16 files changed, 181 insertions, 94 deletions

diff --git a/arch/avr32/Kconfig b/arch/avr32/Kconfig
index bbecbd8469b5..4f402c924504 100644
--- a/arch/avr32/Kconfig
+++ b/arch/avr32/Kconfig
@@ -19,9 +19,6 @@ config AVR32
           There is an AVR32 Linux project with a web page at
           http://avr32linux.org/.
 
-config UID16
-        bool
-
 config GENERIC_GPIO
         bool
         default y
diff --git a/arch/avr32/mach-at32ap/at32ap7000.c b/arch/avr32/mach-at32ap/at32ap7000.c
index a9d9ec081e3d..7c4388f4f17f 100644
--- a/arch/avr32/mach-at32ap/at32ap7000.c
+++ b/arch/avr32/mach-at32ap/at32ap7000.c
@@ -474,7 +474,7 @@ static struct resource at32ap700x_rtc0_resource[] = {
 static struct resource at32_wdt0_resource[] = {
         {
                 .start  = 0xfff000b0,
-                .end    = 0xfff000bf,
+                .end    = 0xfff000cf,
                 .flags  = IORESOURCE_MEM,
         },
 };
@@ -690,7 +690,7 @@ static struct resource atmel_usart0_resource[] = {
         IRQ(6),
 };
 DEFINE_DEV_DATA(atmel_usart, 0);
-DEV_CLK(usart, atmel_usart0, pba, 4);
+DEV_CLK(usart, atmel_usart0, pba, 3);
 
 static struct atmel_uart_data atmel_usart1_data = {
         .use_dma_tx     = 1,
diff --git a/arch/avr32/mach-at32ap/hsmc.c b/arch/avr32/mach-at32ap/hsmc.c
index 704607fbcc69..fa427ed42787 100644
--- a/arch/avr32/mach-at32ap/hsmc.c
+++ b/arch/avr32/mach-at32ap/hsmc.c
@@ -7,7 +7,6 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-#define DEBUG
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/init.h>
diff --git a/arch/avr32/mach-at32ap/intc.c b/arch/avr32/mach-at32ap/intc.c
index dd5c009cf224..0b286cd53028 100644
--- a/arch/avr32/mach-at32ap/intc.c
+++ b/arch/avr32/mach-at32ap/intc.c
@@ -13,6 +13,7 @@
 #include <linux/irq.h>
 #include <linux/platform_device.h>
 
+#include <asm/intc.h>
 #include <asm/io.h>
 
 #include "intc.h"
@@ -136,7 +137,8 @@ fail:
         panic("Interrupt controller initialization failed!\n");
 }
 
-unsigned long intc_get_pending(int group)
+unsigned long intc_get_pending(unsigned int group)
 {
         return intc_readl(&intc0, INTREQ0 + 4 * group);
 }
+EXPORT_SYMBOL_GPL(intc_get_pending);
diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c
index 58e32714afb5..ca18e0be4901 100644
--- a/drivers/i2c/busses/i2c-pasemi.c
+++ b/drivers/i2c/busses/i2c-pasemi.c
@@ -51,6 +51,7 @@ struct pasemi_smbus {
 #define MRXFIFO_DATA_M  0x000000ff
 
 #define SMSTA_XEN       0x08000000
+#define SMSTA_MTN       0x00200000
 
 #define CTL_MRR         0x00000400
 #define CTL_MTR         0x00000200
@@ -98,6 +99,10 @@ static unsigned int pasemi_smb_waitready(struct pasemi_smbus *smbus)
                 status = reg_read(smbus, REG_SMSTA);
         }
 
+        /* Got NACK? */
+        if (status & SMSTA_MTN)
+                return -ENXIO;
+
         if (timeout < 0) {
                 dev_warn(&smbus->dev->dev, "Timeout, status 0x%08x\n", status);
                 reg_write(smbus, REG_SMSTA, status);
@@ -364,7 +369,7 @@ static int __devinit pasemi_smb_probe(struct pci_dev *dev,
         smbus->adapter.algo = &smbus_algorithm;
         smbus->adapter.algo_data = smbus;
 
-        /* set up the driverfs linkage to our parent device */
+        /* set up the sysfs linkage to our parent device */
         smbus->adapter.dev.parent = &dev->dev;
 
         reg_write(smbus, REG_CTL, (CTL_MTR | CTL_MRR |
diff --git a/drivers/i2c/chips/eeprom.c b/drivers/i2c/chips/eeprom.c
index d3da1fb05b9b..1a7eeebac506 100644
--- a/drivers/i2c/chips/eeprom.c
+++ b/drivers/i2c/chips/eeprom.c
@@ -128,13 +128,20 @@ static ssize_t eeprom_read(struct kobject *kobj, struct bin_attribute *bin_attr,
         for (slice = off >> 5; slice <= (off + count - 1) >> 5; slice++)
                 eeprom_update_client(client, slice);
 
-        /* Hide Vaio security settings to regular users (16 first bytes) */
-        if (data->nature == VAIO && off < 16 && !capable(CAP_SYS_ADMIN)) {
-                size_t in_row1 = 16 - off;
-                in_row1 = min(in_row1, count);
-                memset(buf, 0, in_row1);
-                if (count - in_row1 > 0)
-                        memcpy(buf + in_row1, &data->data[16], count - in_row1);
+        /* Hide Vaio private settings to regular users:
+           - BIOS passwords: bytes 0x00 to 0x0f
+           - UUID: bytes 0x10 to 0x1f
+           - Serial number: 0xc0 to 0xdf */
+        if (data->nature == VAIO && !capable(CAP_SYS_ADMIN)) {
+                int i;
+
+                for (i = 0; i < count; i++) {
+                        if ((off + i <= 0x1f) ||
+                            (off + i >= 0xc0 && off + i <= 0xdf))
+                                buf[i] = 0;
+                        else
+                                buf[i] = data->data[off + i];
+                }
         } else {
                 memcpy(buf, &data->data[off], count);
         }
@@ -197,14 +204,18 @@ static int eeprom_detect(struct i2c_adapter *adapter, int address, int kind)
                 goto exit_kfree;
 
         /* Detect the Vaio nature of EEPROMs.
-           We use the "PCG-" prefix as the signature. */
+           We use the "PCG-" or "VGN-" prefix as the signature. */
         if (address == 0x57) {
-                if (i2c_smbus_read_byte_data(new_client, 0x80) == 'P'
-                 && i2c_smbus_read_byte(new_client) == 'C'
-                 && i2c_smbus_read_byte(new_client) == 'G'
-                 && i2c_smbus_read_byte(new_client) == '-') {
+                char name[4];
+
+                name[0] = i2c_smbus_read_byte_data(new_client, 0x80);
+                name[1] = i2c_smbus_read_byte(new_client);
+                name[2] = i2c_smbus_read_byte(new_client);
+                name[3] = i2c_smbus_read_byte(new_client);
+
+                if (!memcmp(name, "PCG-", 4) || !memcmp(name, "VGN-", 4)) {
                         dev_info(&new_client->dev, "Vaio EEPROM detected, "
-                                "enabling password protection\n");
+                                 "enabling privacy protection\n");
                         data->nature = VAIO;
                 }
         }
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 1a4e8dc03b36..b5e13e405e72 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -673,7 +673,7 @@ static int __i2c_check_addr(struct i2c_adapter *adapter, unsigned int addr)
         return 0;
 }
 
-int i2c_check_addr(struct i2c_adapter *adapter, int addr)
+static int i2c_check_addr(struct i2c_adapter *adapter, int addr)
 {
         int rval;
 
@@ -683,7 +683,6 @@ int i2c_check_addr(struct i2c_adapter *adapter, int addr)
 
         return rval;
 }
-EXPORT_SYMBOL(i2c_check_addr);
 
 int i2c_attach_client(struct i2c_client *client)
 {
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 5a15e50748de..c21ae20ae362 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -38,6 +38,15 @@
 
 static struct i2c_driver i2cdev_driver;
 
+/*
+ * An i2c_dev represents an i2c_adapter ... an I2C or SMBus master, not a
+ * slave (i2c_client) with which messages will be exchanged.  It's coupled
+ * with a character special file which is accessed by user mode drivers.
+ *
+ * The list of i2c_dev structures is parallel to the i2c_adapter lists
+ * maintained by the driver model, and is updated using notifications
+ * delivered to the i2cdev_driver.
+ */
 struct i2c_dev {
         struct list_head list;
         struct i2c_adapter *adap;
@@ -103,6 +112,25 @@ static ssize_t show_adapter_name(struct device *dev,
 }
 static DEVICE_ATTR(name, S_IRUGO, show_adapter_name, NULL);
 
+/* ------------------------------------------------------------------------- */
+
+/*
+ * After opening an instance of this character special file, a file
+ * descriptor starts out associated only with an i2c_adapter (and bus).
+ *
+ * Using the I2C_RDWR ioctl(), you can then *immediately* issue i2c_msg
+ * traffic to any devices on the bus used by that adapter.  That's because
+ * the i2c_msg vectors embed all the addressing information they need, and
+ * are submitted directly to an i2c_adapter.  However, SMBus-only adapters
+ * don't support that interface.
+ *
+ * To use read()/write() system calls on that file descriptor, or to use
+ * SMBus interfaces (and work with SMBus-only hosts!), you must first issue
+ * an I2C_SLAVE (or I2C_SLAVE_FORCE) ioctl.  That configures an anonymous
+ * (never registered) i2c_client so it holds the addressing information
+ * needed by those system calls and by this SMBus interface.
+ */
+
 static ssize_t i2cdev_read (struct file *file, char __user *buf, size_t count,
                             loff_t *offset)
 {
@@ -154,6 +182,29 @@ static ssize_t i2cdev_write (struct file *file, const char __user *buf, size_t c
         return ret;
 }
 
+/* This address checking function differs from the one in i2c-core
+   in that it considers an address with a registered device, but no
+   bounded driver, as NOT busy. */
+static int i2cdev_check_addr(struct i2c_adapter *adapter, unsigned int addr)
+{
+        struct list_head *item;
+        struct i2c_client *client;
+        int res = 0;
+
+        mutex_lock(&adapter->clist_lock);
+        list_for_each(item, &adapter->clients) {
+                client = list_entry(item, struct i2c_client, list);
+                if (client->addr == addr) {
+                        if (client->driver)
+                                res = -EBUSY;
+                        break;
+                }
+        }
+        mutex_unlock(&adapter->clist_lock);
+
+        return res;
+}
+
 static int i2cdev_ioctl(struct inode *inode, struct file *file,
                 unsigned int cmd, unsigned long arg)
 {
@@ -172,11 +223,22 @@ static int i2cdev_ioctl(struct inode *inode, struct file *file,
         switch ( cmd ) {
         case I2C_SLAVE:
         case I2C_SLAVE_FORCE:
+                /* NOTE:  devices set up to work with "new style" drivers
+                 * can't use I2C_SLAVE, even when the device node is not
+                 * bound to a driver.  Only I2C_SLAVE_FORCE will work.
+                 *
+                 * Setting the PEC flag here won't affect kernel drivers,
+                 * which will be using the i2c_client node registered with
+                 * the driver model core.  Likewise, when that client has
+                 * the PEC flag already set, the i2c-dev driver won't see
+                 * (or use) this setting.
+                 */
                 if ((arg > 0x3ff) ||
                     (((client->flags & I2C_M_TEN) == 0) && arg > 0x7f))
                         return -EINVAL;
-                if ((cmd == I2C_SLAVE) && i2c_check_addr(client->adapter,arg))
+                if (cmd == I2C_SLAVE && i2cdev_check_addr(client->adapter, arg))
                         return -EBUSY;
+                /* REVISIT: address could become busy later */
                 client->addr = arg;
                 return 0;
         case I2C_TENBIT:
@@ -386,6 +448,13 @@ static int i2cdev_open(struct inode *inode, struct file *file)
         if (!adap)
                 return -ENODEV;
 
+        /* This creates an anonymous i2c_client, which may later be
+         * pointed to some address using I2C_SLAVE or I2C_SLAVE_FORCE.
+         *
+         * This client is ** NEVER REGISTERED ** with the driver model
+         * or I2C core code!!  It just holds private copies of addressing
+         * information and maybe a PEC flag.
+         */
         client = kzalloc(sizeof(*client), GFP_KERNEL);
         if (!client) {
                 i2c_put_adapter(adap);
@@ -394,7 +463,6 @@ static int i2cdev_open(struct inode *inode, struct file *file)
         snprintf(client->name, I2C_NAME_SIZE, "i2c-dev %d", adap->nr);
         client->driver = &i2cdev_driver;
 
-        /* registered with adapter, passed as client to user */
         client->adapter = adap;
         file->private_data = client;
 
@@ -422,6 +490,14 @@ static const struct file_operations i2cdev_fops = {
         .release        = i2cdev_release,
 };
 
+/* ------------------------------------------------------------------------- */
+
+/*
+ * The legacy "i2cdev_driver" is used primarily to get notifications when
+ * I2C adapters are added or removed, so that each one gets an i2c_dev
+ * and is thus made available to userspace driver code.
+ */
+
 static struct class *i2c_dev_class;
 
 static int i2cdev_attach_adapter(struct i2c_adapter *adap)
@@ -486,6 +562,12 @@ static struct i2c_driver i2cdev_driver = {
         .detach_client  = i2cdev_detach_client,
 };
 
+/* ------------------------------------------------------------------------- */
+
+/*
+ * module load/unload record keeping
+ */
+
 static int __init i2c_dev_init(void)
 {
         int res;
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index b9961dc47606..6d62250fba07 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -2512,31 +2512,32 @@ static int skge_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         return err;
 }
 
-/* Assign Ram Buffer allocation to queue */
-static void skge_ramset(struct skge_hw *hw, u16 q, u32 start, u32 space)
+static void skge_ramset(struct skge_hw *hw, u16 q, u32 start, size_t len)
 {
         u32 end;
 
-        /* convert from K bytes to qwords used for hw register */
-        start *= 1024/8;
-        space *= 1024/8;
-        end = start + space - 1;
+        start /= 8;
+        len /= 8;
+        end = start + len - 1;
 
         skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_RST_CLR);
         skge_write32(hw, RB_ADDR(q, RB_START), start);
-        skge_write32(hw, RB_ADDR(q, RB_END), end);
         skge_write32(hw, RB_ADDR(q, RB_WP), start);
         skge_write32(hw, RB_ADDR(q, RB_RP), start);
+        skge_write32(hw, RB_ADDR(q, RB_END), end);
 
         if (q == Q_R1 || q == Q_R2) {
-                u32 tp = space - space/4;
-
                 /* Set thresholds on receive queue's */
-                skge_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp);
-                skge_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4);
-        } else if (hw->chip_id != CHIP_ID_GENESIS)
-                /* Genesis Tx Fifo is too small for normal store/forward */
+                skge_write32(hw, RB_ADDR(q, RB_RX_UTPP),
+                             start + (2*len)/3);
+                skge_write32(hw, RB_ADDR(q, RB_RX_LTPP),
+                             start + (len/3));
+        } else {
+                /* Enable store & forward on Tx queue's because
+                 * Tx FIFO is only 4K on Genesis and 1K on Yukon
+                 */
                 skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_ENA_STFWD);
+        }
 
         skge_write8(hw, RB_ADDR(q, RB_CTRL), RB_ENA_OP_MD);
 }
@@ -2564,7 +2565,7 @@ static int skge_up(struct net_device *dev)
         struct skge_port *skge = netdev_priv(dev);
         struct skge_hw *hw = skge->hw;
         int port = skge->port;
-        u32 ramaddr, ramsize, rxspace;
+        u32 chunk, ram_addr;
         size_t rx_size, tx_size;
         int err;
 
@@ -2619,15 +2620,14 @@ static int skge_up(struct net_device *dev)
         spin_unlock_bh(&hw->phy_lock);
 
         /* Configure RAMbuffers */
-        ramsize = (hw->ram_size - hw->ram_offset) / hw->ports;
-        ramaddr = hw->ram_offset + port * ramsize;
-        rxspace = 8 + (2*(ramsize - 16))/3;
-
-        skge_ramset(hw, rxqaddr[port], ramaddr, rxspace);
-        skge_ramset(hw, txqaddr[port], ramaddr + rxspace, ramsize - rxspace);
+        chunk = hw->ram_size / ((hw->ports + 1)*2);
+        ram_addr = hw->ram_offset + 2 * chunk * port;
 
+        skge_ramset(hw, rxqaddr[port], ram_addr, chunk);
         skge_qset(skge, rxqaddr[port], skge->rx_ring.to_clean);
+
         BUG_ON(skge->tx_ring.to_use != skge->tx_ring.to_clean);
+        skge_ramset(hw, txqaddr[port], ram_addr+chunk, chunk);
         skge_qset(skge, txqaddr[port], skge->tx_ring.to_use);
 
         /* Start receiver BMU */
@@ -3591,12 +3591,15 @@ static int skge_reset(struct skge_hw *hw)
         if (hw->chip_id == CHIP_ID_GENESIS) {
                 if (t8 == 3) {
                         /* special case: 4 x 64k x 36, offset = 0x80000 */
-                        hw->ram_size = 1024;
-                        hw->ram_offset = 512;
+                        hw->ram_size = 0x100000;
+                        hw->ram_offset = 0x80000;
                 } else
                         hw->ram_size = t8 * 512;
-        } else /* Yukon */
-                hw->ram_size = t8 ? t8 * 4 : 128;
+        }
+        else if (t8 == 0)
+                hw->ram_size = 0x20000;
+        else
+                hw->ram_size = t8 * 4096;
 
         hw->intr_mask = IS_HW_ERR;
 
diff --git a/include/asm-avr32/sysreg.h b/include/asm-avr32/sysreg.h
index c02bc8304b13..dd21182b60e0 100644
--- a/include/asm-avr32/sysreg.h
+++ b/include/asm-avr32/sysreg.h
@@ -215,6 +215,8 @@
 #define SYSREG_IRP_SIZE                         6
 
 /* Bitfields in PCCR */
+#define SYSREG_PCCR_E_OFFSET                    0
+#define SYSREG_PCCR_E_SIZE                      1
 #define SYSREG_PCCR_R_OFFSET                    1
 #define SYSREG_PCCR_R_SIZE                      1
 #define SYSREG_PCCR_C_OFFSET                    2
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index 8033e6b33271..a100c9f8eb7c 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -400,11 +400,6 @@ extern int i2c_release_client(struct i2c_client *);
 extern void i2c_clients_command(struct i2c_adapter *adap,
                                 unsigned int cmd, void *arg);
 
-/* returns -EBUSY if address has been taken, 0 if not. Note that the only
-   other place at which this is called is within i2c_attach_client; so
-   you can cheat by simply not registering. Not recommended, of course! */
-extern int i2c_check_addr (struct i2c_adapter *adapter, int addr);
-
 /* Detect function. It iterates over all possible addresses itself.
  * It will only call found_proc if some client is connected at the
  * specific address (unless a 'force' matched);
diff --git a/include/pcmcia/cs_types.h b/include/pcmcia/cs_types.h
index c1d1629fcd27..5f388035687d 100644
--- a/include/pcmcia/cs_types.h
+++ b/include/pcmcia/cs_types.h
@@ -21,7 +21,7 @@
 #include <sys/types.h>
 #endif
 
-#if defined(__arm__) || defined(__mips__)
+#if defined(__arm__) || defined(__mips__) || defined(__avr32__)
 /* This (ioaddr_t) is exposed to userspace & hence cannot be changed. */
 typedef u_int   ioaddr_t;
 #else
diff --git a/kernel/exit.c b/kernel/exit.c
index f1aec27f1df0..cd0f1d4137a7 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1386,8 +1386,7 @@ static int wait_task_stopped(struct task_struct *p, int delayed_group_leader,
                 int why = (p->ptrace & PT_PTRACED) ? CLD_TRAPPED : CLD_STOPPED;
 
                 exit_code = p->exit_code;
-                if (unlikely(!exit_code) ||
-                    unlikely(p->state & TASK_TRACED))
+                if (unlikely(!exit_code) || unlikely(p->exit_state))
                         goto bail_ref;
                 return wait_noreap_copyout(p, pid, uid,
                                            why, (exit_code << 8) | 0x7f,
diff --git a/kernel/sched.c b/kernel/sched.c
index 4fb3532dd7e8..38933cafea8a 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -216,15 +216,15 @@ static inline struct task_group *task_group(struct task_struct *p)
 }
 
 /* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */
-static inline void set_task_cfs_rq(struct task_struct *p)
+static inline void set_task_cfs_rq(struct task_struct *p, unsigned int cpu)
 {
-        p->se.cfs_rq = task_group(p)->cfs_rq[task_cpu(p)];
-        p->se.parent = task_group(p)->se[task_cpu(p)];
+        p->se.cfs_rq = task_group(p)->cfs_rq[cpu];
+        p->se.parent = task_group(p)->se[cpu];
 }
 
 #else
 
-static inline void set_task_cfs_rq(struct task_struct *p) { }
+static inline void set_task_cfs_rq(struct task_struct *p, unsigned int cpu) { }
 
 #endif  /* CONFIG_FAIR_GROUP_SCHED */
 
@@ -455,18 +455,18 @@ static void update_rq_clock(struct rq *rq)
  */
 enum {
         SCHED_FEAT_NEW_FAIR_SLEEPERS    = 1,
-        SCHED_FEAT_START_DEBIT          = 2,
-        SCHED_FEAT_TREE_AVG             = 4,
-        SCHED_FEAT_APPROX_AVG           = 8,
-        SCHED_FEAT_WAKEUP_PREEMPT       = 16,
+        SCHED_FEAT_WAKEUP_PREEMPT       = 2,
+        SCHED_FEAT_START_DEBIT          = 4,
+        SCHED_FEAT_TREE_AVG             = 8,
+        SCHED_FEAT_APPROX_AVG           = 16,
 };
 
 const_debug unsigned int sysctl_sched_features =
                 SCHED_FEAT_NEW_FAIR_SLEEPERS    * 1 |
+                SCHED_FEAT_WAKEUP_PREEMPT       * 1 |
                 SCHED_FEAT_START_DEBIT          * 1 |
                 SCHED_FEAT_TREE_AVG             * 0 |
-                SCHED_FEAT_APPROX_AVG           * 0 |
-                SCHED_FEAT_WAKEUP_PREEMPT       * 1;
+                SCHED_FEAT_APPROX_AVG           * 0;
 
 #define sched_feat(x) (sysctl_sched_features & SCHED_FEAT_##x)
 
@@ -1022,10 +1022,16 @@ unsigned long weighted_cpuload(const int cpu)
 
 static inline void __set_task_cpu(struct task_struct *p, unsigned int cpu)
 {
+        set_task_cfs_rq(p, cpu);
 #ifdef CONFIG_SMP
+        /*
+         * After ->cpu is set up to a new value, task_rq_lock(p, ...) can be
+         * successfuly executed on another CPU. We must ensure that updates of
+         * per-task data have been completed by this moment.
+         */
+        smp_wmb();
         task_thread_info(p)->cpu = cpu;
 #endif
-        set_task_cfs_rq(p);
 }
 
 #ifdef CONFIG_SMP
@@ -3390,10 +3396,8 @@ void account_system_time(struct task_struct *p, int hardirq_offset,
         struct rq *rq = this_rq();
         cputime64_t tmp;
 
-        if (p->flags & PF_VCPU) {
-                account_guest_time(p, cputime);
-                return;
-        }
+        if ((p->flags & PF_VCPU) && (irq_count() - hardirq_offset == 0))
+                return account_guest_time(p, cputime);
 
         p->stime = cputime_add(p->stime, cputime);
 
@@ -5278,23 +5282,9 @@ static void migrate_live_tasks(int src_cpu)
 }
 
 /*
- * activate_idle_task - move idle task to the _front_ of runqueue.
- */
-static void activate_idle_task(struct task_struct *p, struct rq *rq)
-{
-        update_rq_clock(rq);
-
-        if (p->state == TASK_UNINTERRUPTIBLE)
-                rq->nr_uninterruptible--;
-
-        enqueue_task(rq, p, 0);
-        inc_nr_running(p, rq);
-}
-
-/*
  * Schedules idle task to be the next runnable task on current CPU.
- * It does so by boosting its priority to highest possible and adding it to
- * the _front_ of the runqueue. Used by CPU offline code.
+ * It does so by boosting its priority to highest possible.
+ * Used by CPU offline code.
  */
 void sched_idle_next(void)
 {
@@ -5314,8 +5304,8 @@ void sched_idle_next(void)
 
         __setscheduler(rq, p, SCHED_FIFO, MAX_RT_PRIO-1);
 
-        /* Add idle task to the _front_ of its priority queue: */
-        activate_idle_task(p, rq);
+        update_rq_clock(rq);
+        activate_task(rq, p, 0);
 
         spin_unlock_irqrestore(&rq->lock, flags);
 }
@@ -7089,8 +7079,10 @@ void sched_move_task(struct task_struct *tsk)
 
         rq = task_rq_lock(tsk, &flags);
 
-        if (tsk->sched_class != &fair_sched_class)
+        if (tsk->sched_class != &fair_sched_class) {
+                set_task_cfs_rq(tsk, task_cpu(tsk));
                 goto done;
+        }
 
         update_rq_clock(rq);
 
@@ -7103,7 +7095,7 @@ void sched_move_task(struct task_struct *tsk)
                         tsk->sched_class->put_prev_task(rq, tsk);
         }
 
-        set_task_cfs_rq(tsk);
+        set_task_cfs_rq(tsk, task_cpu(tsk));
 
         if (on_rq) {
                 if (unlikely(running))
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index d3c03070872d..ee00da284b12 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -43,7 +43,7 @@ unsigned int sysctl_sched_min_granularity = 1000000ULL;
 /*
  * is kept at sysctl_sched_latency / sysctl_sched_min_granularity
  */
-unsigned int sched_nr_latency = 20;
+static unsigned int sched_nr_latency = 20;
 
 /*
  * After fork, child runs first. (default) If set to 0 then
diff --git a/mm/slob.c b/mm/slob.c
index 5bc2ceb692ec..08a9bd91a1aa 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -321,7 +321,8 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
                 /* Improve fragment distribution and reduce our average
                  * search time by starting our next search here. (see
                  * Knuth vol 1, sec 2.5, pg 449) */
-                if (free_slob_pages.next != prev->next)
+                if (prev != free_slob_pages.prev &&
+                                free_slob_pages.next != prev->next)
                         list_move_tail(&free_slob_pages, prev->next);
                 break;
         }