = 46
+SUBLEVEL = 47
 EXTRAVERSION = -gnu
 NAME = Series 4800
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/mm/page_ext.c linux-libre-4.1.47-gnu/mm/page_ext.c
--- linux-libre-4.1.46-gnu/mm/page_ext.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/mm/page_ext.c	2017-12-06 21:20:16.000000000 -0500
@@ -102,7 +102,6 @@ struct page_ext *lookup_page_ext(struct
 	struct page_ext *base;
 
 	base = NODE_DATA(page_to_nid(page))->node_page_ext;
-#ifdef CONFIG_DEBUG_VM
 	/*
 	 * The sanity checks the page allocator does upon freeing a
 	 * page can reach here before the page_ext arrays are
@@ -111,7 +110,6 @@ struct page_ext *lookup_page_ext(struct
 	 */
 	if (unlikely(!base))
 		return NULL;
-#endif
 	offset = pfn - round_down(node_start_pfn(page_to_nid(page)),
 					MAX_ORDER_NR_PAGES);
 	return base + offset;
@@ -176,7 +174,6 @@ struct page_ext *lookup_page_ext(struct
 {
 	unsigned long pfn = page_to_pfn(page);
 	struct mem_section *section = __pfn_to_section(pfn);
-#ifdef CONFIG_DEBUG_VM
 	/*
 	 * The sanity checks the page allocator does upon freeing a
 	 * page can reach here before the page_ext arrays are
@@ -185,7 +182,6 @@ struct page_ext *lookup_page_ext(struct
 	 */
 	if (!section->page_ext)
 		return NULL;
-#endif
 	return section->page_ext + pfn;
 }
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/mm/pagewalk.c linux-libre-4.1.47-gnu/mm/pagewalk.c
--- linux-libre-4.1.46-gnu/mm/pagewalk.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/mm/pagewalk.c	2017-12-06 21:20:16.000000000 -0500
@@ -142,8 +142,12 @@ static int walk_hugetlb_range(unsigned l
 	do {
 		next = hugetlb_entry_end(h, addr, end);
 		pte = huge_pte_offset(walk->mm, addr & hmask);
-		if (pte && walk->hugetlb_entry)
+
+		if (pte)
 			err = walk->hugetlb_entry(pte, hmask, addr, next, walk);
+		else if (walk->pte_hole)
+			err = walk->pte_hole(addr, next, walk);
+
 		if (err)
 			break;
 	} while (addr = next, addr != end);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/8021q/vlan.c linux-libre-4.1.47-gnu/net/8021q/vlan.c
--- linux-libre-4.1.46-gnu/net/8021q/vlan.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/8021q/vlan.c	2017-12-06 21:20:16.000000000 -0500
@@ -376,6 +376,9 @@ static int vlan_device_event(struct noti
 			dev->name);
 		vlan_vid_add(dev, htons(ETH_P_8021Q), 0);
 	}
+	if (event == NETDEV_DOWN &&
+	    (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
+		vlan_vid_del(dev, htons(ETH_P_8021Q), 0);
 
 	vlan_info = rtnl_dereference(dev->vlan_info);
 	if (!vlan_info)
@@ -423,9 +426,6 @@ static int vlan_device_event(struct noti
 		struct net_device *tmp;
 		LIST_HEAD(close_list);
 
-		if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
-			vlan_vid_del(dev, htons(ETH_P_8021Q), 0);
-
 		/* Put all VLANs for this dev in the down state too.  */
 		vlan_group_for_each_dev(grp, i, vlandev) {
 			flgs = vlandev->flags;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/core/dev.c linux-libre-4.1.47-gnu/net/core/dev.c
--- linux-libre-4.1.46-gnu/net/core/dev.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/core/dev.c	2017-12-06 21:20:16.000000000 -0500
@@ -1079,9 +1079,8 @@ static int dev_alloc_name_ns(struct net
 	return ret;
 }
 
-static int dev_get_valid_name(struct net *net,
-			      struct net_device *dev,
-			      const char *name)
+int dev_get_valid_name(struct net *net, struct net_device *dev,
+		       const char *name)
 {
 	BUG_ON(!net);
 
@@ -1097,6 +1096,7 @@ static int dev_get_valid_name(struct net
 
 	return 0;
 }
+EXPORT_SYMBOL(dev_get_valid_name);
 
 /**
  *	dev_change_name - change name of a device
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/core/skbuff.c linux-libre-4.1.47-gnu/net/core/skbuff.c
--- linux-libre-4.1.46-gnu/net/core/skbuff.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/core/skbuff.c	2017-12-06 21:20:16.000000000 -0500
@@ -4159,6 +4159,7 @@ void skb_scrub_packet(struct sk_buff *sk
 	if (!xnet)
 		return;
 
+	ipvs_reset(skb);
 	skb_orphan(skb);
 	skb->mark = 0;
 }
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/dsa/Kconfig linux-libre-4.1.47-gnu/net/dsa/Kconfig
--- linux-libre-4.1.46-gnu/net/dsa/Kconfig	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/dsa/Kconfig	2017-12-06 21:20:16.000000000 -0500
@@ -1,12 +1,13 @@
 config HAVE_NET_DSA
 	def_bool y
-	depends on NETDEVICES && !S390
+	depends on INET && NETDEVICES && !S390
 
 # Drivers must select NET_DSA and the appropriate tagging format
 
 config NET_DSA
 	tristate "Distributed Switch Architecture"
-	depends on HAVE_NET_DSA && NET_SWITCHDEV
+	depends on HAVE_NET_DSA
+	select NET_SWITCHDEV
 	select PHYLIB
 	---help---
 	  Say Y if you want to enable support for the hardware switches supported
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/ipv4/ah4.c linux-libre-4.1.47-gnu/net/ipv4/ah4.c
--- linux-libre-4.1.46-gnu/net/ipv4/ah4.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/ipv4/ah4.c	2017-12-06 21:20:16.000000000 -0500
@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_
 	int ihl = ip_hdrlen(skb);
 	int ah_hlen = (ah->hdrlen + 2) << 2;
 
+	if (err)
+		goto out;
+
 	work_iph = AH_SKB_CB(skb)->tmp;
 	auth_data = ah_tmp_auth(work_iph, ihl);
 	icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/ipv4/ipip.c linux-libre-4.1.47-gnu/net/ipv4/ipip.c
--- linux-libre-4.1.46-gnu/net/ipv4/ipip.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/ipv4/ipip.c	2017-12-06 21:20:16.000000000 -0500
@@ -129,42 +129,68 @@ static struct rtnl_link_ops ipip_link_op
 static int ipip_err(struct sk_buff *skb, u32 info)
 {
 
-/* All the routers (except for Linux) return only
-   8 bytes of packet payload. It means, that precise relaying of
-   ICMP in the real Internet is absolutely infeasible.
- */
+	/* All the routers (except for Linux) return only
+	   8 bytes of packet payload. It means, that precise relaying of
+	   ICMP in the real Internet is absolutely infeasible.
+	 */
 	struct net *net = dev_net(skb->dev);
 	struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
 	const struct iphdr *iph = (const struct iphdr *)skb->data;
-	struct ip_tunnel *t;
-	int err;
 	const int type = icmp_hdr(skb)->type;
 	const int code = icmp_hdr(skb)->code;
+	struct ip_tunnel *t;
+	int err = 0;
+
+	switch (type) {
+	case ICMP_DEST_UNREACH:
+		switch (code) {
+		case ICMP_SR_FAILED:
+			/* Impossible event. */
+			goto out;
+		default:
+			/* All others are translated to HOST_UNREACH.
+			 * rfc2003 contains "deep thoughts" about NET_UNREACH,
+			 * I believe they are just ether pollution. --ANK
+			 */
+			break;
+		}
+		break;
+
+	case ICMP_TIME_EXCEEDED:
+		if (code != ICMP_EXC_TTL)
+			goto out;
+		break;
+
+	case ICMP_REDIRECT:
+		break;
+
+	default:
+		goto out;
+	}
 
-	err = -ENOENT;
 	t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
 			     iph->daddr, iph->saddr, 0);
-	if (!t)
+	if (!t) {
+		err = -ENOENT;
 		goto out;
+	}
 
 	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
-		ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-				 t->parms.link, 0, IPPROTO_IPIP, 0);
-		err = 0;
+		ipv4_update_pmtu(skb, net, info, t->parms.link, 0,
+				 iph->protocol, 0);
 		goto out;
 	}
 
 	if (type == ICMP_REDIRECT) {
-		ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
-			      IPPROTO_IPIP, 0);
-		err = 0;
+		ipv4_redirect(skb, net, t->parms.link, 0, iph->protocol, 0);
 		goto out;
 	}
 
-	if (t->parms.iph.daddr == 0)
+	if (t->parms.iph.daddr == 0) {
+		err = -ENOENT;
 		goto out;
+	}
 
-	err = 0;
 	if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
 		goto out;
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/ipv4/tcp_output.c linux-libre-4.1.47-gnu/net/ipv4/tcp_output.c
--- linux-libre-4.1.46-gnu/net/ipv4/tcp_output.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/ipv4/tcp_output.c	2017-12-06 21:20:16.000000000 -0500
@@ -1962,6 +1962,7 @@ static int tcp_mtu_probe(struct sock *sk
 	nskb->ip_summed = skb->ip_summed;
 
 	tcp_insert_write_queue_before(nskb, skb, sk);
+	tcp_highest_sack_replace(sk, skb, nskb);
 
 	len = 0;
 	tcp_for_write_queue_from_safe(skb, next, sk) {
@@ -2465,7 +2466,7 @@ static void tcp_collapse_retrans(struct
 
 	BUG_ON(tcp_skb_pcount(skb) != 1 || tcp_skb_pcount(next_skb) != 1);
 
-	tcp_highest_sack_combine(sk, next_skb, skb);
+	tcp_highest_sack_replace(sk, next_skb, skb);
 
 	tcp_unlink_write_queue(next_skb, sk);
 
@@ -3004,13 +3005,8 @@ struct sk_buff *tcp_make_synack(struct s
 	tcp_ecn_make_synack(req, th, sk);
 	th->source = htons(ireq->ir_num);
 	th->dest = ireq->ir_rmt_port;
-	/* Setting of flags are superfluous here for callers (and ECE is
-	 * not even correctly set)
-	 */
-	tcp_init_nondata_skb(skb, tcp_rsk(req)->snt_isn,
-			     TCPHDR_SYN | TCPHDR_ACK);
-
-	th->seq = htonl(TCP_SKB_CB(skb)->seq);
+	skb->ip_summed = CHECKSUM_PARTIAL;
+	th->seq = htonl(tcp_rsk(req)->snt_isn);
 	/* XXX data is queued and acked as is. No buffer/window check */
 	th->ack_seq = htonl(tcp_rsk(req)->rcv_nxt);
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/ipv6/ip6_flowlabel.c linux-libre-4.1.47-gnu/net/ipv6/ip6_flowlabel.c
--- linux-libre-4.1.46-gnu/net/ipv6/ip6_flowlabel.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/ipv6/ip6_flowlabel.c	2017-12-06 21:20:16.000000000 -0500
@@ -315,6 +315,7 @@ struct ipv6_txoptions *fl6_merge_options
 	}
 	opt_space->dst1opt = fopt->dst1opt;
 	opt_space->opt_flen = fopt->opt_flen;
+	opt_space->tot_len = fopt->tot_len;
 	return opt_space;
 }
 EXPORT_SYMBOL_GPL(fl6_merge_options);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/ipv6/ip6_output.c linux-libre-4.1.47-gnu/net/ipv6/ip6_output.c
--- linux-libre-4.1.46-gnu/net/ipv6/ip6_output.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/ipv6/ip6_output.c	2017-12-06 21:20:16.000000000 -0500
@@ -1180,11 +1180,11 @@ static int ip6_setup_cork(struct sock *s
 		if (WARN_ON(v6_cork->opt))
 			return -EINVAL;
 
-		v6_cork->opt = kzalloc(opt->tot_len, sk->sk_allocation);
+		v6_cork->opt = kzalloc(sizeof(*opt), sk->sk_allocation);
 		if (unlikely(!v6_cork->opt))
 			return -ENOBUFS;
 
-		v6_cork->opt->tot_len = opt->tot_len;
+		v6_cork->opt->tot_len = sizeof(*opt);
 		v6_cork->opt->opt_flen = opt->opt_flen;
 		v6_cork->opt->opt_nflen = opt->opt_nflen;
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/l2tp/l2tp_ppp.c linux-libre-4.1.47-gnu/net/l2tp/l2tp_ppp.c
--- linux-libre-4.1.46-gnu/net/l2tp/l2tp_ppp.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/l2tp/l2tp_ppp.c	2017-12-06 21:20:16.000000000 -0500
@@ -1015,6 +1015,9 @@ static int pppol2tp_session_ioctl(struct
 		 session->name, cmd, arg);
 
 	sk = ps->sock;
+	if (!sk)
+		return -EBADR;
+
 	sock_hold(sk);
 
 	switch (cmd) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/mac80211/key.c linux-libre-4.1.47-gnu/net/mac80211/key.c
--- linux-libre-4.1.46-gnu/net/mac80211/key.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/mac80211/key.c	2017-12-06 21:20:16.000000000 -0500
@@ -4,6 +4,7 @@
  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
  * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
+ * Copyright 2017	Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -18,6 +19,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 #include <net/mac80211.h>
+#include <crypto/algapi.h>
 #include <asm/unaligned.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -603,6 +605,39 @@ void ieee80211_key_free_unused(struct ie
 	ieee80211_key_free_common(key);
 }
 
+static bool ieee80211_key_identical(struct ieee80211_sub_if_data *sdata,
+				    struct ieee80211_key *old,
+				    struct ieee80211_key *new)
+{
+	u8 tkip_old[WLAN_KEY_LEN_TKIP], tkip_new[WLAN_KEY_LEN_TKIP];
+	u8 *tk_old, *tk_new;
+
+	if (!old || new->conf.keylen != old->conf.keylen)
+		return false;
+
+	tk_old = old->conf.key;
+	tk_new = new->conf.key;
+
+	/*
+	 * In station mode, don't compare the TX MIC key, as it's never used
+	 * and offloaded rekeying may not care to send it to the host. This
+	 * is the case in iwlwifi, for example.
+	 */
+	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+	    new->conf.cipher == WLAN_CIPHER_SUITE_TKIP &&
+	    new->conf.keylen == WLAN_KEY_LEN_TKIP &&
+	    !(new->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+		memcpy(tkip_old, tk_old, WLAN_KEY_LEN_TKIP);
+		memcpy(tkip_new, tk_new, WLAN_KEY_LEN_TKIP);
+		memset(tkip_old + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, 0, 8);
+		memset(tkip_new + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, 0, 8);
+		tk_old = tkip_old;
+		tk_new = tkip_new;
+	}
+
+	return !crypto_memneq(tk_old, tk_new, new->conf.keylen);
+}
+
 int ieee80211_key_link(struct ieee80211_key *key,
 		       struct ieee80211_sub_if_data *sdata,
 		       struct sta_info *sta)
@@ -614,9 +649,6 @@ int ieee80211_key_link(struct ieee80211_
 
 	pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
 	idx = key->conf.keyidx;
-	key->local = sdata->local;
-	key->sdata = sdata;
-	key->sta = sta;
 
 	mutex_lock(&sdata->local->key_mtx);
 
@@ -627,6 +659,20 @@ int ieee80211_key_link(struct ieee80211_
 	else
 		old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
+	/*
+	 * Silently accept key re-installation without really installing the
+	 * new version of the key to avoid nonce reuse or replay issues.
+	 */
+	if (ieee80211_key_identical(sdata, old_key, key)) {
+		ieee80211_key_free_unused(key);
+		ret = 0;
+		goto out;
+	}
+
+	key->local = sdata->local;
+	key->sdata = sdata;
+	key->sta = sta;
+
 	increment_tailroom_need_count(sdata);
 
 	ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
@@ -642,6 +688,7 @@ int ieee80211_key_link(struct ieee80211_
 		ret = 0;
 	}
 
+ out:
 	mutex_unlock(&sdata->local->key_mtx);
 
 	return ret;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/netlink/af_netlink.c linux-libre-4.1.47-gnu/net/netlink/af_netlink.c
--- linux-libre-4.1.46-gnu/net/netlink/af_netlink.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/netlink/af_netlink.c	2017-12-06 21:20:16.000000000 -0500
@@ -2684,7 +2684,7 @@ static int netlink_dump(struct sock *sk)
 	struct sk_buff *skb = NULL;
 	struct nlmsghdr *nlh;
 	struct module *module;
-	int len, err = -ENOBUFS;
+	int err = -ENOBUFS;
 	int alloc_min_size;
 	int alloc_size;
 
@@ -2734,9 +2734,11 @@ static int netlink_dump(struct sock *sk)
 	skb_reserve(skb, skb_tailroom(skb) - alloc_size);
 	netlink_skb_set_owner_r(skb, sk);
 
-	len = cb->dump(skb, cb);
+	if (nlk->dump_done_errno > 0)
+		nlk->dump_done_errno = cb->dump(skb, cb);
 
-	if (len > 0) {
+	if (nlk->dump_done_errno > 0 ||
+	    skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
 		mutex_unlock(nlk->cb_mutex);
 
 		if (sk_filter(sk, skb))
@@ -2746,13 +2748,15 @@ static int netlink_dump(struct sock *sk)
 		return 0;
 	}
 
-	nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
-	if (!nlh)
+	nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE,
+			       sizeof(nlk->dump_done_errno), NLM_F_MULTI);
+	if (WARN_ON(!nlh))
 		goto errout_skb;
 
 	nl_dump_check_consistent(cb, nlh);
 
-	memcpy(nlmsg_data(nlh), &len, sizeof(len));
+	memcpy(nlmsg_data(nlh), &nlk->dump_done_errno,
+	       sizeof(nlk->dump_done_errno));
 
 	if (sk_filter(sk, skb))
 		kfree_skb(skb);
@@ -2826,6 +2830,7 @@ int __netlink_dump_start(struct sock *ss
 	cb->skb = skb;
 
 	nlk->cb_running = true;
+	nlk->dump_done_errno = INT_MAX;
 
 	mutex_unlock(nlk->cb_mutex);
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/netlink/af_netlink.h linux-libre-4.1.47-gnu/net/netlink/af_netlink.h
--- linux-libre-4.1.46-gnu/net/netlink/af_netlink.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/netlink/af_netlink.h	2017-12-06 21:20:16.000000000 -0500
@@ -37,6 +37,7 @@ struct netlink_sock {
 	wait_queue_head_t	wait;
 	bool			bound;
 	bool			cb_running;
+	int			dump_done_errno;
 	struct netlink_callback	cb;
 	struct mutex		*cb_mutex;
 	struct mutex		cb_def_mutex;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/sctp/input.c linux-libre-4.1.47-gnu/net/sctp/input.c
--- linux-libre-4.1.46-gnu/net/sctp/input.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/sctp/input.c	2017-12-06 21:20:16.000000000 -0500
@@ -420,7 +420,7 @@ void sctp_icmp_redirect(struct sock *sk,
 {
 	struct dst_entry *dst;
 
-	if (!t)
+	if (sock_owned_by_user(sk) || !t)
 		return;
 	dst = sctp_transport_dst_check(t);
 	if (dst)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/sctp/ipv6.c linux-libre-4.1.47-gnu/net/sctp/ipv6.c
--- linux-libre-4.1.46-gnu/net/sctp/ipv6.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/sctp/ipv6.c	2017-12-06 21:20:16.000000000 -0500
@@ -787,6 +787,8 @@ static void sctp_inet6_skb_msgname(struc
 		if (ipv6_addr_type(&addr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) {
 			struct sctp_ulpevent *ev = sctp_skb2event(skb);
 			addr->v6.sin6_scope_id = ev->iif;
+		} else {
+			addr->v6.sin6_scope_id = 0;
 		}
 	}
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/sctp/socket.c linux-libre-4.1.47-gnu/net/sctp/socket.c
--- linux-libre-4.1.46-gnu/net/sctp/socket.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/sctp/socket.c	2017-12-06 21:20:16.000000000 -0500
@@ -168,6 +168,36 @@ static inline void sctp_set_owner_w(stru
 	sk_mem_charge(sk, chunk->skb->truesize);
 }
 
+static void sctp_clear_owner_w(struct sctp_chunk *chunk)
+{
+	skb_orphan(chunk->skb);
+}
+
+static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
+				       void (*cb)(struct sctp_chunk *))
+
+{
+	struct sctp_outq *q = &asoc->outqueue;
+	struct sctp_transport *t;
+	struct sctp_chunk *chunk;
+
+	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
+		list_for_each_entry(chunk, &t->transmitted, transmitted_list)
+			cb(chunk);
+
+	list_for_each_entry(chunk, &q->retransmit, list)
+		cb(chunk);
+
+	list_for_each_entry(chunk, &q->sacked, list)
+		cb(chunk);
+
+	list_for_each_entry(chunk, &q->abandoned, list)
+		cb(chunk);
+
+	list_for_each_entry(chunk, &q->out_chunk_list, list)
+		cb(chunk);
+}
+
 /* Verify that this is a valid address. */
 static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
 				   int len)
@@ -4433,6 +4463,10 @@ int sctp_do_peeloff(struct sock *sk, sct
 	struct socket *sock;
 	int err = 0;
 
+	/* Do not peel off from one netns to another one. */
+	if (!net_eq(current->nsproxy->net_ns, sock_net(sk)))
+		return -EINVAL;
+
 	if (!asoc)
 		return -EINVAL;
 
@@ -7358,7 +7392,9 @@ static void sctp_sock_migrate(struct soc
 	 * paths won't try to lock it and then oldsk.
 	 */
 	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
+	sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
 	sctp_assoc_migrate(assoc, newsk);
+	sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
 
 	/* If the association on the newsk is already closed before accept()
 	 * is called, set RCV_SHUTDOWN flag.
diff -druNp --no-dereference linux-libre-4.1.46-gnu/net/unix/diag.c linux-libre-4.1.47-gnu/net/unix/diag.c
--- linux-libre-4.1.46-gnu/net/unix/diag.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/net/unix/diag.c	2017-12-06 21:20:16.000000000 -0500
@@ -257,6 +257,8 @@ static int unix_diag_get_exact(struct sk
 	err = -ENOENT;
 	if (sk == NULL)
 		goto out_nosk;
+	if (!net_eq(sock_net(sk), net))
+		goto out;
 
 	err = sock_diag_check_cookie(sk, req->udiag_cookie);
 	if (err)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/samples/trace_events/trace-events-sample.c linux-libre-4.1.47-gnu/samples/trace_events/trace-events-sample.c
--- linux-libre-4.1.46-gnu/samples/trace_events/trace-events-sample.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/samples/trace_events/trace-events-sample.c	2017-12-06 21:20:16.000000000 -0500
@@ -78,28 +78,36 @@ static int simple_thread_fn(void *arg)
 }
 
 static DEFINE_MUTEX(thread_mutex);
+static int simple_thread_cnt;
 
 void foo_bar_reg(void)
 {
+	mutex_lock(&thread_mutex);
+	if (simple_thread_cnt++)
+		goto out;
+
 	pr_info("Starting thread for foo_bar_fn\n");
 	/*
 	 * We shouldn't be able to start a trace when the module is
 	 * unloading (there's other locks to prevent that). But
 	 * for consistency sake, we still take the thread_mutex.
 	 */
-	mutex_lock(&thread_mutex);
 	simple_tsk_fn = kthread_run(simple_thread_fn, NULL, "event-sample-fn");
+ out:
 	mutex_unlock(&thread_mutex);
 }
 
 void foo_bar_unreg(void)
 {
-	pr_info("Killing thread for foo_bar_fn\n");
-	/* protect against module unloading */
 	mutex_lock(&thread_mutex);
+	if (--simple_thread_cnt)
+		goto out;
+
+	pr_info("Killing thread for foo_bar_fn\n");
 	if (simple_tsk_fn)
 		kthread_stop(simple_tsk_fn);
 	simple_tsk_fn = NULL;
+ out:
 	mutex_unlock(&thread_mutex);
 }
 
diff -druNp --no-dereference linux-libre-4.1.46-gnu/security/integrity/ima/ima_appraise.c linux-libre-4.1.47-gnu/security/integrity/ima/ima_appraise.c
--- linux-libre-4.1.46-gnu/security/integrity/ima/ima_appraise.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/security/integrity/ima/ima_appraise.c	2017-12-06 21:20:16.000000000 -0500
@@ -297,6 +297,9 @@ void ima_update_xattr(struct integrity_i
 	if (iint->flags & IMA_DIGSIG)
 		return;
 
+	if (iint->ima_file_status != INTEGRITY_PASS)
+		return;
+
 	rc = ima_collect_measurement(iint, file, NULL, NULL);
 	if (rc < 0)
 		return;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/security/keys/encrypted-keys/encrypted.c linux-libre-4.1.47-gnu/security/keys/encrypted-keys/encrypted.c
--- linux-libre-4.1.46-gnu/security/keys/encrypted-keys/encrypted.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/security/keys/encrypted-keys/encrypted.c	2017-12-06 21:20:16.000000000 -0500
@@ -315,6 +315,13 @@ static struct key *request_user_key(cons
 
 	down_read(&ukey->sem);
 	upayload = ukey->payload.data;
+	if (!upayload) {
+		/* key was revoked before we acquired its semaphore */
+		up_read(&ukey->sem);
+		key_put(ukey);
+		ukey = ERR_PTR(-EKEYREVOKED);
+		goto error;
+	}
 	*master_key = upayload->data;
 	*master_keylen = upayload->datalen;
 error:
diff -druNp --no-dereference linux-libre-4.1.46-gnu/security/keys/Kconfig linux-libre-4.1.47-gnu/security/keys/Kconfig
--- linux-libre-4.1.46-gnu/security/keys/Kconfig	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/security/keys/Kconfig	2017-12-06 21:20:16.000000000 -0500
@@ -20,6 +20,10 @@ config KEYS
 
 	  If you are unsure as to whether this is required, answer N.
 
+config KEYS_COMPAT
+	def_bool y
+	depends on COMPAT && KEYS
+
 config PERSISTENT_KEYRINGS
 	bool "Enable register of persistent per-UID keyrings"
 	depends on KEYS
diff -druNp --no-dereference linux-libre-4.1.46-gnu/security/keys/keyring.c linux-libre-4.1.47-gnu/security/keys/keyring.c
--- linux-libre-4.1.46-gnu/security/keys/keyring.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/security/keys/keyring.c	2017-12-06 21:20:16.000000000 -0500
@@ -452,34 +452,33 @@ static long keyring_read(const struct ke
 			 char __user *buffer, size_t buflen)
 {
 	struct keyring_read_iterator_context ctx;
-	unsigned long nr_keys;
-	int ret;
+	long ret;
 
 	kenter("{%d},,%zu", key_serial(keyring), buflen);
 
 	if (buflen & (sizeof(key_serial_t) - 1))
 		return -EINVAL;
 
-	nr_keys = keyring->keys.nr_leaves_on_tree;
-	if (nr_keys == 0)
-		return 0;
-
-	/* Calculate how much data we could return */
-	if (!buffer || !buflen)
-		return nr_keys * sizeof(key_serial_t);
-
-	/* Copy the IDs of the subscribed keys into the buffer */
-	ctx.buffer = (key_serial_t __user *)buffer;
-	ctx.buflen = buflen;
-	ctx.count = 0;
-	ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx);
-	if (ret < 0) {
-		kleave(" = %d [iterate]", ret);
-		return ret;
+	/* Copy as many key IDs as fit into the buffer */
+	if (buffer && buflen) {
+		ctx.buffer = (key_serial_t __user *)buffer;
+		ctx.buflen = buflen;
+		ctx.count = 0;
+		ret = assoc_array_iterate(&keyring->keys,
+					  keyring_read_iterator, &ctx);
+		if (ret < 0) {
+			kleave(" = %ld [iterate]", ret);
+			return ret;
+		}
 	}
 
-	kleave(" = %zu [ok]", ctx.count);
-	return ctx.count;
+	/* Return the size of the buffer needed */
+	ret = keyring->keys.nr_leaves_on_tree * sizeof(key_serial_t);
+	if (ret <= buflen)
+		kleave("= %ld [ok]", ret);
+	else
+		kleave("= %ld [buffer too small]", ret);
+	return ret;
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/core/seq/oss/seq_oss_midi.c linux-libre-4.1.47-gnu/sound/core/seq/oss/seq_oss_midi.c
--- linux-libre-4.1.46-gnu/sound/core/seq/oss/seq_oss_midi.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/core/seq/oss/seq_oss_midi.c	2017-12-06 21:20:16.000000000 -0500
@@ -612,9 +612,7 @@ send_midi_event(struct seq_oss_devinfo *
 	if (!dp->timer->running)
 		len = snd_seq_oss_timer_start(dp->timer);
 	if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
-		if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) == SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
-			snd_seq_oss_readq_puts(dp->readq, mdev->seq_device,
-					       ev->data.ext.ptr, ev->data.ext.len);
+		snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev);
 	} else {
 		len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev);
 		if (len > 0)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/core/seq/oss/seq_oss_readq.c linux-libre-4.1.47-gnu/sound/core/seq/oss/seq_oss_readq.c
--- linux-libre-4.1.46-gnu/sound/core/seq/oss/seq_oss_readq.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/core/seq/oss/seq_oss_readq.c	2017-12-06 21:20:16.000000000 -0500
@@ -119,6 +119,35 @@ snd_seq_oss_readq_puts(struct seq_oss_re
 }
 
 /*
+ * put MIDI sysex bytes; the event buffer may be chained, thus it has
+ * to be expanded via snd_seq_dump_var_event().
+ */
+struct readq_sysex_ctx {
+	struct seq_oss_readq *readq;
+	int dev;
+};
+
+static int readq_dump_sysex(void *ptr, void *buf, int count)
+{
+	struct readq_sysex_ctx *ctx = ptr;
+
+	return snd_seq_oss_readq_puts(ctx->readq, ctx->dev, buf, count);
+}
+
+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
+			    struct snd_seq_event *ev)
+{
+	struct readq_sysex_ctx ctx = {
+		.readq = q,
+		.dev = dev
+	};
+
+	if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+		return 0;
+	return snd_seq_dump_var_event(ev, readq_dump_sysex, &ctx);
+}
+
+/*
  * copy an event to input queue:
  * return zero if enqueued
  */
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/core/seq/oss/seq_oss_readq.h linux-libre-4.1.47-gnu/sound/core/seq/oss/seq_oss_readq.h
--- linux-libre-4.1.46-gnu/sound/core/seq/oss/seq_oss_readq.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/core/seq/oss/seq_oss_readq.h	2017-12-06 21:20:16.000000000 -0500
@@ -44,6 +44,8 @@ void snd_seq_oss_readq_delete(struct seq
 void snd_seq_oss_readq_clear(struct seq_oss_readq *readq);
 unsigned int snd_seq_oss_readq_poll(struct seq_oss_readq *readq, struct file *file, poll_table *wait);
 int snd_seq_oss_readq_puts(struct seq_oss_readq *readq, int dev, unsigned char *data, int len);
+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
+			    struct snd_seq_event *ev);
 int snd_seq_oss_readq_put_event(struct seq_oss_readq *readq, union evrec *ev);
 int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *readq, unsigned long curt, int seq_mode);
 int snd_seq_oss_readq_pick(struct seq_oss_readq *q, union evrec *rec);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/core/seq/seq_clientmgr.c linux-libre-4.1.47-gnu/sound/core/seq/seq_clientmgr.c
--- linux-libre-4.1.46-gnu/sound/core/seq/seq_clientmgr.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/core/seq/seq_clientmgr.c	2017-12-06 21:20:16.000000000 -0500
@@ -676,7 +676,7 @@ static int deliver_to_subscribers(struct
 	if (atomic)
 		read_lock(&grp->list_lock);
 	else
-		down_read(&grp->list_mutex);
+		down_read_nested(&grp->list_mutex, hop);
 	list_for_each_entry(subs, &grp->list_head, src_list) {
 		/* both ports ready? */
 		if (atomic_read(&subs->ref_count) != 2)
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/core/seq/seq_device.c linux-libre-4.1.47-gnu/sound/core/seq/seq_device.c
--- linux-libre-4.1.46-gnu/sound/core/seq/seq_device.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/core/seq/seq_device.c	2017-12-06 21:20:16.000000000 -0500
@@ -148,8 +148,10 @@ void snd_seq_device_load_drivers(void)
 	flush_work(&autoload_work);
 }
 EXPORT_SYMBOL(snd_seq_device_load_drivers);
+#define cancel_autoload_drivers()	cancel_work_sync(&autoload_work)
 #else
 #define queue_autoload_drivers() /* NOP */
+#define cancel_autoload_drivers() /* NOP */
 #endif
 
 /*
@@ -159,6 +161,7 @@ static int snd_seq_device_dev_free(struc
 {
 	struct snd_seq_device *dev = device->device_data;
 
+	cancel_autoload_drivers();
 	put_device(&dev->dev);
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/core/timer_compat.c linux-libre-4.1.47-gnu/sound/core/timer_compat.c
--- linux-libre-4.1.46-gnu/sound/core/timer_compat.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/core/timer_compat.c	2017-12-06 21:20:16.000000000 -0500
@@ -106,7 +106,8 @@ enum {
 #endif /* CONFIG_X86_X32 */
 };
 
-static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)
+static long __snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,
+					  unsigned long arg)
 {
 	void __user *argp = compat_ptr(arg);
 
@@ -127,7 +128,7 @@ static long snd_timer_user_ioctl_compat(
 	case SNDRV_TIMER_IOCTL_PAUSE:
 	case SNDRV_TIMER_IOCTL_PAUSE_OLD:
 	case SNDRV_TIMER_IOCTL_NEXT_DEVICE:
-		return snd_timer_user_ioctl(file, cmd, (unsigned long)argp);
+		return __snd_timer_user_ioctl(file, cmd, (unsigned long)argp);
 	case SNDRV_TIMER_IOCTL_INFO32:
 		return snd_timer_user_info_compat(file, argp);
 	case SNDRV_TIMER_IOCTL_STATUS32:
@@ -139,3 +140,15 @@ static long snd_timer_user_ioctl_compat(
 	}
 	return -ENOIOCTLCMD;
 }
+
+static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,
+					unsigned long arg)
+{
+	struct snd_timer_user *tu = file->private_data;
+	long ret;
+
+	mutex_lock(&tu->ioctl_lock);
+	ret = __snd_timer_user_ioctl_compat(file, cmd, arg);
+	mutex_unlock(&tu->ioctl_lock);
+	return ret;
+}
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/drivers/vx/vx_pcm.c linux-libre-4.1.47-gnu/sound/drivers/vx/vx_pcm.c
--- linux-libre-4.1.46-gnu/sound/drivers/vx/vx_pcm.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/drivers/vx/vx_pcm.c	2017-12-06 21:20:16.000000000 -0500
@@ -1015,7 +1015,7 @@ static void vx_pcm_capture_update(struct
 	int size, space, count;
 	struct snd_pcm_runtime *runtime = subs->runtime;
 
-	if (! pipe->prepared || (chip->chip_status & VX_STAT_IS_STALE))
+	if (!pipe->running || (chip->chip_status & VX_STAT_IS_STALE))
 		return;
 
 	size = runtime->buffer_size - snd_pcm_capture_avail(runtime);
@@ -1048,8 +1048,10 @@ static void vx_pcm_capture_update(struct
 		/* ok, let's accelerate! */
 		int align = pipe->align * 3;
 		space = (count / align) * align;
-		vx_pseudo_dma_read(chip, runtime, pipe, space);
-		count -= space;
+		if (space > 0) {
+			vx_pseudo_dma_read(chip, runtime, pipe, space);
+			count -= space;
+		}
 	}
 	/* read the rest of bytes */
 	while (count > 0) {
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/pci/vx222/vx222_ops.c linux-libre-4.1.47-gnu/sound/pci/vx222/vx222_ops.c
--- linux-libre-4.1.46-gnu/sound/pci/vx222/vx222_ops.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/pci/vx222/vx222_ops.c	2017-12-06 21:20:16.000000000 -0500
@@ -269,12 +269,12 @@ static void vx2_dma_write(struct vx_core
 
 	/* Transfer using pseudo-dma.
 	 */
-	if (offset + count > pipe->buffer_bytes) {
+	if (offset + count >= pipe->buffer_bytes) {
 		int length = pipe->buffer_bytes - offset;
 		count -= length;
 		length >>= 2; /* in 32bit words */
 		/* Transfer using pseudo-dma. */
-		while (length-- > 0) {
+		for (; length > 0; length--) {
 			outl(cpu_to_le32(*addr), port);
 			addr++;
 		}
@@ -284,7 +284,7 @@ static void vx2_dma_write(struct vx_core
 	pipe->hw_ptr += count;
 	count >>= 2; /* in 32bit words */
 	/* Transfer using pseudo-dma. */
-	while (count-- > 0) {
+	for (; count > 0; count--) {
 		outl(cpu_to_le32(*addr), port);
 		addr++;
 	}
@@ -307,12 +307,12 @@ static void vx2_dma_read(struct vx_core
 	vx2_setup_pseudo_dma(chip, 0);
 	/* Transfer using pseudo-dma.
 	 */
-	if (offset + count > pipe->buffer_bytes) {
+	if (offset + count >= pipe->buffer_bytes) {
 		int length = pipe->buffer_bytes - offset;
 		count -= length;
 		length >>= 2; /* in 32bit words */
 		/* Transfer using pseudo-dma. */
-		while (length-- > 0)
+		for (; length > 0; length--)
 			*addr++ = le32_to_cpu(inl(port));
 		addr = (u32 *)runtime->dma_area;
 		pipe->hw_ptr = 0;
@@ -320,7 +320,7 @@ static void vx2_dma_read(struct vx_core
 	pipe->hw_ptr += count;
 	count >>= 2; /* in 32bit words */
 	/* Transfer using pseudo-dma. */
-	while (count-- > 0)
+	for (; count > 0; count--)
 		*addr++ = le32_to_cpu(inl(port));
 
 	vx2_release_pseudo_dma(chip);
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/pcmcia/vx/vxp_ops.c linux-libre-4.1.47-gnu/sound/pcmcia/vx/vxp_ops.c
--- linux-libre-4.1.46-gnu/sound/pcmcia/vx/vxp_ops.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/pcmcia/vx/vxp_ops.c	2017-12-06 21:20:16.000000000 -0500
@@ -369,12 +369,12 @@ static void vxp_dma_write(struct vx_core
 	unsigned short *addr = (unsigned short *)(runtime->dma_area + offset);
 
 	vx_setup_pseudo_dma(chip, 1);
-	if (offset + count > pipe->buffer_bytes) {
+	if (offset + count >= pipe->buffer_bytes) {
 		int length = pipe->buffer_bytes - offset;
 		count -= length;
 		length >>= 1; /* in 16bit words */
 		/* Transfer using pseudo-dma. */
-		while (length-- > 0) {
+		for (; length > 0; length--) {
 			outw(cpu_to_le16(*addr), port);
 			addr++;
 		}
@@ -384,7 +384,7 @@ static void vxp_dma_write(struct vx_core
 	pipe->hw_ptr += count;
 	count >>= 1; /* in 16bit words */
 	/* Transfer using pseudo-dma. */
-	while (count-- > 0) {
+	for (; count > 0; count--) {
 		outw(cpu_to_le16(*addr), port);
 		addr++;
 	}
@@ -411,12 +411,12 @@ static void vxp_dma_read(struct vx_core
 	if (snd_BUG_ON(count % 2))
 		return;
 	vx_setup_pseudo_dma(chip, 0);
-	if (offset + count > pipe->buffer_bytes) {
+	if (offset + count >= pipe->buffer_bytes) {
 		int length = pipe->buffer_bytes - offset;
 		count -= length;
 		length >>= 1; /* in 16bit words */
 		/* Transfer using pseudo-dma. */
-		while (length-- > 0)
+		for (; length > 0; length--)
 			*addr++ = le16_to_cpu(inw(port));
 		addr = (unsigned short *)runtime->dma_area;
 		pipe->hw_ptr = 0;
@@ -424,7 +424,7 @@ static void vxp_dma_read(struct vx_core
 	pipe->hw_ptr += count;
 	count >>= 1; /* in 16bit words */
 	/* Transfer using pseudo-dma. */
-	while (count-- > 1)
+	for (; count > 1; count--)
 		*addr++ = le16_to_cpu(inw(port));
 	/* Disable DMA */
 	pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK;
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/soc/codecs/adau17x1.c linux-libre-4.1.47-gnu/sound/soc/codecs/adau17x1.c
--- linux-libre-4.1.46-gnu/sound/soc/codecs/adau17x1.c	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/soc/codecs/adau17x1.c	2017-12-06 21:20:16.000000000 -0500
@@ -89,6 +89,27 @@ static int adau17x1_pll_event(struct snd
 	return 0;
 }
 
+static int adau17x1_adc_fixup(struct snd_soc_dapm_widget *w,
+	struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+	struct adau *adau = snd_soc_codec_get_drvdata(codec);
+
+	/*
+	 * If we are capturing, toggle the ADOSR bit in Converter Control 0 to
+	 * avoid losing SNR (workaround from ADI). This must be done after
+	 * the ADC(s) have been enabled. According to the data sheet, it is
+	 * normally illegal to set this bit when the sampling rate is 96 kHz,
+	 * but according to ADI it is acceptable for this workaround.
+	 */
+	regmap_update_bits(adau->regmap, ADAU17X1_CONVERTER0,
+		ADAU17X1_CONVERTER0_ADOSR, ADAU17X1_CONVERTER0_ADOSR);
+	regmap_update_bits(adau->regmap, ADAU17X1_CONVERTER0,
+		ADAU17X1_CONVERTER0_ADOSR, 0);
+
+	return 0;
+}
+
 static const char * const adau17x1_mono_stereo_text[] = {
 	"Stereo",
 	"Mono Left Channel (L+R)",
@@ -120,7 +141,8 @@ static const struct snd_soc_dapm_widget
 	SND_SOC_DAPM_MUX("Right DAC Mode Mux", SND_SOC_NOPM, 0, 0,
 		&adau17x1_dac_mode_mux),
 
-	SND_SOC_DAPM_ADC("Left Decimator", NULL, ADAU17X1_ADC_CONTROL, 0, 0),
+	SND_SOC_DAPM_ADC_E("Left Decimator", NULL, ADAU17X1_ADC_CONTROL, 0, 0,
+			   adau17x1_adc_fixup, SND_SOC_DAPM_POST_PMU),
 	SND_SOC_DAPM_ADC("Right Decimator", NULL, ADAU17X1_ADC_CONTROL, 1, 0),
 	SND_SOC_DAPM_DAC("Left DAC", NULL, ADAU17X1_DAC_CONTROL0, 0, 0),
 	SND_SOC_DAPM_DAC("Right DAC", NULL, ADAU17X1_DAC_CONTROL0, 1, 0),
diff -druNp --no-dereference linux-libre-4.1.46-gnu/sound/soc/codecs/adau17x1.h linux-libre-4.1.47-gnu/sound/soc/codecs/adau17x1.h
--- linux-libre-4.1.46-gnu/sound/soc/codecs/adau17x1.h	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/sound/soc/codecs/adau17x1.h	2017-12-06 21:20:16.000000000 -0500
@@ -123,5 +123,7 @@ bool adau17x1_has_dsp(struct adau *adau)
 
 #define ADAU17X1_CONVERTER0_CONVSR_MASK		0x7
 
+#define ADAU17X1_CONVERTER0_ADOSR		BIT(3)
+
 
 #endif
diff -druNp --no-dereference linux-libre-4.1.46-gnu/tools/testing/selftests/firmware/fw_filesystem.sh linux-libre-4.1.47-gnu/tools/testing/selftests/firmware/fw_filesystem.sh
--- linux-libre-4.1.46-gnu/tools/testing/selftests/firmware/fw_filesystem.sh	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/tools/testing/selftests/firmware/fw_filesystem.sh	2017-12-06 21:20:16.000000000 -0500
@@ -35,8 +35,16 @@ echo "ABCD0123" >"$FW"
 
 NAME=$(basename "$FW")
 
+if printf '\000' >"$DIR"/trigger_request 2> /dev/null; then
+	echo "$0: empty filename should not succeed" >&2
+	exit 1
+fi
+
 # Request a firmware that doesn't exist, it should fail.
-echo -n "nope-$NAME" >"$DIR"/trigger_request
+if echo -n "nope-$NAME" >"$DIR"/trigger_request 2> /dev/null; then
+	echo "$0: firmware shouldn't have loaded" >&2
+	exit 1
+fi
 if diff -q "$FW" /dev/test_firmware >/dev/null ; then
 	echo "$0: firmware was not expected to match" >&2
 	exit 1
diff -druNp --no-dereference linux-libre-4.1.46-gnu/tools/testing/selftests/firmware/fw_userhelper.sh linux-libre-4.1.47-gnu/tools/testing/selftests/firmware/fw_userhelper.sh
--- linux-libre-4.1.46-gnu/tools/testing/selftests/firmware/fw_userhelper.sh	2017-11-07 22:44:28.000000000 -0500
+++ linux-libre-4.1.47-gnu/tools/testing/selftests/firmware/fw_userhelper.sh	2017-12-06 21:20:16.000000000 -0500
@@ -54,9 +54,33 @@ trap "test_finish" EXIT
 echo "ABCD0123" >"$FW"
 NAME=$(basename "$FW")
 
+DEVPATH="$DIR"/"nope-$NAME"/loading
+
 # Test failure when doing nothing (timeout works).
-echo 1 >/sys/class/firmware/timeout
-echo -n "$NAME" >"$DIR"/trigger_request
+echo -n 2 >/sys/class/firmware/timeout
+echo -n "nope-$NAME" >"$DIR"/trigger_request 2>/dev/null &
+
+# Give the kernel some time to load the loading file, must be less
+# than the timeout above.
+sleep 1
+if [ ! -f $DEVPATH ]; then
+	echo "$0: fallback mechanism immediately cancelled"
+	echo ""
+	echo "The file never appeared: $DEVPATH"
+	echo ""
+	echo "This might be a distribution udev rule setup by your distribution"
+	echo "to immediately cancel all fallback requests, this must be"
+	echo "removed before running these tests. To confirm look for"
+	echo "a firmware rule like /lib/udev/rules.d/50-firmware.rules"
+	echo "and see if you have something like this:"
+	echo ""
+	echo "SUBSYSTEM==\"firmware\", ACTION==\"add\", ATTR{loading}=\"-1\""
+	echo ""
+	echo "If you do remove this file or comment out this line before"
+	echo "proceeding with these tests."
+	exit 1
+fi
+
 if diff -q "$FW" /dev/test_firmware >/dev/null ; then
 	echo "$0: firmware was not expected to match" >&2
 	exit 1
