diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/arch/x86/boot/header.S linux-libre-3.15-gnu/arch/x86/boot/header.S
--- linux-libre-3.15-rc8-gnu/arch/x86/boot/header.S	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/arch/x86/boot/header.S	2014-06-08 14:19:54.000000000 -0400
@@ -375,8 +375,7 @@ xloadflags:
 # define XLF0 0
 #endif
 
-#if defined(CONFIG_RELOCATABLE) && defined(CONFIG_X86_64) && \
-	!defined(CONFIG_EFI_MIXED)
+#if defined(CONFIG_RELOCATABLE) && defined(CONFIG_X86_64)
    /* kernel/boot_param/ramdisk could be loaded above 4g */
 # define XLF1 XLF_CAN_BE_LOADED_ABOVE_4G
 #else
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/arch/x86/kernel/irq.c linux-libre-3.15-gnu/arch/x86/kernel/irq.c
--- linux-libre-3.15-rc8-gnu/arch/x86/kernel/irq.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/arch/x86/kernel/irq.c	2014-06-08 14:19:54.000000000 -0400
@@ -17,6 +17,7 @@
 #include <asm/idle.h>
 #include <asm/mce.h>
 #include <asm/hw_irq.h>
+#include <asm/desc.h>
 
 #define CREATE_TRACE_POINTS
 #include <asm/trace/irq_vectors.h>
@@ -334,10 +335,17 @@ int check_irq_vectors_for_cpu_disable(vo
 	for_each_online_cpu(cpu) {
 		if (cpu == this_cpu)
 			continue;
-		for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
-		     vector++) {
-			if (per_cpu(vector_irq, cpu)[vector] < 0)
-				count++;
+		/*
+		 * We scan from FIRST_EXTERNAL_VECTOR to first system
+		 * vector. If the vector is marked in the used vectors
+		 * bitmap or an irq is assigned to it, we don't count
+		 * it as available.
+		 */
+		for (vector = FIRST_EXTERNAL_VECTOR;
+		     vector < first_system_vector; vector++) {
+			if (!test_bit(vector, used_vectors) &&
+			    per_cpu(vector_irq, cpu)[vector] < 0)
+					count++;
 		}
 	}
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/arch/x86/kernel/smpboot.c linux-libre-3.15-gnu/arch/x86/kernel/smpboot.c
--- linux-libre-3.15-rc8-gnu/arch/x86/kernel/smpboot.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/arch/x86/kernel/smpboot.c	2014-06-08 14:19:54.000000000 -0400
@@ -859,9 +859,6 @@ static int do_boot_cpu(int apicid, int c
 
 		/* was set by cpu_init() */
 		cpumask_clear_cpu(cpu, cpu_initialized_mask);
-
-		set_cpu_present(cpu, false);
-		per_cpu(x86_cpu_to_apicid, cpu) = BAD_APICID;
 	}
 
 	/* mark "stuck" area as not stuck */
@@ -921,7 +918,7 @@ int native_cpu_up(unsigned int cpu, stru
 
 	err = do_boot_cpu(apicid, cpu, tidle);
 	if (err) {
-		pr_debug("do_boot_cpu failed %d\n", err);
+		pr_err("do_boot_cpu failed(%d) to wakeup CPU#%u\n", err, cpu);
 		return -EIO;
 	}
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/arch/x86/platform/efi/efi.c linux-libre-3.15-gnu/arch/x86/platform/efi/efi.c
--- linux-libre-3.15-rc8-gnu/arch/x86/platform/efi/efi.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/arch/x86/platform/efi/efi.c	2014-06-08 14:19:54.000000000 -0400
@@ -919,6 +919,9 @@ static void __init save_runtime_map(void
 	void *tmp, *p, *q = NULL;
 	int count = 0;
 
+	if (efi_enabled(EFI_OLD_MEMMAP))
+		return;
+
 	for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
 		md = p;
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/arch/x86/vdso/vdso32-setup.c linux-libre-3.15-gnu/arch/x86/vdso/vdso32-setup.c
--- linux-libre-3.15-rc8-gnu/arch/x86/vdso/vdso32-setup.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/arch/x86/vdso/vdso32-setup.c	2014-06-08 14:19:54.000000000 -0400
@@ -155,6 +155,7 @@ int arch_setup_additional_pages(struct l
 	unsigned long addr;
 	int ret = 0;
 	struct vm_area_struct *vma;
+	static struct page *no_pages[] = {NULL};
 
 #ifdef CONFIG_X86_X32_ABI
 	if (test_thread_flag(TIF_X32))
@@ -193,7 +194,7 @@ int arch_setup_additional_pages(struct l
 			addr -  VDSO_OFFSET(VDSO_PREV_PAGES),
 			VDSO_OFFSET(VDSO_PREV_PAGES),
 			VM_READ,
-			NULL);
+			no_pages);
 
 	if (IS_ERR(vma)) {
 		ret = PTR_ERR(vma);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/ata/libata-core.c linux-libre-3.15-gnu/drivers/ata/libata-core.c
--- linux-libre-3.15-rc8-gnu/drivers/ata/libata-core.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/ata/libata-core.c	2014-06-08 14:19:54.000000000 -0400
@@ -4224,10 +4224,10 @@ static const struct ata_blacklist_entry
 	{ "PIONEER DVD-RW  DVR-216D",	NULL,	ATA_HORKAGE_NOSETXFER },
 
 	/* devices that don't properly handle queued TRIM commands */
-	{ "Micron_M500*",		"MU0[1-4]*",	ATA_HORKAGE_NO_NCQ_TRIM, },
-	{ "Crucial_CT???M500SSD*",	"MU0[1-4]*",	ATA_HORKAGE_NO_NCQ_TRIM, },
-	{ "Micron_M550*",		NULL,		ATA_HORKAGE_NO_NCQ_TRIM, },
-	{ "Crucial_CT???M550SSD*",	NULL,		ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Micron_M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Crucial_CT???M500SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Micron_M550*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Crucial_CT???M550SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
 
 	/*
 	 * Some WD SATA-I drives spin up and down erratically when the link
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/cpufreq/intel_pstate.c linux-libre-3.15-gnu/drivers/cpufreq/intel_pstate.c
--- linux-libre-3.15-rc8-gnu/drivers/cpufreq/intel_pstate.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/cpufreq/intel_pstate.c	2014-06-08 14:19:54.000000000 -0400
@@ -40,10 +40,10 @@
 #define BYT_TURBO_VIDS		0x66d
 
 
-#define FRAC_BITS 6
+#define FRAC_BITS 8
 #define int_tofp(X) ((int64_t)(X) << FRAC_BITS)
 #define fp_toint(X) ((X) >> FRAC_BITS)
-#define FP_ROUNDUP(X) ((X) += 1 << FRAC_BITS)
+
 
 static inline int32_t mul_fp(int32_t x, int32_t y)
 {
@@ -59,8 +59,8 @@ struct sample {
 	int32_t core_pct_busy;
 	u64 aperf;
 	u64 mperf;
-	unsigned long long tsc;
 	int freq;
+	ktime_t time;
 };
 
 struct pstate_data {
@@ -98,9 +98,9 @@ struct cpudata {
 	struct vid_data vid;
 	struct _pid pid;
 
+	ktime_t last_sample_time;
 	u64	prev_aperf;
 	u64	prev_mperf;
-	unsigned long long prev_tsc;
 	struct sample sample;
 };
 
@@ -200,7 +200,10 @@ static signed int pid_calc(struct _pid *
 	pid->last_err = fp_error;
 
 	result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
-
+	if (result >= 0)
+		result = result + (1 << (FRAC_BITS-1));
+	else
+		result = result - (1 << (FRAC_BITS-1));
 	return (signed int)fp_toint(result);
 }
 
@@ -560,47 +563,42 @@ static void intel_pstate_get_cpu_pstates
 static inline void intel_pstate_calc_busy(struct cpudata *cpu,
 					struct sample *sample)
 {
-	int32_t core_pct;
-	int32_t c0_pct;
+	int64_t core_pct;
+	int32_t rem;
 
-	core_pct = div_fp(int_tofp((sample->aperf)),
-			int_tofp((sample->mperf)));
-	core_pct = mul_fp(core_pct, int_tofp(100));
-	FP_ROUNDUP(core_pct);
+	core_pct = int_tofp(sample->aperf) * int_tofp(100);
+	core_pct = div_u64_rem(core_pct, int_tofp(sample->mperf), &rem);
 
-	c0_pct = div_fp(int_tofp(sample->mperf), int_tofp(sample->tsc));
+	if ((rem << 1) >= int_tofp(sample->mperf))
+		core_pct += 1;
 
 	sample->freq = fp_toint(
 		mul_fp(int_tofp(cpu->pstate.max_pstate * 1000), core_pct));
 
-	sample->core_pct_busy = mul_fp(core_pct, c0_pct);
+	sample->core_pct_busy = (int32_t)core_pct;
 }
 
 static inline void intel_pstate_sample(struct cpudata *cpu)
 {
 	u64 aperf, mperf;
-	unsigned long long tsc;
 
 	rdmsrl(MSR_IA32_APERF, aperf);
 	rdmsrl(MSR_IA32_MPERF, mperf);
-	tsc = native_read_tsc();
 
 	aperf = aperf >> FRAC_BITS;
 	mperf = mperf >> FRAC_BITS;
-	tsc = tsc >> FRAC_BITS;
 
+	cpu->last_sample_time = cpu->sample.time;
+	cpu->sample.time = ktime_get();
 	cpu->sample.aperf = aperf;
 	cpu->sample.mperf = mperf;
-	cpu->sample.tsc = tsc;
 	cpu->sample.aperf -= cpu->prev_aperf;
 	cpu->sample.mperf -= cpu->prev_mperf;
-	cpu->sample.tsc -= cpu->prev_tsc;
 
 	intel_pstate_calc_busy(cpu, &cpu->sample);
 
 	cpu->prev_aperf = aperf;
 	cpu->prev_mperf = mperf;
-	cpu->prev_tsc = tsc;
 }
 
 static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
@@ -614,13 +612,25 @@ static inline void intel_pstate_set_samp
 
 static inline int32_t intel_pstate_get_scaled_busy(struct cpudata *cpu)
 {
-	int32_t core_busy, max_pstate, current_pstate;
+	int32_t core_busy, max_pstate, current_pstate, sample_ratio;
+	u32 duration_us;
+	u32 sample_time;
 
 	core_busy = cpu->sample.core_pct_busy;
 	max_pstate = int_tofp(cpu->pstate.max_pstate);
 	current_pstate = int_tofp(cpu->pstate.current_pstate);
 	core_busy = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
-	return FP_ROUNDUP(core_busy);
+
+	sample_time = (pid_params.sample_rate_ms  * USEC_PER_MSEC);
+	duration_us = (u32) ktime_us_delta(cpu->sample.time,
+					cpu->last_sample_time);
+	if (duration_us > sample_time * 3) {
+		sample_ratio = div_fp(int_tofp(sample_time),
+				int_tofp(duration_us));
+		core_busy = mul_fp(core_busy, sample_ratio);
+	}
+
+	return core_busy;
 }
 
 static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/gpu/drm/drm_crtc_helper.c linux-libre-3.15-gnu/drivers/gpu/drm/drm_crtc_helper.c
--- linux-libre-3.15-rc8-gnu/drivers/gpu/drm/drm_crtc_helper.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/gpu/drm/drm_crtc_helper.c	2014-06-08 14:19:54.000000000 -0400
@@ -29,6 +29,7 @@
  *      Jesse Barnes <jesse.barnes@intel.com>
  */
 
+#include <linux/kernel.h>
 #include <linux/export.h>
 #include <linux/moduleparam.h>
 
@@ -88,7 +89,13 @@ bool drm_helper_encoder_in_use(struct dr
 	struct drm_connector *connector;
 	struct drm_device *dev = encoder->dev;
 
-	WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+	/*
+	 * We can expect this mutex to be locked if we are not panicking.
+	 * Locking is currently fubar in the panic handler.
+	 */
+	if (!oops_in_progress)
+		WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+
 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
 		if (connector->encoder == encoder)
 			return true;
@@ -112,7 +119,13 @@ bool drm_helper_crtc_in_use(struct drm_c
 	struct drm_encoder *encoder;
 	struct drm_device *dev = crtc->dev;
 
-	WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+	/*
+	 * We can expect this mutex to be locked if we are not panicking.
+	 * Locking is currently fubar in the panic handler.
+	 */
+	if (!oops_in_progress)
+		WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+
 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
 		if (encoder->crtc == crtc && drm_helper_encoder_in_use(encoder))
 			return true;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/atombios_crtc.c linux-libre-3.15-gnu/drivers/gpu/drm/radeon/atombios_crtc.c
--- linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/atombios_crtc.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/gpu/drm/radeon/atombios_crtc.c	2014-06-08 14:19:54.000000000 -0400
@@ -270,8 +270,6 @@ void atombios_crtc_dpms(struct drm_crtc
 	switch (mode) {
 	case DRM_MODE_DPMS_ON:
 		radeon_crtc->enabled = true;
-		/* adjust pm to dpms changes BEFORE enabling crtcs */
-		radeon_pm_compute_clocks(rdev);
 		atombios_enable_crtc(crtc, ATOM_ENABLE);
 		if (ASIC_IS_DCE3(rdev) && !ASIC_IS_DCE6(rdev))
 			atombios_enable_crtc_memreq(crtc, ATOM_ENABLE);
@@ -289,10 +287,10 @@ void atombios_crtc_dpms(struct drm_crtc
 			atombios_enable_crtc_memreq(crtc, ATOM_DISABLE);
 		atombios_enable_crtc(crtc, ATOM_DISABLE);
 		radeon_crtc->enabled = false;
-		/* adjust pm to dpms changes AFTER disabling crtcs */
-		radeon_pm_compute_clocks(rdev);
 		break;
 	}
+	/* adjust pm to dpms */
+	radeon_pm_compute_clocks(rdev);
 }
 
 static void
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/radeon_asic.c linux-libre-3.15-gnu/drivers/gpu/drm/radeon/radeon_asic.c
--- linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/radeon_asic.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/gpu/drm/radeon/radeon_asic.c	2014-06-08 14:19:54.000000000 -0400
@@ -2049,8 +2049,8 @@ static struct radeon_asic ci_asic = {
 		.blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
 		.dma = &cik_copy_dma,
 		.dma_ring_index = R600_RING_TYPE_DMA_INDEX,
-		.copy = &cik_copy_dma,
-		.copy_ring_index = R600_RING_TYPE_DMA_INDEX,
+		.copy = &cik_copy_cpdma,
+		.copy_ring_index = RADEON_RING_TYPE_GFX_INDEX,
 	},
 	.surface = {
 		.set_reg = r600_set_surface_reg,
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/radeon_device.c linux-libre-3.15-gnu/drivers/gpu/drm/radeon/radeon_device.c
--- linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/radeon_device.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/gpu/drm/radeon/radeon_device.c	2014-06-08 14:19:54.000000000 -0400
@@ -1558,6 +1558,10 @@ int radeon_resume_kms(struct drm_device
 
 	drm_kms_helper_poll_enable(dev);
 
+	/* set the power state here in case we are a PX system or headless */
+	if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)
+		radeon_pm_compute_clocks(rdev);
+
 	if (fbcon) {
 		radeon_fbdev_set_suspend(rdev, 0);
 		console_unlock();
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/radeon_pm.c linux-libre-3.15-gnu/drivers/gpu/drm/radeon/radeon_pm.c
--- linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/radeon_pm.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/gpu/drm/radeon/radeon_pm.c	2014-06-08 14:19:54.000000000 -0400
@@ -1104,7 +1104,6 @@ static void radeon_pm_resume_dpm(struct
 	if (ret)
 		goto dpm_resume_fail;
 	rdev->pm.dpm_enabled = true;
-	radeon_pm_compute_clocks(rdev);
 	return;
 
 dpm_resume_fail:
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/radeon_vm.c linux-libre-3.15-gnu/drivers/gpu/drm/radeon/radeon_vm.c
--- linux-libre-3.15-rc8-gnu/drivers/gpu/drm/radeon/radeon_vm.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/gpu/drm/radeon/radeon_vm.c	2014-06-08 14:19:54.000000000 -0400
@@ -132,7 +132,7 @@ struct radeon_cs_reloc *radeon_vm_get_bo
 	struct radeon_cs_reloc *list;
 	unsigned i, idx;
 
-	list = kmalloc_array(vm->max_pde_used + 1,
+	list = kmalloc_array(vm->max_pde_used + 2,
 			     sizeof(struct radeon_cs_reloc), GFP_KERNEL);
 	if (!list)
 		return NULL;
@@ -585,7 +585,8 @@ int radeon_vm_update_page_directory(stru
 {
 	static const uint32_t incr = RADEON_VM_PTE_COUNT * 8;
 
-	uint64_t pd_addr = radeon_bo_gpu_offset(vm->page_directory);
+	struct radeon_bo *pd = vm->page_directory;
+	uint64_t pd_addr = radeon_bo_gpu_offset(pd);
 	uint64_t last_pde = ~0, last_pt = ~0;
 	unsigned count = 0, pt_idx, ndw;
 	struct radeon_ib ib;
@@ -642,6 +643,7 @@ int radeon_vm_update_page_directory(stru
 					incr, R600_PTE_VALID);
 
 	if (ib.length_dw != 0) {
+		radeon_semaphore_sync_to(ib.semaphore, pd->tbo.sync_obj);
 		radeon_semaphore_sync_to(ib.semaphore, vm->last_id_use);
 		r = radeon_ib_schedule(rdev, &ib, NULL);
 		if (r) {
@@ -689,15 +691,18 @@ static void radeon_vm_update_ptes(struct
 	/* walk over the address space and update the page tables */
 	for (addr = start; addr < end; ) {
 		uint64_t pt_idx = addr >> RADEON_VM_BLOCK_SIZE;
+		struct radeon_bo *pt = vm->page_tables[pt_idx].bo;
 		unsigned nptes;
 		uint64_t pte;
 
+		radeon_semaphore_sync_to(ib->semaphore, pt->tbo.sync_obj);
+
 		if ((addr & ~mask) == (end & ~mask))
 			nptes = end - addr;
 		else
 			nptes = RADEON_VM_PTE_COUNT - (addr & mask);
 
-		pte = radeon_bo_gpu_offset(vm->page_tables[pt_idx].bo);
+		pte = radeon_bo_gpu_offset(pt);
 		pte += (addr & mask) * 8;
 
 		if ((last_pte + 8 * count) != pte) {
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/infiniband/ulp/isert/ib_isert.c linux-libre-3.15-gnu/drivers/infiniband/ulp/isert/ib_isert.c
--- linux-libre-3.15-rc8-gnu/drivers/infiniband/ulp/isert/ib_isert.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/infiniband/ulp/isert/ib_isert.c	2014-06-08 14:19:54.000000000 -0400
@@ -1210,6 +1210,8 @@ sequence_cmd:
 
 	if (!rc && dump_payload == false && unsol_data)
 		iscsit_set_unsoliticed_dataout(cmd);
+	else if (dump_payload && imm_data)
+		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/md/md.c linux-libre-3.15-gnu/drivers/md/md.c
--- linux-libre-3.15-rc8-gnu/drivers/md/md.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/md/md.c	2014-06-08 14:19:54.000000000 -0400
@@ -7381,8 +7381,10 @@ void md_do_sync(struct md_thread *thread
 	/* just incase thread restarts... */
 	if (test_bit(MD_RECOVERY_DONE, &mddev->recovery))
 		return;
-	if (mddev->ro) /* never try to sync a read-only array */
+	if (mddev->ro) {/* never try to sync a read-only array */
+		set_bit(MD_RECOVERY_INTR, &mddev->recovery);
 		return;
+	}
 
 	if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
 		if (test_bit(MD_RECOVERY_CHECK, &mddev->recovery)) {
@@ -7824,6 +7826,7 @@ void md_check_recovery(struct mddev *mdd
 			/* There is no thread, but we need to call
 			 * ->spare_active and clear saved_raid_disk
 			 */
+			set_bit(MD_RECOVERY_INTR, &mddev->recovery);
 			md_reap_sync_thread(mddev);
 			clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
 			goto unlock;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/can/led.c linux-libre-3.15-gnu/drivers/net/can/led.c
--- linux-libre-3.15-rc8-gnu/drivers/net/can/led.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/can/led.c	2014-06-08 14:19:54.000000000 -0400
@@ -97,6 +97,9 @@ static int can_led_notifier(struct notif
 	if (!priv)
 		return NOTIFY_DONE;
 
+	if (!priv->tx_led_trig || !priv->rx_led_trig)
+		return NOTIFY_DONE;
+
 	if (msg == NETDEV_CHANGENAME) {
 		snprintf(name, sizeof(name), "%s-tx", netdev->name);
 		led_trigger_rename_static(name, priv->tx_led_trig);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/ibm/emac/mal.c linux-libre-3.15-gnu/drivers/net/ethernet/ibm/emac/mal.c
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/ibm/emac/mal.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/ibm/emac/mal.c	2014-06-08 14:19:54.000000000 -0400
@@ -682,10 +682,7 @@ static int mal_probe(struct platform_dev
 		goto fail6;
 
 	/* Enable all MAL SERR interrupt sources */
-	if (mal->version == 2)
-		set_mal_dcrn(mal, MAL_IER, MAL2_IER_EVENTS);
-	else
-		set_mal_dcrn(mal, MAL_IER, MAL1_IER_EVENTS);
+	set_mal_dcrn(mal, MAL_IER, MAL_IER_EVENTS);
 
 	/* Enable EOB interrupt */
 	mal_enable_eob_irq(mal);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/ibm/emac/mal.h linux-libre-3.15-gnu/drivers/net/ethernet/ibm/emac/mal.h
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/ibm/emac/mal.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/ibm/emac/mal.h	2014-06-08 14:19:54.000000000 -0400
@@ -95,24 +95,20 @@
 
 
 #define MAL_IER			0x02
+/* MAL IER bits */
 #define   MAL_IER_DE		0x00000010
 #define   MAL_IER_OTE		0x00000004
 #define   MAL_IER_OE		0x00000002
 #define   MAL_IER_PE		0x00000001
-/* MAL V1 IER bits */
-#define   MAL1_IER_NWE		0x00000008
-#define   MAL1_IER_SOC_EVENTS	MAL1_IER_NWE
-#define   MAL1_IER_EVENTS	(MAL1_IER_SOC_EVENTS | MAL_IER_DE | \
-				 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
 
-/* MAL V2 IER bits */
-#define   MAL2_IER_PT		0x00000080
-#define   MAL2_IER_PRE		0x00000040
-#define   MAL2_IER_PWE		0x00000020
-#define   MAL2_IER_SOC_EVENTS	(MAL2_IER_PT | MAL2_IER_PRE | MAL2_IER_PWE)
-#define   MAL2_IER_EVENTS	(MAL2_IER_SOC_EVENTS | MAL_IER_DE | \
-				 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
+/* PLB read/write/timeout errors */
+#define   MAL_IER_PTE		0x00000080
+#define   MAL_IER_PRE		0x00000040
+#define   MAL_IER_PWE		0x00000020
 
+#define   MAL_IER_SOC_EVENTS	(MAL_IER_PTE | MAL_IER_PRE | MAL_IER_PWE)
+#define   MAL_IER_EVENTS	(MAL_IER_SOC_EVENTS | MAL_IER_DE | \
+				 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
 
 #define MAL_TXCASR		0x04
 #define MAL_TXCARR		0x05
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/ibm/emac/rgmii.c linux-libre-3.15-gnu/drivers/net/ethernet/ibm/emac/rgmii.c
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/ibm/emac/rgmii.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/ibm/emac/rgmii.c	2014-06-08 14:19:54.000000000 -0400
@@ -45,6 +45,7 @@
 
 /* RGMIIx_SSR */
 #define RGMII_SSR_MASK(idx)	(0x7 << ((idx) * 8))
+#define RGMII_SSR_10(idx)	(0x1 << ((idx) * 8))
 #define RGMII_SSR_100(idx)	(0x2 << ((idx) * 8))
 #define RGMII_SSR_1000(idx)	(0x4 << ((idx) * 8))
 
@@ -139,6 +140,8 @@ void rgmii_set_speed(struct platform_dev
 		ssr |= RGMII_SSR_1000(input);
 	else if (speed == SPEED_100)
 		ssr |= RGMII_SSR_100(input);
+	else if (speed == SPEED_10)
+		ssr |= RGMII_SSR_10(input);
 
 	out_be32(&p->ssr, ssr);
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/Kconfig linux-libre-3.15-gnu/drivers/net/ethernet/Kconfig
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/Kconfig	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/Kconfig	2014-06-08 14:19:54.000000000 -0400
@@ -39,6 +39,7 @@ source "drivers/net/ethernet/cisco/Kconf
 config CX_ECAT
 	tristate "Beckhoff CX5020 EtherCAT master support"
 	depends on PCI
+	depends on X86 || COMPILE_TEST
 	---help---
 	  Driver for EtherCAT master module located on CCAT FPGA
 	  that can be found on Beckhoff CX5020, and possibly other of CX
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/mellanox/mlx4/main.c linux-libre-3.15-gnu/drivers/net/ethernet/mellanox/mlx4/main.c
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/mellanox/mlx4/main.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/mellanox/mlx4/main.c	2014-06-08 14:19:54.000000000 -0400
@@ -2044,6 +2044,7 @@ static int mlx4_init_port_info(struct ml
 	if (!mlx4_is_slave(dev)) {
 		mlx4_init_mac_table(dev, &info->mac_table);
 		mlx4_init_vlan_table(dev, &info->vlan_table);
+		mlx4_init_roce_gid_table(dev, &info->gid_table);
 		info->base_qpn = mlx4_get_base_qpn(dev, port);
 	}
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/mellanox/mlx4/mlx4.h linux-libre-3.15-gnu/drivers/net/ethernet/mellanox/mlx4/mlx4.h
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/mellanox/mlx4/mlx4.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/mellanox/mlx4/mlx4.h	2014-06-08 14:19:54.000000000 -0400
@@ -695,6 +695,17 @@ struct mlx4_mac_table {
 	int			max;
 };
 
+#define MLX4_ROCE_GID_ENTRY_SIZE	16
+
+struct mlx4_roce_gid_entry {
+	u8 raw[MLX4_ROCE_GID_ENTRY_SIZE];
+};
+
+struct mlx4_roce_gid_table {
+	struct mlx4_roce_gid_entry	roce_gids[MLX4_ROCE_MAX_GIDS];
+	struct mutex			mutex;
+};
+
 #define MLX4_MAX_VLAN_NUM	128
 #define MLX4_VLAN_TABLE_SIZE	(MLX4_MAX_VLAN_NUM << 2)
 
@@ -758,6 +769,7 @@ struct mlx4_port_info {
 	struct device_attribute port_mtu_attr;
 	struct mlx4_mac_table	mac_table;
 	struct mlx4_vlan_table	vlan_table;
+	struct mlx4_roce_gid_table gid_table;
 	int			base_qpn;
 };
 
@@ -788,10 +800,6 @@ enum {
 	MLX4_USE_RR	= 1,
 };
 
-struct mlx4_roce_gid_entry {
-	u8 raw[16];
-};
-
 struct mlx4_priv {
 	struct mlx4_dev		dev;
 
@@ -839,7 +847,6 @@ struct mlx4_priv {
 	int			fs_hash_mode;
 	u8 virt2phys_pkey[MLX4_MFUNC_MAX][MLX4_MAX_PORTS][MLX4_MAX_PORT_PKEYS];
 	__be64			slave_node_guids[MLX4_MFUNC_MAX];
-	struct mlx4_roce_gid_entry roce_gids[MLX4_MAX_PORTS][MLX4_ROCE_MAX_GIDS];
 
 	atomic_t		opreq_count;
 	struct work_struct	opreq_task;
@@ -1140,6 +1147,8 @@ int mlx4_change_port_types(struct mlx4_d
 
 void mlx4_init_mac_table(struct mlx4_dev *dev, struct mlx4_mac_table *table);
 void mlx4_init_vlan_table(struct mlx4_dev *dev, struct mlx4_vlan_table *table);
+void mlx4_init_roce_gid_table(struct mlx4_dev *dev,
+			      struct mlx4_roce_gid_table *table);
 void __mlx4_unregister_vlan(struct mlx4_dev *dev, u8 port, u16 vlan);
 int __mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index);
 
@@ -1149,6 +1158,7 @@ int mlx4_get_slave_from_resource_id(stru
 				    enum mlx4_resource resource_type,
 				    u64 resource_id, int *slave);
 void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave_id);
+void mlx4_reset_roce_gids(struct mlx4_dev *dev, int slave);
 int mlx4_init_resource_tracker(struct mlx4_dev *dev);
 
 void mlx4_free_resource_tracker(struct mlx4_dev *dev,
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/mellanox/mlx4/port.c linux-libre-3.15-gnu/drivers/net/ethernet/mellanox/mlx4/port.c
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/mellanox/mlx4/port.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/mellanox/mlx4/port.c	2014-06-08 14:19:54.000000000 -0400
@@ -75,6 +75,16 @@ void mlx4_init_vlan_table(struct mlx4_de
 	table->total = 0;
 }
 
+void mlx4_init_roce_gid_table(struct mlx4_dev *dev,
+			      struct mlx4_roce_gid_table *table)
+{
+	int i;
+
+	mutex_init(&table->mutex);
+	for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++)
+		memset(table->roce_gids[i].raw, 0, MLX4_ROCE_GID_ENTRY_SIZE);
+}
+
 static int validate_index(struct mlx4_dev *dev,
 			  struct mlx4_mac_table *table, int index)
 {
@@ -584,6 +594,84 @@ int mlx4_get_base_gid_ix(struct mlx4_dev
 }
 EXPORT_SYMBOL_GPL(mlx4_get_base_gid_ix);
 
+static int mlx4_reset_roce_port_gids(struct mlx4_dev *dev, int slave,
+				     int port, struct mlx4_cmd_mailbox *mailbox)
+{
+	struct mlx4_roce_gid_entry *gid_entry_mbox;
+	struct mlx4_priv *priv = mlx4_priv(dev);
+	int num_gids, base, offset;
+	int i, err;
+
+	num_gids = mlx4_get_slave_num_gids(dev, slave, port);
+	base = mlx4_get_base_gid_ix(dev, slave, port);
+
+	memset(mailbox->buf, 0, MLX4_MAILBOX_SIZE);
+
+	mutex_lock(&(priv->port[port].gid_table.mutex));
+	/* Zero-out gids belonging to that slave in the port GID table */
+	for (i = 0, offset = base; i < num_gids; offset++, i++)
+		memcpy(priv->port[port].gid_table.roce_gids[offset].raw,
+		       zgid_entry.raw, MLX4_ROCE_GID_ENTRY_SIZE);
+
+	/* Now, copy roce port gids table to mailbox for passing to FW */
+	gid_entry_mbox = (struct mlx4_roce_gid_entry *)mailbox->buf;
+	for (i = 0; i < MLX4_ROCE_MAX_GIDS; gid_entry_mbox++, i++)
+		memcpy(gid_entry_mbox->raw,
+		       priv->port[port].gid_table.roce_gids[i].raw,
+		       MLX4_ROCE_GID_ENTRY_SIZE);
+
+	err = mlx4_cmd(dev, mailbox->dma,
+		       ((u32)port) | (MLX4_SET_PORT_GID_TABLE << 8), 1,
+		       MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
+		       MLX4_CMD_NATIVE);
+	mutex_unlock(&(priv->port[port].gid_table.mutex));
+	return err;
+}
+
+
+void mlx4_reset_roce_gids(struct mlx4_dev *dev, int slave)
+{
+	struct mlx4_active_ports actv_ports;
+	struct mlx4_cmd_mailbox *mailbox;
+	int num_eth_ports, err;
+	int i;
+
+	if (slave < 0 || slave > dev->num_vfs)
+		return;
+
+	actv_ports = mlx4_get_active_ports(dev, slave);
+
+	for (i = 0, num_eth_ports = 0; i < dev->caps.num_ports; i++) {
+		if (test_bit(i, actv_ports.ports)) {
+			if (dev->caps.port_type[i + 1] != MLX4_PORT_TYPE_ETH)
+				continue;
+			num_eth_ports++;
+		}
+	}
+
+	if (!num_eth_ports)
+		return;
+
+	/* have ETH ports.  Alloc mailbox for SET_PORT command */
+	mailbox = mlx4_alloc_cmd_mailbox(dev);
+	if (IS_ERR(mailbox))
+		return;
+
+	for (i = 0; i < dev->caps.num_ports; i++) {
+		if (test_bit(i, actv_ports.ports)) {
+			if (dev->caps.port_type[i + 1] != MLX4_PORT_TYPE_ETH)
+				continue;
+			err = mlx4_reset_roce_port_gids(dev, slave, i + 1, mailbox);
+			if (err)
+				mlx4_warn(dev, "Could not reset ETH port GID table for slave %d, port %d (%d)\n",
+					  slave, i + 1, err);
+		}
+	}
+
+	mlx4_free_cmd_mailbox(dev, mailbox);
+	return;
+}
+
 static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
 				u8 op_mod, struct mlx4_cmd_mailbox *inbox)
 {
@@ -692,10 +780,12 @@ static int mlx4_common_set_port(struct m
 			/* 2. Check that do not have duplicates in OTHER
 			 *    entries in the port GID table
 			 */
+
+			mutex_lock(&(priv->port[port].gid_table.mutex));
 			for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++) {
 				if (i >= base && i < base + num_gids)
 					continue; /* don't compare to slave's current gids */
-				gid_entry_tbl = &priv->roce_gids[port - 1][i];
+				gid_entry_tbl = &priv->port[port].gid_table.roce_gids[i];
 				if (!memcmp(gid_entry_tbl->raw, zgid_entry.raw, sizeof(zgid_entry)))
 					continue;
 				gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
@@ -709,6 +799,7 @@ static int mlx4_common_set_port(struct m
 						mlx4_warn(dev, "requested gid entry for slave:%d "
 							  "is a duplicate of gid at index %d\n",
 							  slave, i);
+						mutex_unlock(&(priv->port[port].gid_table.mutex));
 						return -EINVAL;
 					}
 				}
@@ -717,16 +808,24 @@ static int mlx4_common_set_port(struct m
 			/* insert slave GIDs with memcpy, starting at slave's base index */
 			gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
 			for (i = 0, offset = base; i < num_gids; gid_entry_mbox++, offset++, i++)
-				memcpy(priv->roce_gids[port - 1][offset].raw, gid_entry_mbox->raw, 16);
+				memcpy(priv->port[port].gid_table.roce_gids[offset].raw,
+				       gid_entry_mbox->raw, MLX4_ROCE_GID_ENTRY_SIZE);
 
 			/* Now, copy roce port gids table to current mailbox for passing to FW */
 			gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
 			for (i = 0; i < MLX4_ROCE_MAX_GIDS; gid_entry_mbox++, i++)
-				memcpy(gid_entry_mbox->raw, priv->roce_gids[port - 1][i].raw, 16);
+				memcpy(gid_entry_mbox->raw,
+				       priv->port[port].gid_table.roce_gids[i].raw,
+				       MLX4_ROCE_GID_ENTRY_SIZE);
 
-			break;
+			err = mlx4_cmd(dev, inbox->dma, in_mod & 0xffff, op_mod,
+				       MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
+				       MLX4_CMD_NATIVE);
+			mutex_unlock(&(priv->port[port].gid_table.mutex));
+			return err;
 		}
-		return mlx4_cmd(dev, inbox->dma, in_mod, op_mod,
+
+		return mlx4_cmd(dev, inbox->dma, in_mod & 0xffff, op_mod,
 				MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
 				MLX4_CMD_NATIVE);
 	}
@@ -1099,7 +1198,8 @@ int mlx4_get_slave_from_roce_gid(struct
 	num_vfs = bitmap_weight(slaves_pport.slaves, dev->num_vfs + 1) - 1;
 
 	for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++) {
-		if (!memcmp(priv->roce_gids[port - 1][i].raw, gid, 16)) {
+		if (!memcmp(priv->port[port].gid_table.roce_gids[i].raw, gid,
+			    MLX4_ROCE_GID_ENTRY_SIZE)) {
 			found_ix = i;
 			break;
 		}
@@ -1187,7 +1287,8 @@ int mlx4_get_roce_gid_from_slave(struct
 	if (!mlx4_is_master(dev))
 		return -EINVAL;
 
-	memcpy(gid, priv->roce_gids[port - 1][slave_id].raw, 16);
+	memcpy(gid, priv->port[port].gid_table.roce_gids[slave_id].raw,
+	       MLX4_ROCE_GID_ENTRY_SIZE);
 	return 0;
 }
 EXPORT_SYMBOL(mlx4_get_roce_gid_from_slave);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c linux-libre-3.15-gnu/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c	2014-06-08 14:19:54.000000000 -0400
@@ -586,6 +586,7 @@ void mlx4_free_resource_tracker(struct m
 			}
 			/* free master's vlans */
 			i = dev->caps.function;
+			mlx4_reset_roce_gids(dev, i);
 			mutex_lock(&priv->mfunc.master.res_tracker.slave_list[i].mutex);
 			rem_slave_vlans(dev, i);
 			mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[i].mutex);
@@ -4681,7 +4682,7 @@ static void rem_slave_xrcdns(struct mlx4
 void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
 {
 	struct mlx4_priv *priv = mlx4_priv(dev);
-
+	mlx4_reset_roce_gids(dev, slave);
 	mutex_lock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
 	rem_slave_vlans(dev, slave);
 	rem_slave_macs(dev, slave);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c linux-libre-3.15-gnu/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
--- linux-libre-3.15-rc8-gnu/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c	2014-06-08 14:19:54.000000000 -0400
@@ -1020,6 +1020,7 @@ static int qlcnic_dcb_peer_app_info(stru
 	struct qlcnic_dcb_cee *peer;
 	int i;
 
+	memset(info, 0, sizeof(*info));
 	*app_count = 0;
 
 	if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/team/team.c linux-libre-3.15-gnu/drivers/net/team/team.c
--- linux-libre-3.15-rc8-gnu/drivers/net/team/team.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/team/team.c	2014-06-08 14:19:54.000000000 -0400
@@ -1724,6 +1724,7 @@ static int team_change_mtu(struct net_de
 	 * to traverse list in reverse under rcu_read_lock
 	 */
 	mutex_lock(&team->lock);
+	team->port_mtu_change_allowed = true;
 	list_for_each_entry(port, &team->port_list, list) {
 		err = dev_set_mtu(port->dev, new_mtu);
 		if (err) {
@@ -1732,6 +1733,7 @@ static int team_change_mtu(struct net_de
 			goto unwind;
 		}
 	}
+	team->port_mtu_change_allowed = false;
 	mutex_unlock(&team->lock);
 
 	dev->mtu = new_mtu;
@@ -1741,6 +1743,7 @@ static int team_change_mtu(struct net_de
 unwind:
 	list_for_each_entry_continue_reverse(port, &team->port_list, list)
 		dev_set_mtu(port->dev, dev->mtu);
+	team->port_mtu_change_allowed = false;
 	mutex_unlock(&team->lock);
 
 	return err;
@@ -2851,7 +2854,9 @@ static int team_device_event(struct noti
 		break;
 	case NETDEV_PRECHANGEMTU:
 		/* Forbid to change mtu of underlaying device */
-		return NOTIFY_BAD;
+		if (!port->team->port_mtu_change_allowed)
+			return NOTIFY_BAD;
+		break;
 	case NETDEV_PRE_TYPE_CHANGE:
 		/* Forbid to change type of underlaying device */
 		return NOTIFY_BAD;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/usb/ipheth.c linux-libre-3.15-gnu/drivers/net/usb/ipheth.c
--- linux-libre-3.15-rc8-gnu/drivers/net/usb/ipheth.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/usb/ipheth.c	2014-06-08 14:19:54.000000000 -0400
@@ -59,6 +59,8 @@
 #define USB_PRODUCT_IPHONE_3GS  0x1294
 #define USB_PRODUCT_IPHONE_4	0x1297
 #define USB_PRODUCT_IPAD 0x129a
+#define USB_PRODUCT_IPAD_2	0x12a2
+#define USB_PRODUCT_IPAD_3	0x12a6
 #define USB_PRODUCT_IPAD_MINI    0x12ab
 #define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define USB_PRODUCT_IPHONE_4S	0x12a0
@@ -107,6 +109,14 @@ static struct usb_device_id ipheth_table
 		IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
 		IPHETH_USBINTF_PROTO) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(
+		USB_VENDOR_APPLE, USB_PRODUCT_IPAD_2,
+		IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+		IPHETH_USBINTF_PROTO) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(
+		USB_VENDOR_APPLE, USB_PRODUCT_IPAD_3,
+		IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+		IPHETH_USBINTF_PROTO) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(
 		USB_VENDOR_APPLE, USB_PRODUCT_IPAD_MINI,
 		IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
 		IPHETH_USBINTF_PROTO) },
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/usb/qmi_wwan.c linux-libre-3.15-gnu/drivers/net/usb/qmi_wwan.c
--- linux-libre-3.15-rc8-gnu/drivers/net/usb/qmi_wwan.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/usb/qmi_wwan.c	2014-06-08 14:19:54.000000000 -0400
@@ -748,11 +748,15 @@ static const struct usb_device_id produc
 	{QMI_FIXED_INTF(0x1199, 0x68a2, 19)},	/* Sierra Wireless MC7710 in QMI mode */
 	{QMI_FIXED_INTF(0x1199, 0x68c0, 8)},	/* Sierra Wireless MC73xx */
 	{QMI_FIXED_INTF(0x1199, 0x68c0, 10)},	/* Sierra Wireless MC73xx */
-	{QMI_FIXED_INTF(0x1199, 0x68c0, 11)},	/* Sierra Wireless MC73xx */
 	{QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
 	{QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
 	{QMI_FIXED_INTF(0x1199, 0x9041, 8)},	/* Sierra Wireless MC7305/MC7355 */
 	{QMI_FIXED_INTF(0x1199, 0x9051, 8)},	/* Netgear AirCard 340U */
+	{QMI_FIXED_INTF(0x1199, 0x9053, 8)},	/* Sierra Wireless Modem */
+	{QMI_FIXED_INTF(0x1199, 0x9054, 8)},	/* Sierra Wireless Modem */
+	{QMI_FIXED_INTF(0x1199, 0x9055, 8)},	/* Netgear AirCard 341U */
+	{QMI_FIXED_INTF(0x1199, 0x9056, 8)},	/* Sierra Wireless Modem */
+	{QMI_FIXED_INTF(0x1199, 0x9061, 8)},	/* Sierra Wireless Modem */
 	{QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},	/* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
 	{QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},	/* Alcatel L800MA */
 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c linux-libre-3.15-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c
--- linux-libre-3.15-rc8-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c	2014-06-08 14:19:54.000000000 -0400
@@ -826,7 +826,7 @@ static int iwl_mvm_mac_add_interface(str
 	if (ret)
 		goto out_remove_mac;
 
-	if (!mvm->bf_allowed_vif &&
+	if (!mvm->bf_allowed_vif && false &&
 	    vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
 	    mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BF_UPDATED){
 		mvm->bf_allowed_vif = mvmvif;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/staging/comedi/drivers/ni_daq_700.c linux-libre-3.15-gnu/drivers/staging/comedi/drivers/ni_daq_700.c
--- linux-libre-3.15-rc8-gnu/drivers/staging/comedi/drivers/ni_daq_700.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/staging/comedi/drivers/ni_daq_700.c	2014-06-08 14:19:54.000000000 -0400
@@ -139,6 +139,8 @@ static int daq700_ai_rinsn(struct comedi
 	/* write channel to multiplexer */
 	/* set mask scan bit high to disable scanning */
 	outb(chan | 0x80, dev->iobase + CMD_R1);
+	/* mux needs 2us to really settle [Fred Brooks]. */
+	udelay(2);
 
 	/* convert n samples */
 	for (n = 0; n < insn->n; n++) {
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/staging/rtl8192e/rtllib_tx.c linux-libre-3.15-gnu/drivers/staging/rtl8192e/rtllib_tx.c
--- linux-libre-3.15-rc8-gnu/drivers/staging/rtl8192e/rtllib_tx.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/staging/rtl8192e/rtllib_tx.c	2014-06-08 14:19:54.000000000 -0400
@@ -171,7 +171,7 @@ inline int rtllib_put_snap(u8 *data, u16
 	snap->oui[1] = oui[1];
 	snap->oui[2] = oui[2];
 
-	*(u16 *)(data + SNAP_SIZE) = h_proto;
+	*(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
 
 	return SNAP_SIZE + sizeof(u16);
 }
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/staging/speakup/main.c linux-libre-3.15-gnu/drivers/staging/speakup/main.c
--- linux-libre-3.15-rc8-gnu/drivers/staging/speakup/main.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/staging/speakup/main.c	2014-06-08 14:19:54.000000000 -0400
@@ -2218,6 +2218,7 @@ static void __exit speakup_exit(void)
 	unregister_keyboard_notifier(&keyboard_notifier_block);
 	unregister_vt_notifier(&vt_notifier_block);
 	speakup_unregister_devsynth();
+	speakup_cancel_paste();
 	del_timer(&cursor_timer);
 	kthread_stop(speakup_task);
 	speakup_task = NULL;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/staging/speakup/selection.c linux-libre-3.15-gnu/drivers/staging/speakup/selection.c
--- linux-libre-3.15-rc8-gnu/drivers/staging/speakup/selection.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/staging/speakup/selection.c	2014-06-08 14:19:54.000000000 -0400
@@ -4,6 +4,10 @@
 #include <linux/sched.h>
 #include <linux/device.h> /* for dev_warn */
 #include <linux/selection.h>
+#include <linux/workqueue.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <asm/cmpxchg.h>
 
 #include "speakup.h"
 
@@ -121,31 +125,61 @@ int speakup_set_selection(struct tty_str
 	return 0;
 }
 
-/* TODO: move to some helper thread, probably.  That'd fix having to check for
- * in_atomic().  */
-int speakup_paste_selection(struct tty_struct *tty)
+struct speakup_paste_work {
+	struct work_struct work;
+	struct tty_struct *tty;
+};
+
+static void __speakup_paste_selection(struct work_struct *work)
 {
+	struct speakup_paste_work *spw =
+		container_of(work, struct speakup_paste_work, work);
+	struct tty_struct *tty = xchg(&spw->tty, NULL);
 	struct vc_data *vc = (struct vc_data *) tty->driver_data;
 	int pasted = 0, count;
+	struct tty_ldisc *ld;
 	DECLARE_WAITQUEUE(wait, current);
+
+	ld = tty_ldisc_ref_wait(tty);
+	tty_buffer_lock_exclusive(&vc->port);
+
 	add_wait_queue(&vc->paste_wait, &wait);
 	while (sel_buffer && sel_buffer_lth > pasted) {
 		set_current_state(TASK_INTERRUPTIBLE);
 		if (test_bit(TTY_THROTTLED, &tty->flags)) {
-			if (in_atomic())
-				/* if we are in an interrupt handler, abort */
-				break;
 			schedule();
 			continue;
 		}
 		count = sel_buffer_lth - pasted;
-		count = min_t(int, count, tty->receive_room);
-		tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
-			NULL, count);
+		count = tty_ldisc_receive_buf(ld, sel_buffer + pasted, NULL,
+					      count);
 		pasted += count;
 	}
 	remove_wait_queue(&vc->paste_wait, &wait);
 	current->state = TASK_RUNNING;
+
+	tty_buffer_unlock_exclusive(&vc->port);
+	tty_ldisc_deref(ld);
+	tty_kref_put(tty);
+}
+
+static struct speakup_paste_work speakup_paste_work = {
+	.work = __WORK_INITIALIZER(speakup_paste_work.work,
+				   __speakup_paste_selection)
+};
+
+int speakup_paste_selection(struct tty_struct *tty)
+{
+	if (cmpxchg(&speakup_paste_work.tty, NULL, tty) != NULL)
+		return -EBUSY;
+
+	tty_kref_get(tty);
+	schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work);
 	return 0;
 }
 
+void speakup_cancel_paste(void)
+{
+	cancel_work_sync(&speakup_paste_work.work);
+	tty_kref_put(speakup_paste_work.tty);
+}
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/staging/speakup/speakup_acntsa.c linux-libre-3.15-gnu/drivers/staging/speakup/speakup_acntsa.c
--- linux-libre-3.15-rc8-gnu/drivers/staging/speakup/speakup_acntsa.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/staging/speakup/speakup_acntsa.c	2014-06-08 14:19:54.000000000 -0400
@@ -60,15 +60,15 @@ static struct kobj_attribute vol_attribu
 	__ATTR(vol, S_IWUGO|S_IRUGO, spk_var_show, spk_var_store);
 
 static struct kobj_attribute delay_time_attribute =
-	__ATTR(delay_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+	__ATTR(delay_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute direct_attribute =
 	__ATTR(direct, S_IWUGO|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute full_time_attribute =
-	__ATTR(full_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+	__ATTR(full_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute jiffy_delta_attribute =
-	__ATTR(jiffy_delta, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+	__ATTR(jiffy_delta, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute trigger_time_attribute =
-	__ATTR(trigger_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+	__ATTR(trigger_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 
 /*
  * Create a group of attributes so that we can create and destroy them all
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/staging/speakup/speakup.h linux-libre-3.15-gnu/drivers/staging/speakup/speakup.h
--- linux-libre-3.15-rc8-gnu/drivers/staging/speakup/speakup.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/staging/speakup/speakup.h	2014-06-08 14:19:54.000000000 -0400
@@ -75,6 +75,7 @@ extern void synth_buffer_clear(void);
 extern void speakup_clear_selection(void);
 extern int speakup_set_selection(struct tty_struct *tty);
 extern int speakup_paste_selection(struct tty_struct *tty);
+extern void speakup_cancel_paste(void);
 extern void speakup_register_devsynth(void);
 extern void speakup_unregister_devsynth(void);
 extern void synth_write(const char *buf, size_t count);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/target/iscsi/iscsi_target.c linux-libre-3.15-gnu/drivers/target/iscsi/iscsi_target.c
--- linux-libre-3.15-rc8-gnu/drivers/target/iscsi/iscsi_target.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/target/iscsi/iscsi_target.c	2014-06-08 14:19:54.000000000 -0400
@@ -460,6 +460,7 @@ int iscsit_del_np(struct iscsi_np *np)
 	spin_lock_bh(&np->np_thread_lock);
 	np->np_exports--;
 	if (np->np_exports) {
+		np->enabled = true;
 		spin_unlock_bh(&np->np_thread_lock);
 		return 0;
 	}
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/target/iscsi/iscsi_target_login.c linux-libre-3.15-gnu/drivers/target/iscsi/iscsi_target_login.c
--- linux-libre-3.15-rc8-gnu/drivers/target/iscsi/iscsi_target_login.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/target/iscsi/iscsi_target_login.c	2014-06-08 14:19:54.000000000 -0400
@@ -249,6 +249,28 @@ static void iscsi_login_set_conn_values(
 	mutex_unlock(&auth_id_lock);
 }
 
+static __printf(2, 3) int iscsi_change_param_sprintf(
+	struct iscsi_conn *conn,
+	const char *fmt, ...)
+{
+	va_list args;
+	unsigned char buf[64];
+
+	memset(buf, 0, sizeof buf);
+
+	va_start(args, fmt);
+	vsnprintf(buf, sizeof buf, fmt, args);
+	va_end(args);
+
+	if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
+		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+				ISCSI_LOGIN_STATUS_NO_RESOURCES);
+		return -1;
+	}
+
+	return 0;
+}
+
 /*
  *	This is the leading connection of a new session,
  *	or session reinstatement.
@@ -339,7 +361,6 @@ static int iscsi_login_zero_tsih_s2(
 {
 	struct iscsi_node_attrib *na;
 	struct iscsi_session *sess = conn->sess;
-	unsigned char buf[32];
 	bool iser = false;
 
 	sess->tpg = conn->tpg;
@@ -380,26 +401,16 @@ static int iscsi_login_zero_tsih_s2(
 	 *
 	 * In our case, we have already located the struct iscsi_tiqn at this point.
 	 */
-	memset(buf, 0, 32);
-	sprintf(buf, "TargetPortalGroupTag=%hu", sess->tpg->tpgt);
-	if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-				ISCSI_LOGIN_STATUS_NO_RESOURCES);
+	if (iscsi_change_param_sprintf(conn, "TargetPortalGroupTag=%hu", sess->tpg->tpgt))
 		return -1;
-	}
 
 	/*
 	 * Workaround for Initiators that have broken connection recovery logic.
 	 *
 	 * "We would really like to get rid of this." Linux-iSCSI.org team
 	 */
-	memset(buf, 0, 32);
-	sprintf(buf, "ErrorRecoveryLevel=%d", na->default_erl);
-	if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-				ISCSI_LOGIN_STATUS_NO_RESOURCES);
+	if (iscsi_change_param_sprintf(conn, "ErrorRecoveryLevel=%d", na->default_erl))
 		return -1;
-	}
 
 	if (iscsi_login_disable_FIM_keys(conn->param_list, conn) < 0)
 		return -1;
@@ -411,12 +422,9 @@ static int iscsi_login_zero_tsih_s2(
 		unsigned long mrdsl, off;
 		int rc;
 
-		sprintf(buf, "RDMAExtensions=Yes");
-		if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-			iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-				ISCSI_LOGIN_STATUS_NO_RESOURCES);
+		if (iscsi_change_param_sprintf(conn, "RDMAExtensions=Yes"))
 			return -1;
-		}
+
 		/*
 		 * Make MaxRecvDataSegmentLength PAGE_SIZE aligned for
 		 * Immediate Data + Unsolicitied Data-OUT if necessary..
@@ -446,12 +454,8 @@ static int iscsi_login_zero_tsih_s2(
 		pr_warn("Aligning ISER MaxRecvDataSegmentLength: %lu down"
 			" to PAGE_SIZE\n", mrdsl);
 
-		sprintf(buf, "MaxRecvDataSegmentLength=%lu\n", mrdsl);
-		if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-			iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-				ISCSI_LOGIN_STATUS_NO_RESOURCES);
+		if (iscsi_change_param_sprintf(conn, "MaxRecvDataSegmentLength=%lu\n", mrdsl))
 			return -1;
-		}
 		/*
 		 * ISER currently requires that ImmediateData + Unsolicited
 		 * Data be disabled when protection / signature MRs are enabled.
@@ -461,19 +465,12 @@ check_prot:
 		   (TARGET_PROT_DOUT_STRIP | TARGET_PROT_DOUT_PASS |
 		    TARGET_PROT_DOUT_INSERT)) {
 
-			sprintf(buf, "ImmediateData=No");
-			if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-				iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-						    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+			if (iscsi_change_param_sprintf(conn, "ImmediateData=No"))
 				return -1;
-			}
 
-			sprintf(buf, "InitialR2T=Yes");
-			if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-				iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-						    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+			if (iscsi_change_param_sprintf(conn, "InitialR2T=Yes"))
 				return -1;
-			}
+
 			pr_debug("Forcing ImmediateData=No + InitialR2T=Yes for"
 				 " T10-PI enabled ISER session\n");
 		}
@@ -618,13 +615,8 @@ static int iscsi_login_non_zero_tsih_s2(
 	 *
 	 * In our case, we have already located the struct iscsi_tiqn at this point.
 	 */
-	memset(buf, 0, 32);
-	sprintf(buf, "TargetPortalGroupTag=%hu", sess->tpg->tpgt);
-	if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
-		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-				ISCSI_LOGIN_STATUS_NO_RESOURCES);
+	if (iscsi_change_param_sprintf(conn, "TargetPortalGroupTag=%hu", sess->tpg->tpgt))
 		return -1;
-	}
 
 	return iscsi_login_disable_FIM_keys(conn->param_list, conn);
 }
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/target/iscsi/iscsi_target_tpg.c linux-libre-3.15-gnu/drivers/target/iscsi/iscsi_target_tpg.c
--- linux-libre-3.15-rc8-gnu/drivers/target/iscsi/iscsi_target_tpg.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/target/iscsi/iscsi_target_tpg.c	2014-06-08 14:19:54.000000000 -0400
@@ -184,7 +184,8 @@ static void iscsit_clear_tpg_np_login_th
 		return;
 	}
 
-	tpg_np->tpg_np->enabled = false;
+	if (shutdown)
+		tpg_np->tpg_np->enabled = false;
 	iscsit_reset_np_thread(tpg_np->tpg_np, tpg_np, tpg, shutdown);
 }
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/target/target_core_alua.c linux-libre-3.15-gnu/drivers/target/target_core_alua.c
--- linux-libre-3.15-rc8-gnu/drivers/target/target_core_alua.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/target/target_core_alua.c	2014-06-08 14:19:54.000000000 -0400
@@ -576,7 +576,16 @@ static inline int core_alua_state_standb
 	case REPORT_LUNS:
 	case RECEIVE_DIAGNOSTIC:
 	case SEND_DIAGNOSTIC:
+	case READ_CAPACITY:
 		return 0;
+	case SERVICE_ACTION_IN:
+		switch (cdb[1] & 0x1f) {
+		case SAI_READ_CAPACITY_16:
+			return 0;
+		default:
+			set_ascq(cmd, ASCQ_04H_ALUA_TG_PT_STANDBY);
+			return 1;
+		}
 	case MAINTENANCE_IN:
 		switch (cdb[1] & 0x1f) {
 		case MI_REPORT_TARGET_PGS:
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/target/target_core_configfs.c linux-libre-3.15-gnu/drivers/target/target_core_configfs.c
--- linux-libre-3.15-rc8-gnu/drivers/target/target_core_configfs.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/target/target_core_configfs.c	2014-06-08 14:19:54.000000000 -0400
@@ -2227,6 +2227,11 @@ static ssize_t target_core_alua_tg_pt_gp
 			" tg_pt_gp ID: %hu\n", tg_pt_gp->tg_pt_gp_valid_id);
 		return -EINVAL;
 	}
+	if (!(dev->dev_flags & DF_CONFIGURED)) {
+		pr_err("Unable to set alua_access_state while device is"
+		       " not configured\n");
+		return -ENODEV;
+	}
 
 	ret = kstrtoul(page, 0, &tmp);
 	if (ret < 0) {
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/tty/tty_buffer.c linux-libre-3.15-gnu/drivers/tty/tty_buffer.c
--- linux-libre-3.15-rc8-gnu/drivers/tty/tty_buffer.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/tty/tty_buffer.c	2014-06-08 14:19:54.000000000 -0400
@@ -60,6 +60,7 @@ void tty_buffer_lock_exclusive(struct tt
 	atomic_inc(&buf->priority);
 	mutex_lock(&buf->lock);
 }
+EXPORT_SYMBOL_GPL(tty_buffer_lock_exclusive);
 
 void tty_buffer_unlock_exclusive(struct tty_port *port)
 {
@@ -73,6 +74,7 @@ void tty_buffer_unlock_exclusive(struct
 	if (restart)
 		queue_work(system_unbound_wq, &buf->work);
 }
+EXPORT_SYMBOL_GPL(tty_buffer_unlock_exclusive);
 
 /**
  *	tty_buffer_space_avail	-	return unused buffer space
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/core/driver.c linux-libre-3.15-gnu/drivers/usb/core/driver.c
--- linux-libre-3.15-rc8-gnu/drivers/usb/core/driver.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/core/driver.c	2014-06-08 14:19:54.000000000 -0400
@@ -1822,10 +1822,13 @@ int usb_runtime_suspend(struct device *d
 	if (status == -EAGAIN || status == -EBUSY)
 		usb_mark_last_busy(udev);
 
-	/* The PM core reacts badly unless the return code is 0,
-	 * -EAGAIN, or -EBUSY, so always return -EBUSY on an error.
+	/*
+	 * The PM core reacts badly unless the return code is 0,
+	 * -EAGAIN, or -EBUSY, so always return -EBUSY on an error
+	 * (except for root hubs, because they don't suspend through
+	 * an upstream port like other USB devices).
 	 */
-	if (status != 0)
+	if (status != 0 && udev->parent)
 		return -EBUSY;
 	return status;
 }
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/core/hub.c linux-libre-3.15-gnu/drivers/usb/core/hub.c
--- linux-libre-3.15-rc8-gnu/drivers/usb/core/hub.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/core/hub.c	2014-06-08 14:19:54.000000000 -0400
@@ -1691,8 +1691,19 @@ static int hub_probe(struct usb_interfac
 	 */
 	pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
 
-	/* Hubs have proper suspend/resume support. */
-	usb_enable_autosuspend(hdev);
+	/*
+	 * Hubs have proper suspend/resume support, except for root hubs
+	 * where the controller driver doesn't have bus_suspend and
+	 * bus_resume methods.
+	 */
+	if (hdev->parent) {		/* normal device */
+		usb_enable_autosuspend(hdev);
+	} else {			/* root hub */
+		const struct hc_driver *drv = bus_to_hcd(hdev->bus)->driver;
+
+		if (drv->bus_suspend && drv->bus_resume)
+			usb_enable_autosuspend(hdev);
+	}
 
 	if (hdev->level == MAX_TOPO_LEVEL) {
 		dev_err(&intf->dev,
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/host/pci-quirks.c linux-libre-3.15-gnu/drivers/usb/host/pci-quirks.c
--- linux-libre-3.15-rc8-gnu/drivers/usb/host/pci-quirks.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/host/pci-quirks.c	2014-06-08 14:19:54.000000000 -0400
@@ -847,6 +847,13 @@ void usb_enable_intel_xhci_ports(struct
 	bool		ehci_found = false;
 	struct pci_dev	*companion = NULL;
 
+	/* Sony VAIO t-series with subsystem device ID 90a8 is not capable of
+	 * switching ports from EHCI to xHCI
+	 */
+	if (xhci_pdev->subsystem_vendor == PCI_VENDOR_ID_SONY &&
+	    xhci_pdev->subsystem_device == 0x90a8)
+		return;
+
 	/* make sure an intel EHCI controller exists */
 	for_each_pci_dev(companion) {
 		if (companion->class == PCI_CLASS_SERIAL_USB_EHCI &&
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/host/xhci-mem.c linux-libre-3.15-gnu/drivers/usb/host/xhci-mem.c
--- linux-libre-3.15-rc8-gnu/drivers/usb/host/xhci-mem.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/host/xhci-mem.c	2014-06-08 14:19:54.000000000 -0400
@@ -1822,6 +1822,16 @@ void xhci_mem_cleanup(struct xhci_hcd *x
 		kfree(cur_cd);
 	}
 
+	num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+	for (i = 0; i < num_ports; i++) {
+		struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
+		for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
+			struct list_head *ep = &bwt->interval_bw[j].endpoints;
+			while (!list_empty(ep))
+				list_del_init(ep->next);
+		}
+	}
+
 	for (i = 1; i < MAX_HC_SLOTS; ++i)
 		xhci_free_virt_device(xhci, i);
 
@@ -1857,16 +1867,6 @@ void xhci_mem_cleanup(struct xhci_hcd *x
 	if (!xhci->rh_bw)
 		goto no_bw;
 
-	num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
-	for (i = 0; i < num_ports; i++) {
-		struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
-		for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
-			struct list_head *ep = &bwt->interval_bw[j].endpoints;
-			while (!list_empty(ep))
-				list_del_init(ep->next);
-		}
-	}
-
 	for (i = 0; i < num_ports; i++) {
 		struct xhci_tt_bw_info *tt, *n;
 		list_for_each_entry_safe(tt, n, &xhci->rh_bw[i].tts, tt_list) {
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/serial/ftdi_sio.c linux-libre-3.15-gnu/drivers/usb/serial/ftdi_sio.c
--- linux-libre-3.15-rc8-gnu/drivers/usb/serial/ftdi_sio.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/serial/ftdi_sio.c	2014-06-08 14:19:54.000000000 -0400
@@ -580,6 +580,8 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	/*
 	 * ELV devices:
 	 */
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/serial/ftdi_sio_ids.h linux-libre-3.15-gnu/drivers/usb/serial/ftdi_sio_ids.h
--- linux-libre-3.15-rc8-gnu/drivers/usb/serial/ftdi_sio_ids.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/serial/ftdi_sio_ids.h	2014-06-08 14:19:54.000000000 -0400
@@ -538,6 +538,11 @@
  */
 #define FTDI_TIAO_UMPA_PID	0x8a98	/* TIAO/DIYGADGET USB Multi-Protocol Adapter */
 
+/*
+ * NovaTech product ids (FTDI_VID)
+ */
+#define FTDI_NT_ORIONLXM_PID	0x7c90	/* OrionLXm Substation Automation Platform */
+
 
 /********************************/
 /** third-party VID/PID combos **/
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/serial/io_ti.c linux-libre-3.15-gnu/drivers/usb/serial/io_ti.c
--- linux-libre-3.15-rc8-gnu/drivers/usb/serial/io_ti.c	2014-06-08 01:08:13.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/serial/io_ti.c	2014-06-08 16:14:12.000000000 -0400
@@ -821,7 +821,7 @@ static int build_i2c_fw_hdr(__u8 *header
 	firmware_rec =  (struct ti_i2c_firmware_rec*)i2c_header->Data;
 
 	i2c_header->Type	= I2C_DESC_TYPE_FIRMWARE_BLANK;
-	i2c_header->Size	= (__u16)buffer_size;
+	i2c_header->Size	= cpu_to_le16(buffer_size);
 	i2c_header->CheckSum	= cs;
 	firmware_rec->Ver_Major	= OperationalMajorVersion;
 	firmware_rec->Ver_Minor	= OperationalMinorVersion;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/serial/io_usbvend.h linux-libre-3.15-gnu/drivers/usb/serial/io_usbvend.h
--- linux-libre-3.15-rc8-gnu/drivers/usb/serial/io_usbvend.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/serial/io_usbvend.h	2014-06-08 14:19:54.000000000 -0400
@@ -594,7 +594,7 @@ struct edge_boot_descriptor {
 
 struct ti_i2c_desc {
 	__u8	Type;			// Type of descriptor
-	__u16	Size;			// Size of data only not including header
+	__le16	Size;			// Size of data only not including header
 	__u8	CheckSum;		// Checksum (8 bit sum of data only)
 	__u8	Data[0];		// Data starts here
 } __attribute__((packed));
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/drivers/usb/serial/option.c linux-libre-3.15-gnu/drivers/usb/serial/option.c
--- linux-libre-3.15-rc8-gnu/drivers/usb/serial/option.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/drivers/usb/serial/option.c	2014-06-08 14:19:54.000000000 -0400
@@ -161,6 +161,7 @@ static void option_instat_callback(struc
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED	0x9000
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED	0x9001
 #define NOVATELWIRELESS_PRODUCT_E362		0x9010
+#define NOVATELWIRELESS_PRODUCT_E371		0x9011
 #define NOVATELWIRELESS_PRODUCT_G2		0xA010
 #define NOVATELWIRELESS_PRODUCT_MC551		0xB001
 
@@ -1012,6 +1013,7 @@ static const struct usb_device_id option
 	/* Novatel Ovation MC551 a.k.a. Verizon USB551L */
 	{ USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) },
 
 	{ USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
 	{ USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/fs/btrfs/send.c linux-libre-3.15-gnu/fs/btrfs/send.c
--- linux-libre-3.15-rc8-gnu/fs/btrfs/send.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/fs/btrfs/send.c	2014-06-08 14:19:54.000000000 -0400
@@ -360,10 +360,13 @@ static int fs_path_ensure_buf(struct fs_
 	/*
 	 * First time the inline_buf does not suffice
 	 */
-	if (p->buf == p->inline_buf)
+	if (p->buf == p->inline_buf) {
 		tmp_buf = kmalloc(len, GFP_NOFS);
-	else
+		if (tmp_buf)
+			memcpy(tmp_buf, p->buf, old_buf_len);
+	} else {
 		tmp_buf = krealloc(p->buf, len, GFP_NOFS);
+	}
 	if (!tmp_buf)
 		return -ENOMEM;
 	p->buf = tmp_buf;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/fs/kernfs/mount.c linux-libre-3.15-gnu/fs/kernfs/mount.c
--- linux-libre-3.15-rc8-gnu/fs/kernfs/mount.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/fs/kernfs/mount.c	2014-06-08 14:19:54.000000000 -0400
@@ -62,7 +62,7 @@ struct kernfs_root *kernfs_root_from_sb(
 	return NULL;
 }
 
-static int kernfs_fill_super(struct super_block *sb)
+static int kernfs_fill_super(struct super_block *sb, unsigned long magic)
 {
 	struct kernfs_super_info *info = kernfs_info(sb);
 	struct inode *inode;
@@ -70,7 +70,7 @@ static int kernfs_fill_super(struct supe
 
 	sb->s_blocksize = PAGE_CACHE_SIZE;
 	sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
-	sb->s_magic = SYSFS_MAGIC;
+	sb->s_magic = magic;
 	sb->s_op = &kernfs_sops;
 	sb->s_time_gran = 1;
 
@@ -131,6 +131,7 @@ const void *kernfs_super_ns(struct super
  * @fs_type: file_system_type of the fs being mounted
  * @flags: mount flags specified for the mount
  * @root: kernfs_root of the hierarchy being mounted
+ * @magic: file system specific magic number
  * @new_sb_created: tell the caller if we allocated a new superblock
  * @ns: optional namespace tag of the mount
  *
@@ -142,8 +143,8 @@ const void *kernfs_super_ns(struct super
  * The return value can be passed to the vfs layer verbatim.
  */
 struct dentry *kernfs_mount_ns(struct file_system_type *fs_type, int flags,
-			       struct kernfs_root *root, bool *new_sb_created,
-			       const void *ns)
+				struct kernfs_root *root, unsigned long magic,
+				bool *new_sb_created, const void *ns)
 {
 	struct super_block *sb;
 	struct kernfs_super_info *info;
@@ -166,7 +167,7 @@ struct dentry *kernfs_mount_ns(struct fi
 		*new_sb_created = !sb->s_root;
 
 	if (!sb->s_root) {
-		error = kernfs_fill_super(sb);
+		error = kernfs_fill_super(sb, magic);
 		if (error) {
 			deactivate_locked_super(sb);
 			return ERR_PTR(error);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/fs/proc/task_mmu.c linux-libre-3.15-gnu/fs/proc/task_mmu.c
--- linux-libre-3.15-rc8-gnu/fs/proc/task_mmu.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/fs/proc/task_mmu.c	2014-06-08 14:19:54.000000000 -0400
@@ -1351,7 +1351,7 @@ static int gather_hugetbl_stats(pte_t *p
 	struct numa_maps *md;
 	struct page *page;
 
-	if (pte_none(*pte))
+	if (!pte_present(*pte))
 		return 0;
 
 	page = pte_page(*pte);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/fs/sysfs/mount.c linux-libre-3.15-gnu/fs/sysfs/mount.c
--- linux-libre-3.15-rc8-gnu/fs/sysfs/mount.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/fs/sysfs/mount.c	2014-06-08 14:19:54.000000000 -0400
@@ -13,6 +13,7 @@
 #define DEBUG
 
 #include <linux/fs.h>
+#include <linux/magic.h>
 #include <linux/mount.h>
 #include <linux/init.h>
 #include <linux/user_namespace.h>
@@ -38,7 +39,8 @@ static struct dentry *sysfs_mount(struct
 	}
 
 	ns = kobj_ns_grab_current(KOBJ_NS_TYPE_NET);
-	root = kernfs_mount_ns(fs_type, flags, sysfs_root, &new_sb, ns);
+	root = kernfs_mount_ns(fs_type, flags, sysfs_root,
+				SYSFS_MAGIC, &new_sb, ns);
 	if (IS_ERR(root) || !new_sb)
 		kobj_ns_drop(KOBJ_NS_TYPE_NET, ns);
 	return root;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/include/linux/if_team.h linux-libre-3.15-gnu/include/linux/if_team.h
--- linux-libre-3.15-rc8-gnu/include/linux/if_team.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/include/linux/if_team.h	2014-06-08 14:19:54.000000000 -0400
@@ -194,6 +194,7 @@ struct team {
 	bool user_carrier_enabled;
 	bool queue_override_enabled;
 	struct list_head *qom_lists; /* array of queue override mapping lists */
+	bool port_mtu_change_allowed;
 	struct {
 		unsigned int count;
 		unsigned int interval; /* in ms */
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/include/linux/kernfs.h linux-libre-3.15-gnu/include/linux/kernfs.h
--- linux-libre-3.15-rc8-gnu/include/linux/kernfs.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/include/linux/kernfs.h	2014-06-08 14:19:54.000000000 -0400
@@ -297,8 +297,8 @@ void kernfs_notify(struct kernfs_node *k
 
 const void *kernfs_super_ns(struct super_block *sb);
 struct dentry *kernfs_mount_ns(struct file_system_type *fs_type, int flags,
-			       struct kernfs_root *root, bool *new_sb_created,
-			       const void *ns);
+			       struct kernfs_root *root, unsigned long magic,
+			       bool *new_sb_created, const void *ns);
 void kernfs_kill_sb(struct super_block *sb);
 
 void kernfs_init(void);
@@ -391,7 +391,8 @@ static inline const void *kernfs_super_n
 
 static inline struct dentry *
 kernfs_mount_ns(struct file_system_type *fs_type, int flags,
-		struct kernfs_root *root, bool *new_sb_created, const void *ns)
+		struct kernfs_root *root, unsigned long magic,
+		bool *new_sb_created, const void *ns)
 { return ERR_PTR(-ENOSYS); }
 
 static inline void kernfs_kill_sb(struct super_block *sb) { }
@@ -449,9 +450,11 @@ static inline int kernfs_rename(struct k
 
 static inline struct dentry *
 kernfs_mount(struct file_system_type *fs_type, int flags,
-	     struct kernfs_root *root, bool *new_sb_created)
+		struct kernfs_root *root, unsigned long magic,
+		bool *new_sb_created)
 {
-	return kernfs_mount_ns(fs_type, flags, root, new_sb_created, NULL);
+	return kernfs_mount_ns(fs_type, flags, root,
+				magic, new_sb_created, NULL);
 }
 
 #endif	/* __LINUX_KERNFS_H */
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/include/linux/netlink.h linux-libre-3.15-gnu/include/linux/netlink.h
--- linux-libre-3.15-rc8-gnu/include/linux/netlink.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/include/linux/netlink.h	2014-06-08 14:19:54.000000000 -0400
@@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr
 }
 
 enum netlink_skb_flags {
-	NETLINK_SKB_MMAPED	= 0x1,		/* Packet data is mmaped */
-	NETLINK_SKB_TX		= 0x2,		/* Packet was sent by userspace */
-	NETLINK_SKB_DELIVERED	= 0x4,		/* Packet was delivered */
+	NETLINK_SKB_MMAPED	= 0x1,	/* Packet data is mmaped */
+	NETLINK_SKB_TX		= 0x2,	/* Packet was sent by userspace */
+	NETLINK_SKB_DELIVERED	= 0x4,	/* Packet was delivered */
+	NETLINK_SKB_DST		= 0x8,	/* Dst set in sendto or sendmsg */
 };
 
 struct netlink_skb_parms {
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/include/linux/percpu-refcount.h linux-libre-3.15-gnu/include/linux/percpu-refcount.h
--- linux-libre-3.15-rc8-gnu/include/linux/percpu-refcount.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/include/linux/percpu-refcount.h	2014-06-08 14:19:54.000000000 -0400
@@ -110,7 +110,7 @@ static inline void percpu_ref_get(struct
 	pcpu_count = ACCESS_ONCE(ref->pcpu_count);
 
 	if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR))
-		__this_cpu_inc(*pcpu_count);
+		this_cpu_inc(*pcpu_count);
 	else
 		atomic_inc(&ref->count);
 
@@ -139,7 +139,7 @@ static inline bool percpu_ref_tryget(str
 	pcpu_count = ACCESS_ONCE(ref->pcpu_count);
 
 	if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR)) {
-		__this_cpu_inc(*pcpu_count);
+		this_cpu_inc(*pcpu_count);
 		ret = true;
 	}
 
@@ -164,7 +164,7 @@ static inline void percpu_ref_put(struct
 	pcpu_count = ACCESS_ONCE(ref->pcpu_count);
 
 	if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR))
-		__this_cpu_dec(*pcpu_count);
+		this_cpu_dec(*pcpu_count);
 	else if (unlikely(atomic_dec_and_test(&ref->count)))
 		ref->release(ref);
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/include/net/inetpeer.h linux-libre-3.15-gnu/include/net/inetpeer.h
--- linux-libre-3.15-rc8-gnu/include/net/inetpeer.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/include/net/inetpeer.h	2014-06-08 14:19:54.000000000 -0400
@@ -177,16 +177,9 @@ static inline void inet_peer_refcheck(co
 /* can be called with or without local BH being disabled */
 static inline int inet_getid(struct inet_peer *p, int more)
 {
-	int old, new;
 	more++;
 	inet_peer_refcheck(p);
-	do {
-		old = atomic_read(&p->ip_id_count);
-		new = old + more;
-		if (!new)
-			new = 1;
-	} while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
-	return new;
+	return atomic_add_return(more, &p->ip_id_count) - more;
 }
 
 #endif /* _NET_INETPEER_H */
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/include/uapi/linux/usb/cdc-wdm.h linux-libre-3.15-gnu/include/uapi/linux/usb/cdc-wdm.h
--- linux-libre-3.15-rc8-gnu/include/uapi/linux/usb/cdc-wdm.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/include/uapi/linux/usb/cdc-wdm.h	2014-06-08 14:19:54.000000000 -0400
@@ -9,6 +9,8 @@
 #ifndef _UAPI__LINUX_USB_CDC_WDM_H
 #define _UAPI__LINUX_USB_CDC_WDM_H
 
+#include <linux/types.h>
+
 /*
  * This IOCTL is used to retrieve the wMaxCommand for the device,
  * defining the message limit for both reading and writing.
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/include/uapi/linux/usb/Kbuild linux-libre-3.15-gnu/include/uapi/linux/usb/Kbuild
--- linux-libre-3.15-rc8-gnu/include/uapi/linux/usb/Kbuild	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/include/uapi/linux/usb/Kbuild	2014-06-08 14:19:54.000000000 -0400
@@ -1,6 +1,7 @@
 # UAPI Header export list
 header-y += audio.h
 header-y += cdc.h
+header-y += cdc-wdm.h
 header-y += ch11.h
 header-y += ch9.h
 header-y += functionfs.h
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/kernel/cgroup.c linux-libre-3.15-gnu/kernel/cgroup.c
--- linux-libre-3.15-rc8-gnu/kernel/cgroup.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/kernel/cgroup.c	2014-06-08 14:19:54.000000000 -0400
@@ -33,6 +33,7 @@
 #include <linux/init_task.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
+#include <linux/magic.h>
 #include <linux/mm.h>
 #include <linux/mutex.h>
 #include <linux/mount.h>
@@ -1604,7 +1605,8 @@ out_unlock:
 	if (ret)
 		return ERR_PTR(ret);
 
-	dentry = kernfs_mount(fs_type, flags, root->kf_root, &new_sb);
+	dentry = kernfs_mount(fs_type, flags, root->kf_root,
+				CGROUP_SUPER_MAGIC, &new_sb);
 	if (IS_ERR(dentry) || !new_sb)
 		cgroup_put(&root->cgrp);
 	return dentry;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/kernel/futex.c linux-libre-3.15-gnu/kernel/futex.c
--- linux-libre-3.15-rc8-gnu/kernel/futex.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/kernel/futex.c	2014-06-08 14:19:54.000000000 -0400
@@ -743,10 +743,58 @@ void exit_pi_state_list(struct task_stru
 	raw_spin_unlock_irq(&curr->pi_lock);
 }
 
+/*
+ * We need to check the following states:
+ *
+ *      Waiter | pi_state | pi->owner | uTID      | uODIED | ?
+ *
+ * [1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
+ * [2]  NULL   | ---      | ---       | >0        | 0/1    | Valid
+ *
+ * [3]  Found  | NULL     | --        | Any       | 0/1    | Invalid
+ *
+ * [4]  Found  | Found    | NULL      | 0         | 1      | Valid
+ * [5]  Found  | Found    | NULL      | >0        | 1      | Invalid
+ *
+ * [6]  Found  | Found    | task      | 0         | 1      | Valid
+ *
+ * [7]  Found  | Found    | NULL      | Any       | 0      | Invalid
+ *
+ * [8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
+ * [9]  Found  | Found    | task      | 0         | 0      | Invalid
+ * [10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid
+ *
+ * [1]	Indicates that the kernel can acquire the futex atomically. We
+ *	came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
+ *
+ * [2]	Valid, if TID does not belong to a kernel thread. If no matching
+ *      thread is found then it indicates that the owner TID has died.
+ *
+ * [3]	Invalid. The waiter is queued on a non PI futex
+ *
+ * [4]	Valid state after exit_robust_list(), which sets the user space
+ *	value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
+ *
+ * [5]	The user space value got manipulated between exit_robust_list()
+ *	and exit_pi_state_list()
+ *
+ * [6]	Valid state after exit_pi_state_list() which sets the new owner in
+ *	the pi_state but cannot access the user space value.
+ *
+ * [7]	pi_state->owner can only be NULL when the OWNER_DIED bit is set.
+ *
+ * [8]	Owner and user space value match
+ *
+ * [9]	There is no transient state which sets the user space TID to 0
+ *	except exit_robust_list(), but this is indicated by the
+ *	FUTEX_OWNER_DIED bit. See [4]
+ *
+ * [10] There is no transient state which leaves owner and user space
+ *	TID out of sync.
+ */
 static int
 lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
-		union futex_key *key, struct futex_pi_state **ps,
-		struct task_struct *task)
+		union futex_key *key, struct futex_pi_state **ps)
 {
 	struct futex_pi_state *pi_state = NULL;
 	struct futex_q *this, *next;
@@ -756,12 +804,13 @@ lookup_pi_state(u32 uval, struct futex_h
 	plist_for_each_entry_safe(this, next, &hb->chain, list) {
 		if (match_futex(&this->key, key)) {
 			/*
-			 * Another waiter already exists - bump up
-			 * the refcount and return its pi_state:
+			 * Sanity check the waiter before increasing
+			 * the refcount and attaching to it.
 			 */
 			pi_state = this->pi_state;
 			/*
-			 * Userspace might have messed up non-PI and PI futexes
+			 * Userspace might have messed up non-PI and
+			 * PI futexes [3]
 			 */
 			if (unlikely(!pi_state))
 				return -EINVAL;
@@ -769,44 +818,70 @@ lookup_pi_state(u32 uval, struct futex_h
 			WARN_ON(!atomic_read(&pi_state->refcount));
 
 			/*
-			 * When pi_state->owner is NULL then the owner died
-			 * and another waiter is on the fly. pi_state->owner
-			 * is fixed up by the task which acquires
-			 * pi_state->rt_mutex.
-			 *
-			 * We do not check for pid == 0 which can happen when
-			 * the owner died and robust_list_exit() cleared the
-			 * TID.
+			 * Handle the owner died case:
 			 */
-			if (pid && pi_state->owner) {
+			if (uval & FUTEX_OWNER_DIED) {
 				/*
-				 * Bail out if user space manipulated the
-				 * futex value.
+				 * exit_pi_state_list sets owner to NULL and
+				 * wakes the topmost waiter. The task which
+				 * acquires the pi_state->rt_mutex will fixup
+				 * owner.
 				 */
-				if (pid != task_pid_vnr(pi_state->owner))
+				if (!pi_state->owner) {
+					/*
+					 * No pi state owner, but the user
+					 * space TID is not 0. Inconsistent
+					 * state. [5]
+					 */
+					if (pid)
+						return -EINVAL;
+					/*
+					 * Take a ref on the state and
+					 * return. [4]
+					 */
+					goto out_state;
+				}
+
+				/*
+				 * If TID is 0, then either the dying owner
+				 * has not yet executed exit_pi_state_list()
+				 * or some waiter acquired the rtmutex in the
+				 * pi state, but did not yet fixup the TID in
+				 * user space.
+				 *
+				 * Take a ref on the state and return. [6]
+				 */
+				if (!pid)
+					goto out_state;
+			} else {
+				/*
+				 * If the owner died bit is not set,
+				 * then the pi_state must have an
+				 * owner. [7]
+				 */
+				if (!pi_state->owner)
 					return -EINVAL;
 			}
 
 			/*
-			 * Protect against a corrupted uval. If uval
-			 * is 0x80000000 then pid is 0 and the waiter
-			 * bit is set. So the deadlock check in the
-			 * calling code has failed and we did not fall
-			 * into the check above due to !pid.
+			 * Bail out if user space manipulated the
+			 * futex value. If pi state exists then the
+			 * owner TID must be the same as the user
+			 * space TID. [9/10]
 			 */
-			if (task && pi_state->owner == task)
-				return -EDEADLK;
+			if (pid != task_pid_vnr(pi_state->owner))
+				return -EINVAL;
 
+		out_state:
 			atomic_inc(&pi_state->refcount);
 			*ps = pi_state;
-
 			return 0;
 		}
 	}
 
 	/*
 	 * We are the first waiter - try to look up the real owner and attach
-	 * the new pi_state to it, but bail out when TID = 0
+	 * the new pi_state to it, but bail out when TID = 0 [1]
 	 */
 	if (!pid)
 		return -ESRCH;
@@ -839,6 +914,9 @@ lookup_pi_state(u32 uval, struct futex_h
 		return ret;
 	}
 
+	/*
+	 * No existing pi state. First waiter. [2]
+	 */
 	pi_state = alloc_pi_state();
 
 	/*
@@ -910,10 +988,18 @@ retry:
 		return -EDEADLK;
 
 	/*
-	 * Surprise - we got the lock. Just return to userspace:
+	 * Surprise - we got the lock, but we do not trust user space at all.
 	 */
-	if (unlikely(!curval))
-		return 1;
+	if (unlikely(!curval)) {
+		/*
+		 * We verify whether there is kernel state for this
+		 * futex. If not, we can safely assume, that the 0 ->
+		 * TID transition is correct. If state exists, we do
+		 * not bother to fixup the user space state as it was
+		 * corrupted already.
+		 */
+		return futex_top_waiter(hb, key) ? -EINVAL : 1;
+	}
 
 	uval = curval;
 
@@ -951,7 +1037,7 @@ retry:
 	 * We dont have the lock. Look up the PI state (or create it if
 	 * we are the first waiter):
 	 */
-	ret = lookup_pi_state(uval, hb, key, ps, task);
+	ret = lookup_pi_state(uval, hb, key, ps);
 
 	if (unlikely(ret)) {
 		switch (ret) {
@@ -1044,6 +1130,7 @@ static int wake_futex_pi(u32 __user *uad
 	struct task_struct *new_owner;
 	struct futex_pi_state *pi_state = this->pi_state;
 	u32 uninitialized_var(curval), newval;
+	int ret = 0;
 
 	if (!pi_state)
 		return -EINVAL;
@@ -1067,23 +1154,19 @@ static int wake_futex_pi(u32 __user *uad
 		new_owner = this->task;
 
 	/*
-	 * We pass it to the next owner. (The WAITERS bit is always
-	 * kept enabled while there is PI state around. We must also
-	 * preserve the owner died bit.)
+	 * We pass it to the next owner. The WAITERS bit is always
+	 * kept enabled while there is PI state around. We cleanup the
+	 * owner died bit, because we are the owner.
 	 */
-	if (!(uval & FUTEX_OWNER_DIED)) {
-		int ret = 0;
-
-		newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+	newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
 
-		if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
-			ret = -EFAULT;
-		else if (curval != uval)
-			ret = -EINVAL;
-		if (ret) {
-			raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
-			return ret;
-		}
+	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
+		ret = -EFAULT;
+	else if (curval != uval)
+		ret = -EINVAL;
+	if (ret) {
+		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
+		return ret;
 	}
 
 	raw_spin_lock_irq(&pi_state->owner->pi_lock);
@@ -1442,6 +1525,13 @@ static int futex_requeue(u32 __user *uad
 
 	if (requeue_pi) {
 		/*
+		 * Requeue PI only works on two distinct uaddrs. This
+		 * check is only valid for private futexes. See below.
+		 */
+		if (uaddr1 == uaddr2)
+			return -EINVAL;
+
+		/*
 		 * requeue_pi requires a pi_state, try to allocate it now
 		 * without any locks in case it fails.
 		 */
@@ -1479,6 +1569,15 @@ retry:
 	if (unlikely(ret != 0))
 		goto out_put_key1;
 
+	/*
+	 * The check above which compares uaddrs is not sufficient for
+	 * shared futexes. We need to compare the keys:
+	 */
+	if (requeue_pi && match_futex(&key1, &key2)) {
+		ret = -EINVAL;
+		goto out_put_keys;
+	}
+
 	hb1 = hash_futex(&key1);
 	hb2 = hash_futex(&key2);
 
@@ -1544,7 +1643,7 @@ retry_private:
 			 * rereading and handing potential crap to
 			 * lookup_pi_state.
 			 */
-			ret = lookup_pi_state(ret, hb2, &key2, &pi_state, NULL);
+			ret = lookup_pi_state(ret, hb2, &key2, &pi_state);
 		}
 
 		switch (ret) {
@@ -2327,9 +2426,10 @@ retry:
 	/*
 	 * To avoid races, try to do the TID -> 0 atomic transition
 	 * again. If it succeeds then we can return without waking
-	 * anyone else up:
+	 * anyone else up. We only try this if neither the waiters nor
+	 * the owner died bit are set.
 	 */
-	if (!(uval & FUTEX_OWNER_DIED) &&
+	if (!(uval & ~FUTEX_TID_MASK) &&
 	    cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
 		goto pi_faulted;
 	/*
@@ -2359,11 +2459,9 @@ retry:
 	/*
 	 * No waiters - kernel unlocks the futex:
 	 */
-	if (!(uval & FUTEX_OWNER_DIED)) {
-		ret = unlock_futex_pi(uaddr, uval);
-		if (ret == -EFAULT)
-			goto pi_faulted;
-	}
+	ret = unlock_futex_pi(uaddr, uval);
+	if (ret == -EFAULT)
+		goto pi_faulted;
 
 out_unlock:
 	spin_unlock(&hb->lock);
@@ -2525,6 +2623,15 @@ static int futex_wait_requeue_pi(u32 __u
 	if (ret)
 		goto out_key2;
 
+	/*
+	 * The check above which compares uaddrs is not sufficient for
+	 * shared futexes. We need to compare the keys:
+	 */
+	if (match_futex(&q.key, &key2)) {
+		ret = -EINVAL;
+		goto out_put_keys;
+	}
+
 	/* Queue the futex_q, drop the hb lock, wait for wakeup. */
 	futex_wait_queue_me(hb, &q, to);
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/kernel/sched/core.c linux-libre-3.15-gnu/kernel/sched/core.c
--- linux-libre-3.15-rc8-gnu/kernel/sched/core.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/kernel/sched/core.c	2014-06-08 14:19:54.000000000 -0400
@@ -3685,7 +3685,7 @@ SYSCALL_DEFINE3(sched_setattr, pid_t, pi
 	if (retval)
 		return retval;
 
-	if (attr.sched_policy < 0)
+	if ((int)attr.sched_policy < 0)
 		return -EINVAL;
 
 	rcu_read_lock();
@@ -7751,8 +7751,7 @@ static int tg_set_cfs_bandwidth(struct t
 	/* restart the period timer (if active) to handle new period expiry */
 	if (runtime_enabled && cfs_b->timer_active) {
 		/* force a reprogram */
-		cfs_b->timer_active = 0;
-		__start_cfs_bandwidth(cfs_b);
+		__start_cfs_bandwidth(cfs_b, true);
 	}
 	raw_spin_unlock_irq(&cfs_b->lock);
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/kernel/sched/deadline.c linux-libre-3.15-gnu/kernel/sched/deadline.c
--- linux-libre-3.15-rc8-gnu/kernel/sched/deadline.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/kernel/sched/deadline.c	2014-06-08 14:19:54.000000000 -0400
@@ -513,9 +513,17 @@ static enum hrtimer_restart dl_task_time
 						     struct sched_dl_entity,
 						     dl_timer);
 	struct task_struct *p = dl_task_of(dl_se);
-	struct rq *rq = task_rq(p);
+	struct rq *rq;
+again:
+	rq = task_rq(p);
 	raw_spin_lock(&rq->lock);
 
+	if (rq != task_rq(p)) {
+		/* Task was moved, retrying. */
+		raw_spin_unlock(&rq->lock);
+		goto again;
+	}
+
 	/*
 	 * We need to take care of a possible races here. In fact, the
 	 * task might have changed its scheduling policy to something
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/kernel/sched/fair.c linux-libre-3.15-gnu/kernel/sched/fair.c
--- linux-libre-3.15-rc8-gnu/kernel/sched/fair.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/kernel/sched/fair.c	2014-06-08 14:19:54.000000000 -0400
@@ -1707,18 +1707,19 @@ no_join:
 void task_numa_free(struct task_struct *p)
 {
 	struct numa_group *grp = p->numa_group;
-	int i;
 	void *numa_faults = p->numa_faults_memory;
+	unsigned long flags;
+	int i;
 
 	if (grp) {
-		spin_lock_irq(&grp->lock);
+		spin_lock_irqsave(&grp->lock, flags);
 		for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++)
 			grp->faults[i] -= p->numa_faults_memory[i];
 		grp->total_faults -= p->total_numa_faults;
 
 		list_del(&p->numa_entry);
 		grp->nr_tasks--;
-		spin_unlock_irq(&grp->lock);
+		spin_unlock_irqrestore(&grp->lock, flags);
 		rcu_assign_pointer(p->numa_group, NULL);
 		put_numa_group(grp);
 	}
@@ -3129,7 +3130,7 @@ static int assign_cfs_rq_runtime(struct
 		 */
 		if (!cfs_b->timer_active) {
 			__refill_cfs_bandwidth_runtime(cfs_b);
-			__start_cfs_bandwidth(cfs_b);
+			__start_cfs_bandwidth(cfs_b, false);
 		}
 
 		if (cfs_b->runtime > 0) {
@@ -3308,7 +3309,7 @@ static void throttle_cfs_rq(struct cfs_r
 	raw_spin_lock(&cfs_b->lock);
 	list_add_tail_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq);
 	if (!cfs_b->timer_active)
-		__start_cfs_bandwidth(cfs_b);
+		__start_cfs_bandwidth(cfs_b, false);
 	raw_spin_unlock(&cfs_b->lock);
 }
 
@@ -3690,7 +3691,7 @@ static void init_cfs_rq_runtime(struct c
 }
 
 /* requires cfs_b->lock, may release to reprogram timer */
-void __start_cfs_bandwidth(struct cfs_bandwidth *cfs_b)
+void __start_cfs_bandwidth(struct cfs_bandwidth *cfs_b, bool force)
 {
 	/*
 	 * The timer may be active because we're trying to set a new bandwidth
@@ -3705,7 +3706,7 @@ void __start_cfs_bandwidth(struct cfs_ba
 		cpu_relax();
 		raw_spin_lock(&cfs_b->lock);
 		/* if someone else restarted the timer then we're done */
-		if (cfs_b->timer_active)
+		if (!force && cfs_b->timer_active)
 			return;
 	}
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/kernel/sched/sched.h linux-libre-3.15-gnu/kernel/sched/sched.h
--- linux-libre-3.15-rc8-gnu/kernel/sched/sched.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/kernel/sched/sched.h	2014-06-08 14:19:54.000000000 -0400
@@ -278,7 +278,7 @@ extern void init_cfs_bandwidth(struct cf
 extern int sched_group_set_shares(struct task_group *tg, unsigned long shares);
 
 extern void __refill_cfs_bandwidth_runtime(struct cfs_bandwidth *cfs_b);
-extern void __start_cfs_bandwidth(struct cfs_bandwidth *cfs_b);
+extern void __start_cfs_bandwidth(struct cfs_bandwidth *cfs_b, bool force);
 extern void unthrottle_cfs_rq(struct cfs_rq *cfs_rq);
 
 extern void free_rt_sched_group(struct task_group *tg);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/lib/nlattr.c linux-libre-3.15-gnu/lib/nlattr.c
--- linux-libre-3.15-rc8-gnu/lib/nlattr.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/lib/nlattr.c	2014-06-08 14:19:54.000000000 -0400
@@ -201,8 +201,8 @@ int nla_parse(struct nlattr **tb, int ma
 	}
 
 	if (unlikely(rem > 0))
-		printk(KERN_WARNING "netlink: %d bytes leftover after parsing "
-		       "attributes.\n", rem);
+		pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n",
+				    rem, current->comm);
 
 	err = 0;
 errout:
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/MAINTAINERS linux-libre-3.15-gnu/MAINTAINERS
--- linux-libre-3.15-rc8-gnu/MAINTAINERS	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/MAINTAINERS	2014-06-08 14:19:54.000000000 -0400
@@ -3153,10 +3153,9 @@ S:	Maintained
 F:	drivers/scsi/eata_pio.*
 
 EBTABLES
-M:	Bart De Schuymer <bart.de.schuymer@pandora.be>
 L:	netfilter-devel@vger.kernel.org
 W:	http://ebtables.sourceforge.net/
-S:	Maintained
+S:	Orphan
 F:	include/linux/netfilter_bridge/ebt_*.h
 F:	include/uapi/linux/netfilter_bridge/ebt_*.h
 F:	net/bridge/netfilter/ebt*.c
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/Makefile linux-libre-3.15-gnu/Makefile
--- linux-libre-3.15-rc8-gnu/Makefile	2014-06-08 00:54:21.000000000 -0400
+++ linux-libre-3.15-gnu/Makefile	2014-06-08 15:59:35.000000000 -0400
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 15
 SUBLEVEL = 0
-EXTRAVERSION = -rc8-gnu
+EXTRAVERSION =-gnu
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/mm/mempolicy.c linux-libre-3.15-gnu/mm/mempolicy.c
--- linux-libre-3.15-rc8-gnu/mm/mempolicy.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/mm/mempolicy.c	2014-06-08 14:19:54.000000000 -0400
@@ -526,9 +526,13 @@ static void queue_pages_hugetlb_pmd_rang
 	int nid;
 	struct page *page;
 	spinlock_t *ptl;
+	pte_t entry;
 
 	ptl = huge_pte_lock(hstate_vma(vma), vma->vm_mm, (pte_t *)pmd);
-	page = pte_page(huge_ptep_get((pte_t *)pmd));
+	entry = huge_ptep_get((pte_t *)pmd);
+	if (!pte_present(entry))
+		goto unlock;
+	page = pte_page(entry);
 	nid = page_to_nid(page);
 	if (node_isset(nid, *nodes) == !!(flags & MPOL_MF_INVERT))
 		goto unlock;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/mm/rmap.c linux-libre-3.15-gnu/mm/rmap.c
--- linux-libre-3.15-rc8-gnu/mm/rmap.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/mm/rmap.c	2014-06-08 14:19:54.000000000 -0400
@@ -1564,10 +1564,9 @@ void __put_anon_vma(struct anon_vma *ano
 {
 	struct anon_vma *root = anon_vma->root;
 
+	anon_vma_free(anon_vma);
 	if (root != anon_vma && atomic_dec_and_test(&root->refcount))
 		anon_vma_free(root);
-
-	anon_vma_free(anon_vma);
 }
 
 static struct anon_vma *rmap_walk_anon_lock(struct page *page,
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/batman-adv/multicast.c linux-libre-3.15-gnu/net/batman-adv/multicast.c
--- linux-libre-3.15-rc8-gnu/net/batman-adv/multicast.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/batman-adv/multicast.c	2014-06-08 14:19:54.000000000 -0400
@@ -415,7 +415,7 @@ batadv_mcast_forw_ipv4_node_get(struct b
 	hlist_for_each_entry_rcu(tmp_orig_node,
 				 &bat_priv->mcast.want_all_ipv4_list,
 				 mcast_want_all_ipv4_node) {
-		if (!atomic_inc_not_zero(&orig_node->refcount))
+		if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
 			continue;
 
 		orig_node = tmp_orig_node;
@@ -442,7 +442,7 @@ batadv_mcast_forw_ipv6_node_get(struct b
 	hlist_for_each_entry_rcu(tmp_orig_node,
 				 &bat_priv->mcast.want_all_ipv6_list,
 				 mcast_want_all_ipv6_node) {
-		if (!atomic_inc_not_zero(&orig_node->refcount))
+		if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
 			continue;
 
 		orig_node = tmp_orig_node;
@@ -493,7 +493,7 @@ batadv_mcast_forw_unsnoop_node_get(struc
 	hlist_for_each_entry_rcu(tmp_orig_node,
 				 &bat_priv->mcast.want_all_unsnoopables_list,
 				 mcast_want_all_unsnoopables_node) {
-		if (!atomic_inc_not_zero(&orig_node->refcount))
+		if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
 			continue;
 
 		orig_node = tmp_orig_node;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/bluetooth/l2cap_core.c linux-libre-3.15-gnu/net/bluetooth/l2cap_core.c
--- linux-libre-3.15-rc8-gnu/net/bluetooth/l2cap_core.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/bluetooth/l2cap_core.c	2014-06-08 14:19:54.000000000 -0400
@@ -7519,9 +7519,9 @@ int __init l2cap_init(void)
 	l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
 					    NULL, &l2cap_debugfs_fops);
 
-	debugfs_create_u16("l2cap_le_max_credits", 0466, bt_debugfs,
+	debugfs_create_u16("l2cap_le_max_credits", 0644, bt_debugfs,
 			   &le_max_credits);
-	debugfs_create_u16("l2cap_le_default_mps", 0466, bt_debugfs,
+	debugfs_create_u16("l2cap_le_default_mps", 0644, bt_debugfs,
 			   &le_default_mps);
 
 	bt_6lowpan_init();
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/bridge/br_fdb.c linux-libre-3.15-gnu/net/bridge/br_fdb.c
--- linux-libre-3.15-rc8-gnu/net/bridge/br_fdb.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/bridge/br_fdb.c	2014-06-08 14:19:54.000000000 -0400
@@ -487,6 +487,7 @@ void br_fdb_update(struct net_bridge *br
 {
 	struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
 	struct net_bridge_fdb_entry *fdb;
+	bool fdb_modified = false;
 
 	/* some users want to always flood. */
 	if (hold_time(br) == 0)
@@ -507,10 +508,15 @@ void br_fdb_update(struct net_bridge *br
 					source->dev->name);
 		} else {
 			/* fastpath: update of existing entry */
-			fdb->dst = source;
+			if (unlikely(source != fdb->dst)) {
+				fdb->dst = source;
+				fdb_modified = true;
+			}
 			fdb->updated = jiffies;
 			if (unlikely(added_by_user))
 				fdb->added_by_user = 1;
+			if (unlikely(fdb_modified))
+				fdb_notify(br, fdb, RTM_NEWNEIGH);
 		}
 	} else {
 		spin_lock(&br->hash_lock);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/bridge/br_input.c linux-libre-3.15-gnu/net/bridge/br_input.c
--- linux-libre-3.15-rc8-gnu/net/bridge/br_input.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/bridge/br_input.c	2014-06-08 14:19:54.000000000 -0400
@@ -147,8 +147,8 @@ static int br_handle_local_finish(struct
 	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
 	u16 vid = 0;
 
-	br_vlan_get_tag(skb, &vid);
-	if (p->flags & BR_LEARNING)
+	/* check if vlan is allowed, to avoid spoofing */
+	if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid))
 		br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
 	return 0;	 /* process further */
 }
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/bridge/br_private.h linux-libre-3.15-gnu/net/bridge/br_private.h
--- linux-libre-3.15-rc8-gnu/net/bridge/br_private.h	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/bridge/br_private.h	2014-06-08 14:19:54.000000000 -0400
@@ -581,6 +581,7 @@ bool br_allowed_ingress(struct net_bridg
 			struct sk_buff *skb, u16 *vid);
 bool br_allowed_egress(struct net_bridge *br, const struct net_port_vlans *v,
 		       const struct sk_buff *skb);
+bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid);
 struct sk_buff *br_handle_vlan(struct net_bridge *br,
 			       const struct net_port_vlans *v,
 			       struct sk_buff *skb);
@@ -647,6 +648,12 @@ static inline bool br_allowed_egress(str
 {
 	return true;
 }
+
+static inline bool br_should_learn(struct net_bridge_port *p,
+				   struct sk_buff *skb, u16 *vid)
+{
+	return true;
+}
 
 static inline struct sk_buff *br_handle_vlan(struct net_bridge *br,
 					     const struct net_port_vlans *v,
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/bridge/br_vlan.c linux-libre-3.15-gnu/net/bridge/br_vlan.c
--- linux-libre-3.15-rc8-gnu/net/bridge/br_vlan.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/bridge/br_vlan.c	2014-06-08 14:19:54.000000000 -0400
@@ -241,6 +241,34 @@ bool br_allowed_egress(struct net_bridge
 	return false;
 }
 
+/* Called under RCU */
+bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid)
+{
+	struct net_bridge *br = p->br;
+	struct net_port_vlans *v;
+
+	if (!br->vlan_enabled)
+		return true;
+
+	v = rcu_dereference(p->vlan_info);
+	if (!v)
+		return false;
+
+	br_vlan_get_tag(skb, vid);
+	if (!*vid) {
+		*vid = br_get_pvid(v);
+		if (*vid == VLAN_N_VID)
+			return false;
+
+		return true;
+	}
+
+	if (test_bit(*vid, v->vlan_bitmap))
+		return true;
+
+	return false;
+}
+
 /* Must be protected by RTNL.
  * Must be called with vid in range from 1 to 4094 inclusive.
  */
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/core/dev.c linux-libre-3.15-gnu/net/core/dev.c
--- linux-libre-3.15-rc8-gnu/net/core/dev.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/core/dev.c	2014-06-08 14:19:54.000000000 -0400
@@ -2283,8 +2283,8 @@ EXPORT_SYMBOL(skb_checksum_help);
 
 __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
 {
+	unsigned int vlan_depth = skb->mac_len;
 	__be16 type = skb->protocol;
-	int vlan_depth = skb->mac_len;
 
 	/* Tunnel gso handlers can set protocol to ethernet. */
 	if (type == htons(ETH_P_TEB)) {
@@ -2297,15 +2297,30 @@ __be16 skb_network_protocol(struct sk_bu
 		type = eth->h_proto;
 	}
 
-	while (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
-		struct vlan_hdr *vh;
+	/* if skb->protocol is 802.1Q/AD then the header should already be
+	 * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
+	 * ETH_HLEN otherwise
+	 */
+	if (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
+		if (vlan_depth) {
+			if (unlikely(WARN_ON(vlan_depth < VLAN_HLEN)))
+				return 0;
+			vlan_depth -= VLAN_HLEN;
+		} else {
+			vlan_depth = ETH_HLEN;
+		}
+		do {
+			struct vlan_hdr *vh;
 
-		if (unlikely(!pskb_may_pull(skb, vlan_depth + VLAN_HLEN)))
-			return 0;
+			if (unlikely(!pskb_may_pull(skb,
+						    vlan_depth + VLAN_HLEN)))
+				return 0;
 
-		vh = (struct vlan_hdr *)(skb->data + vlan_depth);
-		type = vh->h_vlan_encapsulated_proto;
-		vlan_depth += VLAN_HLEN;
+			vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+			type = vh->h_vlan_encapsulated_proto;
+			vlan_depth += VLAN_HLEN;
+		} while (type == htons(ETH_P_8021Q) ||
+			 type == htons(ETH_P_8021AD));
 	}
 
 	*depth = vlan_depth;
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/core/filter.c linux-libre-3.15-gnu/net/core/filter.c
--- linux-libre-3.15-rc8-gnu/net/core/filter.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/core/filter.c	2014-06-08 14:19:54.000000000 -0400
@@ -1559,8 +1559,13 @@ static struct sk_filter *__sk_prepare_fi
 	fp->jited = 0;
 
 	err = sk_chk_filter(fp->insns, fp->len);
-	if (err)
+	if (err) {
+		if (sk != NULL)
+			sk_filter_uncharge(sk, fp);
+		else
+			kfree(fp);
 		return ERR_PTR(err);
+	}
 
 	/* Probe if we can JIT compile the filter and if so, do
 	 * the compilation of the filter.
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/ipv4/tcp_input.c linux-libre-3.15-gnu/net/ipv4/tcp_input.c
--- linux-libre-3.15-rc8-gnu/net/ipv4/tcp_input.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/ipv4/tcp_input.c	2014-06-08 14:19:54.000000000 -0400
@@ -2684,13 +2684,12 @@ static void tcp_process_loss(struct sock
 	bool recovered = !before(tp->snd_una, tp->high_seq);
 
 	if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */
-		if (flag & FLAG_ORIG_SACK_ACKED) {
-			/* Step 3.b. A timeout is spurious if not all data are
-			 * lost, i.e., never-retransmitted data are (s)acked.
-			 */
-			tcp_try_undo_loss(sk, true);
+		/* Step 3.b. A timeout is spurious if not all data are
+		 * lost, i.e., never-retransmitted data are (s)acked.
+		 */
+		if (tcp_try_undo_loss(sk, flag & FLAG_ORIG_SACK_ACKED))
 			return;
-		}
+
 		if (after(tp->snd_nxt, tp->high_seq) &&
 		    (flag & FLAG_DATA_SACKED || is_dupack)) {
 			tp->frto = 0; /* Loss was real: 2nd part of step 3.a */
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/ipv6/output_core.c linux-libre-3.15-gnu/net/ipv6/output_core.c
--- linux-libre-3.15-rc8-gnu/net/ipv6/output_core.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/ipv6/output_core.c	2014-06-08 14:19:54.000000000 -0400
@@ -12,7 +12,7 @@ void ipv6_select_ident(struct frag_hdr *
 {
 	static atomic_t ipv6_fragmentation_id;
 	struct in6_addr addr;
-	int old, new;
+	int ident;
 
 #if IS_ENABLED(CONFIG_IPV6)
 	struct inet_peer *peer;
@@ -26,15 +26,10 @@ void ipv6_select_ident(struct frag_hdr *
 		return;
 	}
 #endif
-	do {
-		old = atomic_read(&ipv6_fragmentation_id);
-		new = old + 1;
-		if (!new)
-			new = 1;
-	} while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
+	ident = atomic_inc_return(&ipv6_fragmentation_id);
 
 	addr = rt->rt6i_dst.addr;
-	addr.s6_addr32[0] ^= (__force __be32)new;
+	addr.s6_addr32[0] ^= (__force __be32)ident;
 	fhdr->identification = htonl(secure_ipv6_id(addr.s6_addr32));
 }
 EXPORT_SYMBOL(ipv6_select_ident);
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/netfilter/ipvs/ip_vs_core.c linux-libre-3.15-gnu/net/netfilter/ipvs/ip_vs_core.c
--- linux-libre-3.15-rc8-gnu/net/netfilter/ipvs/ip_vs_core.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/netfilter/ipvs/ip_vs_core.c	2014-06-08 14:19:54.000000000 -0400
@@ -1392,15 +1392,19 @@ ip_vs_in_icmp(struct sk_buff *skb, int *
 
 	if (ipip) {
 		__be32 info = ic->un.gateway;
+		__u8 type = ic->type;
+		__u8 code = ic->code;
 
 		/* Update the MTU */
 		if (ic->type == ICMP_DEST_UNREACH &&
 		    ic->code == ICMP_FRAG_NEEDED) {
 			struct ip_vs_dest *dest = cp->dest;
 			u32 mtu = ntohs(ic->un.frag.mtu);
+			__be16 frag_off = cih->frag_off;
 
 			/* Strip outer IP and ICMP, go to IPIP header */
-			__skb_pull(skb, ihl + sizeof(_icmph));
+			if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL)
+				goto ignore_ipip;
 			offset2 -= ihl + sizeof(_icmph);
 			skb_reset_network_header(skb);
 			IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
@@ -1408,7 +1412,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *
 			ipv4_update_pmtu(skb, dev_net(skb->dev),
 					 mtu, 0, 0, 0, 0);
 			/* Client uses PMTUD? */
-			if (!(cih->frag_off & htons(IP_DF)))
+			if (!(frag_off & htons(IP_DF)))
 				goto ignore_ipip;
 			/* Prefer the resulting PMTU */
 			if (dest) {
@@ -1427,12 +1431,13 @@ ip_vs_in_icmp(struct sk_buff *skb, int *
 		/* Strip outer IP, ICMP and IPIP, go to IP header of
 		 * original request.
 		 */
-		__skb_pull(skb, offset2);
+		if (pskb_pull(skb, offset2) == NULL)
+			goto ignore_ipip;
 		skb_reset_network_header(skb);
 		IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
 			&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
-			ic->type, ic->code, ntohl(info));
-		icmp_send(skb, ic->type, ic->code, info);
+			type, code, ntohl(info));
+		icmp_send(skb, type, code, info);
 		/* ICMP can be shorter but anyways, account it */
 		ip_vs_out_stats(cp, skb);
 
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/net/netlink/af_netlink.c linux-libre-3.15-gnu/net/netlink/af_netlink.c
--- linux-libre-3.15-rc8-gnu/net/netlink/af_netlink.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/net/netlink/af_netlink.c	2014-06-08 14:19:54.000000000 -0400
@@ -1373,7 +1373,9 @@ retry:
 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
 			struct user_namespace *user_ns, int cap)
 {
-	return sk_ns_capable(nsp->sk, user_ns, cap);
+	return ((nsp->flags & NETLINK_SKB_DST) ||
+		file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
+		ns_capable(user_ns, cap);
 }
 EXPORT_SYMBOL(__netlink_ns_capable);
 
@@ -2293,6 +2295,7 @@ static int netlink_sendmsg(struct kiocb
 	struct sk_buff *skb;
 	int err;
 	struct scm_cookie scm;
+	u32 netlink_skb_flags = 0;
 
 	if (msg->msg_flags&MSG_OOB)
 		return -EOPNOTSUPP;
@@ -2314,6 +2317,7 @@ static int netlink_sendmsg(struct kiocb
 		if ((dst_group || dst_portid) &&
 		    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
 			goto out;
+		netlink_skb_flags |= NETLINK_SKB_DST;
 	} else {
 		dst_portid = nlk->dst_portid;
 		dst_group = nlk->dst_group;
@@ -2343,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb
 	NETLINK_CB(skb).portid	= nlk->portid;
 	NETLINK_CB(skb).dst_group = dst_group;
 	NETLINK_CB(skb).creds	= siocb->scm->creds;
+	NETLINK_CB(skb).flags	= netlink_skb_flags;
 
 	err = -EFAULT;
 	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/sound/pci/hda/patch_analog.c linux-libre-3.15-gnu/sound/pci/hda/patch_analog.c
--- linux-libre-3.15-rc8-gnu/sound/pci/hda/patch_analog.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/sound/pci/hda/patch_analog.c	2014-06-08 14:19:54.000000000 -0400
@@ -332,6 +332,7 @@ static const struct hda_fixup ad1986a_fi
 
 static const struct snd_pci_quirk ad1986a_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC),
+	SND_PCI_QUIRK(0x1043, 0x1447, "ASUS A8JN", AD1986A_FIXUP_EAPD),
 	SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8100, "ASUS P5", AD1986A_FIXUP_3STACK),
 	SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8200, "ASUS M2", AD1986A_FIXUP_3STACK),
 	SND_PCI_QUIRK(0x10de, 0xcb84, "ASUS A8N-VM", AD1986A_FIXUP_3STACK),
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/sound/pci/hda/patch_realtek.c linux-libre-3.15-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-3.15-rc8-gnu/sound/pci/hda/patch_realtek.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/sound/pci/hda/patch_realtek.c	2014-06-08 14:19:54.000000000 -0400
@@ -1647,12 +1647,10 @@ static const struct hda_fixup alc260_fix
 	[ALC260_FIXUP_COEF] = {
 		.type = HDA_FIXUP_VERBS,
 		.v.verbs = (const struct hda_verb[]) {
-			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x07 },
-			{ 0x20, AC_VERB_SET_PROC_COEF,  0x3040 },
+			{ 0x1a, AC_VERB_SET_COEF_INDEX, 0x07 },
+			{ 0x1a, AC_VERB_SET_PROC_COEF,  0x3040 },
 			{ }
 		},
-		.chained = true,
-		.chain_id = ALC260_FIXUP_HP_PIN_0F,
 	},
 	[ALC260_FIXUP_GPIO1] = {
 		.type = HDA_FIXUP_VERBS,
@@ -1667,8 +1665,8 @@ static const struct hda_fixup alc260_fix
 	[ALC260_FIXUP_REPLACER] = {
 		.type = HDA_FIXUP_VERBS,
 		.v.verbs = (const struct hda_verb[]) {
-			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x07 },
-			{ 0x20, AC_VERB_SET_PROC_COEF,  0x3050 },
+			{ 0x1a, AC_VERB_SET_COEF_INDEX, 0x07 },
+			{ 0x1a, AC_VERB_SET_PROC_COEF,  0x3050 },
 			{ }
 		},
 		.chained = true,
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/tools/perf/util/dwarf-aux.c linux-libre-3.15-gnu/tools/perf/util/dwarf-aux.c
--- linux-libre-3.15-rc8-gnu/tools/perf/util/dwarf-aux.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/tools/perf/util/dwarf-aux.c	2014-06-08 14:19:54.000000000 -0400
@@ -747,14 +747,17 @@ struct __find_variable_param {
 static int __die_find_variable_cb(Dwarf_Die *die_mem, void *data)
 {
 	struct __find_variable_param *fvp = data;
+	Dwarf_Attribute attr;
 	int tag;
 
 	tag = dwarf_tag(die_mem);
 	if ((tag == DW_TAG_formal_parameter ||
 	     tag == DW_TAG_variable) &&
-	    die_compare_name(die_mem, fvp->name))
+	    die_compare_name(die_mem, fvp->name) &&
+	/* Does the DIE have location information or external instance? */
+	    (dwarf_attr(die_mem, DW_AT_external, &attr) ||
+	     dwarf_attr(die_mem, DW_AT_location, &attr)))
 		return DIE_FIND_CB_END;
-
 	if (dwarf_haspc(die_mem, fvp->addr))
 		return DIE_FIND_CB_CONTINUE;
 	else
diff -druNp --no-dereference linux-libre-3.15-rc8-gnu/tools/perf/util/probe-finder.c linux-libre-3.15-gnu/tools/perf/util/probe-finder.c
--- linux-libre-3.15-rc8-gnu/tools/perf/util/probe-finder.c	2014-06-01 22:12:24.000000000 -0400
+++ linux-libre-3.15-gnu/tools/perf/util/probe-finder.c	2014-06-08 14:19:54.000000000 -0400
@@ -511,12 +511,12 @@ static int convert_variable(Dwarf_Die *v
 
 	ret = convert_variable_location(vr_die, pf->addr, pf->fb_ops,
 					&pf->sp_die, pf->tvar);
-	if (ret == -ENOENT)
+	if (ret == -ENOENT || ret == -EINVAL)
 		pr_err("Failed to find the location of %s at this address.\n"
 		       " Perhaps, it has been optimized out.\n", pf->pvar->var);
 	else if (ret == -ENOTSUP)
 		pr_err("Sorry, we don't support this variable location yet.\n");
-	else if (pf->pvar->field) {
+	else if (ret == 0 && pf->pvar->field) {
 		ret = convert_variable_fields(vr_die, pf->pvar->var,
 					      pf->pvar->field, &pf->tvar->ref,
 					      &die_mem);
