Merge remote-tracking branch '4.9/tmp-a745b345' into msm-4.9

* 4.9/tmp-a745b345:
  Linux 4.9.28
  block: get rid of blk_integrity_revalidate()
  drm/ttm: fix use-after-free races in vm fault handling
  wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event
  wlcore: Pass win_size taken from ieee80211_sta to FW
  xen: Revert commits da72ff5bfcb0 and 72a9b186
  f2fs: sanity check segment count
  net: mdio-mux: bcm-iproc: call mdiobus_free() in error path
  bpf: don't let ldimm64 leak map addresses on unprivileged
  bnxt_en: allocate enough space for ->ntp_fltr_bmap
  ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
  ipv6: initialize route null entry in addrconf_init()
  rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
  ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
  tcp: do not inherit fastopen_req from parent
  net: usb: qmi_wwan: add Telit ME910 support
  net: ipv6: Do not duplicate DAD on link up
  tcp: fix wraparound issue in tcp_lp
  bpf, arm64: fix jit branch offset related to ldimm64
  bpf: enhance verifier to understand stack pointer arithmetic
  tcp: do not underestimate skb->truesize in tcp_trim_head()
  macsec: dynamically allocate space for sglist
  sparc64: fix fault handling in NGbzero.S and GENbzero.S
  ALSA: hda - Fix deadlock of controller device lock at unbinding
  staging: emxx_udc: remove incorrect __init annotations
  staging: wlan-ng: add missing byte order conversion
  staging/lustre/llite: move root_squash from sysfs to debugfs
  brcmfmac: Make skb header writable before use
  brcmfmac: Ensure pointer correctly set if skb data location changes
  MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix
  scsi: smartpqi: fix time handling
  scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m
  scsi: qla2xxx: Fix crash in qla2xxx_eh_abort on bad ptr
  serial: 8250_omap: Fix probe and remove for PM runtime
  phy: qcom-usb-hs: Add depends on EXTCON
  clk: rockchip: add "," to mux_pll_src_apll_dpll_gpll_usb480m_p on rk3036
  USB: serial: io_edgeport: fix descriptor error handling
  USB: serial: mct_u232: fix modem-status error handling
  USB: serial: quatech2: fix control-message error handling
  USB: serial: ftdi_sio: fix latency-timer error handling
  USB: serial: ark3116: fix open error handling
  USB: serial: ti_usb_3410_5052: fix control-message error handling
  USB: serial: io_edgeport: fix epic-descriptor handling
  USB: serial: ssu100: fix control-message error handling
  USB: serial: digi_acceleport: fix incomplete rx sanity check
  USB: serial: keyspan_pda: fix receive sanity checks
  usb: chipidea: Handle extcon events properly
  usb: chipidea: Only read/write OTGSC from one place
  usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths
  usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths
  usb: dwc2: host: use msleep() for long delay
  KVM: nVMX: do not leak PML full vmexit to L1
  KVM: nVMX: initialize PML fields in vmcs02
  Revert "KVM: nested VMX: disable perf cpuid reporting"
  x86/platform/intel-mid: Correct MSI IRQ line for watchdog device
  kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed
  clk: Make x86/ conditional on CONFIG_COMMON_CLK
  x86/mpx: Re-add MPX to selftests Makefile
  x86/pci-calgary: Fix iommu_free() comparison of unsigned expression >= 0
  x86/ioapic: Restore IO-APIC irq_chip retrigger callback
  iwlwifi: mvm: writing zero bytes to debugfs causes a crash
  iwlwifi: mvm: synchronize firmware DMA paging memory
  iwlwifi: mvm: fix references to first_agg_queue in DQA mode
  iwlwifi: mvm: fix pending frame counter calculation
  iwlwifi: mvm/pcie: adjust A-MSDU tx_cmd length in PCIe
  iwlwifi: mvm: Use aux queue for offchannel frames in dqa
  iwlwifi: mvm: fix reorder timer re-arming
  iwlwifi: pcie: fix the set of DMA memory mask
  iwlwifi: pcie: trans: Remove unused 'shift_param'
  iwlwifi: pcie: don't increment / decrement a bool
  iwlwifi: mvm: overwrite skb info later
  iwlwifi: mvm: don't restart HW if suspend fails with unified image
  iwlwifi: fix MODULE_FIRMWARE for 6030
  mwifiex: Avoid skipping WEP key deletion for AP
  mwifiex: remove redundant dma padding in AMSDU
  mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print
  ARM: dts: sun7i: lamobo-r1: Fix CPU port RGMII settings
  ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build
  ARM: dts: NSP: GPIO reboot open-source
  leds: ktd2692: avoid harmless maybe-uninitialized warning
  arm64: Improve detection of user/non-user mappings in set_pte(_at)
  arm: dts: qcom: Fix ipq board clock rates
  arm64: dts: r8a7795: Mark EthernetAVB device node disabled
  power: supply: bq24190_charger: Handle fault before status on interrupt
  power: supply: bq24190_charger: Don't read fault register outside irq_handle_thread()
  power: supply: bq24190_charger: Call power_supply_changed() for relevant component
  power: supply: bq24190_charger: Install irq_handler_thread() at end of probe()
  power: supply: bq24190_charger: Call set_mode_host() on pm_resume()
  power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING
  perf/x86/intel/pt: Add format strings for PTWRITE and power event tracing
  powerpc: Correctly disable latent entropy GCC plugin on prom_init.o
  powerpc/ftrace: Fix confusing help text for DISABLE_MPROFILE_KERNEL
  powerpc/powernv: Fix opal_exit tracepoint opcode
  powerpc/mm: Fixup wrong LPCR_VRMASD value
  cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores
  power: supply: lp8788: prevent out of bounds array access
  crypto: caam - fix error path for ctx_dma mapping failure
  tmp: use pdev for parent device in tpm_chip_alloc
  tpm: fix RC value check in tpm2_seal_trusted
  hwmon: (it87) Fix pwm4 detection for IT8620 and IT8628
  drm/sti: fix GDP size to support up to UHD resolution
  9p: fix a potential acl leak
  ANDROID: android-base.cfg: remove spurious CONFIG_MODULES line
  ANDROID: memory_state_time: fix undefined behavior with missing DT properties
  ANDROID: rfkill: fix unused function warning
  ANDROID: make PF_KEY SHA256 use RFC-compliant truncation.
  ANDROID: sdcardfs: fix sdcardfs_destroy_inode for the inode RCU approach
  ANDROID: android-base.cfg: remove NETFILTER_XT_MATCH_QUOTA2_LOG
  ANDROID: sdcardfs: Don't iput if we didn't igrab
  ANDROID: sdcardfs: Call lower fs's revalidate
  ANDROID: sdcardfs: Avoid setting GIDs outside of valid ranges
  ANDROID: sdcardfs: Copy meta-data from lower inode
  Revert "Revert "Android: sdcardfs: Don't do d_add for lower fs""
  ANDROID: sdcardfs: Use filesystem specific hash
  ANDROID: Add untag hacks to inet_release function

Change-Id: I7f4c34591ffb11c05217449d823cdc84fb6f2aeb
Signed-off-by: Kyle Yan <kyan@codeaurora.org>