diff -druNp --no-dereference linux-libre-4.9.36-gnu/arch/x86/lib/copy_user_64.S linux-libre-4.9.37-gnu/arch/x86/lib/copy_user_64.S
--- linux-libre-4.9.36-gnu/arch/x86/lib/copy_user_64.S	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/arch/x86/lib/copy_user_64.S	2017-07-12 09:42:41.000000000 -0400
@@ -84,7 +84,7 @@ ENTRY(copy_user_generic_unrolled)
 	movl %edx,%ecx
 	andl $63,%edx
 	shrl $6,%ecx
-	jz 17f
+	jz .L_copy_short_string
 1:	movq (%rsi),%r8
 2:	movq 1*8(%rsi),%r9
 3:	movq 2*8(%rsi),%r10
@@ -105,7 +105,8 @@ ENTRY(copy_user_generic_unrolled)
 	leaq 64(%rdi),%rdi
 	decl %ecx
 	jnz 1b
-17:	movl %edx,%ecx
+.L_copy_short_string:
+	movl %edx,%ecx
 	andl $7,%edx
 	shrl $3,%ecx
 	jz 20f
@@ -221,6 +222,8 @@ EXPORT_SYMBOL(copy_user_generic_string)
  */
 ENTRY(copy_user_enhanced_fast_string)
 	ASM_STAC
+	cmpl $64,%edx
+	jb .L_copy_short_string	/* less then 64 bytes, avoid the costly 'rep' */
 	movl %edx,%ecx
 1:	rep
 	movsb
diff -druNp --no-dereference linux-libre-4.9.36-gnu/arch/x86/tools/relocs.c linux-libre-4.9.37-gnu/arch/x86/tools/relocs.c
--- linux-libre-4.9.36-gnu/arch/x86/tools/relocs.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/arch/x86/tools/relocs.c	2017-07-12 09:42:41.000000000 -0400
@@ -992,11 +992,12 @@ static void emit_relocs(int as_text, int
 		die("Segment relocations found but --realmode not specified\n");
 
 	/* Order the relocations for more efficient processing */
-	sort_relocs(&relocs16);
 	sort_relocs(&relocs32);
 #if ELF_BITS == 64
 	sort_relocs(&relocs32neg);
 	sort_relocs(&relocs64);
+#else
+	sort_relocs(&relocs16);
 #endif
 
 	/* Print the relocations */
diff -druNp --no-dereference linux-libre-4.9.36-gnu/crypto/drbg.c linux-libre-4.9.37-gnu/crypto/drbg.c
--- linux-libre-4.9.36-gnu/crypto/drbg.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/crypto/drbg.c	2017-07-12 09:42:41.000000000 -0400
@@ -1691,6 +1691,7 @@ static int drbg_init_sym_kernel(struct d
 		return PTR_ERR(sk_tfm);
 	}
 	drbg->ctr_handle = sk_tfm;
+	init_completion(&drbg->ctr_completion);
 
 	req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
 	if (!req) {
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/base/platform.c linux-libre-4.9.37-gnu/drivers/base/platform.c
--- linux-libre-4.9.36-gnu/drivers/base/platform.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/base/platform.c	2017-07-12 09:42:41.000000000 -0400
@@ -856,7 +856,7 @@ static ssize_t driver_override_store(str
 				     const char *buf, size_t count)
 {
 	struct platform_device *pdev = to_platform_device(dev);
-	char *driver_override, *old = pdev->driver_override, *cp;
+	char *driver_override, *old, *cp;
 
 	if (count > PATH_MAX)
 		return -EINVAL;
@@ -869,12 +869,15 @@ static ssize_t driver_override_store(str
 	if (cp)
 		*cp = '\0';
 
+	device_lock(dev);
+	old = pdev->driver_override;
 	if (strlen(driver_override)) {
 		pdev->driver_override = driver_override;
 	} else {
 		kfree(driver_override);
 		pdev->driver_override = NULL;
 	}
+	device_unlock(dev);
 
 	kfree(old);
 
@@ -885,8 +888,12 @@ static ssize_t driver_override_show(stru
 				    struct device_attribute *attr, char *buf)
 {
 	struct platform_device *pdev = to_platform_device(dev);
+	ssize_t len;
 
-	return sprintf(buf, "%s\n", pdev->driver_override);
+	device_lock(dev);
+	len = sprintf(buf, "%s\n", pdev->driver_override);
+	device_unlock(dev);
+	return len;
 }
 static DEVICE_ATTR_RW(driver_override);
 
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/char/tpm/tpm-sysfs.c linux-libre-4.9.37-gnu/drivers/char/tpm/tpm-sysfs.c
--- linux-libre-4.9.36-gnu/drivers/char/tpm/tpm-sysfs.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/char/tpm/tpm-sysfs.c	2017-07-12 09:42:41.000000000 -0400
@@ -35,9 +35,10 @@ static ssize_t pubek_show(struct device
 	ssize_t err;
 	int i, rc;
 	char *str = buf;
-
 	struct tpm_chip *chip = to_tpm_chip(dev);
 
+	memset(&tpm_cmd, 0, sizeof(tpm_cmd));
+
 	tpm_cmd.header.in = tpm_readpubek_header;
 	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,
 			       "attempting to read the PUBEK");
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/gpu/drm/virtio/virtgpu_object.c linux-libre-4.9.37-gnu/drivers/gpu/drm/virtio/virtgpu_object.c
--- linux-libre-4.9.36-gnu/drivers/gpu/drm/virtio/virtgpu_object.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/gpu/drm/virtio/virtgpu_object.c	2017-07-12 09:42:41.000000000 -0400
@@ -81,8 +81,10 @@ int virtio_gpu_object_create(struct virt
 		return -ENOMEM;
 	size = roundup(size, PAGE_SIZE);
 	ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size);
-	if (ret != 0)
+	if (ret != 0) {
+		kfree(bo);
 		return ret;
+	}
 	bo->dumb = false;
 	virtio_gpu_init_ttm_placement(bo, pinned);
 
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/infiniband/core/uverbs_cmd.c linux-libre-4.9.37-gnu/drivers/infiniband/core/uverbs_cmd.c
--- linux-libre-4.9.36-gnu/drivers/infiniband/core/uverbs_cmd.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/infiniband/core/uverbs_cmd.c	2017-07-12 09:42:41.000000000 -0400
@@ -2342,6 +2342,10 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
+	if (cmd.port_num < rdma_start_port(ib_dev) ||
+	    cmd.port_num > rdma_end_port(ib_dev))
+		return -EINVAL;
+
 	INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
 		   out_len);
 
@@ -2882,6 +2886,10 @@ ssize_t ib_uverbs_create_ah(struct ib_uv
 	if (copy_from_user(&cmd, buf, sizeof cmd))
 		return -EFAULT;
 
+	if (cmd.attr.port_num < rdma_start_port(ib_dev) ||
+	    cmd.attr.port_num > rdma_end_port(ib_dev))
+		return -EINVAL;
+
 	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 	if (!uobj)
 		return -ENOMEM;
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/media/media-entity.c linux-libre-4.9.37-gnu/drivers/media/media-entity.c
--- linux-libre-4.9.36-gnu/drivers/media/media-entity.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/media/media-entity.c	2017-07-12 09:42:41.000000000 -0400
@@ -468,7 +468,7 @@ error:
 
 	while ((entity_err = media_entity_graph_walk_next(graph))) {
 		/* don't let the stream_count go negative */
-		if (entity->stream_count > 0) {
+		if (entity_err->stream_count > 0) {
 			entity_err->stream_count--;
 			if (entity_err->stream_count == 0)
 				entity_err->pipe = NULL;
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/net/wireless/ath/ath10k/pci.c linux-libre-4.9.37-gnu/drivers/net/wireless/ath/ath10k/pci.c
--- linux-libre-4.9.36-gnu/drivers/net/wireless/ath/ath10k/pci.c	2017-07-05 15:19:58.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/net/wireless/ath/ath10k/pci.c	2017-07-12 19:13:21.000000000 -0400
@@ -3133,7 +3133,7 @@ int ath10k_pci_setup_resource(struct ath
 	setup_timer(&ar_pci->rx_post_retry, ath10k_pci_rx_replenish_retry,
 		    (unsigned long)ar);
 
-	if (QCA_REV_6174(ar))
+	if (QCA_REV_6174(ar) || QCA_REV_9377(ar))
 		ath10k_pci_override_ce_config(ar);
 
 	ret = ath10k_pci_alloc_pipes(ar);
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/net/wireless/mac80211_hwsim.c linux-libre-4.9.37-gnu/drivers/net/wireless/mac80211_hwsim.c
--- linux-libre-4.9.36-gnu/drivers/net/wireless/mac80211_hwsim.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/net/wireless/mac80211_hwsim.c	2017-07-12 09:42:41.000000000 -0400
@@ -2662,7 +2662,7 @@ static int mac80211_hwsim_new_radio(stru
 
 	tasklet_hrtimer_init(&data->beacon_timer,
 			     mac80211_hwsim_beacon,
-			     CLOCK_MONOTONIC_RAW, HRTIMER_MODE_ABS);
+			     CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
 
 	spin_lock_bh(&hwsim_radio_lock);
 	list_add_tail(&data->list, &hwsim_radios);
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/freescale/pinctrl-mxs.c linux-libre-4.9.37-gnu/drivers/pinctrl/freescale/pinctrl-mxs.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/freescale/pinctrl-mxs.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/freescale/pinctrl-mxs.c	2017-07-12 09:42:41.000000000 -0400
@@ -194,6 +194,16 @@ static int mxs_pinctrl_get_func_groups(s
 	return 0;
 }
 
+static void mxs_pinctrl_rmwl(u32 value, u32 mask, u8 shift, void __iomem *reg)
+{
+	u32 tmp;
+
+	tmp = readl(reg);
+	tmp &= ~(mask << shift);
+	tmp |= value << shift;
+	writel(tmp, reg);
+}
+
 static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
 			       unsigned group)
 {
@@ -211,8 +221,7 @@ static int mxs_pinctrl_set_mux(struct pi
 		reg += bank * 0x20 + pin / 16 * 0x10;
 		shift = pin % 16 * 2;
 
-		writel(0x3 << shift, reg + CLR);
-		writel(g->muxsel[i] << shift, reg + SET);
+		mxs_pinctrl_rmwl(g->muxsel[i], 0x3, shift, reg);
 	}
 
 	return 0;
@@ -279,8 +288,7 @@ static int mxs_pinconf_group_set(struct
 			/* mA */
 			if (config & MA_PRESENT) {
 				shift = pin % 8 * 4;
-				writel(0x3 << shift, reg + CLR);
-				writel(ma << shift, reg + SET);
+				mxs_pinctrl_rmwl(ma, 0x3, shift, reg);
 			}
 
 			/* vol */
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/intel/pinctrl-cherryview.c linux-libre-4.9.37-gnu/drivers/pinctrl/intel/pinctrl-cherryview.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/intel/pinctrl-cherryview.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/intel/pinctrl-cherryview.c	2017-07-12 09:42:41.000000000 -0400
@@ -13,6 +13,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/dmi.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -1524,10 +1525,32 @@ static void chv_gpio_irq_handler(struct
 	chained_irq_exit(chip, desc);
 }
 
+/*
+ * Certain machines seem to hardcode Linux IRQ numbers in their ACPI
+ * tables. Since we leave GPIOs that are not capable of generating
+ * interrupts out of the irqdomain the numbering will be different and
+ * cause devices using the hardcoded IRQ numbers fail. In order not to
+ * break such machines we will only mask pins from irqdomain if the machine
+ * is not listed below.
+ */
+static const struct dmi_system_id chv_no_valid_mask[] = {
+	{
+		/* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
+		.ident = "Acer Chromebook (CYAN)",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Edgar"),
+			DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
+		},
+	},
+	{}
+};
+
 static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
 {
 	const struct chv_gpio_pinrange *range;
 	struct gpio_chip *chip = &pctrl->chip;
+	bool need_valid_mask = !dmi_check_system(chv_no_valid_mask);
 	int ret, i, offset;
 
 	*chip = chv_gpio_chip;
@@ -1536,7 +1559,7 @@ static int chv_gpio_probe(struct chv_pin
 	chip->label = dev_name(pctrl->dev);
 	chip->parent = pctrl->dev;
 	chip->base = -1;
-	chip->irq_need_valid_mask = true;
+	chip->irq_need_valid_mask = need_valid_mask;
 
 	ret = devm_gpiochip_add_data(pctrl->dev, chip, pctrl);
 	if (ret) {
@@ -1567,7 +1590,7 @@ static int chv_gpio_probe(struct chv_pin
 		intsel &= CHV_PADCTRL0_INTSEL_MASK;
 		intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
 
-		if (intsel >= pctrl->community->nirqs)
+		if (need_valid_mask && intsel >= pctrl->community->nirqs)
 			clear_bit(i, chip->irq_valid_mask);
 	}
 
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/meson/pinctrl-meson8b.c linux-libre-4.9.37-gnu/drivers/pinctrl/meson/pinctrl-meson8b.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/meson/pinctrl-meson8b.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/meson/pinctrl-meson8b.c	2017-07-12 09:42:41.000000000 -0400
@@ -739,8 +739,8 @@ static const char * const sdxc_c_groups[
 static const char * const nand_groups[] = {
 	"nand_io", "nand_io_ce0", "nand_io_ce1",
 	"nand_io_rb0", "nand_ale", "nand_cle",
-	"nand_wen_clk", "nand_ren_clk", "nand_dqs0",
-	"nand_dqs1"
+	"nand_wen_clk", "nand_ren_clk", "nand_dqs_0",
+	"nand_dqs_1"
 };
 
 static const char * const nor_groups[] = {
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/qcom/pinctrl-ipq4019.c linux-libre-4.9.37-gnu/drivers/pinctrl/qcom/pinctrl-ipq4019.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/qcom/pinctrl-ipq4019.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/qcom/pinctrl-ipq4019.c	2017-07-12 09:42:41.000000000 -0400
@@ -405,6 +405,36 @@ static const struct msm_pingroup ipq4019
 	PINGROUP(67, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 	PINGROUP(68, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 	PINGROUP(69, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(70, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(71, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(72, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(73, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(74, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(75, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(76, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(77, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(78, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(79, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(80, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(81, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(82, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(83, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(84, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(85, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(86, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(87, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(88, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(89, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(90, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(91, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(92, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(93, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(94, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(95, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(96, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(97, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(98, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+	PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 };
 
 static const struct msm_pinctrl_soc_data ipq4019_pinctrl = {
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/sh-pfc/core.c linux-libre-4.9.37-gnu/drivers/pinctrl/sh-pfc/core.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/sh-pfc/core.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/sh-pfc/core.c	2017-07-12 09:42:41.000000000 -0400
@@ -586,6 +586,9 @@ static int sh_pfc_probe(struct platform_
 		ret = info->ops->init(pfc);
 		if (ret < 0)
 			return ret;
+
+		/* .init() may have overridden pfc->info */
+		info = pfc->info;
 	}
 
 	/* Enable dummy states for those platforms without pinctrl support */
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7791.c linux-libre-4.9.37-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7791.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7791.c	2017-07-12 09:42:41.000000000 -0400
@@ -203,7 +203,7 @@ enum {
 
 	/* IPSR6 */
 	FN_AUDIO_CLKB, FN_STP_OPWM_0_B, FN_MSIOF1_SCK_B,
-	FN_SCIF_CLK, FN_BPFCLK_E,
+	FN_SCIF_CLK, FN_DVC_MUTE, FN_BPFCLK_E,
 	FN_AUDIO_CLKC, FN_SCIFB0_SCK_C, FN_MSIOF1_SYNC_B, FN_RX2,
 	FN_SCIFA2_RXD, FN_FMIN_E,
 	FN_AUDIO_CLKOUT, FN_MSIOF1_SS1_B, FN_TX2, FN_SCIFA2_TXD,
@@ -573,7 +573,7 @@ enum {
 
 	/* IPSR6 */
 	AUDIO_CLKB_MARK, STP_OPWM_0_B_MARK, MSIOF1_SCK_B_MARK,
-	SCIF_CLK_MARK, BPFCLK_E_MARK,
+	SCIF_CLK_MARK, DVC_MUTE_MARK, BPFCLK_E_MARK,
 	AUDIO_CLKC_MARK, SCIFB0_SCK_C_MARK, MSIOF1_SYNC_B_MARK, RX2_MARK,
 	SCIFA2_RXD_MARK, FMIN_E_MARK,
 	AUDIO_CLKOUT_MARK, MSIOF1_SS1_B_MARK, TX2_MARK, SCIFA2_TXD_MARK,
@@ -1010,14 +1010,17 @@ static const u16 pinmux_data[] = {
 	PINMUX_IPSR_MSEL(IP4_12_10, SCL2, SEL_IIC2_0),
 	PINMUX_IPSR_MSEL(IP4_12_10, GPS_CLK_B, SEL_GPS_1),
 	PINMUX_IPSR_MSEL(IP4_12_10, GLO_Q0_D, SEL_GPS_3),
+	PINMUX_IPSR_MSEL(IP4_12_10, HSCK1_E, SEL_HSCIF1_4),
 	PINMUX_IPSR_GPSR(IP4_15_13, SSI_WS2),
 	PINMUX_IPSR_MSEL(IP4_15_13, SDA2, SEL_IIC2_0),
 	PINMUX_IPSR_MSEL(IP4_15_13, GPS_SIGN_B, SEL_GPS_1),
 	PINMUX_IPSR_MSEL(IP4_15_13, RX2_E, SEL_SCIF2_4),
 	PINMUX_IPSR_MSEL(IP4_15_13, GLO_Q1_D, SEL_GPS_3),
+	PINMUX_IPSR_MSEL(IP4_15_13, HCTS1_N_E, SEL_HSCIF1_4),
 	PINMUX_IPSR_GPSR(IP4_18_16, SSI_SDATA2),
 	PINMUX_IPSR_MSEL(IP4_18_16, GPS_MAG_B, SEL_GPS_1),
 	PINMUX_IPSR_MSEL(IP4_18_16, TX2_E, SEL_SCIF2_4),
+	PINMUX_IPSR_MSEL(IP4_18_16, HRTS1_N_E, SEL_HSCIF1_4),
 	PINMUX_IPSR_GPSR(IP4_19, SSI_SCK34),
 	PINMUX_IPSR_GPSR(IP4_20, SSI_WS34),
 	PINMUX_IPSR_GPSR(IP4_21, SSI_SDATA3),
@@ -1090,6 +1093,7 @@ static const u16 pinmux_data[] = {
 	PINMUX_IPSR_MSEL(IP6_2_0, STP_OPWM_0_B, SEL_SSP_1),
 	PINMUX_IPSR_MSEL(IP6_2_0, MSIOF1_SCK_B, SEL_SOF1_1),
 	PINMUX_IPSR_MSEL(IP6_2_0, SCIF_CLK, SEL_SCIF_0),
+	PINMUX_IPSR_GPSR(IP6_2_0, DVC_MUTE),
 	PINMUX_IPSR_MSEL(IP6_2_0, BPFCLK_E, SEL_FM_4),
 	PINMUX_IPSR_GPSR(IP6_5_3, AUDIO_CLKC),
 	PINMUX_IPSR_MSEL(IP6_5_3, SCIFB0_SCK_C, SEL_SCIFB_2),
@@ -1099,7 +1103,7 @@ static const u16 pinmux_data[] = {
 	PINMUX_IPSR_MSEL(IP6_5_3, FMIN_E, SEL_FM_4),
 	PINMUX_IPSR_GPSR(IP6_7_6, AUDIO_CLKOUT),
 	PINMUX_IPSR_MSEL(IP6_7_6, MSIOF1_SS1_B, SEL_SOF1_1),
-	PINMUX_IPSR_MSEL(IP6_5_3, TX2, SEL_SCIF2_0),
+	PINMUX_IPSR_MSEL(IP6_7_6, TX2, SEL_SCIF2_0),
 	PINMUX_IPSR_MSEL(IP6_7_6, SCIFA2_TXD, SEL_SCIFA2_0),
 	PINMUX_IPSR_GPSR(IP6_9_8, IRQ0),
 	PINMUX_IPSR_MSEL(IP6_9_8, SCIFB1_RXD_D, SEL_SCIFB1_3),
@@ -5810,7 +5814,7 @@ static const struct pinmux_cfg_reg pinmu
 		0, 0,
 		/* IP6_2_0 [3] */
 		FN_AUDIO_CLKB, FN_STP_OPWM_0_B, FN_MSIOF1_SCK_B,
-		FN_SCIF_CLK, 0, FN_BPFCLK_E,
+		FN_SCIF_CLK, FN_DVC_MUTE, FN_BPFCLK_E,
 		0, 0, }
 	},
 	{ PINMUX_CFG_REG_VAR("IPSR7", 0xE606003C, 32,
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7794.c linux-libre-4.9.37-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7794.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7794.c	2017-07-12 09:42:41.000000000 -0400
@@ -281,8 +281,8 @@ enum {
 	FN_AVB_AVTP_CAPTURE, FN_ETH_CRS_DV_B, FN_SSI_WS1, FN_SCIF1_TXD_B,
 	FN_IIC1_SDA_C, FN_VI1_DATA0, FN_CAN0_TX_D, FN_AVB_AVTP_MATCH,
 	FN_ETH_RX_ER_B, FN_SSI_SDATA1, FN_HSCIF1_HRX_B, FN_SDATA, FN_VI1_DATA1,
-	FN_ATAG0_N, FN_ETH_RXD0_B, FN_SSI_SCK2, FN_HSCIF1_HTX_B, FN_VI1_DATA2,
-	FN_MDATA, FN_ATAWR0_N, FN_ETH_RXD1_B,
+	FN_ATAWR0_N, FN_ETH_RXD0_B, FN_SSI_SCK2, FN_HSCIF1_HTX_B, FN_VI1_DATA2,
+	FN_MDATA, FN_ATAG0_N, FN_ETH_RXD1_B,
 
 	/* IPSR13 */
 	FN_SSI_WS2, FN_HSCIF1_HCTS_N_B, FN_SCIFA0_RXD_D, FN_VI1_DATA3, FN_SCKZ,
@@ -575,8 +575,8 @@ enum {
 	ETH_CRS_DV_B_MARK, SSI_WS1_MARK, SCIF1_TXD_B_MARK, IIC1_SDA_C_MARK,
 	VI1_DATA0_MARK, CAN0_TX_D_MARK, AVB_AVTP_MATCH_MARK, ETH_RX_ER_B_MARK,
 	SSI_SDATA1_MARK, HSCIF1_HRX_B_MARK, VI1_DATA1_MARK, SDATA_MARK,
-	ATAG0_N_MARK, ETH_RXD0_B_MARK, SSI_SCK2_MARK, HSCIF1_HTX_B_MARK,
-	VI1_DATA2_MARK, MDATA_MARK, ATAWR0_N_MARK, ETH_RXD1_B_MARK,
+	ATAWR0_N_MARK, ETH_RXD0_B_MARK, SSI_SCK2_MARK, HSCIF1_HTX_B_MARK,
+	VI1_DATA2_MARK, MDATA_MARK, ATAG0_N_MARK, ETH_RXD1_B_MARK,
 
 	/* IPSR13 */
 	SSI_WS2_MARK, HSCIF1_HCTS_N_B_MARK, SCIFA0_RXD_D_MARK, VI1_DATA3_MARK,
@@ -1413,13 +1413,13 @@ static const u16 pinmux_data[] = {
 	PINMUX_IPSR_MSEL(IP12_26_24, HSCIF1_HRX_B, SEL_HSCIF1_1),
 	PINMUX_IPSR_GPSR(IP12_26_24, VI1_DATA1),
 	PINMUX_IPSR_MSEL(IP12_26_24, SDATA, SEL_FSN_0),
-	PINMUX_IPSR_GPSR(IP12_26_24, ATAG0_N),
+	PINMUX_IPSR_GPSR(IP12_26_24, ATAWR0_N),
 	PINMUX_IPSR_MSEL(IP12_26_24, ETH_RXD0_B, SEL_ETH_1),
 	PINMUX_IPSR_MSEL(IP12_29_27, SSI_SCK2, SEL_SSI2_0),
 	PINMUX_IPSR_MSEL(IP12_29_27, HSCIF1_HTX_B, SEL_HSCIF1_1),
 	PINMUX_IPSR_GPSR(IP12_29_27, VI1_DATA2),
 	PINMUX_IPSR_MSEL(IP12_29_27, MDATA, SEL_FSN_0),
-	PINMUX_IPSR_GPSR(IP12_29_27, ATAWR0_N),
+	PINMUX_IPSR_GPSR(IP12_29_27, ATAG0_N),
 	PINMUX_IPSR_MSEL(IP12_29_27, ETH_RXD1_B, SEL_ETH_1),
 
 	/* IPSR13 */
@@ -4938,10 +4938,10 @@ static const struct pinmux_cfg_reg pinmu
 		0, 0, 0, 0,
 		/* IP12_29_27 [3] */
 		FN_SSI_SCK2, FN_HSCIF1_HTX_B, FN_VI1_DATA2, FN_MDATA,
-		FN_ATAWR0_N, FN_ETH_RXD1_B, 0, 0,
+		FN_ATAG0_N, FN_ETH_RXD1_B, 0, 0,
 		/* IP12_26_24 [3] */
 		FN_SSI_SDATA1, FN_HSCIF1_HRX_B, FN_VI1_DATA1, FN_SDATA,
-		FN_ATAG0_N, FN_ETH_RXD0_B, 0, 0,
+		FN_ATAWR0_N, FN_ETH_RXD0_B, 0, 0,
 		/* IP12_23_21 [3] */
 		FN_SSI_WS1, FN_SCIF1_TXD_B, FN_IIC1_SDA_C, FN_VI1_DATA0,
 		FN_CAN0_TX_D, FN_AVB_AVTP_MATCH, FN_ETH_RX_ER_B, 0,
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7795.c linux-libre-4.9.37-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7795.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/sh-pfc/pfc-r8a7795.c	2017-07-12 09:42:41.000000000 -0400
@@ -2056,7 +2056,7 @@ static const unsigned int hscif2_clk_b_p
 	RCAR_GP_PIN(6, 21),
 };
 static const unsigned int hscif2_clk_b_mux[] = {
-	HSCK1_B_MARK,
+	HSCK2_B_MARK,
 };
 static const unsigned int hscif2_ctrl_b_pins[] = {
 	/* RTS, CTS */
@@ -2129,7 +2129,7 @@ static const unsigned int hscif4_ctrl_pi
 	RCAR_GP_PIN(1, 15), RCAR_GP_PIN(1, 14),
 };
 static const unsigned int hscif4_ctrl_mux[] = {
-	HRTS4_N_MARK, HCTS3_N_MARK,
+	HRTS4_N_MARK, HCTS4_N_MARK,
 };
 
 static const unsigned int hscif4_data_b_pins[] = {
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/stm32/pinctrl-stm32.c linux-libre-4.9.37-gnu/drivers/pinctrl/stm32/pinctrl-stm32.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/stm32/pinctrl-stm32.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/stm32/pinctrl-stm32.c	2017-07-12 09:42:41.000000000 -0400
@@ -798,7 +798,7 @@ static int stm32_pconf_parse_conf(struct
 		break;
 	case PIN_CONFIG_OUTPUT:
 		__stm32_gpio_set(bank, offset, arg);
-		ret = stm32_pmx_gpio_set_direction(pctldev, NULL, pin, false);
+		ret = stm32_pmx_gpio_set_direction(pctldev, range, pin, false);
 		break;
 	default:
 		ret = -EINVAL;
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c linux-libre-4.9.37-gnu/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
--- linux-libre-4.9.36-gnu/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c	2017-07-12 09:42:41.000000000 -0400
@@ -394,7 +394,7 @@ static const struct sunxi_desc_pin sun8i
 	SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 18),
 		  SUNXI_FUNCTION(0x0, "gpio_in"),
 		  SUNXI_FUNCTION(0x1, "gpio_out"),
-		  SUNXI_FUNCTION(0x3, "owa")),		/* DOUT */
+		  SUNXI_FUNCTION(0x3, "spdif")),	/* DOUT */
 	SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 19),
 		  SUNXI_FUNCTION(0x0, "gpio_in"),
 		  SUNXI_FUNCTION(0x1, "gpio_out")),
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/core/quirks.c linux-libre-4.9.37-gnu/drivers/usb/core/quirks.c
--- linux-libre-4.9.36-gnu/drivers/usb/core/quirks.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/core/quirks.c	2017-07-12 09:42:41.000000000 -0400
@@ -223,6 +223,10 @@ static const struct usb_device_id usb_qu
 	/* Blackmagic Design UltraStudio SDI */
 	{ USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
 
+	/* Hauppauge HVR-950q */
+	{ USB_DEVICE(0x2040, 0x7200), .driver_info =
+			USB_QUIRK_CONFIG_INTF_STRINGS },
+
 	/* INTEL VALUE SSD */
 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/core/usb.c linux-libre-4.9.37-gnu/drivers/usb/core/usb.c
--- linux-libre-4.9.36-gnu/drivers/usb/core/usb.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/core/usb.c	2017-07-12 09:42:41.000000000 -0400
@@ -279,6 +279,8 @@ static void usb_release_dev(struct devic
 
 	usb_destroy_configuration(udev);
 	usb_release_bos_descriptor(udev);
+	if (udev->parent)
+		of_node_put(dev->of_node);
 	usb_put_hcd(hcd);
 	kfree(udev->product);
 	kfree(udev->manufacturer);
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/dwc3/dwc3-st.c linux-libre-4.9.37-gnu/drivers/usb/dwc3/dwc3-st.c
--- linux-libre-4.9.36-gnu/drivers/usb/dwc3/dwc3-st.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/dwc3/dwc3-st.c	2017-07-12 09:42:41.000000000 -0400
@@ -231,7 +231,7 @@ static int st_dwc3_probe(struct platform
 
 	dwc3_data->syscfg_reg_off = res->start;
 
-	dev_vdbg(&pdev->dev, "glue-logic addr 0x%p, syscfg-reg offset 0x%x\n",
+	dev_vdbg(&pdev->dev, "glue-logic addr 0x%pK, syscfg-reg offset 0x%x\n",
 		 dwc3_data->glue_base, dwc3_data->syscfg_reg_off);
 
 	dwc3_data->rstc_pwrdn =
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/dwc3/gadget.c linux-libre-4.9.37-gnu/drivers/usb/dwc3/gadget.c
--- linux-libre-4.9.36-gnu/drivers/usb/dwc3/gadget.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/dwc3/gadget.c	2017-07-12 09:42:41.000000000 -0400
@@ -1069,9 +1069,9 @@ static int __dwc3_gadget_ep_queue(struct
 		return -ESHUTDOWN;
 	}
 
-	if (WARN(req->dep != dep, "request %p belongs to '%s'\n",
+	if (WARN(req->dep != dep, "request %pK belongs to '%s'\n",
 				&req->request, req->dep->name)) {
-		dwc3_trace(trace_dwc3_gadget, "request %p belongs to '%s'",
+		dwc3_trace(trace_dwc3_gadget, "request %pK belongs to '%s'",
 				&req->request, req->dep->name);
 		return -EINVAL;
 	}
@@ -1212,7 +1212,7 @@ static int dwc3_gadget_ep_dequeue(struct
 			dwc3_stop_active_transfer(dwc, dep->number, true);
 			goto out1;
 		}
-		dev_err(dwc->dev, "request %p was not queued to %s\n",
+		dev_err(dwc->dev, "request %pK was not queued to %s\n",
 				request, ep->name);
 		ret = -EINVAL;
 		goto out0;
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/host/xhci.h linux-libre-4.9.37-gnu/drivers/usb/host/xhci.h
--- linux-libre-4.9.36-gnu/drivers/usb/host/xhci.h	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/host/xhci.h	2017-07-12 09:42:41.000000000 -0400
@@ -1660,6 +1660,7 @@ struct xhci_hcd {
 /* For controller with a broken Port Disable implementation */
 #define XHCI_BROKEN_PORT_PED	(1 << 25)
 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7	(1 << 26)
+#define XHCI_U2_DISABLE_WAKE	(1 << 27)
 
 	unsigned int		num_active_eps;
 	unsigned int		limit_active_eps;
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/host/xhci-hub.c linux-libre-4.9.37-gnu/drivers/usb/host/xhci-hub.c
--- linux-libre-4.9.36-gnu/drivers/usb/host/xhci-hub.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/host/xhci-hub.c	2017-07-12 09:42:41.000000000 -0400
@@ -1348,6 +1348,9 @@ int xhci_bus_suspend(struct usb_hcd *hcd
 				t2 |= PORT_WKOC_E | PORT_WKCONN_E;
 				t2 &= ~PORT_WKDISC_E;
 			}
+			if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
+			    (hcd->speed < HCD_USB3))
+				t2 &= ~PORT_WAKE_BITS;
 		} else
 			t2 &= ~PORT_WAKE_BITS;
 
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/host/xhci-pci.c linux-libre-4.9.37-gnu/drivers/usb/host/xhci-pci.c
--- linux-libre-4.9.36-gnu/drivers/usb/host/xhci-pci.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/host/xhci-pci.c	2017-07-12 09:42:41.000000000 -0400
@@ -54,6 +54,11 @@
 #define PCI_DEVICE_ID_INTEL_APL_XHCI			0x5aa8
 #define PCI_DEVICE_ID_INTEL_DNV_XHCI			0x19d0
 
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_4			0x43b9
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_3			0x43ba
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_2			0x43bb
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_1			0x43bc
+
 static const char hcd_name[] = "xhci_hcd";
 
 static struct hc_driver __read_mostly xhci_pci_hc_driver;
@@ -135,6 +140,13 @@ static void xhci_pci_quirks(struct devic
 	if (pdev->vendor == PCI_VENDOR_ID_AMD)
 		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
+	if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
+		((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
+		(pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
+		(pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
+		(pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
+		xhci->quirks |= XHCI_U2_DISABLE_WAKE;
+
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
 		xhci->quirks |= XHCI_LPM_SUPPORT;
 		xhci->quirks |= XHCI_INTEL_HOST;
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/serial/cp210x.c linux-libre-4.9.37-gnu/drivers/usb/serial/cp210x.c
--- linux-libre-4.9.36-gnu/drivers/usb/serial/cp210x.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/serial/cp210x.c	2017-07-12 09:42:41.000000000 -0400
@@ -135,6 +135,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */
 	{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
 	{ USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+	{ USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/serial/option.c linux-libre-4.9.37-gnu/drivers/usb/serial/option.c
--- linux-libre-4.9.36-gnu/drivers/usb/serial/option.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/serial/option.c	2017-07-12 09:42:41.000000000 -0400
@@ -1877,6 +1877,10 @@ static const struct usb_device_id option
 	  .driver_info = (kernel_ulong_t)&four_g_w100_blacklist
 	},
 	{ USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
+	{ USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9801, 0xff),
+	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+	{ USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff),
+	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/serial/qcserial.c linux-libre-4.9.37-gnu/drivers/usb/serial/qcserial.c
--- linux-libre-4.9.36-gnu/drivers/usb/serial/qcserial.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/serial/qcserial.c	2017-07-12 09:42:41.000000000 -0400
@@ -158,6 +158,7 @@ static const struct usb_device_id id_tab
 	{DEVICE_SWI(0x1199, 0x9056)},	/* Sierra Wireless Modem */
 	{DEVICE_SWI(0x1199, 0x9060)},	/* Sierra Wireless Modem */
 	{DEVICE_SWI(0x1199, 0x9061)},	/* Sierra Wireless Modem */
+	{DEVICE_SWI(0x1199, 0x9063)},	/* Sierra Wireless EM7305 */
 	{DEVICE_SWI(0x1199, 0x9070)},	/* Sierra Wireless MC74xx */
 	{DEVICE_SWI(0x1199, 0x9071)},	/* Sierra Wireless MC74xx */
 	{DEVICE_SWI(0x1199, 0x9078)},	/* Sierra Wireless EM74xx */
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/usbip/stub_main.c linux-libre-4.9.37-gnu/drivers/usb/usbip/stub_main.c
--- linux-libre-4.9.36-gnu/drivers/usb/usbip/stub_main.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/usbip/stub_main.c	2017-07-12 09:42:41.000000000 -0400
@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stu
 		kmem_cache_free(stub_priv_cache, priv);
 
 		kfree(urb->transfer_buffer);
+		urb->transfer_buffer = NULL;
+
 		kfree(urb->setup_packet);
+		urb->setup_packet = NULL;
+
 		usb_free_urb(urb);
 	}
 }
diff -druNp --no-dereference linux-libre-4.9.36-gnu/drivers/usb/usbip/stub_tx.c linux-libre-4.9.37-gnu/drivers/usb/usbip/stub_tx.c
--- linux-libre-4.9.36-gnu/drivers/usb/usbip/stub_tx.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/drivers/usb/usbip/stub_tx.c	2017-07-12 09:42:41.000000000 -0400
@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struc
 	struct urb *urb = priv->urb;
 
 	kfree(urb->setup_packet);
+	urb->setup_packet = NULL;
+
 	kfree(urb->transfer_buffer);
+	urb->transfer_buffer = NULL;
+
 	list_del(&priv->list);
 	kmem_cache_free(stub_priv_cache, priv);
 	usb_free_urb(urb);
diff -druNp --no-dereference linux-libre-4.9.36-gnu/fs/ceph/dir.c linux-libre-4.9.37-gnu/fs/ceph/dir.c
--- linux-libre-4.9.36-gnu/fs/ceph/dir.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/fs/ceph/dir.c	2017-07-12 09:42:41.000000000 -0400
@@ -315,7 +315,7 @@ static int ceph_readdir(struct file *fil
 	struct ceph_mds_client *mdsc = fsc->mdsc;
 	int i;
 	int err;
-	u32 ftype;
+	unsigned frag = -1;
 	struct ceph_mds_reply_info_parsed *rinfo;
 
 	dout("readdir %p file %p pos %llx\n", inode, file, ctx->pos);
@@ -362,7 +362,6 @@ more:
 	/* do we have the correct frag content buffered? */
 	if (need_send_readdir(fi, ctx->pos)) {
 		struct ceph_mds_request *req;
-		unsigned frag;
 		int op = ceph_snap(inode) == CEPH_SNAPDIR ?
 			CEPH_MDS_OP_LSSNAP : CEPH_MDS_OP_READDIR;
 
@@ -373,8 +372,11 @@ more:
 		}
 
 		if (is_hash_order(ctx->pos)) {
-			frag = ceph_choose_frag(ci, fpos_hash(ctx->pos),
-						NULL, NULL);
+			/* fragtree isn't always accurate. choose frag
+			 * based on previous reply when possible. */
+			if (frag == (unsigned)-1)
+				frag = ceph_choose_frag(ci, fpos_hash(ctx->pos),
+							NULL, NULL);
 		} else {
 			frag = fpos_frag(ctx->pos);
 		}
@@ -497,6 +499,7 @@ more:
 		struct ceph_mds_reply_dir_entry *rde = rinfo->dir_entries + i;
 		struct ceph_vino vino;
 		ino_t ino;
+		u32 ftype;
 
 		BUG_ON(rde->offset < ctx->pos);
 
@@ -519,15 +522,17 @@ more:
 		ctx->pos++;
 	}
 
+	ceph_mdsc_put_request(fi->last_readdir);
+	fi->last_readdir = NULL;
+
 	if (fi->next_offset > 2) {
-		ceph_mdsc_put_request(fi->last_readdir);
-		fi->last_readdir = NULL;
+		frag = fi->frag;
 		goto more;
 	}
 
 	/* more frags? */
 	if (!ceph_frag_is_rightmost(fi->frag)) {
-		unsigned frag = ceph_frag_next(fi->frag);
+		frag = ceph_frag_next(fi->frag);
 		if (is_hash_order(ctx->pos)) {
 			loff_t new_pos = ceph_make_fpos(ceph_frag_value(frag),
 							fi->next_offset, true);
diff -druNp --no-dereference linux-libre-4.9.36-gnu/fs/fcntl.c linux-libre-4.9.37-gnu/fs/fcntl.c
--- linux-libre-4.9.36-gnu/fs/fcntl.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/fs/fcntl.c	2017-07-12 09:42:41.000000000 -0400
@@ -741,16 +741,10 @@ static int __init fcntl_init(void)
 	 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
 	 * is defined as O_NONBLOCK on some platforms and not on others.
 	 */
-	BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
-		O_RDONLY	| O_WRONLY	| O_RDWR	|
-		O_CREAT		| O_EXCL	| O_NOCTTY	|
-		O_TRUNC		| O_APPEND	| /* O_NONBLOCK	| */
-		__O_SYNC	| O_DSYNC	| FASYNC	|
-		O_DIRECT	| O_LARGEFILE	| O_DIRECTORY	|
-		O_NOFOLLOW	| O_NOATIME	| O_CLOEXEC	|
-		__FMODE_EXEC	| O_PATH	| __O_TMPFILE	|
-		__FMODE_NONOTIFY
-		));
+	BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=
+		HWEIGHT32(
+			(VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
+			__FMODE_EXEC | __FMODE_NONOTIFY));
 
 	fasync_cache = kmem_cache_create("fasync_cache",
 		sizeof(struct fasync_struct), 0, SLAB_PANIC, NULL);
diff -druNp --no-dereference linux-libre-4.9.36-gnu/fs/gfs2/glock.c linux-libre-4.9.37-gnu/fs/gfs2/glock.c
--- linux-libre-4.9.36-gnu/fs/gfs2/glock.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/fs/gfs2/glock.c	2017-07-12 09:42:41.000000000 -0400
@@ -80,9 +80,9 @@ static struct rhashtable_params ht_parms
 
 static struct rhashtable gl_hash_table;
 
-void gfs2_glock_free(struct gfs2_glock *gl)
+static void gfs2_glock_dealloc(struct rcu_head *rcu)
 {
-	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+	struct gfs2_glock *gl = container_of(rcu, struct gfs2_glock, gl_rcu);
 
 	if (gl->gl_ops->go_flags & GLOF_ASPACE) {
 		kmem_cache_free(gfs2_glock_aspace_cachep, gl);
@@ -90,6 +90,13 @@ void gfs2_glock_free(struct gfs2_glock *
 		kfree(gl->gl_lksb.sb_lvbptr);
 		kmem_cache_free(gfs2_glock_cachep, gl);
 	}
+}
+
+void gfs2_glock_free(struct gfs2_glock *gl)
+{
+	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+
+	call_rcu(&gl->gl_rcu, gfs2_glock_dealloc);
 	if (atomic_dec_and_test(&sdp->sd_glock_disposal))
 		wake_up(&sdp->sd_glock_wait);
 }
diff -druNp --no-dereference linux-libre-4.9.36-gnu/fs/gfs2/incore.h linux-libre-4.9.37-gnu/fs/gfs2/incore.h
--- linux-libre-4.9.36-gnu/fs/gfs2/incore.h	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/fs/gfs2/incore.h	2017-07-12 09:42:41.000000000 -0400
@@ -370,6 +370,7 @@ struct gfs2_glock {
 			loff_t end;
 		} gl_vm;
 	};
+	struct rcu_head gl_rcu;
 	struct rhash_head gl_node;
 };
 
diff -druNp --no-dereference linux-libre-4.9.36-gnu/fs/open.c linux-libre-4.9.37-gnu/fs/open.c
--- linux-libre-4.9.36-gnu/fs/open.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/fs/open.c	2017-07-12 09:42:41.000000000 -0400
@@ -902,6 +902,12 @@ static inline int build_open_flags(int f
 	int lookup_flags = 0;
 	int acc_mode = ACC_MODE(flags);
 
+	/*
+	 * Clear out all open flags we don't know about so that we don't report
+	 * them in fcntl(F_GETFD) or similar interfaces.
+	 */
+	flags &= VALID_OPEN_FLAGS;
+
 	if (flags & (O_CREAT | __O_TMPFILE))
 		op->mode = (mode & S_IALLUGO) | S_IFREG;
 	else
diff -druNp --no-dereference linux-libre-4.9.36-gnu/include/linux/fcntl.h linux-libre-4.9.37-gnu/include/linux/fcntl.h
--- linux-libre-4.9.36-gnu/include/linux/fcntl.h	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/include/linux/fcntl.h	2017-07-12 09:42:41.000000000 -0400
@@ -3,6 +3,12 @@
 
 #include <uapi/linux/fcntl.h>
 
+/* list of all valid flags for the open/openat flags argument: */
+#define VALID_OPEN_FLAGS \
+	(O_RDONLY | O_WRONLY | O_RDWR | O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | \
+	 O_APPEND | O_NDELAY | O_NONBLOCK | O_NDELAY | __O_SYNC | O_DSYNC | \
+	 FASYNC	| O_DIRECT | O_LARGEFILE | O_DIRECTORY | O_NOFOLLOW | \
+	 O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE)
 
 #ifndef force_o_largefile
 #define force_o_largefile() (BITS_PER_LONG != 32)
diff -druNp --no-dereference linux-libre-4.9.36-gnu/include/linux/usb/hcd.h linux-libre-4.9.37-gnu/include/linux/usb/hcd.h
--- linux-libre-4.9.36-gnu/include/linux/usb/hcd.h	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/include/linux/usb/hcd.h	2017-07-12 09:42:41.000000000 -0400
@@ -561,9 +561,9 @@ extern void usb_ep0_reinit(struct usb_de
 	((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8)
 
 #define EndpointRequest \
-	((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8)
+	((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8)
 #define EndpointOutRequest \
-	((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8)
+	((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8)
 
 /* class requests from the USB 2.0 hub spec, table 11-15 */
 /* GetBusState and SetHubDescriptor are optional, omitted */
diff -druNp --no-dereference linux-libre-4.9.36-gnu/kernel/sysctl.c linux-libre-4.9.37-gnu/kernel/sysctl.c
--- linux-libre-4.9.36-gnu/kernel/sysctl.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/kernel/sysctl.c	2017-07-12 09:42:41.000000000 -0400
@@ -2146,9 +2146,12 @@ static int do_proc_douintvec_conv(bool *
 	if (write) {
 		if (*negp)
 			return -EINVAL;
+		if (*lvalp > UINT_MAX)
+			return -EINVAL;
 		*valp = *lvalp;
 	} else {
 		unsigned int val = *valp;
+		*negp = false;
 		*lvalp = (unsigned long)val;
 	}
 	return 0;
diff -druNp --no-dereference linux-libre-4.9.36-gnu/kernel/trace/trace_kprobe.c linux-libre-4.9.37-gnu/kernel/trace/trace_kprobe.c
--- linux-libre-4.9.36-gnu/kernel/trace/trace_kprobe.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/kernel/trace/trace_kprobe.c	2017-07-12 09:42:41.000000000 -0400
@@ -667,30 +667,25 @@ static int create_trace_kprobe(int argc,
 		pr_info("Probe point is not specified.\n");
 		return -EINVAL;
 	}
-	if (isdigit(argv[1][0])) {
-		if (is_return) {
-			pr_info("Return probe point must be a symbol.\n");
-			return -EINVAL;
-		}
-		/* an address specified */
-		ret = kstrtoul(&argv[1][0], 0, (unsigned long *)&addr);
-		if (ret) {
-			pr_info("Failed to parse address.\n");
-			return ret;
-		}
-	} else {
+
+	/* try to parse an address. if that fails, try to read the
+	 * input as a symbol. */
+	if (kstrtoul(argv[1], 0, (unsigned long *)&addr)) {
 		/* a symbol specified */
 		symbol = argv[1];
 		/* TODO: support .init module functions */
 		ret = traceprobe_split_symbol_offset(symbol, &offset);
 		if (ret) {
-			pr_info("Failed to parse symbol.\n");
+			pr_info("Failed to parse either an address or a symbol.\n");
 			return ret;
 		}
 		if (offset && is_return) {
 			pr_info("Return probe must be used without offset.\n");
 			return -EINVAL;
 		}
+	} else if (is_return) {
+		pr_info("Return probe point must be a symbol.\n");
+		return -EINVAL;
 	}
 	argc -= 2; argv += 2;
 
diff -druNp --no-dereference linux-libre-4.9.36-gnu/Makefile linux-libre-4.9.37-gnu/Makefile
--- linux-libre-4.9.36-gnu/Makefile	2017-07-05 14:55:30.000000000 -0400
+++ linux-libre-4.9.37-gnu/Makefile	2017-07-12 18:44:03.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 36
+SUBLEVEL = 37
 EXTRAVERSION = -gnu
 NAME = Roaring Lionus
 
diff -druNp --no-dereference linux-libre-4.9.36-gnu/security/keys/encrypted-keys/encrypted.c linux-libre-4.9.37-gnu/security/keys/encrypted-keys/encrypted.c
--- linux-libre-4.9.36-gnu/security/keys/encrypted-keys/encrypted.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/security/keys/encrypted-keys/encrypted.c	2017-07-12 09:42:41.000000000 -0400
@@ -437,7 +437,7 @@ static struct skcipher_request *init_skc
 static struct key *request_master_key(struct encrypted_key_payload *epayload,
 				      const u8 **master_key, size_t *master_keylen)
 {
-	struct key *mkey = NULL;
+	struct key *mkey = ERR_PTR(-EINVAL);
 
 	if (!strncmp(epayload->master_desc, KEY_TRUSTED_PREFIX,
 		     KEY_TRUSTED_PREFIX_LEN)) {
diff -druNp --no-dereference linux-libre-4.9.36-gnu/sound/soc/codecs/rt286.c linux-libre-4.9.37-gnu/sound/soc/codecs/rt286.c
--- linux-libre-4.9.36-gnu/sound/soc/codecs/rt286.c	2017-07-05 08:40:44.000000000 -0400
+++ linux-libre-4.9.37-gnu/sound/soc/codecs/rt286.c	2017-07-12 09:42:41.000000000 -0400
@@ -1108,6 +1108,13 @@ static const struct dmi_system_id force_
 			DMI_MATCH(DMI_PRODUCT_NAME, "Kabylake Client platform")
 		}
 	},
+	{
+		.ident = "Thinkpad Helix 2nd",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix 2nd")
+		}
+	},
 
 	{ }
 };
