diff --git a/runtime/doc/vimtutor.1 b/runtime/doc/vimtutor.1
index 4b5aea64da..12bde7e485 100644
--- a/runtime/doc/vimtutor.1
+++ b/runtime/doc/vimtutor.1
@@ -3,7 +3,7 @@
 vimtutor \- the Vim tutor
 .SH SYNOPSIS
 .br
-.B vimtutor [language]
+.B vimtutor [-g] [language]
 .SH DESCRIPTION
 .B Vimtutor
 starts the
@@ -18,6 +18,9 @@ is useful for people that want to learn their first
 .B Vim
 commands.
 .PP
+The optional argument -g starts vimtutor with gvim rather than vim, if the
+GUI version of vim is available, or falls back to Vim if gvim is not found.
+.PP
 The optional [language] argument is the two-letter name of a language, like
 "it" or "es".
 If the [language] argument is missing, the language of the current locale will
diff --git a/src/Makefile b/src/Makefile
index 75c90ffe79..c20307e2d1 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -1883,6 +1883,8 @@ installmacros: $(DEST_VIM) $(DEST_RT) $(DEST_MACRO)
 installtutorbin: $(DEST_VIM)
 	$(INSTALL_DATA) vimtutor $(DEST_BIN)/$(VIMNAME)tutor
 	chmod $(SCRIPTMOD) $(DEST_BIN)/$(VIMNAME)tutor
+	$(INSTALL_DATA) gvimtutor $(DEST_BIN)/$(GVIMNAME)tutor
+	chmod $(SCRIPTMOD) $(DEST_BIN)/$(GVIMNAME)tutor
 
 installtutor: $(DEST_RT) $(DEST_TUTOR)
 	-$(INSTALL_DATA) $(TUTORSOURCE)/README* $(TUTORSOURCE)/tutor* $(DEST_TUTOR)
@@ -2091,6 +2093,7 @@ installmanlinks:
 uninstall: uninstall_runtime
 	-rm -f $(DEST_BIN)/$(VIMTARGET)
 	-rm -f $(DEST_BIN)/vimtutor
+	-rm -f $(DEST_BIN)/gvimtutor
 	-rm -f $(DEST_BIN)/$(EXTARGET) $(DEST_BIN)/$(VIEWTARGET)
 	-rm -f $(DEST_BIN)/$(GVIMTARGET) $(DEST_BIN)/$(GVIEWTARGET)
 	-rm -f $(DEST_BIN)/$(RVIMTARGET) $(DEST_BIN)/$(RVIEWTARGET)
@@ -2187,7 +2190,7 @@ SHADOWDIR = shadow
 
 shadow:	runtime pixmaps
 	mkdir $(SHADOWDIR)
-	cd $(SHADOWDIR); ln -s ../*.[ch] ../*.in ../*.sh ../*.xs ../*.xbm ../toolcheck ../proto ../vimtutor ../mkinstalldirs .
+	cd $(SHADOWDIR); ln -s ../*.[ch] ../*.in ../*.sh ../*.xs ../*.xbm ../toolcheck ../proto ../vimtutor ../gvimtutor ../mkinstalldirs .
 	mkdir $(SHADOWDIR)/auto
 	cd $(SHADOWDIR)/auto; ln -s ../../auto/configure .
 	cd $(SHADOWDIR); rm -f auto/link.sed
diff --git a/src/auto/configure b/src/auto/configure
index 3eb8757dcb..386fc810e1 100755
--- a/src/auto/configure
+++ b/src/auto/configure
@@ -845,6 +845,7 @@ Optional Features:
   --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)
   --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
   --disable-darwin        Disable Darwin (Mac OS X) support.
+  --disable-selinux	  Don't check for SELinux support.
   --disable-xsmp          Disable XSMP session management
   --disable-xsmp-interact Disable XSMP interaction
   --enable-mzschemeinterp   Include MzScheme interpreter.
@@ -3611,6 +3612,94 @@ echo "${ECHO_T}no" >&6
 esac
 fi
 
+echo "$as_me:$LINENO: checking --disable-selinux argument" >&5
+echo $ECHO_N "checking --disable-selinux argument... $ECHO_C" >&6
+# Check whether --enable-selinux or --disable-selinux was given.
+if test "${enable_selinux+set}" = set; then
+  enableval="$enable_selinux"
+
+else
+  enable_selinux="yes"
+fi;
+if test "$enable_selinux" = "yes"; then
+  echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6
+  echo "$as_me:$LINENO: checking for is_selinux_enabled in -lselinux" >&5
+echo $ECHO_N "checking for is_selinux_enabled in -lselinux... $ECHO_C" >&6
+if test "${ac_cv_lib_selinux_is_selinux_enabled+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lselinux  $LIBS"
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+/* Override any gcc2 internal prototype to avoid an error.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+/* We use char because int might match the return type of a gcc2
+   builtin and then its argument prototype would still apply.  */
+char is_selinux_enabled ();
+int
+main ()
+{
+is_selinux_enabled ();
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+	 { ac_try='test -z "$ac_c_werror_flag"
+			 || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+	 { ac_try='test -s conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_lib_selinux_is_selinux_enabled=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ac_cv_lib_selinux_is_selinux_enabled=no
+fi
+rm -f conftest.err conftest.$ac_objext \
+      conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_is_selinux_enabled" >&5
+echo "${ECHO_T}$ac_cv_lib_selinux_is_selinux_enabled" >&6
+if test $ac_cv_lib_selinux_is_selinux_enabled = yes; then
+  LIBS="$LIBS -lselinux"
+	   cat >>confdefs.h <<\_ACEOF
+#define HAVE_SELINUX 1
+_ACEOF
+
+fi
+
+else
+   echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6
+fi
 
 
 echo "$as_me:$LINENO: checking --with-features argument" >&5
diff --git a/src/config.h.in b/src/config.h.in
index 3d9e162125..cb1feaf866 100644
--- a/src/config.h.in
+++ b/src/config.h.in
@@ -155,6 +155,7 @@
 #undef HAVE_READLINK
 #undef HAVE_RENAME
 #undef HAVE_SELECT
+#undef HAVE_SELINUX
 #undef HAVE_SETENV
 #undef HAVE_SETPGID
 #undef HAVE_SETSID
diff --git a/src/configure.in b/src/configure.in
index 295b72535d..701210ff14 100644
--- a/src/configure.in
+++ b/src/configure.in
@@ -308,6 +308,19 @@ case `uname` in
 esac
 fi
 
+dnl Link with -lselinux for SELinux stuff; if not found
+AC_MSG_CHECKING(--disable-selinux argument)
+AC_ARG_ENABLE(selinux,
+	[  --disable-selinux	  Don't check for SELinux support.],
+	, enable_selinux="yes")
+if test "$enable_selinux" = "yes"; then
+  AC_MSG_RESULT(no)
+  AC_CHECK_LIB(selinux, is_selinux_enabled,
+	  [LIBS="$LIBS -lselinux"
+	   AC_DEFINE(HAVE_SELINUX)])
+else
+   AC_MSG_RESULT(yes)
+fi
 
 dnl Check user requested features.
 
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index a87dab6a6f..218ced0f76 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -1160,6 +1160,7 @@ do_filter(line1, line2, eap, cmd, do_in, do_out)
     if (!do_out)
 	msg_putchar('\n');
 
+    /* Create the shell command in allocated memory. */
     cmd_buf = make_filter_cmd(cmd, itmp, otmp);
     if (cmd_buf == NULL)
 	goto filterend;
@@ -1180,7 +1181,10 @@ do_filter(line1, line2, eap, cmd, do_in, do_out)
     if (do_out)
     {
 	if (u_save((linenr_T)(line2), (linenr_T)(line2 + 1)) == FAIL)
+	{
+	    vim_free(cmd_buf);
 	    goto error;
+	}
 	redraw_curbuf_later(VALID);
     }
     read_linecount = curbuf->b_ml.ml_line_count;
@@ -4471,7 +4475,7 @@ do_sub(eap)
 	    /*
 	     * The new text is build up step by step, to avoid too much
 	     * copying.  There are these pieces:
-	     * sub_firstline	The old text, unmodifed.
+	     * sub_firstline	The old text, unmodified.
 	     * copycol		Column in the old text where we started
 	     *			looking for a match; from here old text still
 	     *			needs to be copied to the new text.
diff --git a/src/fileio.c b/src/fileio.c
index 25a63f81d0..c154fff854 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -3651,6 +3651,9 @@ buf_write(buf, fname, sfname, start, end, eap, append, forceit,
 						)
 			    mch_setperm(backup,
 					  (perm & 0707) | ((perm & 07) << 3));
+# ifdef HAVE_SELINUX
+			mch_copy_sec(fname, backup);
+# endif
 #endif
 
 			/*
@@ -3686,6 +3689,9 @@ buf_write(buf, fname, sfname, start, end, eap, append, forceit,
 #endif
 #ifdef HAVE_ACL
 			mch_set_acl(backup, acl);
+#endif
+#ifdef HAVE_SELINUX
+			mch_copy_sec(fname, backup);
 #endif
 			break;
 		    }
@@ -4309,6 +4315,12 @@ restore_backup:
     }
 #endif
 
+#ifdef HAVE_SELINUX
+    /* Probably need to set the security context. */
+    if (!backup_copy)
+	mch_copy_sec(backup, wfname);
+#endif
+
 #ifdef UNIX
     /* When creating a new file, set its owner/group to that of the original
      * file.  Get the new device and inode number. */
diff --git a/src/gui.c b/src/gui.c
index 323f12c3f7..1065f1ff70 100644
--- a/src/gui.c
+++ b/src/gui.c
@@ -4955,6 +4955,15 @@ gui_update_screen()
 {
     update_topline();
     validate_cursor();
+#ifdef FEAT_AUTOCMD
+    /* Trigger CursorMoved if the cursor moved. */
+    if (!finish_op && has_cursormoved()
+	    && !equalpos(last_cursormoved, curwin->w_cursor))
+    {
+	apply_autocmds(EVENT_CURSORMOVED, NULL, NULL, FALSE, curbuf);
+	last_cursormoved = curwin->w_cursor;
+    }
+#endif
     update_screen(0);	/* may need to update the screen */
     setcursor();
     out_flush();		/* make sure output has been written */
diff --git a/src/memfile.c b/src/memfile.c
index d0dd8deef3..f1ce681434 100644
--- a/src/memfile.c
+++ b/src/memfile.c
@@ -1346,5 +1346,10 @@ mf_do_open(mfp, fname, flags)
 	mfp->mf_ffname = NULL;
     }
     else
+    {
+#ifdef HAVE_SELINUX
+	mch_copy_sec(fname, mfp->mf_fname);
+#endif
 	mch_hide(mfp->mf_fname);    /* try setting the 'hidden' flag */
+    }
 }
diff --git a/src/os_unix.c b/src/os_unix.c
index f66e4ef460..1b1564fb63 100644
--- a/src/os_unix.c
+++ b/src/os_unix.c
@@ -45,6 +45,11 @@
 # include <X11/SM/SMlib.h>
 #endif
 
+#ifdef HAVE_SELINUX
+# include <selinux/selinux.h>
+static int selinux_enabled = -1;
+#endif
+
 /*
  * Use this prototype for select, some include files have a wrong prototype
  */
@@ -2559,6 +2564,62 @@ typedef struct vim_acl_solaris_T {
 } vim_acl_solaris_T;
 # endif
 
+#if defined(HAVE_SELINUX) || defined(PROTO)
+/*
+ * Copy security info from "from_file" to "to_file".
+ */
+    void
+mch_copy_sec(from_file, to_file)
+    char_u	*from_file;
+    char_u	*to_file;
+{
+    if (from_file == NULL)
+	return;
+
+    if (selinux_enabled == -1)
+	selinux_enabled = is_selinux_enabled();
+
+    if (selinux_enabled > 0)
+    {
+	security_context_t from_context = NULL;
+	security_context_t to_context = NULL;
+
+	if (getfilecon((char *)from_file, &from_context) < 0)
+	{
+	    /* If the filesystem doesn't support extended attributes,
+	       the original had no special security context and the
+	       target cannot have one either.  */
+	    if (errno == EOPNOTSUPP)
+		return;
+
+	    MSG_PUTS(_("\nCould not get security context for "));
+	    msg_outtrans(from_file);
+	    msg_putchar('\n');
+	    return;
+	}
+	if (getfilecon((char *)to_file, &to_context) < 0)
+	{
+	    MSG_PUTS(_("\nCould not get security context for "));
+	    msg_outtrans(to_file);
+	    msg_putchar('\n');
+	    freecon (from_context);
+	    return ;
+	}
+	if (strcmp(from_context, to_context) != 0)
+	{
+	    if (setfilecon((char *)to_file, from_context) < 0)
+	    {
+		MSG_PUTS(_("\nCould not set security context for "));
+		msg_outtrans(to_file);
+		msg_putchar('\n');
+	    }
+	}
+	freecon(to_context);
+	freecon(from_context);
+    }
+}
+#endif /* HAVE_SELINUX */
+
 /*
  * Return a pointer to the ACL of file "fname" in allocated memory.
  * Return NULL if the ACL is not available for whatever reason.
diff --git a/src/proto/os_unix.pro b/src/proto/os_unix.pro
index 5bf6c8abe1..735565a258 100644
--- a/src/proto/os_unix.pro
+++ b/src/proto/os_unix.pro
@@ -34,6 +34,7 @@ int mch_isFullName __ARGS((char_u *fname));
 void fname_case __ARGS((char_u *name, int len));
 long mch_getperm __ARGS((char_u *name));
 int mch_setperm __ARGS((char_u *name, long perm));
+void mch_copy_sec __ARGS((char_u *from_file, char_u *to_file));
 vim_acl_T mch_get_acl __ARGS((char_u *fname));
 void mch_set_acl __ARGS((char_u *fname, vim_acl_T aclent));
 void mch_free_acl __ARGS((vim_acl_T aclent));
diff --git a/src/version.c b/src/version.c
index 740b799074..9c22236677 100644
--- a/src/version.c
+++ b/src/version.c
@@ -681,6 +681,14 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    297,
+/**/
+    296,
+/**/
+    295,
+/**/
+    294,
 /**/
     293,
 /**/
diff --git a/src/vimtutor b/src/vimtutor
index 731b1ef235..70d9ec7412 100755
--- a/src/vimtutor
+++ b/src/vimtutor
@@ -2,11 +2,24 @@
 
 # Start Vim on a copy of the tutor file.
 
-# Usage: vimtutor [xx], where xx is a language code like "es" or "nl".
+# Usage: vimtutor [-g] [xx]
+# Where optional argument -g starts vimtutor in gvim (GUI) instead of vim.
+# and xx is a language code like "es" or "nl".
 # When an argument is given, it tries loading that tutor.
 # When this fails or no argument was given, it tries using 'v:lang'
 # When that also fails, it uses the English version.
 
+# Vim could be called "vim" or "vi".  Also check for "vimN", for people who
+# have Vim installed with its version number.
+# We anticipate up to a future Vim 8 version :-).
+seq="vim vim8 vim75 vim74 vim73 vim72 vim71 vim70 vim7 vim6 vi"
+if test "$1" = "-g"; then 
+  # Try to use the GUI version of Vim if possible, it will fall back
+  # on Vim if Gvim is not installed.
+  seq="gvim gvim8 gvim75 gvim74 gvim73 gvim72 gvim71 gvim70 gvim7 gvim6 $seq"
+  shift
+fi
+
 xx=$1
 export xx
 
@@ -39,10 +52,6 @@ export TUTORCOPY
 # remove the copy of the tutor on exit
 trap "rm -rf $TODELETE" 0 1 2 3 9 11 13 15
 
-# Vim could be called "vim" or "vi".  Also check for "vimN", for people who
-# have Vim installed with its version number.
-# We anticipate up to a future Vim 8 version :-).
-seq="vim vim8 vim75 vim74 vim73 vim72 vim71 vim70 vim7 vim6 vi"
 for i in $seq; do
 	testvim=`which $i 2>/dev/null`
 	if test -f "$testvim"; then
@@ -59,7 +68,7 @@ fi
 
 # Use Vim to copy the tutor, it knows the value of $VIMRUNTIME
 # The script tutor.vim tells Vim which file to copy
-$VIM -u NONE -c 'so $VIMRUNTIME/tutor/tutor.vim'
+$VIM -f -u NONE -c 'so $VIMRUNTIME/tutor/tutor.vim'
 
 # Start vim without any .vimrc, set 'nocompatible'
-$VIM -u NONE -c "set nocp" $TUTORCOPY
+$VIM -f -u NONE -c "set nocp" $TUTORCOPY