[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] linux-2.6-xen.hg



While I'm on the subject, there's a very large diff between the
xen-unstable internal xenlinux tree (linux-2.6.16.13-xen) and the
standalone xenlinux tree (linux-2.6-xen.hg). For example, oprofile
won't compile in the external xenlinux tree. Could we sync them up,
either by applying this patch wholesale or cherry-picking the
important bits bits from it? alternatively, just basing both trees on
the exact same kernel version will reduce the diff significantly.

Cheers,
Muli

diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/alpha/kernel/setup.c 
hg/linux-2.6.16.13-xen/arch/alpha/kernel/setup.c
--- linux/linux-2.6-xen.hg/arch/alpha/kernel/setup.c    2006-03-07 
23:11:15.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/alpha/kernel/setup.c    2006-05-03 
00:38:44.000000000 +0300
@@ -24,6 +24,7 @@
 #include <linux/config.h>      /* CONFIG_ALPHA_LCA etc */
 #include <linux/mc146818rtc.h>
 #include <linux/console.h>
+#include <linux/cpu.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/string.h>
@@ -477,6 +478,22 @@ page_is_ram(unsigned long pfn)
 #undef PFN_PHYS
 #undef PFN_MAX
 
+static int __init
+register_cpus(void)
+{
+       int i;
+
+       for_each_possible_cpu(i) {
+               struct cpu *p = kzalloc(sizeof(*p), GFP_KERNEL);
+               if (!p)
+                       return -ENOMEM;
+               register_cpu(p, i, NULL);
+       }
+       return 0;
+}
+
+arch_initcall(register_cpus);
+
 void __init
 setup_arch(char **cmdline_p)
 {
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/alpha/kernel/smp.c 
hg/linux-2.6.16.13-xen/arch/alpha/kernel/smp.c
--- linux/linux-2.6-xen.hg/arch/alpha/kernel/smp.c      2006-03-07 
23:11:15.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/alpha/kernel/smp.c      2006-05-03 
00:38:44.000000000 +0300
@@ -439,7 +439,7 @@ setup_smp(void)
                        if ((cpu->flags & 0x1cc) == 0x1cc) {
                                smp_num_probed++;
                                /* Assume here that "whami" == index */
-                               cpu_set(i, cpu_possible_map);
+                               cpu_set(i, cpu_present_mask);
                                cpu->pal_revision = boot_cpu_palrev;
                        }
 
@@ -450,9 +450,8 @@ setup_smp(void)
                }
        } else {
                smp_num_probed = 1;
-               cpu_set(boot_cpuid, cpu_possible_map);
+               cpu_set(boot_cpuid, cpu_present_mask);
        }
-       cpu_present_mask = cpumask_of_cpu(boot_cpuid);
 
        printk(KERN_INFO "SMP: %d CPUs probed -- cpu_present_mask = %lx\n",
               smp_num_probed, cpu_possible_map.bits[0]);
@@ -488,9 +487,8 @@ void __devinit
 smp_prepare_boot_cpu(void)
 {
        /*
-        * Mark the boot cpu (current cpu) as both present and online
+        * Mark the boot cpu (current cpu) as online
         */ 
-       cpu_set(smp_processor_id(), cpu_present_mask);
        cpu_set(smp_processor_id(), cpu_online_map);
 }
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/alpha/lib/strncpy.S 
hg/linux-2.6.16.13-xen/arch/alpha/lib/strncpy.S
--- linux/linux-2.6-xen.hg/arch/alpha/lib/strncpy.S     2006-03-07 
23:11:15.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/alpha/lib/strncpy.S     2006-05-03 
00:38:44.000000000 +0300
@@ -43,8 +43,8 @@ strncpy:
 
        .align  4
 $multiword:
-       subq    $24, 1, $2      # clear the final bits in the prev word
-       or      $2, $24, $2
+       subq    $27, 1, $2      # clear the final bits in the prev word
+       or      $2, $27, $2
        zapnot  $1, $2, $1
        subq    $18, 1, $18
 
@@ -70,8 +70,8 @@ $multiword:
        bne     $18, 0b
 
 1:     ldq_u   $1, 0($16)      # clear the leading bits in the final word
-       subq    $27, 1, $2
-       or      $2, $27, $2
+       subq    $24, 1, $2
+       or      $2, $24, $2
 
        zap     $1, $2, $1
        stq_u   $1, 0($16)
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/i386/kernel/apm.c 
hg/linux-2.6.16.13-xen/arch/i386/kernel/apm.c
--- linux/linux-2.6-xen.hg/arch/i386/kernel/apm.c       2006-03-07 
23:11:22.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/i386/kernel/apm.c       2006-05-03 
00:38:44.000000000 +0300
@@ -1081,7 +1081,7 @@ static int apm_console_blank(int blank)
                        break;
        }
 
-       if (error == APM_NOT_ENGAGED && state != APM_STATE_READY) {
+       if (error == APM_NOT_ENGAGED) {
                static int tried;
                int eng_error;
                if (tried++ == 0) {
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/i386/kernel/cpu/amd.c 
hg/linux-2.6.16.13-xen/arch/i386/kernel/cpu/amd.c
--- linux/linux-2.6-xen.hg/arch/i386/kernel/cpu/amd.c   2006-03-07 
23:11:22.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/i386/kernel/cpu/amd.c   2006-05-03 
00:38:44.000000000 +0300
@@ -207,6 +207,8 @@ static void __init init_amd(struct cpuin
                set_bit(X86_FEATURE_K7, c->x86_capability); 
                break;
        }
+       if (c->x86 >= 6)
+               set_bit(X86_FEATURE_FXSAVE_LEAK, c->x86_capability);
 
        display_cacheinfo(c);
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/i386/kernel/cpu/cpufreq/Kconfig 
hg/linux-2.6.16.13-xen/arch/i386/kernel/cpu/cpufreq/Kconfig
--- linux/linux-2.6-xen.hg/arch/i386/kernel/cpu/cpufreq/Kconfig 2006-03-07 
23:11:22.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/i386/kernel/cpu/cpufreq/Kconfig 2006-05-03 
00:38:44.000000000 +0300
@@ -203,6 +203,7 @@ config X86_LONGRUN
 config X86_LONGHAUL
        tristate "VIA Cyrix III Longhaul"
        select CPU_FREQ_TABLE
+       depends on BROKEN
        help
          This adds the CPUFreq driver for VIA Samuel/CyrixIII, 
          VIA Cyrix Samuel/C3, VIA Cyrix Ezra and VIA Cyrix Ezra-T 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c 
hg/linux-2.6.16.13-xen/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
--- linux/linux-2.6-xen.hg/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c   
2006-03-07 23:11:22.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c   
2006-05-03 00:38:44.000000000 +0300
@@ -244,7 +244,7 @@ static int cpufreq_p4_cpu_init(struct cp
        for (i=1; (p4clockmod_table[i].frequency != CPUFREQ_TABLE_END); i++) {
                if ((i<2) && (has_N44_O17_errata[policy->cpu]))
                        p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
-               else if (has_N60_errata[policy->cpu] && 
p4clockmod_table[i].frequency < 2000000)
+               else if (has_N60_errata[policy->cpu] && ((stock_freq * i)/8) < 
2000000)
                        p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
                else
                        p4clockmod_table[i].frequency = (stock_freq * i)/8;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c 
hg/linux-2.6.16.13-xen/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
--- linux/linux-2.6-xen.hg/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c 
2006-03-07 23:11:23.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c 
2006-05-03 00:38:44.000000000 +0300
@@ -75,7 +75,9 @@ static int speedstep_smi_ownership (void
        __asm__ __volatile__(
                "out %%al, (%%dx)\n"
                : "=D" (result)
-               : "a" (command), "b" (function), "c" (0), "d" (smi_port), "D" 
(0), "S" (magic)
+               : "a" (command), "b" (function), "c" (0), "d" (smi_port),
+                       "D" (0), "S" (magic)
+               : "memory"
        );
 
        dprintk("result is %x\n", result);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/i386/kernel/dmi_scan.c 
hg/linux-2.6.16.13-xen/arch/i386/kernel/dmi_scan.c
--- linux/linux-2.6-xen.hg/arch/i386/kernel/dmi_scan.c  2006-03-07 
23:11:23.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/i386/kernel/dmi_scan.c  2006-05-03 
00:38:44.000000000 +0300
@@ -106,7 +106,7 @@ static void __init dmi_save_devices(stru
        struct dmi_device *dev;
 
        for (i = 0; i < count; i++) {
-               char *d = ((char *) dm) + (i * 2);
+               char *d = (char *)(dm + 1) + (i * 2);
 
                /* Skip disabled device */
                if ((*d & 0x80) == 0)
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/i386/kernel/vm86.c 
hg/linux-2.6.16.13-xen/arch/i386/kernel/vm86.c
--- linux/linux-2.6-xen.hg/arch/i386/kernel/vm86.c      2006-06-07 
11:11:40.000000000 +0300
+++ hg/linux-2.6.16.13-xen/arch/i386/kernel/vm86.c      2006-06-02 
23:36:11.000000000 +0300
@@ -43,6 +43,7 @@
 #include <linux/smp_lock.h>
 #include <linux/highmem.h>
 #include <linux/ptrace.h>
+#include <linux/audit.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -260,6 +261,7 @@ static void do_sys_vm86(struct kernel_vm
 #ifndef CONFIG_X86_NO_TSS
        struct tss_struct *tss;
 #endif
+       long eax;
 /*
  * make sure the vm86() system call doesn't try to do anything silly
  */
@@ -317,13 +319,19 @@ static void do_sys_vm86(struct kernel_vm
        tsk->thread.screen_bitmap = info->screen_bitmap;
        if (info->flags & VM86_SCREEN_BITMAP)
                mark_screen_rdonly(tsk->mm);
+       __asm__ __volatile__("xorl %eax,%eax; movl %eax,%fs; movl 
%eax,%gs\n\t");
+       __asm__ __volatile__("movl %%eax, %0\n" :"=r"(eax));
+
+       /*call audit_syscall_exit since we do not exit via the normal paths */
+       if (unlikely(current->audit_context))
+               audit_syscall_exit(current, AUDITSC_RESULT(eax), eax);
+
        __asm__ __volatile__(
-               "xorl %%eax,%%eax; movl %%eax,%%fs; movl %%eax,%%gs\n\t"
                "movl %0,%%esp\n\t"
                "movl %1,%%ebp\n\t"
                "jmp resume_userspace"
                : /* no outputs */
-               :"r" (&info->regs), "r" (task_thread_info(tsk)) : "ax");
+               :"r" (&info->regs), "r" (task_thread_info(tsk)));
        /* we never return here */
 }
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/i386/oprofile/xenoprof.c 
hg/linux-2.6.16.13-xen/arch/i386/oprofile/xenoprof.c
--- linux/linux-2.6-xen.hg/arch/i386/oprofile/xenoprof.c        2006-06-28 
10:07:43.000000000 +0300
+++ hg/linux-2.6.16.13-xen/arch/i386/oprofile/xenoprof.c        2006-07-13 
09:27:48.000000000 +0300
@@ -29,6 +29,7 @@
 #include <xen/interface/xen.h>
 #include <xen/interface/xenoprof.h>
 #include <../../../drivers/oprofile/cpu_buffer.h>
+#include <../../../drivers/oprofile/event_buffer.h>
 
 static int xenoprof_start(void);
 static void xenoprof_stop(void);
@@ -151,16 +152,27 @@ static void xenoprof_add_pc(xenoprof_buf
 static void xenoprof_handle_passive(void)
 {
        int i, j;
-
-       for (i = 0; i < pdomains; i++)
+       int flag_domain, flag_switch = 0;
+       
+       for (i = 0; i < pdomains; i++) {
+               flag_domain = 0;
                for (j = 0; j < passive_domains[i].nbuf; j++) {
                        xenoprof_buf_t *buf = p_xenoprof_buf[i][j];
                        if (buf->event_head == buf->event_tail)
                                continue;
-                        oprofile_add_pc(IGNORED_PC, CPU_MODE_PASSIVE_START, 
passive_domains[i].domain_id);
+                       if (!flag_domain) {
+                               if 
(!oprofile_add_domain_switch(passive_domains[i].
+                                                               domain_id))
+                                       goto done;
+                               flag_domain = 1;
+                       }
                        xenoprof_add_pc(buf, 1);
-                        oprofile_add_pc(IGNORED_PC, CPU_MODE_PASSIVE_STOP, 
passive_domains[i].domain_id);
-               }                       
+                       flag_switch = 1;
+               }
+       }
+done:
+       if (flag_switch)
+               oprofile_add_domain_switch(COORDINATOR_DOMAIN);
 }
 
 static irqreturn_t 
@@ -177,6 +189,7 @@ xenoprof_ovf_interrupt(int irq, void * d
 
        if (is_primary && !test_and_set_bit(0, &flag)) {
                xenoprof_handle_passive();
+               smp_mb__before_clear_bit();
                clear_bit(0, &flag);
        }
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/ia64/xen/drivers/README 
hg/linux-2.6.16.13-xen/arch/ia64/xen/drivers/README
--- linux/linux-2.6-xen.hg/arch/ia64/xen/drivers/README 2006-03-07 
23:11:26.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/ia64/xen/drivers/README 1970-01-01 
02:00:00.000000000 +0200
@@ -1,2 +0,0 @@
-This is a temporary location for source/Makefiles that need to be
-patched/reworked in drivers/xen to work with xenlinux/ia64.
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/m32r/kernel/m32r_ksyms.c 
hg/linux-2.6.16.13-xen/arch/m32r/kernel/m32r_ksyms.c
--- linux/linux-2.6-xen.hg/arch/m32r/kernel/m32r_ksyms.c        2006-03-07 
23:11:26.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/m32r/kernel/m32r_ksyms.c        2006-05-03 
00:38:44.000000000 +0300
@@ -38,10 +38,6 @@ EXPORT_SYMBOL(__udelay);
 EXPORT_SYMBOL(__delay);
 EXPORT_SYMBOL(__const_udelay);
 
-EXPORT_SYMBOL(__get_user_1);
-EXPORT_SYMBOL(__get_user_2);
-EXPORT_SYMBOL(__get_user_4);
-
 EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strstr);
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/m32r/kernel/setup.c 
hg/linux-2.6.16.13-xen/arch/m32r/kernel/setup.c
--- linux/linux-2.6-xen.hg/arch/m32r/kernel/setup.c     2006-03-07 
23:11:26.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/m32r/kernel/setup.c     2006-05-03 
00:38:44.000000000 +0300
@@ -9,6 +9,7 @@
 
 #include <linux/config.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/stddef.h>
 #include <linux/fs.h>
 #include <linux/sched.h>
@@ -218,8 +219,6 @@ static unsigned long __init setup_memory
 extern unsigned long setup_memory(void);
 #endif /* CONFIG_DISCONTIGMEM */
 
-#define M32R_PCC_PCATCR        0x00ef7014      /* will move to m32r.h */
-
 void __init setup_arch(char **cmdline_p)
 {
        ROOT_DEV = old_decode_dev(ORIG_ROOT_DEV);
@@ -268,15 +267,14 @@ void __init setup_arch(char **cmdline_p)
        paging_init();
 }
 
-static struct cpu cpu[NR_CPUS];
+static struct cpu cpu_devices[NR_CPUS];
 
 static int __init topology_init(void)
 {
-       int cpu_id;
+       int i;
 
-       for (cpu_id = 0; cpu_id < NR_CPUS; cpu_id++)
-               if (cpu_possible(cpu_id))
-                       register_cpu(&cpu[cpu_id], cpu_id, NULL);
+       for_each_present_cpu(i)
+               register_cpu(&cpu_devices[i], i, NULL);
 
        return 0;
 }
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/m32r/kernel/smpboot.c 
hg/linux-2.6.16.13-xen/arch/m32r/kernel/smpboot.c
--- linux/linux-2.6-xen.hg/arch/m32r/kernel/smpboot.c   2006-03-07 
23:11:27.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/m32r/kernel/smpboot.c   2006-05-03 
00:38:44.000000000 +0300
@@ -39,8 +39,10 @@
  *             Martin J. Bligh :       Added support for multi-quad systems
  */
 
+#include <linux/module.h>
 #include <linux/config.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/smp_lock.h>
 #include <linux/irq.h>
@@ -72,11 +74,15 @@ physid_mask_t phys_cpu_present_map;
 
 /* Bitmask of currently online CPUs */
 cpumask_t cpu_online_map;
+EXPORT_SYMBOL(cpu_online_map);
 
 cpumask_t cpu_bootout_map;
 cpumask_t cpu_bootin_map;
-cpumask_t cpu_callout_map;
 static cpumask_t cpu_callin_map;
+cpumask_t cpu_callout_map;
+EXPORT_SYMBOL(cpu_callout_map);
+cpumask_t cpu_possible_map = CPU_MASK_ALL;
+EXPORT_SYMBOL(cpu_possible_map);
 
 /* Per CPU bogomips and other parameters */
 struct cpuinfo_m32r cpu_data[NR_CPUS] __cacheline_aligned;
@@ -110,7 +116,6 @@ static unsigned int calibration_result;
 
 void smp_prepare_boot_cpu(void);
 void smp_prepare_cpus(unsigned int);
-static void smp_tune_scheduling(void);
 static void init_ipi_lock(void);
 static void do_boot_cpu(int);
 int __cpu_up(unsigned int);
@@ -177,6 +182,9 @@ void __init smp_prepare_cpus(unsigned in
        }
        for (phys_id = 0 ; phys_id < nr_cpu ; phys_id++)
                physid_set(phys_id, phys_cpu_present_map);
+#ifndef CONFIG_HOTPLUG_CPU
+       cpu_present_map = cpu_possible_map;
+#endif
 
        show_mp_info(nr_cpu);
 
@@ -186,7 +194,6 @@ void __init smp_prepare_cpus(unsigned in
         * Setup boot CPU information
         */
        smp_store_cpu_info(0); /* Final full version of the data */
-       smp_tune_scheduling();
 
        /*
         * If SMP should be disabled, then really disable it!
@@ -230,11 +237,6 @@ smp_done:
        Dprintk("Boot done.\n");
 }
 
-static void __init smp_tune_scheduling(void)
-{
-       /* Nothing to do. */
-}
-
 /*
  * init_ipi_lock : Initialize IPI locks.
  */
@@ -629,4 +631,3 @@ static void __init unmap_cpu_to_physid(i
        physid_2_cpu[phys_id] = -1;
        cpu_2_physid[cpu_id] = -1;
 }
-
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/m32r/lib/getuser.S 
hg/linux-2.6.16.13-xen/arch/m32r/lib/getuser.S
--- linux/linux-2.6-xen.hg/arch/m32r/lib/getuser.S      2006-03-07 
23:11:27.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/m32r/lib/getuser.S      1970-01-01 
02:00:00.000000000 +0200
@@ -1,88 +0,0 @@
-/*
- * __get_user functions.
- *
- * (C) Copyright 2001 Hirokazu Takata
- *
- * These functions have a non-standard call interface
- * to make them more efficient, especially as they
- * return an error value in addition to the "real"
- * return value.
- */
-
-#include <linux/config.h>
-
-/*
- * __get_user_X
- *
- * Inputs:     r0 contains the address
- *
- * Outputs:    r0 is error code (0 or -EFAULT)
- *             r1 contains zero-extended value
- *
- * These functions should not modify any other registers,
- * as they get called from within inline assembly.
- */
-
-#ifdef CONFIG_ISA_DUAL_ISSUE
-
-       .text
-       .balign 4
-       .globl __get_user_1
-__get_user_1:
-1:     ldub    r1, @r0             ||  ldi     r0, #0
-       jmp     r14
-
-       .balign 4
-       .globl __get_user_2
-__get_user_2:
-2:     lduh    r1, @r0             ||  ldi     r0, #0
-       jmp     r14
-
-       .balign 4
-       .globl __get_user_4
-__get_user_4:
-3:     ld      r1, @r0             ||  ldi     r0, #0
-       jmp     r14
-
-bad_get_user:
-       ldi     r1, #0              ||  ldi     r0, #-14
-       jmp     r14
-
-#else /* not CONFIG_ISA_DUAL_ISSUE */
-
-       .text
-       .balign 4
-       .globl __get_user_1
-__get_user_1:
-1:     ldub    r1, @r0
-       ldi     r0, #0
-       jmp     r14
-
-       .balign 4
-       .globl __get_user_2
-__get_user_2:
-2:     lduh    r1, @r0
-       ldi     r0, #0
-       jmp     r14
-
-       .balign 4
-       .globl __get_user_4
-__get_user_4:
-3:     ld      r1, @r0
-       ldi     r0, #0
-       jmp     r14
-
-bad_get_user:
-       ldi     r1, #0
-       ldi     r0, #-14
-       jmp     r14
-
-#endif /* not CONFIG_ISA_DUAL_ISSUE */
-
-.section __ex_table,"a"
-       .long 1b,bad_get_user
-       .long 2b,bad_get_user
-       .long 3b,bad_get_user
-.previous
-
-       .end
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/m32r/lib/Makefile 
hg/linux-2.6.16.13-xen/arch/m32r/lib/Makefile
--- linux/linux-2.6-xen.hg/arch/m32r/lib/Makefile       2006-03-07 
23:11:27.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/m32r/lib/Makefile       2006-05-03 
00:38:44.000000000 +0300
@@ -2,6 +2,6 @@
 # Makefile for M32R-specific library files..
 #
 
-lib-y  := checksum.o ashxdi3.o memset.o memcpy.o getuser.o \
-         putuser.o delay.o strlen.o usercopy.o csum_partial_copy.o
+lib-y  := checksum.o ashxdi3.o memset.o memcpy.o \
+         delay.o strlen.o usercopy.o csum_partial_copy.o
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/m32r/lib/putuser.S 
hg/linux-2.6.16.13-xen/arch/m32r/lib/putuser.S
--- linux/linux-2.6-xen.hg/arch/m32r/lib/putuser.S      2006-03-07 
23:11:27.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/m32r/lib/putuser.S      1970-01-01 
02:00:00.000000000 +0200
@@ -1,84 +0,0 @@
-/*
- * __put_user functions.
- *
- * (C) Copyright 1998 Linus Torvalds
- * (C) Copyright 2001 Hirokazu Takata
- *
- * These functions have a non-standard call interface
- * to make them more efficient.
- */
-
-#include <linux/config.h>
-
-/*
- * __put_user_X
- *
- * Inputs:     r0 contains the address
- *             r1 contains the value
- *
- * Outputs:    r0 is error code (0 or -EFAULT)
- *             r1 is corrupted (will contain "current_task").
- *
- * These functions should not modify any other registers,
- * as they get called from within inline assembly.
- */
-
-#ifdef CONFIG_ISA_DUAL_ISSUE
-
-       .text
-       .balign 4
-       .globl __put_user_1
-__put_user_1:
-1:     stb     r1, @r0             ||  ldi     r0, #0
-       jmp     r14
-
-       .balign 4
-       .globl __put_user_2
-__put_user_2:
-2:     sth     r1, @r0             ||  ldi     r0, #0
-       jmp     r14
-
-       .balign 4
-       .globl __put_user_4
-__put_user_4:
-3:     st      r1, @r0             ||  ldi     r0, #0
-       jmp     r14
-
-bad_put_user:
-       ldi     r0, #-14            ||  jmp     r14
-
-#else /* not CONFIG_ISA_DUAL_ISSUE */
-
-       .text
-       .balign 4
-       .globl __put_user_1
-__put_user_1:
-1:     stb     r1, @r0
-       ldi     r0, #0
-       jmp     r14
-
-       .balign 4
-       .globl __put_user_2
-__put_user_2:
-2:     sth     r1, @r0
-       ldi     r0, #0
-       jmp     r14
-
-       .balign 4
-       .globl __put_user_4
-__put_user_4:
-3:     st      r1, @r0
-       ldi     r0, #0
-       jmp     r14
-
-bad_put_user:
-       ldi     r0, #-14
-       jmp     r14
-
-#endif /* not CONFIG_ISA_DUAL_ISSUE */
-
-.section __ex_table,"a"
-       .long 1b,bad_put_user
-       .long 2b,bad_put_user
-       .long 3b,bad_put_user
-.previous
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/mips/kernel/branch.c 
hg/linux-2.6.16.13-xen/arch/mips/kernel/branch.c
--- linux/linux-2.6-xen.hg/arch/mips/kernel/branch.c    2006-03-07 
23:11:31.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/mips/kernel/branch.c    2006-05-03 
00:38:44.000000000 +0300
@@ -184,7 +184,7 @@ int __compute_return_epc(struct pt_regs 
                bit = (insn.i_format.rt >> 2);
                bit += (bit != 0);
                bit += 23;
-               switch (insn.i_format.rt) {
+               switch (insn.i_format.rt & 3) {
                case 0: /* bc1f */
                case 2: /* bc1fl */
                        if (~fcr31 & (1 << bit))
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/mips/mm/c-r4k.c 
hg/linux-2.6.16.13-xen/arch/mips/mm/c-r4k.c
--- linux/linux-2.6-xen.hg/arch/mips/mm/c-r4k.c 2006-03-22 18:36:07.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/arch/mips/mm/c-r4k.c 2006-05-03 00:38:44.000000000 
+0300
@@ -154,7 +154,8 @@ static inline void blast_icache32_r4600_
 
 static inline void tx49_blast_icache32_page_indexed(unsigned long page)
 {
-       unsigned long start = page;
+       unsigned long indexmask = current_cpu_data.icache.waysize - 1;
+       unsigned long start = INDEX_BASE + (page & indexmask);
        unsigned long end = start + PAGE_SIZE;
        unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
        unsigned long ws_end = current_cpu_data.icache.ways <<
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/powerpc/kernel/pci_64.c 
hg/linux-2.6.16.13-xen/arch/powerpc/kernel/pci_64.c
--- linux/linux-2.6-xen.hg/arch/powerpc/kernel/pci_64.c 2006-03-22 
18:36:07.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/powerpc/kernel/pci_64.c 2006-05-03 
00:38:44.000000000 +0300
@@ -78,6 +78,7 @@ int global_phb_number;                /* Global phb co
 
 /* Cached ISA bridge dev. */
 struct pci_dev *ppc64_isabridge_dev = NULL;
+EXPORT_SYMBOL_GPL(ppc64_isabridge_dev);
 
 static void fixup_broken_pcnet32(struct pci_dev* dev)
 {
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/powerpc/kernel/setup_64.c 
hg/linux-2.6.16.13-xen/arch/powerpc/kernel/setup_64.c
--- linux/linux-2.6-xen.hg/arch/powerpc/kernel/setup_64.c       2006-03-07 
23:11:37.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/powerpc/kernel/setup_64.c       2006-05-03 
00:38:44.000000000 +0300
@@ -256,12 +256,10 @@ void __init early_setup(unsigned long dt
        /*
         * Initialize stab / SLB management except on iSeries
         */
-       if (!firmware_has_feature(FW_FEATURE_ISERIES)) {
-               if (cpu_has_feature(CPU_FTR_SLB))
-                       slb_initialize();
-               else
-                       stab_initialize(lpaca->stab_real);
-       }
+       if (cpu_has_feature(CPU_FTR_SLB))
+               slb_initialize();
+       else if (!firmware_has_feature(FW_FEATURE_ISERIES))
+               stab_initialize(lpaca->stab_real);
 
        DBG(" <- early_setup()\n");
 }
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/powerpc/kernel/signal_64.c 
hg/linux-2.6.16.13-xen/arch/powerpc/kernel/signal_64.c
--- linux/linux-2.6-xen.hg/arch/powerpc/kernel/signal_64.c      2006-03-19 
14:08:30.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/powerpc/kernel/signal_64.c      2006-05-03 
00:38:44.000000000 +0300
@@ -213,7 +213,7 @@ static inline void __user * get_sigframe
         /* Default to using normal stack */
         newsp = regs->gpr[1];
 
-       if (ka->sa.sa_flags & SA_ONSTACK) {
+       if ((ka->sa.sa_flags & SA_ONSTACK) && current->sas_ss_size) {
                if (! on_sig_stack(regs->gpr[1]))
                        newsp = (current->sas_ss_sp + current->sas_ss_size);
        }
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/x86_64/ia32/Makefile 
hg/linux-2.6.16.13-xen/arch/x86_64/ia32/Makefile
--- linux/linux-2.6-xen.hg/arch/x86_64/ia32/Makefile    2006-03-07 
23:11:51.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/x86_64/ia32/Makefile    2006-05-11 
14:37:36.000000000 +0300
@@ -28,11 +28,11 @@ $(obj)/vsyscall-sysenter.so $(obj)/vsysc
 $(obj)/vsyscall-%.so: $(src)/vsyscall.lds $(obj)/vsyscall-%.o FORCE
        $(call if_changed,syscall)
 
-AFLAGS_vsyscall-sysenter.o = -m32 -Iarch/i386/kernel
-AFLAGS_vsyscall-syscall.o = -m32 -Iarch/i386/kernel
+AFLAGS_vsyscall-sysenter.o = -m32 -Wa,-32 -Iarch/i386/kernel
+AFLAGS_vsyscall-syscall.o = -m32 -Wa,-32 -Iarch/i386/kernel
 
 ifdef CONFIG_XEN
-AFLAGS_vsyscall-int80.o = -m32 -Iarch/i386/kernel
+AFLAGS_vsyscall-int80.o = -m32 -Wa,-32 -Iarch/i386/kernel
 CFLAGS_syscall32-xen.o += -DUSE_INT80
 AFLAGS_syscall32_syscall-xen.o += -DUSE_INT80
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/x86_64/kernel/entry.S 
hg/linux-2.6.16.13-xen/arch/x86_64/kernel/entry.S
--- linux/linux-2.6-xen.hg/arch/x86_64/kernel/entry.S   2006-04-01 
17:41:53.000000000 +0300
+++ hg/linux-2.6.16.13-xen/arch/x86_64/kernel/entry.S   2006-07-31 
10:27:31.000000000 +0300
@@ -180,6 +180,10 @@ rff_trace:
  *
  * XXX if we had a free scratch register we could save the RSP into the stack 
frame
  *      and report it properly in ps. Unfortunately we haven't.
+ *
+ * When user can change the frames always force IRET. That is because
+ * it deals with uncanonical addresses better. SYSRET has trouble
+ * with them due to bugs in both AMD and Intel CPUs.
  */                                    
 
 ENTRY(system_call)
@@ -254,7 +258,10 @@ sysret_signal:
        xorl %esi,%esi # oldset -> arg2
        call ptregscall_common
 1:     movl $_TIF_NEED_RESCHED,%edi
-       jmp sysret_check
+       /* Use IRET because user could have changed frame. This
+          works because ptregscall_common has called FIXUP_TOP_OF_STACK. */
+       cli
+       jmp int_with_check
        
 badsys:
        movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
@@ -280,7 +287,8 @@ tracesys:                    
        call syscall_trace_leave
        RESTORE_TOP_OF_STACK %rbx
        RESTORE_REST
-       jmp ret_from_sys_call
+       /* Use IRET because user could have changed frame */
+       jmp int_ret_from_sys_call
        CFI_ENDPROC
                
 /* 
@@ -408,25 +416,9 @@ ENTRY(stub_execve)
        CFI_ADJUST_CFA_OFFSET -8
        CFI_REGISTER rip, r11
        SAVE_REST
-       movq %r11, %r15
-       CFI_REGISTER rip, r15
        FIXUP_TOP_OF_STACK %r11
        call sys_execve
-       GET_THREAD_INFO(%rcx)
-       bt $TIF_IA32,threadinfo_flags(%rcx)
-       CFI_REMEMBER_STATE
-       jc exec_32bit
        RESTORE_TOP_OF_STACK %r11
-       movq %r15, %r11
-       CFI_REGISTER rip, r11
-       RESTORE_REST
-       pushq %r11
-       CFI_ADJUST_CFA_OFFSET 8
-       CFI_REL_OFFSET rip, 0
-       ret
-
-exec_32bit:
-       CFI_RESTORE_STATE
        movq %rax,RAX(%rsp)
        RESTORE_REST
        jmp int_ret_from_sys_call
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/x86_64/kernel/entry-xen.S 
hg/linux-2.6.16.13-xen/arch/x86_64/kernel/entry-xen.S
--- linux/linux-2.6-xen.hg/arch/x86_64/kernel/entry-xen.S       2006-04-01 
17:41:53.000000000 +0300
+++ hg/linux-2.6.16.13-xen/arch/x86_64/kernel/entry-xen.S       2006-05-11 
14:37:36.000000000 +0300
@@ -221,6 +221,10 @@ rff_trace:
  *
  * XXX if we had a free scratch register we could save the RSP into the stack 
frame
  *      and report it properly in ps. Unfortunately we haven't.
+ *
+ * When user can change the frames always force IRET. That is because
+ * it deals with uncanonical addresses better. SYSRET has trouble
+ * with them due to bugs in both AMD and Intel CPUs.
  */                                    
 
 ENTRY(system_call)
@@ -289,7 +293,10 @@ sysret_signal:
        xorl %esi,%esi # oldset -> arg2
        call ptregscall_common
 1:     movl $_TIF_NEED_RESCHED,%edi
-       jmp sysret_check
+       /* Use IRET because user could have changed frame. This
+          works because ptregscall_common has called FIXUP_TOP_OF_STACK. */
+       cli
+       jmp int_with_check
        
 badsys:
        movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
@@ -315,7 +322,8 @@ tracesys:                    
        call syscall_trace_leave
        RESTORE_TOP_OF_STACK %rbx
        RESTORE_REST
-       jmp ret_from_sys_call
+       /* Use IRET because user could have changed frame */
+       jmp int_ret_from_sys_call
        CFI_ENDPROC
                
 /* 
@@ -449,25 +457,9 @@ ENTRY(stub_execve)
        CFI_ADJUST_CFA_OFFSET -8
        CFI_REGISTER rip, r11
        SAVE_REST
-       movq %r11, %r15
-       CFI_REGISTER rip, r15
        FIXUP_TOP_OF_STACK %r11
        call sys_execve
-       GET_THREAD_INFO(%rcx)
-       bt $TIF_IA32,threadinfo_flags(%rcx)
-       CFI_REMEMBER_STATE
-       jc exec_32bit
        RESTORE_TOP_OF_STACK %r11
-       movq %r15, %r11
-       CFI_REGISTER rip, r11
-       RESTORE_REST
-       pushq %r11
-       CFI_ADJUST_CFA_OFFSET 8
-       CFI_REL_OFFSET rip, 0
-       ret
-
-exec_32bit:
-       CFI_RESTORE_STATE
        movq %rax,RAX(%rsp)
        RESTORE_REST
        jmp int_ret_from_sys_call
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/x86_64/kernel/pci-gart.c 
hg/linux-2.6.16.13-xen/arch/x86_64/kernel/pci-gart.c
--- linux/linux-2.6-xen.hg/arch/x86_64/kernel/pci-gart.c        2006-03-07 
23:11:52.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/x86_64/kernel/pci-gart.c        2006-05-03 
00:38:44.000000000 +0300
@@ -114,10 +114,6 @@ static unsigned long alloc_iommu(int siz
 static void free_iommu(unsigned long offset, int size)
 { 
        unsigned long flags;
-       if (size == 1) { 
-               clear_bit(offset, iommu_gart_bitmap); 
-               return;
-       }
        spin_lock_irqsave(&iommu_bitmap_lock, flags);
        __clear_bit_string(iommu_gart_bitmap, offset, size);
        spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/x86_64/kernel/process.c 
hg/linux-2.6.16.13-xen/arch/x86_64/kernel/process.c
--- linux/linux-2.6-xen.hg/arch/x86_64/kernel/process.c 2006-03-07 
23:11:52.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/x86_64/kernel/process.c 2006-05-03 
00:38:44.000000000 +0300
@@ -527,8 +527,6 @@ __switch_to(struct task_struct *prev_p, 
        int cpu = smp_processor_id();  
        struct tss_struct *tss = &per_cpu(init_tss, cpu);
 
-       unlazy_fpu(prev_p);
-
        /*
         * Reload esp0, LDT and the page table pointer:
         */
@@ -591,6 +589,12 @@ __switch_to(struct task_struct *prev_p, 
        prev->userrsp = read_pda(oldrsp); 
        write_pda(oldrsp, next->userrsp); 
        write_pda(pcurrent, next_p); 
+
+       /* This must be here to ensure both math_state_restore() and
+          kernel_fpu_begin() work consistently.
+          And the AMD workaround requires it to be after DS reload. */
+       unlazy_fpu(prev_p);
+
        write_pda(kernelstack,
                  task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET);
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/x86_64/kernel/process-xen.c 
hg/linux-2.6.16.13-xen/arch/x86_64/kernel/process-xen.c
--- linux/linux-2.6-xen.hg/arch/x86_64/kernel/process-xen.c     2006-06-02 
23:37:34.000000000 +0300
+++ hg/linux-2.6.16.13-xen/arch/x86_64/kernel/process-xen.c     2006-06-02 
23:36:12.000000000 +0300
@@ -477,6 +477,10 @@ __switch_to(struct task_struct *prev_p, 
         * This is basically '__unlazy_fpu', except that we queue a
         * multicall to indicate FPU task switch, rather than
         * synchronously trapping to Xen.
+        * This must be here to ensure both math_state_restore() and
+        * kernel_fpu_begin() work consistently.
+        * The AMD workaround requires it to be after DS reload, or
+        * after DS has been cleared, which we do in __prepare_arch_switch.
         */
        if (prev_p->thread_info->status & TS_USEDFPU) {
                __save_init_fpu(prev_p); /* _not_ save_init_fpu() */
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/x86_64/kernel/setup.c 
hg/linux-2.6.16.13-xen/arch/x86_64/kernel/setup.c
--- linux/linux-2.6-xen.hg/arch/x86_64/kernel/setup.c   2006-03-07 
23:11:52.000000000 +0200
+++ hg/linux-2.6.16.13-xen/arch/x86_64/kernel/setup.c   2006-05-03 
00:38:44.000000000 +0300
@@ -909,6 +909,10 @@ static int __init init_amd(struct cpuinf
        if (c->x86 == 15 && ((level >= 0x0f48 && level < 0x0f50) || level >= 
0x0f58))
                set_bit(X86_FEATURE_REP_GOOD, &c->x86_capability);
 
+       /* Enable workaround for FXSAVE leak */
+       if (c->x86 >= 6)
+               set_bit(X86_FEATURE_FXSAVE_LEAK, &c->x86_capability);
+
        r = get_model_name(c);
        if (!r) { 
                switch (c->x86) { 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/arch/x86_64/kernel/setup-xen.c 
hg/linux-2.6.16.13-xen/arch/x86_64/kernel/setup-xen.c
--- linux/linux-2.6-xen.hg/arch/x86_64/kernel/setup-xen.c       2006-06-12 
14:00:16.000000000 +0300
+++ hg/linux-2.6.16.13-xen/arch/x86_64/kernel/setup-xen.c       2006-06-10 
00:56:13.000000000 +0300
@@ -1150,6 +1150,10 @@ static int __init init_amd(struct cpuinf
        if (c->x86 == 15 && ((level >= 0x0f48 && level < 0x0f50) || level >= 
0x0f58))
                set_bit(X86_FEATURE_REP_GOOD, &c->x86_capability);
 
+       /* Enable workaround for FXSAVE leak */
+       if (c->x86 >= 6)
+               set_bit(X86_FEATURE_FXSAVE_LEAK, &c->x86_capability);
+
        r = get_model_name(c);
        if (!r) { 
                switch (c->x86) { 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/block/genhd.c 
hg/linux-2.6.16.13-xen/block/genhd.c
--- linux/linux-2.6-xen.hg/block/genhd.c        2006-03-07 23:11:53.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/block/genhd.c        2006-05-03 00:38:44.000000000 
+0300
@@ -16,8 +16,6 @@
 #include <linux/kobj_map.h>
 #include <linux/buffer_head.h>
 
-#define MAX_PROBE_HASH 255     /* random */
-
 static struct subsystem block_subsys;
 
 static DECLARE_MUTEX(block_subsys_sem);
@@ -30,108 +28,29 @@ static struct blk_major_name {
        struct blk_major_name *next;
        int major;
        char name[16];
-} *major_names[MAX_PROBE_HASH];
+} *major_names[BLKDEV_MAJOR_HASH_SIZE];
 
 /* index in the above - for now: assume no multimajor ranges */
 static inline int major_to_index(int major)
 {
-       return major % MAX_PROBE_HASH;
-}
-
-struct blkdev_info {
-        int index;
-        struct blk_major_name *bd;
-};
-
-/*
- * iterate over a list of blkdev_info structures.  allows
- * the major_names array to be iterated over from outside this file
- * must be called with the block_subsys_sem held
- */
-void *get_next_blkdev(void *dev)
-{
-        struct blkdev_info *info;
-
-        if (dev == NULL) {
-                info = kmalloc(sizeof(*info), GFP_KERNEL);
-                if (!info)
-                        goto out;
-                info->index=0;
-                info->bd = major_names[info->index];
-                if (info->bd)
-                        goto out;
-        } else {
-                info = dev;
-        }
-
-        while (info->index < ARRAY_SIZE(major_names)) {
-                if (info->bd)
-                        info->bd = info->bd->next;
-                if (info->bd)
-                        goto out;
-                /*
-                 * No devices on this chain, move to the next
-                 */
-                info->index++;
-                info->bd = (info->index < ARRAY_SIZE(major_names)) ?
-                       major_names[info->index] : NULL;
-                if (info->bd)
-                        goto out;
-        }
-
-out:
-        return info;
-}
-
-void *acquire_blkdev_list(void)
-{
-        down(&block_subsys_sem);
-        return get_next_blkdev(NULL);
-}
-
-void release_blkdev_list(void *dev)
-{
-        up(&block_subsys_sem);
-        kfree(dev);
+       return major % BLKDEV_MAJOR_HASH_SIZE;
 }
 
+#ifdef CONFIG_PROC_FS
 
-/*
- * Count the number of records in the blkdev_list.
- * must be called with the block_subsys_sem held
- */
-int count_blkdev_list(void)
+void blkdev_show(struct seq_file *f, off_t offset)
 {
-       struct blk_major_name *n;
-       int i, count;
-
-       count = 0;
+       struct blk_major_name *dp;
 
-       for (i = 0; i < ARRAY_SIZE(major_names); i++) {
-               for (n = major_names[i]; n; n = n->next)
-                               count++;
+       if (offset < BLKDEV_MAJOR_HASH_SIZE) {
+               down(&block_subsys_sem);
+               for (dp = major_names[offset]; dp; dp = dp->next)
+                       seq_printf(f, "%3d %s\n", dp->major, dp->name);
+               up(&block_subsys_sem);
        }
-
-       return count;
-}
-
-/*
- * extract the major and name values from a blkdev_info struct
- * passed in as a void to *dev.  Must be called with
- * block_subsys_sem held
- */
-int get_blkdev_info(void *dev, int *major, char **name)
-{
-        struct blkdev_info *info = dev;
-
-        if (info->bd == NULL)
-                return 1;
-
-        *major = info->bd->major;
-        *name = info->bd->name;
-        return 0;
 }
 
+#endif /* CONFIG_PROC_FS */
 
 int register_blkdev(unsigned int major, const char *name)
 {
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/Documentation/dvb/get_dvb_firmware 
hg/linux-2.6.16.13-xen/Documentation/dvb/get_dvb_firmware
--- linux/linux-2.6-xen.hg/Documentation/dvb/get_dvb_firmware   2006-03-07 
23:11:04.000000000 +0200
+++ hg/linux-2.6.16.13-xen/Documentation/dvb/get_dvb_firmware   2006-05-03 
00:38:44.000000000 +0300
@@ -240,9 +240,9 @@ sub dibusb {
 }
 
 sub nxt2002 {
-    my $sourcefile = "Broadband4PC_4_2_11.zip";
+    my $sourcefile = "Technisat_DVB-PC_4_4_COMPACT.zip";
     my $url = "http://www.bbti.us/download/windows/$sourcefile";;
-    my $hash = "c6d2ea47a8f456d887ada0cfb718ff2a";
+    my $hash = "476befae8c7c1bb9648954060b1eec1f";
     my $outfile = "dvb-fe-nxt2002.fw";
     my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
 
@@ -250,8 +250,8 @@ sub nxt2002 {
 
     wgetfile($sourcefile, $url);
     unzip($sourcefile, $tmpdir);
-    verify("$tmpdir/SkyNETU.sys", $hash);
-    extract("$tmpdir/SkyNETU.sys", 375832, 5908, $outfile);
+    verify("$tmpdir/SkyNET.sys", $hash);
+    extract("$tmpdir/SkyNET.sys", 331624, 5908, $outfile);
 
     $outfile;
 }
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/drivers/base/cpu.c 
hg/linux-2.6.16.13-xen/drivers/base/cpu.c
--- linux/linux-2.6-xen.hg/drivers/base/cpu.c   2006-03-07 23:11:57.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/base/cpu.c   2006-05-03 00:38:44.000000000 
+0300
@@ -141,7 +141,7 @@ int __devinit register_cpu(struct cpu *c
        return error;
 }
 
-struct sys_device *get_cpu_sysdev(int cpu)
+struct sys_device *get_cpu_sysdev(unsigned cpu)
 {
        if (cpu < NR_CPUS)
                return cpu_sys_devices[cpu];
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/base/firmware_class.c 
hg/linux-2.6.16.13-xen/drivers/base/firmware_class.c
--- linux/linux-2.6-xen.hg/drivers/base/firmware_class.c        2006-03-07 
23:11:57.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/base/firmware_class.c        2006-05-03 
00:38:44.000000000 +0300
@@ -211,18 +211,20 @@ static int
 fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
 {
        u8 *new_data;
+       int new_size = fw_priv->alloc_size;
 
        if (min_size <= fw_priv->alloc_size)
                return 0;
 
-       new_data = vmalloc(fw_priv->alloc_size + PAGE_SIZE);
+       new_size = ALIGN(min_size, PAGE_SIZE);
+       new_data = vmalloc(new_size);
        if (!new_data) {
                printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
                /* Make sure that we don't keep incomplete data */
                fw_load_abort(fw_priv);
                return -ENOMEM;
        }
-       fw_priv->alloc_size += PAGE_SIZE;
+       fw_priv->alloc_size = new_size;
        if (fw_priv->fw->data) {
                memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
                vfree(fw_priv->fw->data);
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/drivers/base/node.c 
hg/linux-2.6.16.13-xen/drivers/base/node.c
--- linux/linux-2.6-xen.hg/drivers/base/node.c  2006-03-07 23:11:57.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/base/node.c  2006-05-03 00:38:44.000000000 
+0300
@@ -106,7 +106,7 @@ static ssize_t node_read_numastat(struct
        other_node = 0;
        for (i = 0; i < MAX_NR_ZONES; i++) {
                struct zone *z = &pg->node_zones[i];
-               for (cpu = 0; cpu < NR_CPUS; cpu++) {
+               for_each_online_cpu(cpu) {
                        struct per_cpu_pageset *ps = zone_pcp(z,cpu);
                        numa_hit += ps->numa_hit;
                        numa_miss += ps->numa_miss;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/block/cciss.c 
hg/linux-2.6.16.13-xen/drivers/block/cciss.c
--- linux/linux-2.6-xen.hg/drivers/block/cciss.c        2006-03-07 
23:11:57.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/block/cciss.c        2006-05-03 
00:38:44.000000000 +0300
@@ -1181,6 +1181,53 @@ static int revalidate_allvol(ctlr_info_t
         return 0;
 }
 
+static inline void complete_buffers(struct bio *bio, int status)
+{
+       while (bio) {
+               struct bio *xbh = bio->bi_next;
+               int nr_sectors = bio_sectors(bio);
+
+               bio->bi_next = NULL;
+               blk_finished_io(len);
+               bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
+               bio = xbh;
+       }
+
+}
+
+static void cciss_softirq_done(struct request *rq)
+{
+       CommandList_struct *cmd = rq->completion_data;
+       ctlr_info_t *h = hba[cmd->ctlr];
+       unsigned long flags;
+       u64bit temp64;
+       int i, ddir;
+
+       if (cmd->Request.Type.Direction == XFER_READ)
+               ddir = PCI_DMA_FROMDEVICE;
+       else
+               ddir = PCI_DMA_TODEVICE;
+
+       /* command did not need to be retried */
+       /* unmap the DMA mapping for all the scatter gather elements */
+       for(i=0; i<cmd->Header.SGList; i++) {
+               temp64.val32.lower = cmd->SG[i].Addr.lower;
+               temp64.val32.upper = cmd->SG[i].Addr.upper;
+               pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
+       }
+
+       complete_buffers(rq->bio, rq->errors);
+
+#ifdef CCISS_DEBUG
+       printk("Done with %p\n", rq);
+#endif /* CCISS_DEBUG */
+
+       spin_lock_irqsave(&h->lock, flags);
+       end_that_request_last(rq, rq->errors);
+       cmd_free(h, cmd,1);
+       spin_unlock_irqrestore(&h->lock, flags);
+}
+
 /* This function will check the usage_count of the drive to be updated/added.
  * If the usage_count is zero then the drive information will be updated and
  * the disk will be re-registered with the kernel.  If not then it will be
@@ -1249,6 +1296,8 @@ static void cciss_update_drive_info(int 
 
                blk_queue_max_sectors(disk->queue, 512);
 
+               blk_queue_softirq_done(disk->queue, cciss_softirq_done);
+
                disk->queue->queuedata = hba[ctlr];
 
                blk_queue_hardsect_size(disk->queue,
@@ -2148,20 +2197,6 @@ static void start_io( ctlr_info_t *h)
                addQ (&(h->cmpQ), c); 
        }
 }
-
-static inline void complete_buffers(struct bio *bio, int status)
-{
-       while (bio) {
-               struct bio *xbh = bio->bi_next; 
-               int nr_sectors = bio_sectors(bio);
-
-               bio->bi_next = NULL; 
-               blk_finished_io(len);
-               bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
-               bio = xbh;
-       }
-
-} 
 /* Assumes that CCISS_LOCK(h->ctlr) is held. */
 /* Zeros out the error record and then resends the command back */
 /* to the controller */
@@ -2179,39 +2214,6 @@ static inline void resend_cciss_cmd( ctl
        start_io(h);
 }
 
-static void cciss_softirq_done(struct request *rq)
-{
-       CommandList_struct *cmd = rq->completion_data;
-       ctlr_info_t *h = hba[cmd->ctlr];
-       unsigned long flags;
-       u64bit temp64;
-       int i, ddir;
-
-       if (cmd->Request.Type.Direction == XFER_READ)
-               ddir = PCI_DMA_FROMDEVICE;
-       else
-               ddir = PCI_DMA_TODEVICE;
-
-       /* command did not need to be retried */
-       /* unmap the DMA mapping for all the scatter gather elements */
-       for(i=0; i<cmd->Header.SGList; i++) {
-               temp64.val32.lower = cmd->SG[i].Addr.lower;
-               temp64.val32.upper = cmd->SG[i].Addr.upper;
-               pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
-       }
-
-       complete_buffers(rq->bio, rq->errors);
-
-#ifdef CCISS_DEBUG
-       printk("Done with %p\n", rq);
-#endif /* CCISS_DEBUG */ 
-
-       spin_lock_irqsave(&h->lock, flags);
-       end_that_request_last(rq, rq->errors);
-       cmd_free(h, cmd,1);
-       spin_unlock_irqrestore(&h->lock, flags);
-}
-
 /* checks the status of the job and calls complete buffers to mark all 
  * buffers for the completed job. Note that this function does not need
  * to hold the hba/queue lock.
@@ -3269,8 +3271,8 @@ clean2:
        unregister_blkdev(hba[i]->major, hba[i]->devname);
 clean1:
        release_io_mem(hba[i]);
-       free_hba(i);
        hba[i]->busy_initializing = 0;
+       free_hba(i);
        return(-1);
 }
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/char/agp/efficeon-agp.c 
hg/linux-2.6.16.13-xen/drivers/char/agp/efficeon-agp.c
--- linux/linux-2.6-xen.hg/drivers/char/agp/efficeon-agp.c      2006-03-07 
23:11:58.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/char/agp/efficeon-agp.c      2006-05-03 
00:38:44.000000000 +0300
@@ -64,6 +64,12 @@ static struct gatt_mask efficeon_generic
        {.mask = 0x00000001, .type = 0}
 };
 
+/* This function does the same thing as mask_memory() for this chipset... */
+static inline unsigned long efficeon_mask_memory(unsigned long addr)
+{
+       return addr | 0x00000001;
+}
+
 static struct aper_size_info_lvl2 efficeon_generic_sizes[4] =
 {
        {256, 65536, 0},
@@ -251,7 +257,7 @@ static int efficeon_insert_memory(struct
        last_page = NULL;
        for (i = 0; i < count; i++) {
                int index = pg_start + i;
-               unsigned long insert = mem->memory[i];
+               unsigned long insert = efficeon_mask_memory(mem->memory[i]);
 
                page = (unsigned int *) efficeon_private.l1_table[index >> 10];
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/char/cs5535_gpio.c 
hg/linux-2.6.16.13-xen/drivers/char/cs5535_gpio.c
--- linux/linux-2.6-xen.hg/drivers/char/cs5535_gpio.c   2006-03-07 
23:11:58.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/char/cs5535_gpio.c   2006-05-03 
00:38:44.000000000 +0300
@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
 static void __exit cs5535_gpio_cleanup(void)
 {
        dev_t dev_id = MKDEV(major, 0);
+
+       cdev_del(&cs5535_gpio_cdev);
        unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
-       if (gpio_base != 0)
-               release_region(gpio_base, CS5535_GPIO_SIZE);
+       release_region(gpio_base, CS5535_GPIO_SIZE);
 }
 
 module_init(cs5535_gpio_init);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/char/ipmi/ipmi_bt_sm.c 
hg/linux-2.6.16.13-xen/drivers/char/ipmi/ipmi_bt_sm.c
--- linux/linux-2.6-xen.hg/drivers/char/ipmi/ipmi_bt_sm.c       2006-03-07 
23:12:00.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/char/ipmi/ipmi_bt_sm.c       2006-05-03 
00:38:44.000000000 +0300
@@ -165,7 +165,7 @@ static int bt_start_transaction(struct s
 {
        unsigned int i;
 
-       if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
+       if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2)))
               return -1;
 
        if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED))
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/char/Kconfig 
hg/linux-2.6.16.13-xen/drivers/char/Kconfig
--- linux/linux-2.6-xen.hg/drivers/char/Kconfig 2006-03-07 23:11:58.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/char/Kconfig 2006-05-03 00:38:44.000000000 
+0300
@@ -187,6 +187,7 @@ config MOXA_SMARTIO
 config ISI
        tristate "Multi-Tech multiport card support (EXPERIMENTAL)"
        depends on SERIAL_NONSTANDARD
+       select FW_LOADER
        help
          This is a driver for the Multi-Tech cards which provide several
          serial ports.  The driver is experimental and can currently only be
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/drivers/char/snsc.c 
hg/linux-2.6.16.13-xen/drivers/char/snsc.c
--- linux/linux-2.6-xen.hg/drivers/char/snsc.c  2006-03-07 23:12:01.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/char/snsc.c  2006-05-03 00:38:44.000000000 
+0300
@@ -391,7 +391,8 @@ scdrv_init(void)
                        format_module_id(devnamep, geo_module(geoid),
                                         MODULE_FORMAT_BRIEF);
                        devnamep = devname + strlen(devname);
-                       sprintf(devnamep, "#%d", geo_slab(geoid));
+                       sprintf(devnamep, "^%d#%d", geo_slot(geoid),
+                               geo_slab(geoid));
 
                        /* allocate sysctl device data */
                        scd = kmalloc(sizeof (struct sysctl_data_s),
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/char/sonypi.c 
hg/linux-2.6.16.13-xen/drivers/char/sonypi.c
--- linux/linux-2.6-xen.hg/drivers/char/sonypi.c        2006-03-07 
23:12:01.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/char/sonypi.c        2006-05-03 
00:38:44.000000000 +0300
@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct
        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                          PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+       else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                         PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
+               sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
        else
                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/char/tipar.c 
hg/linux-2.6.16.13-xen/drivers/char/tipar.c
--- linux/linux-2.6-xen.hg/drivers/char/tipar.c 2006-03-07 23:12:01.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/char/tipar.c 2006-05-03 00:38:44.000000000 
+0300
@@ -515,7 +515,7 @@ tipar_init_module(void)
                err = PTR_ERR(tipar_class);
                goto out_chrdev;
        }
-       if (parport_register_driver(&tipar_driver) || tp_count == 0) {
+       if (parport_register_driver(&tipar_driver)) {
                printk(KERN_ERR "tipar: unable to register with parport\n");
                err = -EIO;
                goto out_class;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/char/tlclk.c 
hg/linux-2.6.16.13-xen/drivers/char/tlclk.c
--- linux/linux-2.6-xen.hg/drivers/char/tlclk.c 2006-03-07 23:12:01.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/char/tlclk.c 2006-05-03 00:38:44.000000000 
+0300
@@ -327,7 +327,7 @@ static ssize_t store_received_ref_clk3a(
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(received_ref_clk3a, S_IWUGO, NULL,
+static DEVICE_ATTR(received_ref_clk3a, (S_IWUSR|S_IWGRP), NULL,
                store_received_ref_clk3a);
 
 
@@ -349,7 +349,7 @@ static ssize_t store_received_ref_clk3b(
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(received_ref_clk3b, S_IWUGO, NULL,
+static DEVICE_ATTR(received_ref_clk3b, (S_IWUSR|S_IWGRP), NULL,
                store_received_ref_clk3b);
 
 
@@ -371,7 +371,7 @@ static ssize_t store_enable_clk3b_output
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clk3b_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clk3b_output, (S_IWUSR|S_IWGRP), NULL,
                store_enable_clk3b_output);
 
 static ssize_t store_enable_clk3a_output(struct device *d,
@@ -392,7 +392,7 @@ static ssize_t store_enable_clk3a_output
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clk3a_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clk3a_output, (S_IWUSR|S_IWGRP), NULL,
                store_enable_clk3a_output);
 
 static ssize_t store_enable_clkb1_output(struct device *d,
@@ -413,7 +413,7 @@ static ssize_t store_enable_clkb1_output
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clkb1_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clkb1_output, (S_IWUSR|S_IWGRP), NULL,
                store_enable_clkb1_output);
 
 
@@ -435,7 +435,7 @@ static ssize_t store_enable_clka1_output
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clka1_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clka1_output, (S_IWUSR|S_IWGRP), NULL,
                store_enable_clka1_output);
 
 static ssize_t store_enable_clkb0_output(struct device *d,
@@ -456,7 +456,7 @@ static ssize_t store_enable_clkb0_output
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clkb0_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clkb0_output, (S_IWUSR|S_IWGRP), NULL,
                store_enable_clkb0_output);
 
 static ssize_t store_enable_clka0_output(struct device *d,
@@ -477,7 +477,7 @@ static ssize_t store_enable_clka0_output
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clka0_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clka0_output, (S_IWUSR|S_IWGRP), NULL,
                store_enable_clka0_output);
 
 static ssize_t store_select_amcb2_transmit_clock(struct device *d,
@@ -519,7 +519,7 @@ static ssize_t store_select_amcb2_transm
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_amcb2_transmit_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_amcb2_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
        store_select_amcb2_transmit_clock);
 
 static ssize_t store_select_amcb1_transmit_clock(struct device *d,
@@ -560,7 +560,7 @@ static ssize_t store_select_amcb1_transm
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_amcb1_transmit_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_amcb1_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
                store_select_amcb1_transmit_clock);
 
 static ssize_t store_select_redundant_clock(struct device *d,
@@ -581,7 +581,7 @@ static ssize_t store_select_redundant_cl
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_redundant_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_redundant_clock, (S_IWUSR|S_IWGRP), NULL,
                store_select_redundant_clock);
 
 static ssize_t store_select_ref_frequency(struct device *d,
@@ -602,7 +602,7 @@ static ssize_t store_select_ref_frequenc
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_ref_frequency, S_IWUGO, NULL,
+static DEVICE_ATTR(select_ref_frequency, (S_IWUSR|S_IWGRP), NULL,
                store_select_ref_frequency);
 
 static ssize_t store_filter_select(struct device *d,
@@ -623,7 +623,7 @@ static ssize_t store_filter_select(struc
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(filter_select, S_IWUGO, NULL, store_filter_select);
+static DEVICE_ATTR(filter_select, (S_IWUSR|S_IWGRP), NULL, 
store_filter_select);
 
 static ssize_t store_hardware_switching_mode(struct device *d,
                 struct device_attribute *attr, const char *buf, size_t count)
@@ -643,7 +643,7 @@ static ssize_t store_hardware_switching_
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(hardware_switching_mode, S_IWUGO, NULL,
+static DEVICE_ATTR(hardware_switching_mode, (S_IWUSR|S_IWGRP), NULL,
                store_hardware_switching_mode);
 
 static ssize_t store_hardware_switching(struct device *d,
@@ -664,7 +664,7 @@ static ssize_t store_hardware_switching(
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(hardware_switching, S_IWUGO, NULL,
+static DEVICE_ATTR(hardware_switching, (S_IWUSR|S_IWGRP), NULL,
                store_hardware_switching);
 
 static ssize_t store_refalign (struct device *d,
@@ -684,7 +684,7 @@ static ssize_t store_refalign (struct de
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(refalign, S_IWUGO, NULL, store_refalign);
+static DEVICE_ATTR(refalign, (S_IWUSR|S_IWGRP), NULL, store_refalign);
 
 static ssize_t store_mode_select (struct device *d,
                 struct device_attribute *attr, const char *buf, size_t count)
@@ -704,7 +704,7 @@ static ssize_t store_mode_select (struct
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(mode_select, S_IWUGO, NULL, store_mode_select);
+static DEVICE_ATTR(mode_select, (S_IWUSR|S_IWGRP), NULL, store_mode_select);
 
 static ssize_t store_reset (struct device *d,
                 struct device_attribute *attr, const char *buf, size_t count)
@@ -724,7 +724,7 @@ static ssize_t store_reset (struct devic
        return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(reset, S_IWUGO, NULL, store_reset);
+static DEVICE_ATTR(reset, (S_IWUSR|S_IWGRP), NULL, store_reset);
 
 static struct attribute *tlclk_sysfs_entries[] = {
        &dev_attr_current_ref.attr,
@@ -767,6 +767,7 @@ static int __init tlclk_init(void)
                printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major);
                return ret;
        }
+       tlclk_major = ret;
        alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
        if (!alarm_events)
                goto out1;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/char/tty_io.c 
hg/linux-2.6.16.13-xen/drivers/char/tty_io.c
--- linux/linux-2.6-xen.hg/drivers/char/tty_io.c        2006-03-19 
14:08:31.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/char/tty_io.c        2006-05-11 
14:37:36.000000000 +0300
@@ -2708,7 +2708,11 @@ static void __do_SAK(void *arg)
                }
                task_lock(p);
                if (p->files) {
-                       rcu_read_lock();
+                       /*
+                        * We don't take a ref to the file, so we must
+                        * hold ->file_lock instead.
+                        */
+                       spin_lock(&p->files->file_lock);
                        fdt = files_fdtable(p->files);
                        for (i=0; i < fdt->max_fds; i++) {
                                filp = fcheck_files(p->files, i);
@@ -2723,7 +2727,7 @@ static void __do_SAK(void *arg)
                                        break;
                                }
                        }
-                       rcu_read_unlock();
+                       spin_unlock(&p->files->file_lock);
                }
                task_unlock(p);
        } while_each_task_pid(session, PIDTYPE_SID, p);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/edac/Kconfig 
hg/linux-2.6.16.13-xen/drivers/edac/Kconfig
--- linux/linux-2.6-xen.hg/drivers/edac/Kconfig 2006-03-19 14:08:31.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/edac/Kconfig 2006-05-03 00:38:44.000000000 
+0300
@@ -71,7 +71,7 @@ config EDAC_E7XXX
 
 config EDAC_E752X
        tristate "Intel e752x (e7520, e7525, e7320)"
-       depends on EDAC_MM_EDAC && PCI
+       depends on EDAC_MM_EDAC && PCI && HOTPLUG
        help
          Support for error detection and correction on the Intel
          E7520, E7525, E7320 server chipsets.
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/i2c/busses/i2c-i801.c 
hg/linux-2.6.16.13-xen/drivers/i2c/busses/i2c-i801.c
--- linux/linux-2.6-xen.hg/drivers/i2c/busses/i2c-i801.c        2006-03-07 
23:12:03.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/i2c/busses/i2c-i801.c        2006-05-03 
00:38:44.000000000 +0300
@@ -478,6 +478,11 @@ static s32 i801_access(struct i2c_adapte
                ret = i801_transaction();
        }
 
+       /* Some BIOSes don't like it when PEC is enabled at reboot or resume
+          time, so we forcibly disable it after every transaction. */
+       if (hwpec)
+               outb_p(0, SMBAUXCTL);
+
        if(block)
                return ret;
        if(ret)
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/i2c/chips/m41t00.c 
hg/linux-2.6.16.13-xen/drivers/i2c/chips/m41t00.c
--- linux/linux-2.6-xen.hg/drivers/i2c/chips/m41t00.c   2006-03-07 
23:12:03.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/i2c/chips/m41t00.c   2006-05-03 
00:38:44.000000000 +0300
@@ -129,13 +129,13 @@ m41t00_set_tlet(ulong arg)
        if ((i2c_smbus_write_byte_data(save_client, 0, tm.tm_sec & 0x7f) < 0)
                || (i2c_smbus_write_byte_data(save_client, 1, tm.tm_min & 0x7f)
                        < 0)
-               || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x7f)
+               || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x3f)
                        < 0)
-               || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x7f)
+               || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x3f)
                        < 0)
-               || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x7f)
+               || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x1f)
                        < 0)
-               || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0x7f)
+               || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0xff)
                        < 0))
 
                dev_warn(&save_client->dev,"m41t00: can't write to rtc chip\n");
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/ide/pci/alim15x3.c 
hg/linux-2.6.16.13-xen/drivers/ide/pci/alim15x3.c
--- linux/linux-2.6-xen.hg/drivers/ide/pci/alim15x3.c   2006-03-07 
23:12:03.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/ide/pci/alim15x3.c   2006-05-03 
00:38:44.000000000 +0300
@@ -731,6 +731,8 @@ static unsigned int __devinit ata66_ali1
        
        if(m5229_revision <= 0x20)
                tmpbyte = (tmpbyte & (~0x02)) | 0x01;
+       else if (m5229_revision == 0xc7)
+               tmpbyte |= 0x03;
        else
                tmpbyte |= 0x01;
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/ieee1394/sbp2.c 
hg/linux-2.6.16.13-xen/drivers/ieee1394/sbp2.c
--- linux/linux-2.6-xen.hg/drivers/ieee1394/sbp2.c      2006-03-07 
23:12:05.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/ieee1394/sbp2.c      2006-05-03 
00:38:44.000000000 +0300
@@ -495,22 +495,17 @@ static struct sbp2_command_info *sbp2uti
 /*
  * This function finds the sbp2_command for a given outstanding SCpnt.
  * Only looks at the inuse list.
+ * Must be called with scsi_id->sbp2_command_orb_lock held.
  */
-static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(struct 
scsi_id_instance_data *scsi_id, void *SCpnt)
+static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(
+               struct scsi_id_instance_data *scsi_id, void *SCpnt)
 {
        struct sbp2_command_info *command;
-       unsigned long flags;
 
-       spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
-       if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) {
-               list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, 
list) {
-                       if (command->Current_SCpnt == SCpnt) {
-                               
spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+       if (!list_empty(&scsi_id->sbp2_command_orb_inuse))
+               list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, 
list)
+                       if (command->Current_SCpnt == SCpnt)
                                return command;
-                       }
-               }
-       }
-       spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
        return NULL;
 }
 
@@ -579,17 +574,15 @@ static void sbp2util_free_command_dma(st
 
 /*
  * This function moves a command to the completed orb list.
+ * Must be called with scsi_id->sbp2_command_orb_lock held.
  */
-static void sbp2util_mark_command_completed(struct scsi_id_instance_data 
*scsi_id,
-                                           struct sbp2_command_info *command)
+static void sbp2util_mark_command_completed(
+               struct scsi_id_instance_data *scsi_id,
+               struct sbp2_command_info *command)
 {
-       unsigned long flags;
-
-       spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
        list_del(&command->list);
        sbp2util_free_command_dma(command);
        list_add_tail(&command->list, &scsi_id->sbp2_command_orb_completed);
-       spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
 }
 
 /*
@@ -2177,7 +2170,9 @@ static int sbp2_handle_status_write(stru
                 * Matched status with command, now grab scsi command pointers 
and check status
                 */
                SCpnt = command->Current_SCpnt;
+               spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
                sbp2util_mark_command_completed(scsi_id, command);
+               spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
 
                if (SCpnt) {
 
@@ -2513,6 +2508,7 @@ static int sbp2scsi_abort(struct scsi_cm
                (struct scsi_id_instance_data 
*)SCpnt->device->host->hostdata[0];
        struct sbp2scsi_host_info *hi = scsi_id->hi;
        struct sbp2_command_info *command;
+       unsigned long flags;
 
        SBP2_ERR("aborting sbp2 command");
        scsi_print_command(SCpnt);
@@ -2523,6 +2519,7 @@ static int sbp2scsi_abort(struct scsi_cm
                 * Right now, just return any matching command structures
                 * to the free pool.
                 */
+               spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
                command = sbp2util_find_command_for_SCpnt(scsi_id, SCpnt);
                if (command) {
                        SBP2_DEBUG("Found command to abort");
@@ -2540,6 +2537,7 @@ static int sbp2scsi_abort(struct scsi_cm
                                command->Current_done(command->Current_SCpnt);
                        }
                }
+               spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
 
                /*
                 * Initiate a fetch agent reset.
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/macintosh/therm_adt746x.c 
hg/linux-2.6.16.13-xen/drivers/macintosh/therm_adt746x.c
--- linux/linux-2.6-xen.hg/drivers/macintosh/therm_adt746x.c    2006-03-07 
23:12:11.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/macintosh/therm_adt746x.c    2006-05-03 
00:38:44.000000000 +0300
@@ -627,8 +627,8 @@ thermostat_init(void)
        if(therm_type == ADT7460)
                device_create_file(&of_dev->dev, &dev_attr_sensor2_fan_speed);
 
-#ifndef CONFIG_I2C_KEYWEST
-       request_module("i2c-keywest");
+#ifndef CONFIG_I2C_POWERMAC
+       request_module("i2c-powermac");
 #endif
 
        return i2c_add_driver(&thermostat_driver);
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/drivers/md/dm.c 
hg/linux-2.6.16.13-xen/drivers/md/dm.c
--- linux/linux-2.6-xen.hg/drivers/md/dm.c      2006-03-07 23:12:12.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/md/dm.c      2006-05-03 00:38:44.000000000 
+0300
@@ -533,30 +533,35 @@ static void __clone_and_map(struct clone
 
        } else {
                /*
-                * Create two copy bios to deal with io that has
-                * been split across a target.
+                * Handle a bvec that must be split between two or more targets.
                 */
                struct bio_vec *bv = bio->bi_io_vec + ci->idx;
+               sector_t remaining = to_sector(bv->bv_len);
+               unsigned int offset = 0;
 
-               clone = split_bvec(bio, ci->sector, ci->idx,
-                                  bv->bv_offset, max);
-               __map_bio(ti, clone, tio);
-
-               ci->sector += max;
-               ci->sector_count -= max;
-               ti = dm_table_find_target(ci->map, ci->sector);
-
-               len = to_sector(bv->bv_len) - max;
-               clone = split_bvec(bio, ci->sector, ci->idx,
-                                  bv->bv_offset + to_bytes(max), len);
-               tio = alloc_tio(ci->md);
-               tio->io = ci->io;
-               tio->ti = ti;
-               memset(&tio->info, 0, sizeof(tio->info));
-               __map_bio(ti, clone, tio);
+               do {
+                       if (offset) {
+                               ti = dm_table_find_target(ci->map, ci->sector);
+                               max = max_io_len(ci->md, ci->sector, ti);
+
+                               tio = alloc_tio(ci->md);
+                               tio->io = ci->io;
+                               tio->ti = ti;
+                               memset(&tio->info, 0, sizeof(tio->info));
+                       }
+
+                       len = min(remaining, max);
+
+                       clone = split_bvec(bio, ci->sector, ci->idx,
+                                          bv->bv_offset + offset, len);
+
+                       __map_bio(ti, clone, tio);
+
+                       ci->sector += len;
+                       ci->sector_count -= len;
+                       offset += to_bytes(len);
+               } while (remaining -= len);
 
-               ci->sector += len;
-               ci->sector_count -= len;
                ci->idx++;
        }
 }
@@ -1093,6 +1098,7 @@ int dm_suspend(struct mapped_device *md,
 {
        struct dm_table *map = NULL;
        DECLARE_WAITQUEUE(wait, current);
+       struct bio *def;
        int r = -EINVAL;
 
        down(&md->suspend_lock);
@@ -1152,9 +1158,11 @@ int dm_suspend(struct mapped_device *md,
        /* were we interrupted ? */
        r = -EINTR;
        if (atomic_read(&md->pending)) {
+               clear_bit(DMF_BLOCK_IO, &md->flags);
+               def = bio_list_get(&md->deferred);
+               __flush_deferred_io(md, def);
                up_write(&md->io_lock);
                unlock_fs(md);
-               clear_bit(DMF_BLOCK_IO, &md->flags);
                goto out;
        }
        up_write(&md->io_lock);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/md/dm-snap.c 
hg/linux-2.6.16.13-xen/drivers/md/dm-snap.c
--- linux/linux-2.6-xen.hg/drivers/md/dm-snap.c 2006-03-07 23:12:12.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/md/dm-snap.c 2006-05-03 00:38:44.000000000 
+0300
@@ -542,8 +542,12 @@ static void snapshot_dtr(struct dm_targe
 {
        struct dm_snapshot *s = (struct dm_snapshot *) ti->private;
 
+       /* Prevent further origin writes from using this snapshot. */
+       /* After this returns there can be no new kcopyd jobs. */
        unregister_snapshot(s);
 
+       kcopyd_client_destroy(s->kcopyd_client);
+
        exit_exception_table(&s->pending, pending_cache);
        exit_exception_table(&s->complete, exception_cache);
 
@@ -552,7 +556,7 @@ static void snapshot_dtr(struct dm_targe
 
        dm_put_device(ti, s->origin);
        dm_put_device(ti, s->cow);
-       kcopyd_client_destroy(s->kcopyd_client);
+
        kfree(s);
 }
 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/drivers/md/kcopyd.c 
hg/linux-2.6.16.13-xen/drivers/md/kcopyd.c
--- linux/linux-2.6-xen.hg/drivers/md/kcopyd.c  2006-03-07 23:12:12.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/md/kcopyd.c  2006-05-03 00:38:44.000000000 
+0300
@@ -44,6 +44,9 @@ struct kcopyd_client {
        struct page_list *pages;
        unsigned int nr_pages;
        unsigned int nr_free_pages;
+
+       wait_queue_head_t destroyq;
+       atomic_t nr_jobs;
 };
 
 static struct page_list *alloc_pl(void)
@@ -293,10 +296,15 @@ static int run_complete_job(struct kcopy
        int read_err = job->read_err;
        unsigned int write_err = job->write_err;
        kcopyd_notify_fn fn = job->fn;
+       struct kcopyd_client *kc = job->kc;
 
-       kcopyd_put_pages(job->kc, job->pages);
+       kcopyd_put_pages(kc, job->pages);
        mempool_free(job, _job_pool);
        fn(read_err, write_err, context);
+
+       if (atomic_dec_and_test(&kc->nr_jobs))
+               wake_up(&kc->destroyq);
+
        return 0;
 }
 
@@ -431,6 +439,7 @@ static void do_work(void *ignored)
  */
 static void dispatch_job(struct kcopyd_job *job)
 {
+       atomic_inc(&job->kc->nr_jobs);
        push(&_pages_jobs, job);
        wake();
 }
@@ -670,6 +679,9 @@ int kcopyd_client_create(unsigned int nr
                return r;
        }
 
+       init_waitqueue_head(&kc->destroyq);
+       atomic_set(&kc->nr_jobs, 0);
+
        client_add(kc);
        *result = kc;
        return 0;
@@ -677,6 +689,9 @@ int kcopyd_client_create(unsigned int nr
 
 void kcopyd_client_destroy(struct kcopyd_client *kc)
 {
+       /* Wait for completion of all jobs submitted by this client. */
+       wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
+
        dm_io_put(kc->nr_pages);
        client_free_pages(kc);
        client_del(kc);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/media/dvb/dvb-usb/cxusb.c 
hg/linux-2.6.16.13-xen/drivers/media/dvb/dvb-usb/cxusb.c
--- linux/linux-2.6-xen.hg/drivers/media/dvb/dvb-usb/cxusb.c    2006-03-19 
14:08:31.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/media/dvb/dvb-usb/cxusb.c    2006-05-03 
00:38:44.000000000 +0300
@@ -149,6 +149,15 @@ static int cxusb_power_ctrl(struct dvb_u
                return cxusb_ctrl_msg(d, CMD_POWER_OFF, &b, 1, NULL, 0);
 }
 
+static int cxusb_bluebird_power_ctrl(struct dvb_usb_device *d, int onoff)
+{
+       u8 b = 0;
+       if (onoff)
+               return cxusb_ctrl_msg(d, CMD_POWER_ON, &b, 1, NULL, 0);
+       else
+               return 0;
+}
+
 static int cxusb_streaming_ctrl(struct dvb_usb_device *d, int onoff)
 {
        u8 buf[2] = { 0x03, 0x00 };
@@ -505,7 +514,7 @@ static struct dvb_usb_properties cxusb_b
        .size_of_priv     = sizeof(struct cxusb_state),
 
        .streaming_ctrl   = cxusb_streaming_ctrl,
-       .power_ctrl       = cxusb_power_ctrl,
+       .power_ctrl       = cxusb_bluebird_power_ctrl,
        .frontend_attach  = cxusb_lgdt3303_frontend_attach,
        .tuner_attach     = cxusb_lgh064f_tuner_attach,
 
@@ -545,7 +554,7 @@ static struct dvb_usb_properties cxusb_b
        .size_of_priv     = sizeof(struct cxusb_state),
 
        .streaming_ctrl   = cxusb_streaming_ctrl,
-       .power_ctrl       = cxusb_power_ctrl,
+       .power_ctrl       = cxusb_bluebird_power_ctrl,
        .frontend_attach  = cxusb_dee1601_frontend_attach,
        .tuner_attach     = cxusb_dee1601_tuner_attach,
 
@@ -594,7 +603,7 @@ static struct dvb_usb_properties cxusb_b
        .size_of_priv     = sizeof(struct cxusb_state),
 
        .streaming_ctrl   = cxusb_streaming_ctrl,
-       .power_ctrl       = cxusb_power_ctrl,
+       .power_ctrl       = cxusb_bluebird_power_ctrl,
        .frontend_attach  = cxusb_mt352_frontend_attach,
        .tuner_attach     = cxusb_lgz201_tuner_attach,
 
@@ -634,7 +643,7 @@ static struct dvb_usb_properties cxusb_b
        .size_of_priv     = sizeof(struct cxusb_state),
 
        .streaming_ctrl   = cxusb_streaming_ctrl,
-       .power_ctrl       = cxusb_power_ctrl,
+       .power_ctrl       = cxusb_bluebird_power_ctrl,
        .frontend_attach  = cxusb_mt352_frontend_attach,
        .tuner_attach     = cxusb_dtt7579_tuner_attach,
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/media/video/Kconfig 
hg/linux-2.6.16.13-xen/drivers/media/video/Kconfig
--- linux/linux-2.6-xen.hg/drivers/media/video/Kconfig  2006-03-07 
23:12:13.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/media/video/Kconfig  2006-05-03 
00:38:44.000000000 +0300
@@ -349,6 +349,7 @@ config VIDEO_AUDIO_DECODER
 config VIDEO_DECODER
        tristate "Add support for additional video chipsets"
        depends on VIDEO_DEV && I2C && EXPERIMENTAL
+       select FW_LOADER
        ---help---
          Say Y here to compile drivers for SAA7115, SAA7127 and CX25840
          video decoders.
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/media/video/saa7127.c 
hg/linux-2.6.16.13-xen/drivers/media/video/saa7127.c
--- linux/linux-2.6-xen.hg/drivers/media/video/saa7127.c        2006-03-07 
23:12:16.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/media/video/saa7127.c        2006-05-03 
00:38:44.000000000 +0300
@@ -141,6 +141,7 @@ struct i2c_reg_value {
 static const struct i2c_reg_value saa7129_init_config_extra[] = {
        { SAA7127_REG_OUTPUT_PORT_CONTROL,              0x38 },
        { SAA7127_REG_VTRIG,                            0xfa },
+       { 0, 0 }
 };
 
 static const struct i2c_reg_value saa7127_init_config_common[] = {
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/media/video/tuner-types.c 
hg/linux-2.6.16.13-xen/drivers/media/video/tuner-types.c
--- linux/linux-2.6-xen.hg/drivers/media/video/tuner-types.c    2006-03-07 
23:12:16.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/media/video/tuner-types.c    2006-05-03 
00:38:44.000000000 +0300
@@ -1087,8 +1087,8 @@ static struct tuner_params tuner_tnf_533
 /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
 
 static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
-       { 16 * 175.75 /*MHz*/, 0x01, },
-       { 16 * 410.25 /*MHz*/, 0x02, },
+       { 16 * 130.00 /*MHz*/, 0x01, },
+       { 16 * 364.50 /*MHz*/, 0x02, },
        { 16 * 999.99        , 0x08, },
 };
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/mtd/nand/Kconfig 
hg/linux-2.6.16.13-xen/drivers/mtd/nand/Kconfig
--- linux/linux-2.6-xen.hg/drivers/mtd/nand/Kconfig     2006-03-07 
23:12:17.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/mtd/nand/Kconfig     2006-05-03 
00:38:44.000000000 +0300
@@ -178,17 +178,16 @@ config MTD_NAND_DISKONCHIP_BBTWRITE
          Even if you leave this disabled, you can enable BBT writes at module
          load time (assuming you build diskonchip as a module) with the module
          parameter "inftl_bbt_write=1".
-         
- config MTD_NAND_SHARPSL
-       bool "Support for NAND Flash on Sharp SL Series (C7xx + others)"
-       depends on MTD_NAND && ARCH_PXA
- 
- config MTD_NAND_NANDSIM
-       bool "Support for NAND Flash Simulator"
-       depends on MTD_NAND && MTD_PARTITIONS
 
+config MTD_NAND_SHARPSL
+       tristate "Support for NAND Flash on Sharp SL Series (C7xx + others)"
+       depends on MTD_NAND && ARCH_PXA
+
+config MTD_NAND_NANDSIM
+       tristate "Support for NAND Flash Simulator"
+       depends on MTD_NAND && MTD_PARTITIONS
        help
          The simulator may simulate verious NAND flash chips for the
          MTD nand layer.
- 
+
 endmenu
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/net/e1000/e1000_main.c 
hg/linux-2.6.16.13-xen/drivers/net/e1000/e1000_main.c
--- linux/linux-2.6-xen.hg/drivers/net/e1000/e1000_main.c       2006-07-16 
11:40:53.000000000 +0300
+++ hg/linux-2.6.16.13-xen/drivers/net/e1000/e1000_main.c       2006-07-31 
10:27:31.000000000 +0300
@@ -3850,6 +3850,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapt
                        skb_shinfo(skb)->nr_frags++;
                        skb->len += length;
                        skb->data_len += length;
+                       skb->truesize += length;
                }
 
                e1000_rx_checksum(adapter, staterr,
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/net/irda/irda-usb.c 
hg/linux-2.6.16.13-xen/drivers/net/irda/irda-usb.c
--- linux/linux-2.6-xen.hg/drivers/net/irda/irda-usb.c  2006-03-07 
23:12:21.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/net/irda/irda-usb.c  2006-05-03 
00:38:44.000000000 +0300
@@ -740,7 +740,7 @@ static void irda_usb_receive(struct urb 
        struct sk_buff *newskb;
        struct sk_buff *dataskb;
        struct urb *next_urb;
-       int             docopy;
+       unsigned int len, docopy;
 
        IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length);
        
@@ -851,10 +851,11 @@ static void irda_usb_receive(struct urb 
        dataskb->dev = self->netdev;
        dataskb->mac.raw  = dataskb->data;
        dataskb->protocol = htons(ETH_P_IRDA);
+       len = dataskb->len;
        netif_rx(dataskb);
 
        /* Keep stats up to date */
-       self->stats.rx_bytes += dataskb->len;
+       self->stats.rx_bytes += len;
        self->stats.rx_packets++;
        self->netdev->last_rx = jiffies;
 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/drivers/net/sky2.c 
hg/linux-2.6.16.13-xen/drivers/net/sky2.c
--- linux/linux-2.6-xen.hg/drivers/net/sky2.c   2006-07-16 11:40:53.000000000 
+0300
+++ hg/linux-2.6.16.13-xen/drivers/net/sky2.c   2006-07-31 10:27:31.000000000 
+0300
@@ -579,8 +579,8 @@ static void sky2_mac_init(struct sky2_hw
        reg = gma_read16(hw, port, GM_PHY_ADDR);
        gma_write16(hw, port, GM_PHY_ADDR, reg | GM_PAR_MIB_CLR);
 
-       for (i = 0; i < GM_MIB_CNT_SIZE; i++)
-               gma_read16(hw, port, GM_MIB_CNT_BASE + 8 * i);
+       for (i = GM_MIB_CNT_BASE; i <= GM_MIB_CNT_END; i += 4)
+               gma_read16(hw, port, i);
        gma_write16(hw, port, GM_PHY_ADDR, reg);
 
        /* transmit control */
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/drivers/net/sky2.h 
hg/linux-2.6.16.13-xen/drivers/net/sky2.h
--- linux/linux-2.6-xen.hg/drivers/net/sky2.h   2006-03-19 14:08:31.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/net/sky2.h   2006-05-03 00:38:44.000000000 
+0300
@@ -1380,6 +1380,7 @@ enum {
 /* MIB Counters */
 #define GM_MIB_CNT_BASE        0x0100          /* Base Address of MIB Counters 
*/
 #define GM_MIB_CNT_SIZE        44              /* Number of MIB Counters */
+#define GM_MIB_CNT_END 0x025C          /* Last MIB counter */
 
 /*
  * MIB Counters base address definitions (low word) -
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/net/wireless/hostap/hostap_80211_tx.c 
hg/linux-2.6.16.13-xen/drivers/net/wireless/hostap/hostap_80211_tx.c
--- linux/linux-2.6-xen.hg/drivers/net/wireless/hostap/hostap_80211_tx.c        
2006-03-07 23:12:27.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/net/wireless/hostap/hostap_80211_tx.c        
2006-05-03 00:38:44.000000000 +0300
@@ -469,7 +469,7 @@ int hostap_master_start_xmit(struct sk_b
        }
 
        if (local->ieee_802_1x && meta->ethertype == ETH_P_PAE && tx.crypt &&
-           !(fc & IEEE80211_FCTL_VERS)) {
+           !(fc & IEEE80211_FCTL_PROTECTED)) {
                no_encrypt = 1;
                PDEBUG(DEBUG_EXTRA2, "%s: TX: IEEE 802.1X - passing "
                       "unencrypted EAPOL frame\n", dev->name);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/net/wireless/ipw2200.c 
hg/linux-2.6.16.13-xen/drivers/net/wireless/ipw2200.c
--- linux/linux-2.6-xen.hg/drivers/net/wireless/ipw2200.c       2006-03-07 
23:12:28.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/net/wireless/ipw2200.c       2006-05-03 
00:38:44.000000000 +0300
@@ -9956,9 +9956,8 @@ static int ipw_ethtool_set_eeprom(struct
                return -EINVAL;
        down(&p->sem);
        memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len);
-       for (i = IPW_EEPROM_DATA;
-            i < IPW_EEPROM_DATA + IPW_EEPROM_IMAGE_SIZE; i++)
-               ipw_write8(p, i, p->eeprom[i]);
+       for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
+               ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]);
        up(&p->sem);
        return 0;
 }
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/net/wireless/Kconfig 
hg/linux-2.6.16.13-xen/drivers/net/wireless/Kconfig
--- linux/linux-2.6-xen.hg/drivers/net/wireless/Kconfig 2006-03-07 
23:12:24.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/net/wireless/Kconfig 2006-05-03 
00:38:44.000000000 +0300
@@ -239,7 +239,8 @@ config IPW2200_DEBUG
 
 config AIRO
        tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
-       depends on NET_RADIO && ISA_DMA_API && CRYPTO && (PCI || BROKEN)
+       depends on NET_RADIO && ISA_DMA_API && (PCI || BROKEN)
+       select CRYPTO
        ---help---
          This is the standard Linux driver to support Cisco/Aironet ISA and
          PCI 802.11 wireless cards.
@@ -374,6 +375,7 @@ config PCMCIA_HERMES
 config PCMCIA_SPECTRUM
        tristate "Symbol Spectrum24 Trilogy PCMCIA card support"
        depends on NET_RADIO && PCMCIA && HERMES
+       select FW_LOADER
        ---help---
 
          This is a driver for 802.11b cards using RAM-loadable Symbol
@@ -387,6 +389,7 @@ config PCMCIA_SPECTRUM
 config AIRO_CS
        tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
        depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
+       select CRYPTO
        ---help---
          This is the standard Linux driver to support Cisco/Aironet PCMCIA
          802.11 wireless cards.  This driver is the same as the Aironet
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/drivers/pcmcia/ds.c 
hg/linux-2.6.16.13-xen/drivers/pcmcia/ds.c
--- linux/linux-2.6-xen.hg/drivers/pcmcia/ds.c  2006-03-19 14:08:31.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/drivers/pcmcia/ds.c  2006-05-03 00:38:44.000000000 
+0300
@@ -546,7 +546,7 @@ static int pcmcia_device_query(struct pc
                        tmp = vers1->str + vers1->ofs[i];
 
                        length = strlen(tmp) + 1;
-                       if ((length < 3) || (length > 255))
+                       if ((length < 2) || (length > 255))
                                continue;
 
                        p_dev->prod_id[i] = kmalloc(sizeof(char) * length,
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/scsi/3w-9xxx.c 
hg/linux-2.6.16.13-xen/drivers/scsi/3w-9xxx.c
--- linux/linux-2.6-xen.hg/drivers/scsi/3w-9xxx.c       2006-03-07 
23:12:31.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/scsi/3w-9xxx.c       2006-05-03 
00:38:44.000000000 +0300
@@ -85,7 +85,7 @@
 #include "3w-9xxx.h"
 
 /* Globals */
-#define TW_DRIVER_VERSION "2.26.02.005"
+#define TW_DRIVER_VERSION "2.26.02.007"
 static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
 static unsigned int twa_device_extension_count;
 static int twa_major = -1;
@@ -1944,9 +1944,13 @@ static void twa_scsiop_execute_scsi_comp
                }
                if (tw_dev->srb[request_id]->use_sg == 1) {
                        struct scatterlist *sg = (struct scatterlist 
*)tw_dev->srb[request_id]->request_buffer;
-                       char *buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
+                       char *buf;
+                       unsigned long flags = 0;
+                       local_irq_save(flags);
+                       buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
                        memcpy(buf, tw_dev->generic_buffer_virt[request_id], 
sg->length);
                        kunmap_atomic(buf - sg->offset, KM_IRQ0);
+                       local_irq_restore(flags);
                }
        }
 } /* End twa_scsiop_execute_scsi_complete() */
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/scsi/3w-xxxx.c 
hg/linux-2.6.16.13-xen/drivers/scsi/3w-xxxx.c
--- linux/linux-2.6-xen.hg/drivers/scsi/3w-xxxx.c       2006-03-07 
23:12:31.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/scsi/3w-xxxx.c       2006-05-03 
00:38:44.000000000 +0300
@@ -1508,10 +1508,12 @@ static void tw_transfer_internal(TW_Devi
        struct scsi_cmnd *cmd = tw_dev->srb[request_id];
        void *buf;
        unsigned int transfer_len;
+       unsigned long flags = 0;
 
        if (cmd->use_sg) {
                struct scatterlist *sg =
                        (struct scatterlist *)cmd->request_buffer;
+               local_irq_save(flags);
                buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
                transfer_len = min(sg->length, len);
        } else {
@@ -1526,6 +1528,7 @@ static void tw_transfer_internal(TW_Devi
 
                sg = (struct scatterlist *)cmd->request_buffer;
                kunmap_atomic(buf - sg->offset, KM_IRQ0);
+               local_irq_restore(flags);
        }
 }
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/scsi/sata_mv.c 
hg/linux-2.6.16.13-xen/drivers/scsi/sata_mv.c
--- linux/linux-2.6-xen.hg/drivers/scsi/sata_mv.c       2006-03-07 
23:12:37.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/scsi/sata_mv.c       2006-05-03 
00:38:44.000000000 +0300
@@ -1102,6 +1102,7 @@ static u8 mv_get_crpb_status(struct ata_
        void __iomem *port_mmio = mv_ap_base(ap);
        struct mv_port_priv *pp = ap->private_data;
        u32 out_ptr;
+       u8 ata_status;
 
        out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
 
@@ -1109,6 +1110,8 @@ static u8 mv_get_crpb_status(struct ata_
        assert(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) ==
               pp->rsp_consumer);
 
+       ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT;
+
        /* increment our consumer index... */
        pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer);
 
@@ -1123,7 +1126,7 @@ static u8 mv_get_crpb_status(struct ata_
        writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
 
        /* Return ATA status register for completed CRPB */
-       return (pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT);
+       return ata_status;
 }
 
 /**
@@ -1192,7 +1195,6 @@ static void mv_host_intr(struct ata_host
        u32 hc_irq_cause;
        int shift, port, port0, hard_port, handled;
        unsigned int err_mask;
-       u8 ata_status = 0;
 
        if (hc == 0) {
                port0 = 0;
@@ -1210,6 +1212,7 @@ static void mv_host_intr(struct ata_host
                hc,relevant,hc_irq_cause);
 
        for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
+               u8 ata_status = 0;
                ap = host_set->ports[port];
                hard_port = port & MV_PORT_MASK;        /* range 0-3 */
                handled = 0;    /* ensure ata_status is set if handled++ */
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/usb/core/message.c 
hg/linux-2.6.16.13-xen/drivers/usb/core/message.c
--- linux/linux-2.6-xen.hg/drivers/usb/core/message.c   2006-03-07 
23:12:39.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/usb/core/message.c   2006-05-03 
00:38:44.000000000 +0300
@@ -1388,11 +1388,13 @@ free_interfaces:
        if (dev->state != USB_STATE_ADDRESS)
                usb_disable_device (dev, 1);    // Skip ep0
 
-       i = dev->bus_mA - cp->desc.bMaxPower * 2;
-       if (i < 0)
-               dev_warn(&dev->dev, "new config #%d exceeds power "
-                               "limit by %dmA\n",
-                               configuration, -i);
+       if (cp) {
+               i = dev->bus_mA - cp->desc.bMaxPower * 2;
+               if (i < 0)
+                       dev_warn(&dev->dev, "new config #%d exceeds power "
+                                       "limit by %dmA\n",
+                                       configuration, -i);
+       }
 
        if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
                        USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/usb/host/ehci-sched.c 
hg/linux-2.6.16.13-xen/drivers/usb/host/ehci-sched.c
--- linux/linux-2.6-xen.hg/drivers/usb/host/ehci-sched.c        2006-03-07 
23:12:40.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/usb/host/ehci-sched.c        2006-05-03 
00:38:44.000000000 +0300
@@ -707,6 +707,7 @@ iso_stream_init (
        } else {
                u32             addr;
                int             think_time;
+               int             hs_transfers;
 
                addr = dev->ttport << 24;
                if (!ehci_is_TDI(ehci)
@@ -719,6 +720,7 @@ iso_stream_init (
                think_time = dev->tt ? dev->tt->think_time : 0;
                stream->tt_usecs = NS_TO_US (think_time + usb_calc_bus_time (
                                dev->speed, is_input, 1, maxp));
+               hs_transfers = max (1u, (maxp + 187) / 188);
                if (is_input) {
                        u32     tmp;
 
@@ -727,12 +729,11 @@ iso_stream_init (
                        stream->usecs = HS_USECS_ISO (1);
                        stream->raw_mask = 1;
 
-                       /* pessimistic c-mask */
-                       tmp = usb_calc_bus_time (USB_SPEED_FULL, 1, 0, maxp)
-                                       / (125 * 1000);
-                       stream->raw_mask |= 3 << (tmp + 9);
+                       /* c-mask as specified in USB 2.0 11.18.4 3.c */
+                       tmp = (1 << (hs_transfers + 2)) - 1;
+                       stream->raw_mask |= tmp << (8 + 2);
                } else
-                       stream->raw_mask = smask_out [maxp / 188];
+                       stream->raw_mask = smask_out [hs_transfers - 1];
                bandwidth = stream->usecs + stream->c_usecs;
                bandwidth /= 1 << (interval + 2);
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/usb/serial/console.c 
hg/linux-2.6.16.13-xen/drivers/usb/serial/console.c
--- linux/linux-2.6-xen.hg/drivers/usb/serial/console.c 2006-03-07 
23:12:41.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/usb/serial/console.c 2006-05-03 
00:38:44.000000000 +0300
@@ -54,7 +54,7 @@ static struct console usbcons;
  * serial.c code, except that the specifier is "ttyUSB" instead
  * of "ttyS".
  */
-static int __init usb_console_setup(struct console *co, char *options)
+static int usb_console_setup(struct console *co, char *options)
 {
        struct usbcons_info *info = &usbcons_info;
        int baud = 9600;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/usb/serial/option.c 
hg/linux-2.6.16.13-xen/drivers/usb/serial/option.c
--- linux/linux-2.6-xen.hg/drivers/usb/serial/option.c  2006-03-07 
23:12:41.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/usb/serial/option.c  2006-05-03 
00:38:44.000000000 +0300
@@ -582,14 +582,14 @@ static void option_setup_urbs(struct usb
        portdata = usb_get_serial_port_data(port);
 
        /* Do indat endpoints first */
-       for (j = 0; j <= N_IN_URB; ++j) {
+       for (j = 0; j < N_IN_URB; ++j) {
                portdata->in_urbs[j] = option_setup_urb (serial,
                   port->bulk_in_endpointAddress, USB_DIR_IN, port,
                   portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
        }
 
        /* outdat endpoints */
-       for (j = 0; j <= N_OUT_URB; ++j) {
+       for (j = 0; j < N_OUT_URB; ++j) {
                portdata->out_urbs[j] = option_setup_urb (serial,
                   port->bulk_out_endpointAddress, USB_DIR_OUT, port,
                   portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/usb/storage/Kconfig 
hg/linux-2.6.16.13-xen/drivers/usb/storage/Kconfig
--- linux/linux-2.6-xen.hg/drivers/usb/storage/Kconfig  2006-03-07 
23:12:41.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/usb/storage/Kconfig  2006-05-03 
00:38:44.000000000 +0300
@@ -48,7 +48,8 @@ config USB_STORAGE_FREECOM
 
 config USB_STORAGE_ISD200
        bool "ISD-200 USB/ATA Bridge support"
-       depends on USB_STORAGE && BLK_DEV_IDE
+       depends on USB_STORAGE
+       depends on BLK_DEV_IDE=y || BLK_DEV_IDE=USB_STORAGE
        ---help---
          Say Y here if you want to use USB Mass Store devices based
          on the In-Systems Design ISD-200 USB/ATA bridge.
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/video/cfbimgblt.c 
hg/linux-2.6.16.13-xen/drivers/video/cfbimgblt.c
--- linux/linux-2.6-xen.hg/drivers/video/cfbimgblt.c    2006-03-07 
23:12:42.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/video/cfbimgblt.c    2006-05-03 
00:38:44.000000000 +0300
@@ -169,7 +169,7 @@ static inline void slow_imageblit(const 
 
                while (j--) {
                        l--;
-                       color = (*s & 1 << (FB_BIT_NR(l))) ? fgcolor : bgcolor;
+                       color = (*s & (1 << l)) ? fgcolor : bgcolor;
                        val |= FB_SHIFT_HIGH(color, shift);
                        
                        /* Did the bitshift spill bits to the next long? */
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/video/fbmem.c 
hg/linux-2.6.16.13-xen/drivers/video/fbmem.c
--- linux/linux-2.6-xen.hg/drivers/video/fbmem.c        2006-03-07 
23:12:42.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/video/fbmem.c        2006-05-03 
00:38:44.000000000 +0300
@@ -669,13 +669,19 @@ fb_write(struct file *file, const char _
                total_size = info->fix.smem_len;
 
        if (p > total_size)
-               return 0;
+               return -EFBIG;
 
-       if (count >= total_size)
+       if (count > total_size) {
+               err = -EFBIG;
                count = total_size;
+       }
+
+       if (count + p > total_size) {
+               if (!err)
+                       err = -ENOSPC;
 
-       if (count + p > total_size)
                count = total_size - p;
+       }
 
        buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count,
                         GFP_KERNEL);
@@ -717,7 +723,7 @@ fb_write(struct file *file, const char _
 
        kfree(buffer);
 
-       return (err) ? err : cnt;
+       return (cnt) ? cnt : err;
 }
 
 #ifdef CONFIG_KMOD
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/video/i810/i810_main.c 
hg/linux-2.6.16.13-xen/drivers/video/i810/i810_main.c
--- linux/linux-2.6-xen.hg/drivers/video/i810/i810_main.c       2006-03-07 
23:12:42.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/video/i810/i810_main.c       2006-05-03 
00:38:44.000000000 +0300
@@ -1508,7 +1508,7 @@ static int i810fb_cursor(struct fb_info 
                int size = ((cursor->image.width + 7) >> 3) *
                        cursor->image.height;
                int i;
-               u8 *data = kmalloc(64 * 8, GFP_KERNEL);
+               u8 *data = kmalloc(64 * 8, GFP_ATOMIC);
 
                if (data == NULL)
                        return -ENOMEM;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/xen/blkfront/Kconfig 
hg/linux-2.6.16.13-xen/drivers/xen/blkfront/Kconfig
--- linux/linux-2.6-xen.hg/drivers/xen/blkfront/Kconfig 2006-03-07 
23:12:44.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/xen/blkfront/Kconfig 1970-01-01 
02:00:00.000000000 +0200
@@ -1,6 +0,0 @@
-
-config XENBLOCK
-       tristate "Block device driver"
-       depends on ARCH_XEN
-       help
-         Block device driver for Xen
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/drivers/xen/netfront/Kconfig 
hg/linux-2.6.16.13-xen/drivers/xen/netfront/Kconfig
--- linux/linux-2.6-xen.hg/drivers/xen/netfront/Kconfig 2006-03-07 
23:12:48.000000000 +0200
+++ hg/linux-2.6.16.13-xen/drivers/xen/netfront/Kconfig 1970-01-01 
02:00:00.000000000 +0200
@@ -1,6 +0,0 @@
-
-config XENNET
-       tristate "Xen network driver"
-       depends on NETDEVICES && ARCH_XEN
-       help
-         Network driver for Xen
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/9p/vfs_inode.c 
hg/linux-2.6.16.13-xen/fs/9p/vfs_inode.c
--- linux/linux-2.6-xen.hg/fs/9p/vfs_inode.c    2006-03-19 14:08:31.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/9p/vfs_inode.c    2006-05-03 00:38:44.000000000 
+0300
@@ -614,6 +614,7 @@ static struct dentry *v9fs_vfs_lookup(st
 
        sb = dir->i_sb;
        v9ses = v9fs_inode2v9ses(dir);
+       dentry->d_op = &v9fs_dentry_operations;
        dirfid = v9fs_fid_lookup(dentry->d_parent);
 
        if (!dirfid) {
@@ -681,8 +682,6 @@ static struct dentry *v9fs_vfs_lookup(st
                goto FreeFcall;
 
        fid->qid = fcall->params.rstat.stat.qid;
-
-       dentry->d_op = &v9fs_dentry_operations;
        v9fs_stat2inode(&fcall->params.rstat.stat, inode, inode->i_sb);
 
        d_add(dentry, inode);
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/char_dev.c 
hg/linux-2.6.16.13-xen/fs/char_dev.c
--- linux/linux-2.6-xen.hg/fs/char_dev.c        2006-03-07 23:12:50.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/char_dev.c        2006-05-03 00:38:44.000000000 
+0300
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/smp_lock.h>
 #include <linux/devfs_fs_kernel.h>
+#include <linux/seq_file.h>
 
 #include <linux/kobject.h>
 #include <linux/kobj_map.h>
@@ -26,8 +27,6 @@
 
 static struct kobj_map *cdev_map;
 
-#define MAX_PROBE_HASH 255     /* random */
-
 static DECLARE_MUTEX(chrdevs_lock);
 
 static struct char_device_struct {
@@ -38,93 +37,29 @@ static struct char_device_struct {
        char name[64];
        struct file_operations *fops;
        struct cdev *cdev;              /* will die */
-} *chrdevs[MAX_PROBE_HASH];
+} *chrdevs[CHRDEV_MAJOR_HASH_SIZE];
 
 /* index in the above */
 static inline int major_to_index(int major)
 {
-       return major % MAX_PROBE_HASH;
-}
-
-struct chrdev_info {
-       int index;
-       struct char_device_struct *cd;
-};
-
-void *get_next_chrdev(void *dev)
-{
-       struct chrdev_info *info;
-
-       if (dev == NULL) {
-               info = kmalloc(sizeof(*info), GFP_KERNEL);
-               if (!info)
-                       goto out;
-               info->index=0;
-               info->cd = chrdevs[info->index];
-               if (info->cd)
-                       goto out;
-       } else {
-               info = dev;
-       }
-
-       while (info->index < ARRAY_SIZE(chrdevs)) {
-               if (info->cd)
-                       info->cd = info->cd->next;
-               if (info->cd)
-                       goto out;
-               /*
-                * No devices on this chain, move to the next
-                */
-               info->index++;
-               info->cd = (info->index < ARRAY_SIZE(chrdevs)) ?
-                       chrdevs[info->index] : NULL;
-               if (info->cd)
-                       goto out;
-       }
-
-out:
-       return info;
-}
-
-void *acquire_chrdev_list(void)
-{
-       down(&chrdevs_lock);
-       return get_next_chrdev(NULL);
-}
-
-void release_chrdev_list(void *dev)
-{
-       up(&chrdevs_lock);
-       kfree(dev);
+       return major % CHRDEV_MAJOR_HASH_SIZE;
 }
 
+#ifdef CONFIG_PROC_FS
 
-int count_chrdev_list(void)
+void chrdev_show(struct seq_file *f, off_t offset)
 {
        struct char_device_struct *cd;
-       int i, count;
-
-       count = 0;
 
-       for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) {
-               for (cd = chrdevs[i]; cd; cd = cd->next)
-                       count++;
+       if (offset < CHRDEV_MAJOR_HASH_SIZE) {
+               down(&chrdevs_lock);
+               for (cd = chrdevs[offset]; cd; cd = cd->next)
+                       seq_printf(f, "%3d %s\n", cd->major, cd->name);
+               up(&chrdevs_lock);
        }
-
-       return count;
 }
 
-int get_chrdev_info(void *dev, int *major, char **name)
-{
-       struct chrdev_info *info = dev;
-
-       if (info->cd == NULL)
-               return 1;
-
-       *major = info->cd->major;
-       *name = info->cd->name;
-       return 0;
-}
+#endif /* CONFIG_PROC_FS */
 
 /*
  * Register a single major with a specified minor range.
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/fs/cifs/cifsencrypt.c 
hg/linux-2.6.16.13-xen/fs/cifs/cifsencrypt.c
--- linux/linux-2.6-xen.hg/fs/cifs/cifsencrypt.c        2006-03-07 
23:12:50.000000000 +0200
+++ hg/linux-2.6.16.13-xen/fs/cifs/cifsencrypt.c        2006-05-03 
00:38:44.000000000 +0300
@@ -56,9 +56,6 @@ int cifs_sign_smb(struct smb_hdr * cifs_
        int rc = 0;
        char smb_signature[20];
 
-       /* BB remember to initialize sequence number elsewhere and initialize 
mac_signing key elsewhere BB */
-       /* BB remember to add code to save expected sequence number in midQ 
entry BB */
-
        if((cifs_pdu == NULL) || (server == NULL))
                return -EINVAL;
 
@@ -85,20 +82,33 @@ int cifs_sign_smb(struct smb_hdr * cifs_
 static int cifs_calc_signature2(const struct kvec * iov, int n_vec,
                                const char * key, char * signature)
 {
-        struct  MD5Context context;
-
-        if((iov == NULL) || (signature == NULL))
-                return -EINVAL;
+       struct  MD5Context context;
+       int i;
 
-        MD5Init(&context);
-        MD5Update(&context,key,CIFS_SESSION_KEY_SIZE+16);
+       if((iov == NULL) || (signature == NULL))
+               return -EINVAL;
 
-/*        MD5Update(&context,cifs_pdu->Protocol,cifs_pdu->smb_buf_length); */ 
/* BB FIXME BB */
+       MD5Init(&context);
+       MD5Update(&context,key,CIFS_SESSION_KEY_SIZE+16);
+       for(i=0;i<n_vec;i++) {
+               if(iov[i].iov_base == NULL) {
+                       cERROR(1,("null iovec entry"));
+                       return -EIO;
+               } else if(iov[i].iov_len == 0)
+                       break; /* bail out if we are sent nothing to sign */
+               /* The first entry includes a length field (which does not get
+                  signed that occupies the first 4 bytes before the header */
+               if(i==0) {
+                       if (iov[0].iov_len <= 8 ) /* cmd field at offset 9 */
+                               break; /* nothing to sign or corrupt header */
+                       MD5Update(&context,iov[0].iov_base+4, iov[0].iov_len-4);
+               } else
+                       MD5Update(&context,iov[i].iov_base, iov[i].iov_len);
+       }
 
-        MD5Final(signature,&context);
+       MD5Final(signature,&context);
 
-       return -EOPNOTSUPP;
-/*        return 0; */
+       return 0;
 }
 
 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/cifs/dir.c 
hg/linux-2.6.16.13-xen/fs/cifs/dir.c
--- linux/linux-2.6-xen.hg/fs/cifs/dir.c        2006-03-07 23:12:50.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/cifs/dir.c        2006-05-03 00:38:44.000000000 
+0300
@@ -441,6 +441,20 @@ cifs_lookup(struct inode *parent_dir_ino
        cifs_sb = CIFS_SB(parent_dir_inode->i_sb);
        pTcon = cifs_sb->tcon;
 
+       /*
+        * Don't allow the separator character in a path component.
+        * The VFS will not allow "/", but "\" is allowed by posix.
+        */
+       if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) {
+               int i;
+               for (i = 0; i < direntry->d_name.len; i++)
+                       if (direntry->d_name.name[i] == '\\') {
+                               cFYI(1, ("Invalid file name"));
+                               FreeXid(xid);
+                               return ERR_PTR(-EINVAL);
+                       }
+       }
+
        /* can not grab the rename sem here since it would
        deadlock in the cases (beginning of sys_rename itself)
        in which we already have the sb rename sem */
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/compat.c 
hg/linux-2.6.16.13-xen/fs/compat.c
--- linux/linux-2.6-xen.hg/fs/compat.c  2006-03-07 23:12:50.000000000 +0200
+++ hg/linux-2.6.16.13-xen/fs/compat.c  2006-05-03 00:38:44.000000000 +0300
@@ -1215,6 +1215,10 @@ static ssize_t compat_do_readv_writev(in
        if (ret < 0)
                goto out;
 
+       ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);
+       if (ret)
+               goto out;
+
        fnv = NULL;
        if (type == READ) {
                fn = file->f_op->read;
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/ext3/resize.c 
hg/linux-2.6.16.13-xen/fs/ext3/resize.c
--- linux/linux-2.6-xen.hg/fs/ext3/resize.c     2006-03-07 23:12:51.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/ext3/resize.c     2006-05-03 00:38:44.000000000 
+0300
@@ -974,6 +974,7 @@ int ext3_group_extend(struct super_block
        if (o_blocks_count != le32_to_cpu(es->s_blocks_count)) {
                ext3_warning(sb, __FUNCTION__,
                             "multiple resizers run on filesystem!");
+               unlock_super(sb);
                err = -EBUSY;
                goto exit_put;
        }
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/fuse/file.c 
hg/linux-2.6.16.13-xen/fs/fuse/file.c
--- linux/linux-2.6-xen.hg/fs/fuse/file.c       2006-03-07 23:12:51.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/fuse/file.c       2006-05-03 00:38:44.000000000 
+0300
@@ -397,8 +397,12 @@ static int fuse_readpages(struct file *f
                return -EINTR;
 
        err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
-       if (!err)
-               fuse_send_readpages(data.req, file, inode);
+       if (!err) {
+               if (data.req->num_pages)
+                       fuse_send_readpages(data.req, file, inode);
+               else
+                       fuse_put_request(fc, data.req);
+       }
        return err;
 }
 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/locks.c 
hg/linux-2.6.16.13-xen/fs/locks.c
--- linux/linux-2.6-xen.hg/fs/locks.c   2006-03-07 23:12:52.000000000 +0200
+++ hg/linux-2.6.16.13-xen/fs/locks.c   2006-05-03 00:38:44.000000000 +0300
@@ -2212,7 +2212,12 @@ void steal_locks(fl_owner_t from)
 
        lock_kernel();
        j = 0;
-       rcu_read_lock();
+
+       /*
+        * We are not taking a ref to the file structures, so
+        * we need to acquire ->file_lock.
+        */
+       spin_lock(&files->file_lock);
        fdt = files_fdtable(files);
        for (;;) {
                unsigned long set;
@@ -2230,7 +2235,7 @@ void steal_locks(fl_owner_t from)
                        set >>= 1;
                }
        }
-       rcu_read_unlock();
+       spin_unlock(&files->file_lock);
        unlock_kernel();
 }
 EXPORT_SYMBOL(steal_locks);
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/nfsd/nfs3proc.c 
hg/linux-2.6.16.13-xen/fs/nfsd/nfs3proc.c
--- linux/linux-2.6-xen.hg/fs/nfsd/nfs3proc.c   2006-03-07 23:12:53.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/nfsd/nfs3proc.c   2006-05-03 00:38:44.000000000 
+0300
@@ -682,7 +682,7 @@ static struct svc_procedure         nfsd_proced
   PROC(lookup,  dirop,         dirop,          fhandle2, RC_NOCACHE, 
ST+FH+pAT+pAT),
   PROC(access,  access,        access,         fhandle,  RC_NOCACHE, ST+pAT+1),
   PROC(readlink, readlink,     readlink,       fhandle,  RC_NOCACHE, 
ST+pAT+1+NFS3_MAXPATHLEN/4),
-  PROC(read,    read,          read,           fhandle,  RC_NOCACHE, 
ST+pAT+4+NFSSVC_MAXBLKSIZE),
+  PROC(read,    read,          read,           fhandle,  RC_NOCACHE, 
ST+pAT+4+NFSSVC_MAXBLKSIZE/4),
   PROC(write,   write,         write,          fhandle,  RC_REPLBUFF, ST+WC+4),
   PROC(create,  create,        create,         fhandle2, RC_REPLBUFF, 
ST+(1+FH+pAT)+WC),
   PROC(mkdir,   mkdir,         create,         fhandle2, RC_REPLBUFF, 
ST+(1+FH+pAT)+WC),
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/nfsd/nfs4proc.c 
hg/linux-2.6.16.13-xen/fs/nfsd/nfs4proc.c
--- linux/linux-2.6-xen.hg/fs/nfsd/nfs4proc.c   2006-03-07 23:12:53.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/nfsd/nfs4proc.c   2006-05-03 00:38:44.000000000 
+0300
@@ -975,7 +975,7 @@ struct nfsd4_voidargs { int dummy; };
  */
 static struct svc_procedure            nfsd_procedures4[2] = {
   PROC(null,    void,          void,           void,     RC_NOCACHE, 1),
-  PROC(compound, compound,     compound,       compound, RC_NOCACHE, 
NFSD_BUFSIZE)
+  PROC(compound, compound,     compound,       compound, RC_NOCACHE, 
NFSD_BUFSIZE/4)
 };
 
 struct svc_version     nfsd_version4 = {
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/nfsd/nfsproc.c 
hg/linux-2.6.16.13-xen/fs/nfsd/nfsproc.c
--- linux/linux-2.6-xen.hg/fs/nfsd/nfsproc.c    2006-03-07 23:12:53.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/nfsd/nfsproc.c    2006-05-03 00:38:44.000000000 
+0300
@@ -553,7 +553,7 @@ static struct svc_procedure         nfsd_proced
   PROC(none,    void,          void,           none,           RC_NOCACHE, ST),
   PROC(lookup,  diropargs,     diropres,       fhandle,        RC_NOCACHE, 
ST+FH+AT),
   PROC(readlink, readlinkargs, readlinkres,    none,           RC_NOCACHE, 
ST+1+NFS_MAXPATHLEN/4),
-  PROC(read,    readargs,      readres,        fhandle,        RC_NOCACHE, 
ST+AT+1+NFSSVC_MAXBLKSIZE),
+  PROC(read,    readargs,      readres,        fhandle,        RC_NOCACHE, 
ST+AT+1+NFSSVC_MAXBLKSIZE/4),
   PROC(none,    void,          void,           none,           RC_NOCACHE, ST),
   PROC(write,   writeargs,     attrstat,       fhandle,        RC_REPLBUFF, 
ST+AT),
   PROC(create,  createargs,    diropres,       fhandle,        RC_REPLBUFF, 
ST+FH+AT),
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/open.c 
hg/linux-2.6.16.13-xen/fs/open.c
--- linux/linux-2.6-xen.hg/fs/open.c    2006-03-07 23:12:54.000000000 +0200
+++ hg/linux-2.6.16.13-xen/fs/open.c    2006-05-03 00:38:44.000000000 +0300
@@ -330,7 +330,10 @@ out:
 
 asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
 {
-       return do_sys_ftruncate(fd, length, 1);
+       long ret = do_sys_ftruncate(fd, length, 1);
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 /* LFS versions of truncate are only needed on 32 bit machines */
@@ -342,7 +345,10 @@ asmlinkage long sys_truncate64(const cha
 
 asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
 {
-       return do_sys_ftruncate(fd, length, 0);
+       long ret = do_sys_ftruncate(fd, length, 0);
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 #endif
 
@@ -1083,20 +1089,30 @@ long do_sys_open(int dfd, const char __u
 
 asmlinkage long sys_open(const char __user *filename, int flags, int mode)
 {
+       long ret;
+
        if (force_o_largefile())
                flags |= O_LARGEFILE;
 
-       return do_sys_open(AT_FDCWD, filename, flags, mode);
+       ret = do_sys_open(AT_FDCWD, filename, flags, mode);
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 EXPORT_SYMBOL_GPL(sys_open);
 
 asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
                           int mode)
 {
+       long ret;
+
        if (force_o_largefile())
                flags |= O_LARGEFILE;
 
-       return do_sys_open(dfd, filename, flags, mode);
+       ret = do_sys_open(dfd, filename, flags, mode);
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 EXPORT_SYMBOL_GPL(sys_openat);
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/fs/partitions/check.c 
hg/linux-2.6.16.13-xen/fs/partitions/check.c
--- linux/linux-2.6-xen.hg/fs/partitions/check.c        2006-03-07 
23:12:54.000000000 +0200
+++ hg/linux-2.6.16.13-xen/fs/partitions/check.c        2006-05-03 
00:38:44.000000000 +0300
@@ -345,6 +345,7 @@ static char *make_block_name(struct gend
        char *name;
        static char *block_str = "block:";
        int size;
+       char *s;
 
        size = strlen(block_str) + strlen(disk->disk_name) + 1;
        name = kmalloc(size, GFP_KERNEL);
@@ -352,6 +353,10 @@ static char *make_block_name(struct gend
                return NULL;
        strcpy(name, block_str);
        strcat(name, disk->disk_name);
+       /* ewww... some of these buggers have / in name... */
+       s = strchr(name, '/');
+       if (s)
+               *s = '!';
        return name;
 }
 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/proc/base.c 
hg/linux-2.6.16.13-xen/fs/proc/base.c
--- linux/linux-2.6-xen.hg/fs/proc/base.c       2006-03-07 23:12:56.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/proc/base.c       2006-05-03 00:38:44.000000000 
+0300
@@ -294,16 +294,20 @@ static int proc_fd_link(struct inode *in
 
        files = get_files_struct(task);
        if (files) {
-               rcu_read_lock();
+               /*
+                * We are not taking a ref to the file structure, so we must
+                * hold ->file_lock.
+                */
+               spin_lock(&files->file_lock);
                file = fcheck_files(files, fd);
                if (file) {
                        *mnt = mntget(file->f_vfsmnt);
                        *dentry = dget(file->f_dentry);
-                       rcu_read_unlock();
+                       spin_unlock(&files->file_lock);
                        put_files_struct(files);
                        return 0;
                }
-               rcu_read_unlock();
+               spin_unlock(&files->file_lock);
                put_files_struct(files);
        }
        return -ENOENT;
@@ -1485,7 +1489,12 @@ static struct dentry *proc_lookupfd(stru
        if (!files)
                goto out_unlock;
        inode->i_mode = S_IFLNK;
-       rcu_read_lock();
+
+       /*
+        * We are not taking a ref to the file structure, so we must
+        * hold ->file_lock.
+        */
+       spin_lock(&files->file_lock);
        file = fcheck_files(files, fd);
        if (!file)
                goto out_unlock2;
@@ -1493,7 +1502,7 @@ static struct dentry *proc_lookupfd(stru
                inode->i_mode |= S_IRUSR | S_IXUSR;
        if (file->f_mode & 2)
                inode->i_mode |= S_IWUSR | S_IXUSR;
-       rcu_read_unlock();
+       spin_unlock(&files->file_lock);
        put_files_struct(files);
        inode->i_op = &proc_pid_link_inode_operations;
        inode->i_size = 64;
@@ -1503,7 +1512,7 @@ static struct dentry *proc_lookupfd(stru
        return NULL;
 
 out_unlock2:
-       rcu_read_unlock();
+       spin_unlock(&files->file_lock);
        put_files_struct(files);
 out_unlock:
        iput(inode);
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/proc/proc_misc.c 
hg/linux-2.6.16.13-xen/fs/proc/proc_misc.c
--- linux/linux-2.6-xen.hg/fs/proc/proc_misc.c  2006-03-07 23:12:56.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/proc/proc_misc.c  2006-07-31 10:27:31.000000000 
+0300
@@ -249,144 +249,60 @@ static int cpuinfo_open(struct inode *in
        return seq_open(file, &cpuinfo_op);
 }
 
-enum devinfo_states {
-       CHR_HDR,
-       CHR_LIST,
-       BLK_HDR,
-       BLK_LIST,
-       DEVINFO_DONE
-};
-
-struct devinfo_state {
-       void *chrdev;
-       void *blkdev;
-       unsigned int num_records;
-       unsigned int cur_record;
-       enum devinfo_states state;
+static struct file_operations proc_cpuinfo_operations = {
+       .open           = cpuinfo_open,
+       .read           = seq_read,
+       .llseek         = seq_lseek,
+       .release        = seq_release,
 };
 
-static void *devinfo_start(struct seq_file *f, loff_t *pos)
+static int devinfo_show(struct seq_file *f, void *v)
 {
-       struct devinfo_state *info = f->private;
+       int i = *(loff_t *) v;
 
-       if (*pos) {
-               if ((info) && (*pos <= info->num_records))
-                       return info;
-               return NULL;
+       if (i < CHRDEV_MAJOR_HASH_SIZE) {
+               if (i == 0)
+                       seq_printf(f, "Character devices:\n");
+               chrdev_show(f, i);
+       } else {
+               i -= CHRDEV_MAJOR_HASH_SIZE;
+               if (i == 0)
+                       seq_printf(f, "\nBlock devices:\n");
+               blkdev_show(f, i);
        }
-       info = kmalloc(sizeof(*info), GFP_KERNEL);
-       f->private = info;
-       info->chrdev = acquire_chrdev_list();
-       info->blkdev = acquire_blkdev_list();
-       info->state = CHR_HDR;
-       info->num_records = count_chrdev_list();
-       info->num_records += count_blkdev_list();
-       info->num_records += 2; /* Character and Block headers */
-       *pos = 1;
-       info->cur_record = *pos;
-       return info;
+       return 0;
 }
 
-static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
+static void *devinfo_start(struct seq_file *f, loff_t *pos)
 {
-       int idummy;
-       char *ndummy;
-       struct devinfo_state *info = f->private;
-
-       switch (info->state) {
-               case CHR_HDR:
-                       info->state = CHR_LIST;
-                       (*pos)++;
-                       /*fallthrough*/
-               case CHR_LIST:
-                       if (get_chrdev_info(info->chrdev,&idummy,&ndummy)) {
-                               /*
-                                * The character dev list is complete
-                                */
-                               info->state = BLK_HDR;
-                       } else {
-                               info->chrdev = get_next_chrdev(info->chrdev);
-                       }
-                       (*pos)++;
-                       break;
-               case BLK_HDR:
-                       info->state = BLK_LIST;
-                       (*pos)++;
-                       break;
-               case BLK_LIST:
-                       if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
-                               /*
-                                * The block dev list is complete
-                                */
-                               info->state = DEVINFO_DONE;
-                       } else {
-                               info->blkdev = get_next_blkdev(info->blkdev);
-                       }
-                       (*pos)++;
-                       break;
-               case DEVINFO_DONE:
-                       (*pos)++;
-                       info->cur_record = *pos;
-                       info = NULL;
-                       break;
-               default:
-                       break;
-       }
-       if (info)
-               info->cur_record = *pos;
-       return info;
+       if (*pos < (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
+               return pos;
+       return NULL;
 }
 
-static void devinfo_stop(struct seq_file *f, void *v)
+static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
 {
-       struct devinfo_state *info = f->private;
-
-       if (info) {
-               release_chrdev_list(info->chrdev);
-               release_blkdev_list(info->blkdev);
-               f->private = NULL;
-               kfree(info);
-       }
+       (*pos)++;
+       if (*pos >= (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
+               return NULL;
+       return pos;
 }
 
-static int devinfo_show(struct seq_file *f, void *arg)
+static void devinfo_stop(struct seq_file *f, void *v)
 {
-       int major;
-       char *name;
-       struct devinfo_state *info = f->private;
-
-       switch(info->state) {
-               case CHR_HDR:
-                       seq_printf(f,"Character devices:\n");
-                       /* fallthrough */
-               case CHR_LIST:
-                       if (!get_chrdev_info(info->chrdev,&major,&name))
-                               seq_printf(f,"%3d %s\n",major,name);
-                       break;
-               case BLK_HDR:
-                       seq_printf(f,"\nBlock devices:\n");
-                       /* fallthrough */
-               case BLK_LIST:
-                       if (!get_blkdev_info(info->blkdev,&major,&name))
-                               seq_printf(f,"%3d %s\n",major,name);
-                       break;
-               default:
-                       break;
-       }
-
-       return 0;
+       /* Nothing to do */
 }
 
-static  struct seq_operations devinfo_op = {
-       .start  = devinfo_start,
-       .next   = devinfo_next,
-       .stop   = devinfo_stop,
-       .show   = devinfo_show,
+static struct seq_operations devinfo_ops = {
+       .start = devinfo_start,
+       .next  = devinfo_next,
+       .stop  = devinfo_stop,
+       .show  = devinfo_show
 };
 
-static int devinfo_open(struct inode *inode, struct file *file)
+static int devinfo_open(struct inode *inode, struct file *filp)
 {
-       return seq_open(file, &devinfo_op);
+       return seq_open(filp, &devinfo_ops);
 }
 
 static struct file_operations proc_devinfo_operations = {
@@ -396,13 +312,6 @@ static struct file_operations proc_devin
        .release        = seq_release,
 };
 
-static struct file_operations proc_cpuinfo_operations = {
-       .open           = cpuinfo_open,
-       .read           = seq_read,
-       .llseek         = seq_lseek,
-       .release        = seq_release,
-};
-
 extern struct seq_operations vmstat_op;
 static int vmstat_open(struct inode *inode, struct file *file)
 {
@@ -524,7 +433,7 @@ static int show_stat(struct seq_file *p,
                (unsigned long long)cputime64_to_clock_t(irq),
                (unsigned long long)cputime64_to_clock_t(softirq),
                (unsigned long long)cputime64_to_clock_t(steal));
-       for_each_online_cpu(i) {
+       for_each_cpu(i) {
 
                /* Copy values here to work around gcc-2.95.3, gcc-2.96 */
                user = kstat_cpu(i).cpustat.user;
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/proc/vmcore.c 
hg/linux-2.6.16.13-xen/fs/proc/vmcore.c
--- linux/linux-2.6-xen.hg/fs/proc/vmcore.c     2006-03-07 23:12:56.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/proc/vmcore.c     2006-05-03 00:38:44.000000000 
+0300
@@ -103,8 +103,8 @@ static ssize_t read_vmcore(struct file *
                                size_t buflen, loff_t *fpos)
 {
        ssize_t acc = 0, tmp;
-       size_t tsz, nr_bytes;
-       u64 start;
+       size_t tsz;
+       u64 start, nr_bytes;
        struct vmcore *curr_m = NULL;
 
        if (buflen == 0 || *fpos >= vmcore_size)
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/fs/reiserfs/xattr_acl.c 
hg/linux-2.6.16.13-xen/fs/reiserfs/xattr_acl.c
--- linux/linux-2.6-xen.hg/fs/reiserfs/xattr_acl.c      2006-03-07 
23:12:57.000000000 +0200
+++ hg/linux-2.6.16.13-xen/fs/reiserfs/xattr_acl.c      2006-05-03 
00:38:44.000000000 +0300
@@ -408,8 +408,9 @@ int reiserfs_cache_default_acl(struct in
                acl = reiserfs_get_acl(inode, ACL_TYPE_DEFAULT);
                reiserfs_read_unlock_xattrs(inode->i_sb);
                reiserfs_read_unlock_xattr_i(inode);
-               ret = acl ? 1 : 0;
-               posix_acl_release(acl);
+               ret = (acl && !IS_ERR(acl));
+               if (ret)
+                       posix_acl_release(acl);
        }
 
        return ret;
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/sysfs/dir.c 
hg/linux-2.6.16.13-xen/fs/sysfs/dir.c
--- linux/linux-2.6-xen.hg/fs/sysfs/dir.c       2006-03-07 23:12:57.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/sysfs/dir.c       2006-05-03 00:38:44.000000000 
+0300
@@ -302,6 +302,7 @@ void sysfs_remove_dir(struct kobject * k
         * Drop reference from dget() on entrance.
         */
        dput(dentry);
+       kobj->dentry = NULL;
 }
 
 int sysfs_rename_dir(struct kobject * kobj, const char *new_name)
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/sysfs/file.c 
hg/linux-2.6.16.13-xen/fs/sysfs/file.c
--- linux/linux-2.6-xen.hg/fs/sysfs/file.c      2006-03-07 23:12:57.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/sysfs/file.c      2006-05-03 00:38:44.000000000 
+0300
@@ -183,7 +183,7 @@ fill_write_buffer(struct sysfs_buffer * 
                return -ENOMEM;
 
        if (count >= PAGE_SIZE)
-               count = PAGE_SIZE;
+               count = PAGE_SIZE - 1;
        error = copy_from_user(buffer->page,buf,count);
        buffer->needs_read_fill = 1;
        return error ? -EFAULT : count;
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/sysfs/inode.c 
hg/linux-2.6.16.13-xen/fs/sysfs/inode.c
--- linux/linux-2.6-xen.hg/fs/sysfs/inode.c     2006-03-07 23:12:57.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/sysfs/inode.c     2006-05-03 00:38:44.000000000 
+0300
@@ -227,12 +227,16 @@ void sysfs_drop_dentry(struct sysfs_dire
 void sysfs_hash_and_remove(struct dentry * dir, const char * name)
 {
        struct sysfs_dirent * sd;
-       struct sysfs_dirent * parent_sd = dir->d_fsdata;
+       struct sysfs_dirent * parent_sd;
+
+       if (!dir)
+               return;
 
        if (dir->d_inode == NULL)
                /* no inode means this hasn't been made visible yet */
                return;
 
+       parent_sd = dir->d_fsdata;
        mutex_lock(&dir->d_inode->i_mutex);
        list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
                if (!sd->s_element)
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/fs/sysfs/symlink.c 
hg/linux-2.6.16.13-xen/fs/sysfs/symlink.c
--- linux/linux-2.6-xen.hg/fs/sysfs/symlink.c   2006-03-07 23:12:57.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/fs/sysfs/symlink.c   2006-05-03 00:38:44.000000000 
+0300
@@ -66,6 +66,7 @@ static int sysfs_add_link(struct dentry 
        if (!error)
                return 0;
 
+       kobject_put(target);
        kfree(sl->link_name);
 exit2:
        kfree(sl);
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/fs/xfs/linux-2.6/xfs_aops.c 
hg/linux-2.6.16.13-xen/fs/xfs/linux-2.6/xfs_aops.c
--- linux/linux-2.6-xen.hg/fs/xfs/linux-2.6/xfs_aops.c  2006-03-19 
14:08:32.000000000 +0200
+++ hg/linux-2.6.16.13-xen/fs/xfs/linux-2.6/xfs_aops.c  2006-05-03 
00:38:44.000000000 +0300
@@ -616,7 +616,7 @@ xfs_is_delayed_page(
                                acceptable = (type == IOMAP_UNWRITTEN);
                        else if (buffer_delay(bh))
                                acceptable = (type == IOMAP_DELAY);
-                       else if (buffer_mapped(bh))
+                       else if (buffer_dirty(bh) && buffer_mapped(bh))
                                acceptable = (type == 0);
                        else
                                break;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/fs/xfs/linux-2.6/xfs_iops.c 
hg/linux-2.6.16.13-xen/fs/xfs/linux-2.6/xfs_iops.c
--- linux/linux-2.6-xen.hg/fs/xfs/linux-2.6/xfs_iops.c  2006-03-07 
23:12:58.000000000 +0200
+++ hg/linux-2.6.16.13-xen/fs/xfs/linux-2.6/xfs_iops.c  2006-05-03 
00:38:44.000000000 +0300
@@ -673,8 +673,7 @@ linvfs_setattr(
        if (ia_valid & ATTR_ATIME) {
                vattr.va_mask |= XFS_AT_ATIME;
                vattr.va_atime = attr->ia_atime;
-               if (ia_valid & ATTR_ATIME_SET)
-                       inode->i_atime = attr->ia_atime;
+               inode->i_atime = attr->ia_atime;
        }
        if (ia_valid & ATTR_MTIME) {
                vattr.va_mask |= XFS_AT_MTIME;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-i386/cpufeature.h 
hg/linux-2.6.16.13-xen/include/asm-i386/cpufeature.h
--- linux/linux-2.6-xen.hg/include/asm-i386/cpufeature.h        2006-03-07 
23:13:09.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-i386/cpufeature.h        2006-05-03 
00:38:44.000000000 +0300
@@ -70,6 +70,7 @@
 #define X86_FEATURE_P3         (3*32+ 6) /* P3 */
 #define X86_FEATURE_P4         (3*32+ 7) /* P4 */
 #define X86_FEATURE_CONSTANT_TSC (3*32+ 8) /* TSC ticks at a constant rate */
+#define X86_FEATURE_FXSAVE_LEAK (3*32+10) /* FXSAVE leaks FOP/FIP/FOP */
 
 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
 #define X86_FEATURE_XMM3       (4*32+ 0) /* Streaming SIMD Extensions-3 */
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-i386/i387.h 
hg/linux-2.6.16.13-xen/include/asm-i386/i387.h
--- linux/linux-2.6-xen.hg/include/asm-i386/i387.h      2006-03-07 
23:13:09.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-i386/i387.h      2006-05-03 
00:38:44.000000000 +0300
@@ -13,6 +13,7 @@
 
 #include <linux/sched.h>
 #include <linux/init.h>
+#include <linux/kernel_stat.h>
 #include <asm/processor.h>
 #include <asm/sigcontext.h>
 #include <asm/user.h>
@@ -38,17 +39,38 @@ extern void init_fpu(struct task_struct 
 extern void kernel_fpu_begin(void);
 #define kernel_fpu_end() do { stts(); preempt_enable(); } while(0)
 
+/* We need a safe address that is cheap to find and that is already
+   in L1 during context switch. The best choices are unfortunately
+   different for UP and SMP */
+#ifdef CONFIG_SMP
+#define safe_address (__per_cpu_offset[0])
+#else
+#define safe_address (kstat_cpu(0).cpustat.user)
+#endif
+
 /*
  * These must be called with preempt disabled
  */
 static inline void __save_init_fpu( struct task_struct *tsk )
 {
+       /* Use more nops than strictly needed in case the compiler
+          varies code */
        alternative_input(
-               "fnsave %1 ; fwait ;" GENERIC_NOP2,
-               "fxsave %1 ; fnclex",
+               "fnsave %[fx] ;fwait;" GENERIC_NOP8 GENERIC_NOP4,
+               "fxsave %[fx]\n"
+               "bt $7,%[fsw] ; jnc 1f ; fnclex\n1:",
                X86_FEATURE_FXSR,
-               "m" (tsk->thread.i387.fxsave)
-               :"memory");
+               [fx] "m" (tsk->thread.i387.fxsave),
+               [fsw] "m" (tsk->thread.i387.fxsave.swd) : "memory");
+       /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
+          is pending.  Clear the x87 state here by setting it to fixed
+          values. safe_address is a random variable that should be in L1 */
+       alternative_input(
+               GENERIC_NOP8 GENERIC_NOP2,
+               "emms\n\t"              /* clear stack tags */
+               "fildl %[addr]",        /* set F?P to defined value */
+               X86_FEATURE_FXSAVE_LEAK,
+               [addr] "m" (safe_address));
        task_thread_info(tsk)->status &= ~TS_USEDFPU;
 }
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-i386/pgtable-2level.h 
hg/linux-2.6.16.13-xen/include/asm-i386/pgtable-2level.h
--- linux/linux-2.6-xen.hg/include/asm-i386/pgtable-2level.h    2006-03-07 
23:13:10.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-i386/pgtable-2level.h    2006-05-03 
00:38:44.000000000 +0300
@@ -18,6 +18,9 @@
 #define set_pte_atomic(pteptr, pteval) set_pte(pteptr,pteval)
 #define set_pmd(pmdptr, pmdval) (*(pmdptr) = (pmdval))
 
+#define pte_clear(mm,addr,xp)  do { set_pte_at(mm, addr, xp, __pte(0)); } 
while (0)
+#define pmd_clear(xp)  do { set_pmd(xp, __pmd(0)); } while (0)
+
 #define ptep_get_and_clear(mm,addr,xp) __pte(xchg(&(xp)->pte_low, 0))
 #define pte_same(a, b)         ((a).pte_low == (b).pte_low)
 #define pte_page(x)            pfn_to_page(pte_pfn(x))
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-i386/pgtable-3level.h 
hg/linux-2.6.16.13-xen/include/asm-i386/pgtable-3level.h
--- linux/linux-2.6-xen.hg/include/asm-i386/pgtable-3level.h    2006-03-07 
23:13:10.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-i386/pgtable-3level.h    2006-05-03 
00:38:44.000000000 +0300
@@ -85,6 +85,26 @@ static inline void pud_clear (pud_t * pu
 #define pmd_offset(pud, address) ((pmd_t *) pud_page(*(pud)) + \
                        pmd_index(address))
 
+/*
+ * For PTEs and PDEs, we must clear the P-bit first when clearing a page table
+ * entry, so clear the bottom half first and enforce ordering with a compiler
+ * barrier.
+ */
+static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t 
*ptep)
+{
+       ptep->pte_low = 0;
+       smp_wmb();
+       ptep->pte_high = 0;
+}
+
+static inline void pmd_clear(pmd_t *pmd)
+{
+       u32 *tmp = (u32 *)pmd;
+       *tmp = 0;
+       smp_wmb();
+       *(tmp + 1) = 0;
+}
+
 static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long 
addr, pte_t *ptep)
 {
        pte_t res;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-i386/pgtable.h 
hg/linux-2.6.16.13-xen/include/asm-i386/pgtable.h
--- linux/linux-2.6-xen.hg/include/asm-i386/pgtable.h   2006-03-07 
23:13:10.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-i386/pgtable.h   2006-05-03 
00:38:44.000000000 +0300
@@ -204,12 +204,10 @@ extern unsigned long long __PAGE_KERNEL,
 extern unsigned long pg0[];
 
 #define pte_present(x) ((x).pte_low & (_PAGE_PRESENT | _PAGE_PROTNONE))
-#define pte_clear(mm,addr,xp)  do { set_pte_at(mm, addr, xp, __pte(0)); } 
while (0)
 
 /* To avoid harmful races, pmd_none(x) should check only the lower when PAE */
 #define pmd_none(x)    (!(unsigned long)pmd_val(x))
 #define pmd_present(x) (pmd_val(x) & _PAGE_PRESENT)
-#define pmd_clear(xp)  do { set_pmd(xp, __pmd(0)); } while (0)
 #define        pmd_bad(x)      ((pmd_val(x) & (~PAGE_MASK & ~_PAGE_USER)) != 
_KERNPG_TABLE)
 
 
@@ -269,7 +267,7 @@ static inline pte_t ptep_get_and_clear_f
        pte_t pte;
        if (full) {
                pte = *ptep;
-               *ptep = __pte(0);
+               pte_clear(mm, addr, ptep);
        } else {
                pte = ptep_get_and_clear(mm, addr, ptep);
        }
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-ia64/hypervisor.h 
hg/linux-2.6.16.13-xen/include/asm-ia64/hypervisor.h
--- linux/linux-2.6-xen.hg/include/asm-ia64/hypervisor.h        2006-06-21 
20:32:12.000000000 +0300
+++ hg/linux-2.6.16.13-xen/include/asm-ia64/hypervisor.h        2006-06-18 
09:52:12.000000000 +0300
@@ -123,8 +123,6 @@ HYPERVISOR_poll(
        return rc;
 }
 
-#include <asm/hypercall.h>
-
 // for drivers/xen/privcmd/privcmd.c
 #define machine_to_phys_mapping 0
 #ifndef CONFIG_XEN_IA64_DOM0_VP
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-m32r/smp.h 
hg/linux-2.6.16.13-xen/include/asm-m32r/smp.h
--- linux/linux-2.6-xen.hg/include/asm-m32r/smp.h       2006-03-07 
23:13:14.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-m32r/smp.h       2006-05-03 
00:38:44.000000000 +0300
@@ -67,7 +67,8 @@ extern volatile int cpu_2_physid[NR_CPUS
 #define raw_smp_processor_id() (current_thread_info()->cpu)
 
 extern cpumask_t cpu_callout_map;
-#define cpu_possible_map cpu_callout_map
+extern cpumask_t cpu_possible_map;
+extern cpumask_t cpu_present_map;
 
 static __inline__ int hard_smp_processor_id(void)
 {
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-m32r/uaccess.h 
hg/linux-2.6.16.13-xen/include/asm-m32r/uaccess.h
--- linux/linux-2.6-xen.hg/include/asm-m32r/uaccess.h   2006-03-07 
23:13:15.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-m32r/uaccess.h   2006-05-03 
00:38:44.000000000 +0300
@@ -5,17 +5,9 @@
  *  linux/include/asm-m32r/uaccess.h
  *
  *  M32R version.
- *    Copyright (C) 2004  Hirokazu Takata <takata at linux-m32r.org>
+ *    Copyright (C) 2004, 2006  Hirokazu Takata <takata at linux-m32r.org>
  */
 
-#undef UACCESS_DEBUG
-
-#ifdef UACCESS_DEBUG
-#define UAPRINTK(args...) printk(args)
-#else
-#define UAPRINTK(args...)
-#endif /* UACCESS_DEBUG */
-
 /*
  * User space memory access functions
  */
@@ -38,27 +30,29 @@
 #define MAKE_MM_SEG(s) ((mm_segment_t) { (s) })
 
 #ifdef CONFIG_MMU
+
 #define KERNEL_DS      MAKE_MM_SEG(0xFFFFFFFF)
 #define USER_DS                MAKE_MM_SEG(PAGE_OFFSET)
-#else
-#define KERNEL_DS      MAKE_MM_SEG(0xFFFFFFFF)
-#define USER_DS                MAKE_MM_SEG(0xFFFFFFFF)
-#endif /* CONFIG_MMU */
-
 #define get_ds()       (KERNEL_DS)
-#ifdef CONFIG_MMU
 #define get_fs()       (current_thread_info()->addr_limit)
 #define set_fs(x)      (current_thread_info()->addr_limit = (x))
-#else
+
+#else /* not CONFIG_MMU */
+
+#define KERNEL_DS      MAKE_MM_SEG(0xFFFFFFFF)
+#define USER_DS                MAKE_MM_SEG(0xFFFFFFFF)
+#define get_ds()       (KERNEL_DS)
+
 static inline mm_segment_t get_fs(void)
 {
-  return USER_DS;
+       return USER_DS;
 }
 
 static inline void set_fs(mm_segment_t s)
 {
 }
-#endif /* CONFIG_MMU */
+
+#endif /* not CONFIG_MMU */
 
 #define segment_eq(a,b)        ((a).seg == (b).seg)
 
@@ -83,9 +77,9 @@ static inline void set_fs(mm_segment_t s
                "       subx    %0, %0\n"                               \
                "       cmpu    %4, %1\n"                               \
                "       subx    %0, %5\n"                               \
-               : "=&r"(flag), "=r"(sum)                                \
-               : "1"(addr), "r"((int)(size)),                          \
-                 "r"(current_thread_info()->addr_limit.seg), "r"(0)    \
+               : "=&r" (flag), "=r" (sum)                              \
+               : "1" (addr), "r" ((int)(size)),                        \
+                 "r" (current_thread_info()->addr_limit.seg), "r" (0)  \
                : "cbit" );                                             \
        flag; })
 
@@ -113,10 +107,10 @@ static inline void set_fs(mm_segment_t s
 #else
 static inline int access_ok(int type, const void *addr, unsigned long size)
 {
-  extern unsigned long memory_start, memory_end;
-  unsigned long val = (unsigned long)addr;
+       extern unsigned long memory_start, memory_end;
+       unsigned long val = (unsigned long)addr;
 
-  return ((val >= memory_start) && ((val + size) < memory_end));
+       return ((val >= memory_start) && ((val + size) < memory_end));
 }
 #endif /* CONFIG_MMU */
 
@@ -155,39 +149,6 @@ extern int fixup_exception(struct pt_reg
  * accesses to the same area of user memory).
  */
 
-extern void __get_user_1(void);
-extern void __get_user_2(void);
-extern void __get_user_4(void);
-
-#ifndef MODULE
-#define __get_user_x(size,ret,x,ptr)                                   \
-       __asm__ __volatile__(                                           \
-               "       mv      r0, %0\n"                               \
-               "       mv      r1, %1\n"                               \
-               "       bl __get_user_" #size "\n"                      \
-               "       mv      %0, r0\n"                               \
-               "       mv      %1, r1\n"                               \
-               : "=r"(ret), "=r"(x)                                    \
-               : "0"(ptr)                                              \
-               : "r0", "r1", "r14" )
-#else /* MODULE */
-/*
- * Use "jl" instead of "bl" for MODULE
- */
-#define __get_user_x(size,ret,x,ptr)                                   \
-       __asm__ __volatile__(                                           \
-               "       mv      r0, %0\n"                               \
-               "       mv      r1, %1\n"                               \
-               "       seth    lr, #high(__get_user_" #size ")\n"      \
-               "       or3     lr, lr, #low(__get_user_" #size ")\n"   \
-               "       jl      lr\n"                                   \
-               "       mv      %0, r0\n"                               \
-               "       mv      %1, r1\n"                               \
-               : "=r"(ret), "=r"(x)                                    \
-               : "0"(ptr)                                              \
-               : "r0", "r1", "r14" )
-#endif
-
 /* Careful: we have to cast the result to the type of the pointer for sign
    reasons */
 /**
@@ -208,20 +169,7 @@ extern void __get_user_4(void);
  * On error, the variable @x is set to zero.
  */
 #define get_user(x,ptr)                                                        
\
-({     int __ret_gu;                                                   \
-       unsigned long __val_gu;                                         \
-       __chk_user_ptr(ptr);                                            \
-       switch(sizeof (*(ptr))) {                                       \
-       case 1:  __get_user_x(1,__ret_gu,__val_gu,ptr); break;          \
-       case 2:  __get_user_x(2,__ret_gu,__val_gu,ptr); break;          \
-       case 4:  __get_user_x(4,__ret_gu,__val_gu,ptr); break;          \
-       default: __get_user_x(X,__ret_gu,__val_gu,ptr); break;          \
-       }                                                               \
-       (x) = (__typeof__(*(ptr)))__val_gu;                             \
-       __ret_gu;                                                       \
-})
-
-extern void __put_user_bad(void);
+       __get_user_check((x),(ptr),sizeof(*(ptr)))
 
 /**
  * put_user: - Write a simple value into user space.
@@ -240,8 +188,7 @@ extern void __put_user_bad(void);
  * Returns zero on success, or -EFAULT on error.
  */
 #define put_user(x,ptr)                                                        
\
-  __put_user_check((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
-
+       __put_user_check((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
 
 /**
  * __get_user: - Get a simple variable from user space, with less checking.
@@ -264,8 +211,64 @@ extern void __put_user_bad(void);
  * On error, the variable @x is set to zero.
  */
 #define __get_user(x,ptr) \
-  __get_user_nocheck((x),(ptr),sizeof(*(ptr)))
+       __get_user_nocheck((x),(ptr),sizeof(*(ptr)))
 
+#define __get_user_nocheck(x,ptr,size)                                 \
+({                                                                     \
+       long __gu_err = 0;                                              \
+       unsigned long __gu_val;                                         \
+       might_sleep();                                                  \
+       __get_user_size(__gu_val,(ptr),(size),__gu_err);                \
+       (x) = (__typeof__(*(ptr)))__gu_val;                             \
+       __gu_err;                                                       \
+})
+
+#define __get_user_check(x,ptr,size)                                   \
+({                                                                     \
+       long __gu_err = -EFAULT;                                        \
+       unsigned long __gu_val = 0;                                     \
+       const __typeof__(*(ptr)) __user *__gu_addr = (ptr);             \
+       might_sleep();                                                  \
+       if (access_ok(VERIFY_READ,__gu_addr,size))                      \
+               __get_user_size(__gu_val,__gu_addr,(size),__gu_err);    \
+       (x) = (__typeof__(*(ptr)))__gu_val;                             \
+       __gu_err;                                                       \
+})
+
+extern long __get_user_bad(void);
+
+#define __get_user_size(x,ptr,size,retval)                             \
+do {                                                                   \
+       retval = 0;                                                     \
+       __chk_user_ptr(ptr);                                            \
+       switch (size) {                                                 \
+         case 1: __get_user_asm(x,ptr,retval,"ub"); break;             \
+         case 2: __get_user_asm(x,ptr,retval,"uh"); break;             \
+         case 4: __get_user_asm(x,ptr,retval,""); break;               \
+         default: (x) = __get_user_bad();                              \
+       }                                                               \
+} while (0)
+
+#define __get_user_asm(x, addr, err, itype)                            \
+       __asm__ __volatile__(                                           \
+               "       .fillinsn\n"                                    \
+               "1:     ld"itype" %1,@%2\n"                             \
+               "       .fillinsn\n"                                    \
+               "2:\n"                                                  \
+               ".section .fixup,\"ax\"\n"                              \
+               "       .balign 4\n"                                    \
+               "3:     ldi %0,%3\n"                                    \
+               "       seth r14,#high(2b)\n"                           \
+               "       or3 r14,r14,#low(2b)\n"                         \
+               "       jmp r14\n"                                      \
+               ".previous\n"                                           \
+               ".section __ex_table,\"a\"\n"                           \
+               "       .balign 4\n"                                    \
+               "       .long 1b,3b\n"                                  \
+               ".previous"                                             \
+               : "=&r" (err), "=&r" (x)                                \
+               : "r" (addr), "i" (-EFAULT), "0" (err)                  \
+               : "r14", "memory")
 
 /**
  * __put_user: - Write a simple value into user space, with less checking.
@@ -287,11 +290,13 @@ extern void __put_user_bad(void);
  * Returns zero on success, or -EFAULT on error.
  */
 #define __put_user(x,ptr) \
-  __put_user_nocheck((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
+       __put_user_nocheck((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
+
 
 #define __put_user_nocheck(x,ptr,size)                                 \
 ({                                                                     \
        long __pu_err;                                                  \
+       might_sleep();                                                  \
        __put_user_size((x),(ptr),(size),__pu_err);                     \
        __pu_err;                                                       \
 })
@@ -308,28 +313,28 @@ extern void __put_user_bad(void);
 })
 
 #if defined(__LITTLE_ENDIAN__)
-#define __put_user_u64(x, addr, err)                                    \
-        __asm__ __volatile__(                                           \
-                "       .fillinsn\n"                                    \
-                "1:     st %L1,@%2\n"                                    \
-                "       .fillinsn\n"                                    \
-                "2:     st %H1,@(4,%2)\n"                                \
-                "       .fillinsn\n"                                    \
-                "3:\n"                                                  \
-                ".section .fixup,\"ax\"\n"                              \
-                "       .balign 4\n"                                    \
-                "4:     ldi %0,%3\n"                                    \
-                "       seth r14,#high(3b)\n"                           \
-                "       or3 r14,r14,#low(3b)\n"                         \
-                "       jmp r14\n"                                      \
-                ".previous\n"                                           \
-                ".section __ex_table,\"a\"\n"                           \
-                "       .balign 4\n"                                    \
-                "       .long 1b,4b\n"                                  \
-                "       .long 2b,4b\n"                                  \
-                ".previous"                                             \
-                : "=&r"(err)                                             \
-                : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)            \
+#define __put_user_u64(x, addr, err)                                   \
+        __asm__ __volatile__(                                          \
+                "       .fillinsn\n"                                   \
+                "1:     st %L1,@%2\n"                                  \
+                "       .fillinsn\n"                                   \
+                "2:     st %H1,@(4,%2)\n"                              \
+                "       .fillinsn\n"                                   \
+                "3:\n"                                                 \
+                ".section .fixup,\"ax\"\n"                             \
+                "       .balign 4\n"                                   \
+                "4:     ldi %0,%3\n"                                   \
+                "       seth r14,#high(3b)\n"                          \
+                "       or3 r14,r14,#low(3b)\n"                                
\
+                "       jmp r14\n"                                     \
+                ".previous\n"                                          \
+                ".section __ex_table,\"a\"\n"                          \
+                "       .balign 4\n"                                   \
+                "       .long 1b,4b\n"                                 \
+                "       .long 2b,4b\n"                                 \
+                ".previous"                                            \
+                : "=&r" (err)                                          \
+                : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)                
\
                 : "r14", "memory")
 
 #elif defined(__BIG_ENDIAN__)
@@ -353,13 +358,15 @@ extern void __put_user_bad(void);
                "       .long 1b,4b\n"                                  \
                "       .long 2b,4b\n"                                  \
                ".previous"                                             \
-               : "=&r"(err)                                            \
-               : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
+               : "=&r" (err)                                           \
+               : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)         \
                : "r14", "memory")
 #else
 #error no endian defined
 #endif
 
+extern void __put_user_bad(void);
+
 #define __put_user_size(x,ptr,size,retval)                             \
 do {                                                                   \
        retval = 0;                                                     \
@@ -398,52 +405,8 @@ struct __large_struct { unsigned long bu
                "       .balign 4\n"                                    \
                "       .long 1b,3b\n"                                  \
                ".previous"                                             \
-               : "=&r"(err)                                            \
-               : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
-               : "r14", "memory")
-
-#define __get_user_nocheck(x,ptr,size)                                 \
-({                                                                     \
-       long __gu_err;                                                  \
-       unsigned long __gu_val;                                         \
-       __get_user_size(__gu_val,(ptr),(size),__gu_err);                \
-       (x) = (__typeof__(*(ptr)))__gu_val;                             \
-       __gu_err;                                                       \
-})
-
-extern long __get_user_bad(void);
-
-#define __get_user_size(x,ptr,size,retval)                             \
-do {                                                                   \
-       retval = 0;                                                     \
-       __chk_user_ptr(ptr);                                            \
-       switch (size) {                                                 \
-         case 1: __get_user_asm(x,ptr,retval,"ub"); break;             \
-         case 2: __get_user_asm(x,ptr,retval,"uh"); break;             \
-         case 4: __get_user_asm(x,ptr,retval,""); break;               \
-         default: (x) = __get_user_bad();                              \
-       }                                                               \
-} while (0)
-
-#define __get_user_asm(x, addr, err, itype)                            \
-       __asm__ __volatile__(                                           \
-               "       .fillinsn\n"                                    \
-               "1:     ld"itype" %1,@%2\n"                             \
-               "       .fillinsn\n"                                    \
-               "2:\n"                                                  \
-               ".section .fixup,\"ax\"\n"                              \
-               "       .balign 4\n"                                    \
-               "3:     ldi %0,%3\n"                                    \
-               "       seth r14,#high(2b)\n"                           \
-               "       or3 r14,r14,#low(2b)\n"                         \
-               "       jmp r14\n"                                      \
-               ".previous\n"                                           \
-               ".section __ex_table,\"a\"\n"                           \
-               "       .balign 4\n"                                    \
-               "       .long 1b,3b\n"                                  \
-               ".previous"                                             \
-               : "=&r"(err), "=&r"(x)                                  \
-               : "r"(addr), "i"(-EFAULT), "0"(err)                     \
+               : "=&r" (err)                                           \
+               : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)         \
                : "r14", "memory")
 
 /*
@@ -453,7 +416,6 @@ do {                                                        
                \
  * anything, so this is accurate.
  */
 
-
 /*
  * Copy To/From Userspace
  */
@@ -511,8 +473,9 @@ do {                                                        
                \
                "       .long 2b,9b\n"                                  \
                "       .long 3b,9b\n"                                  \
                ".previous\n"                                           \
-               : "=&r"(__dst), "=&r"(__src), "=&r"(size), "=&r"(__c)   \
-               : "0"(to), "1"(from), "2"(size), "3"(size / 4)          \
+               : "=&r" (__dst), "=&r" (__src), "=&r" (size),           \
+                 "=&r" (__c)                                           \
+               : "0" (to), "1" (from), "2" (size), "3" (size / 4)      \
                : "r14", "memory");                                     \
 } while (0)
 
@@ -573,8 +536,9 @@ do {                                                        
                \
                "       .long 2b,7b\n"                                  \
                "       .long 3b,7b\n"                                  \
                ".previous\n"                                           \
-               : "=&r"(__dst), "=&r"(__src), "=&r"(size), "=&r"(__c)   \
-               : "0"(to), "1"(from), "2"(size), "3"(size / 4)          \
+               : "=&r" (__dst), "=&r" (__src), "=&r" (size),           \
+                 "=&r" (__c)                                           \
+               : "0" (to), "1" (from), "2" (size), "3" (size / 4)      \
                : "r14", "memory");                                     \
 } while (0)
 
@@ -676,7 +640,7 @@ unsigned long __generic_copy_from_user(v
 #define copy_from_user(to,from,n)                      \
 ({                                                     \
        might_sleep();                                  \
-__generic_copy_from_user((to),(from),(n));     \
+       __generic_copy_from_user((to),(from),(n));      \
 })
 
 long __must_check strncpy_from_user(char *dst, const char __user *src,
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-mips/bitops.h 
hg/linux-2.6.16.13-xen/include/asm-mips/bitops.h
--- linux/linux-2.6-xen.hg/include/asm-mips/bitops.h    2006-03-07 
23:13:20.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-mips/bitops.h    2006-05-03 
00:38:44.000000000 +0300
@@ -654,7 +654,12 @@ static inline unsigned long fls(unsigned
 {
 #ifdef CONFIG_32BIT
 #ifdef CONFIG_CPU_MIPS32
-       __asm__ ("clz %0, %1" : "=r" (word) : "r" (word));
+       __asm__ (
+       "       .set    mips32                                  \n"
+       "       clz     %0, %1                                  \n"
+       "       .set    mips0                                   \n"
+       : "=r" (word)
+       : "r" (word));
 
        return 32 - word;
 #else
@@ -678,7 +683,12 @@ static inline unsigned long fls(unsigned
 #ifdef CONFIG_64BIT
 #ifdef CONFIG_CPU_MIPS64
 
-       __asm__ ("dclz %0, %1" : "=r" (word) : "r" (word));
+       __asm__ (
+       "       .set    mips64                                  \n"
+       "       dclz    %0, %1                                  \n"
+       "       .set    mips0                                   \n"
+       : "=r" (word)
+       : "r" (word));
 
        return 64 - word;
 #else
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-mips/byteorder.h 
hg/linux-2.6.16.13-xen/include/asm-mips/byteorder.h
--- linux/linux-2.6-xen.hg/include/asm-mips/byteorder.h 2006-03-07 
23:13:20.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-mips/byteorder.h 2006-05-03 
00:38:44.000000000 +0300
@@ -19,7 +19,9 @@
 static __inline__ __attribute_const__ __u16 ___arch__swab16(__u16 x)
 {
        __asm__(
+       "       .set    mips32r2                \n"
        "       wsbh    %0, %1                  \n"
+       "       .set    mips0                   \n"
        : "=r" (x)
        : "r" (x));
 
@@ -30,8 +32,10 @@ static __inline__ __attribute_const__ __
 static __inline__ __attribute_const__ __u32 ___arch__swab32(__u32 x)
 {
        __asm__(
+       "       .set    mips32r2                \n"
        "       wsbh    %0, %1                  \n"
        "       rotr    %0, %0, 16              \n"
+       "       .set    mips0                   \n"
        : "=r" (x)
        : "r" (x));
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-mips/interrupt.h 
hg/linux-2.6.16.13-xen/include/asm-mips/interrupt.h
--- linux/linux-2.6-xen.hg/include/asm-mips/interrupt.h 2006-03-07 
23:13:20.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-mips/interrupt.h 2006-05-03 
00:38:44.000000000 +0300
@@ -20,7 +20,9 @@ __asm__ (
        "       .set    reorder                                         \n"
        "       .set    noat                                            \n"
 #ifdef CONFIG_CPU_MIPSR2
+       "       .set    mips32r2                                        \n"
        "       ei                                                      \n"
+       "       .set    mips0                                           \n"
 #else
        "       mfc0    $1,$12                                          \n"
        "       ori     $1,0x1f                                         \n"
@@ -63,7 +65,9 @@ __asm__ (
        "       .set    push                                            \n"
        "       .set    noat                                            \n"
 #ifdef CONFIG_CPU_MIPSR2
+       "       .set    mips32r2                                        \n"
        "       di                                                      \n"
+       "       .set    mips0                                           \n"
 #else
        "       mfc0    $1,$12                                          \n"
        "       ori     $1,0x1f                                         \n"
@@ -103,8 +107,10 @@ __asm__ (
        "       .set    reorder                                         \n"
        "       .set    noat                                            \n"
 #ifdef CONFIG_CPU_MIPSR2
+       "       .set    mips32r2                                        \n"
        "       di      \\result                                        \n"
        "       andi    \\result, 1                                     \n"
+       "       .set    mips0                                           \n"
 #else
        "       mfc0    \\result, $12                                   \n"
        "       ori     $1, \\result, 0x1f                              \n"
@@ -133,9 +139,11 @@ __asm__ (
         * Slow, but doesn't suffer from a relativly unlikely race
         * condition we're having since days 1.
         */
+       "       .set    mips32r2                                        \n"
        "       beqz    \\flags, 1f                                     \n"
        "        di                                                     \n"
        "       ei                                                      \n"
+       "       .set    mips0                                           \n"
        "1:                                                             \n"
 #elif defined(CONFIG_CPU_MIPSR2)
        /*
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-mips/r4kcache.h 
hg/linux-2.6.16.13-xen/include/asm-mips/r4kcache.h
--- linux/linux-2.6-xen.hg/include/asm-mips/r4kcache.h  2006-03-22 
18:36:07.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-mips/r4kcache.h  2006-05-03 
00:38:44.000000000 +0300
@@ -37,7 +37,7 @@
        "       cache   %0, %1                                  \n"     \
        "       .set    pop                                     \n"     \
        :                                                               \
-       : "i" (op), "m" (*(unsigned char *)(addr)))
+       : "i" (op), "R" (*(unsigned char *)(addr)))
 
 static inline void flush_icache_line_indexed(unsigned long addr)
 {
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-powerpc/floppy.h 
hg/linux-2.6.16.13-xen/include/asm-powerpc/floppy.h
--- linux/linux-2.6-xen.hg/include/asm-powerpc/floppy.h 2006-03-07 
23:13:23.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-powerpc/floppy.h 2006-05-03 
00:38:44.000000000 +0300
@@ -35,6 +35,7 @@
 #ifdef CONFIG_PCI
 
 #include <linux/pci.h>
+#include <asm/ppc-pci.h>       /* for ppc64_isabridge_dev */
 
 #define fd_dma_setup(addr,size,mode,io) powerpc_fd_dma_setup(addr,size,mode,io)
 
@@ -52,12 +53,12 @@ static __inline__ int powerpc_fd_dma_set
        if (bus_addr 
            && (addr != prev_addr || size != prev_size || dir != prev_dir)) {
                /* different from last time -- unmap prev */
-               pci_unmap_single(NULL, bus_addr, prev_size, prev_dir);
+               pci_unmap_single(ppc64_isabridge_dev, bus_addr, prev_size, 
prev_dir);
                bus_addr = 0;
        }
 
        if (!bus_addr)  /* need to map it */
-               bus_addr = pci_map_single(NULL, addr, size, dir);
+               bus_addr = pci_map_single(ppc64_isabridge_dev, addr, size, dir);
 
        /* remember this one as prev */
        prev_addr = addr;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-x86_64/cpufeature.h 
hg/linux-2.6.16.13-xen/include/asm-x86_64/cpufeature.h
--- linux/linux-2.6-xen.hg/include/asm-x86_64/cpufeature.h      2006-03-07 
23:13:32.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-x86_64/cpufeature.h      2006-05-03 
00:38:44.000000000 +0300
@@ -64,6 +64,7 @@
 #define X86_FEATURE_REP_GOOD   (3*32+ 4) /* rep microcode works well on this 
CPU */
 #define X86_FEATURE_CONSTANT_TSC (3*32+5) /* TSC runs at constant rate */
 #define X86_FEATURE_SYNC_RDTSC  (3*32+6)  /* RDTSC syncs CPU core */
+#define X86_FEATURE_FXSAVE_LEAK (3*32+7)  /* FIP/FOP/FDP leaks through FXSAVE 
*/
 
 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
 #define X86_FEATURE_XMM3       (4*32+ 0) /* Streaming SIMD Extensions-3 */
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/asm-x86_64/i387.h 
hg/linux-2.6.16.13-xen/include/asm-x86_64/i387.h
--- linux/linux-2.6-xen.hg/include/asm-x86_64/i387.h    2006-03-07 
23:13:32.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/asm-x86_64/i387.h    2006-05-03 
00:38:44.000000000 +0300
@@ -72,6 +72,23 @@ extern int set_fpregs(struct task_struct
 #define set_fpu_swd(t,val) ((t)->thread.i387.fxsave.swd = (val))
 #define set_fpu_fxsr_twd(t,val) ((t)->thread.i387.fxsave.twd = (val))
 
+#define X87_FSW_ES (1 << 7)    /* Exception Summary */
+
+/* AMD CPUs don't save/restore FDP/FIP/FOP unless an exception
+   is pending. Clear the x87 state here by setting it to fixed
+   values. The kernel data segment can be sometimes 0 and sometimes
+   new user value. Both should be ok.
+   Use the PDA as safe address because it should be already in L1. */
+static inline void clear_fpu_state(struct i387_fxsave_struct *fx)
+{
+       if (unlikely(fx->swd & X87_FSW_ES))
+                asm volatile("fnclex");
+       alternative_input(ASM_NOP8 ASM_NOP2,
+                    "    emms\n"               /* clear stack tags */
+                    "    fildl %%gs:0",        /* load to clear state */
+                    X86_FEATURE_FXSAVE_LEAK);
+}
+
 static inline int restore_fpu_checking(struct i387_fxsave_struct *fx) 
 { 
        int err;
@@ -119,6 +136,7 @@ static inline int save_i387_checking(str
 #endif
        if (unlikely(err))
                __clear_user(fx, sizeof(struct i387_fxsave_struct));
+       /* No need to clear here because the caller clears USED_MATH */
        return err;
 } 
 
@@ -149,7 +167,7 @@ static inline void __fxsave_clear(struct
                                "i" (offsetof(__typeof__(*tsk),
                                              thread.i387.fxsave)));
 #endif
-       __asm__ __volatile__("fnclex");
+       clear_fpu_state(&tsk->thread.i387.fxsave);
 }
 
 static inline void kernel_fpu_begin(void)
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/include/linux/cpu.h 
hg/linux-2.6.16.13-xen/include/linux/cpu.h
--- linux/linux-2.6-xen.hg/include/linux/cpu.h  2006-03-07 23:13:34.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/include/linux/cpu.h  2006-05-03 00:38:44.000000000 
+0300
@@ -32,7 +32,7 @@ struct cpu {
 };
 
 extern int register_cpu(struct cpu *, int, struct node *);
-extern struct sys_device *get_cpu_sysdev(int cpu);
+extern struct sys_device *get_cpu_sysdev(unsigned cpu);
 #ifdef CONFIG_HOTPLUG_CPU
 extern void unregister_cpu(struct cpu *, struct node *);
 #endif
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/include/linux/fb.h 
hg/linux-2.6.16.13-xen/include/linux/fb.h
--- linux/linux-2.6-xen.hg/include/linux/fb.h   2006-03-07 23:13:36.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/include/linux/fb.h   2006-05-03 00:38:44.000000000 
+0300
@@ -839,12 +839,10 @@ struct fb_info {
 #define FB_LEFT_POS(bpp)          (32 - bpp)
 #define FB_SHIFT_HIGH(val, bits)  ((val) >> (bits))
 #define FB_SHIFT_LOW(val, bits)   ((val) << (bits))
-#define FB_BIT_NR(b)              (7 - (b))
 #else
 #define FB_LEFT_POS(bpp)          (0)
 #define FB_SHIFT_HIGH(val, bits)  ((val) << (bits))
 #define FB_SHIFT_LOW(val, bits)   ((val) >> (bits))
-#define FB_BIT_NR(b)              (b)
 #endif
 
     /*
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/include/linux/fs.h 
hg/linux-2.6.16.13-xen/include/linux/fs.h
--- linux/linux-2.6-xen.hg/include/linux/fs.h   2006-03-19 14:08:32.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/include/linux/fs.h   2006-05-03 00:38:44.000000000 
+0300
@@ -1383,6 +1383,7 @@ extern int bd_claim(struct block_device 
 extern void bd_release(struct block_device *);
 
 /* fs/char_dev.c */
+#define CHRDEV_MAJOR_HASH_SIZE 255
 extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
 extern int register_chrdev_region(dev_t, unsigned, const char *);
 extern int register_chrdev(unsigned int, const char *,
@@ -1390,25 +1391,17 @@ extern int register_chrdev(unsigned int,
 extern int unregister_chrdev(unsigned int, const char *);
 extern void unregister_chrdev_region(dev_t, unsigned);
 extern int chrdev_open(struct inode *, struct file *);
-extern int get_chrdev_list(char *);
-extern void *acquire_chrdev_list(void);
-extern int count_chrdev_list(void);
-extern void *get_next_chrdev(void *);
-extern int get_chrdev_info(void *, int *, char **);
-extern void release_chrdev_list(void *);
+extern void chrdev_show(struct seq_file *,off_t);
 
 /* fs/block_dev.c */
+#define BLKDEV_MAJOR_HASH_SIZE 255
 #define BDEVNAME_SIZE  32      /* Largest string for a blockdev identifier */
 extern const char *__bdevname(dev_t, char *buffer);
 extern const char *bdevname(struct block_device *bdev, char *buffer);
 extern struct block_device *lookup_bdev(const char *);
 extern struct block_device *open_bdev_excl(const char *, int, void *);
 extern void close_bdev_excl(struct block_device *);
-extern void *acquire_blkdev_list(void);
-extern int count_blkdev_list(void);
-extern void *get_next_blkdev(void *);
-extern int get_blkdev_info(void *, int *, char **);
-extern void release_blkdev_list(void *);
+extern void blkdev_show(struct seq_file *,off_t);
 
 extern void init_special_inode(struct inode *, umode_t, dev_t);
 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/include/linux/mm.h 
hg/linux-2.6.16.13-xen/include/linux/mm.h
--- linux/linux-2.6-xen.hg/include/linux/mm.h   2006-05-09 16:29:51.000000000 
+0300
+++ hg/linux-2.6.16.13-xen/include/linux/mm.h   2006-05-11 14:37:37.000000000 
+0300
@@ -232,10 +232,9 @@ struct page {
                unsigned long private;          /* Mapping-private opaque data:
                                                 * usually used for buffer_heads
                                                 * if PagePrivate set; used for
-                                                * swp_entry_t if PageSwapCache.
-                                                * When page is free, this
+                                                * swp_entry_t if PageSwapCache;
                                                 * indicates order in the buddy
-                                                * system.
+                                                * system if PG_buddy is set.
                                                 */
                struct address_space *mapping;  /* If low bit clear, points to
                                                 * inode address_space, or NULL.
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/linux/page-flags.h 
hg/linux-2.6.16.13-xen/include/linux/page-flags.h
--- linux/linux-2.6-xen.hg/include/linux/page-flags.h   2006-03-07 
23:13:44.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/linux/page-flags.h   2006-05-03 
00:38:44.000000000 +0300
@@ -74,7 +74,9 @@
 #define PG_mappedtodisk                16      /* Has blocks allocated on-disk 
*/
 #define PG_reclaim             17      /* To be reclaimed asap */
 #define PG_nosave_free         18      /* Free, should not be written */
-#define PG_uncached            19      /* Page has been mapped as uncached */
+#define PG_buddy               19      /* Page is free, on buddy lists */
+
+#define PG_uncached            20      /* Page has been mapped as uncached */
 
 /*
  * Global page accounting.  One instance per CPU.  Only unsigned longs are
@@ -319,6 +321,10 @@ extern void __mod_page_state_offset(unsi
 #define SetPageNosaveFree(page)        set_bit(PG_nosave_free, &(page)->flags)
 #define ClearPageNosaveFree(page)              clear_bit(PG_nosave_free, 
&(page)->flags)
 
+#define PageBuddy(page)                test_bit(PG_buddy, &(page)->flags)
+#define __SetPageBuddy(page)   __set_bit(PG_buddy, &(page)->flags)
+#define __ClearPageBuddy(page) __clear_bit(PG_buddy, &(page)->flags)
+
 #define PageMappedToDisk(page) test_bit(PG_mappedtodisk, &(page)->flags)
 #define SetPageMappedToDisk(page) set_bit(PG_mappedtodisk, &(page)->flags)
 #define ClearPageMappedToDisk(page) clear_bit(PG_mappedtodisk, &(page)->flags)
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/linux/proc_fs.h 
hg/linux-2.6.16.13-xen/include/linux/proc_fs.h
--- linux/linux-2.6-xen.hg/include/linux/proc_fs.h      2006-03-07 
23:13:44.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/linux/proc_fs.h      2006-05-03 
00:38:44.000000000 +0300
@@ -78,7 +78,7 @@ struct kcore_list {
 struct vmcore {
        struct list_head list;
        unsigned long long paddr;
-       unsigned long size;
+       unsigned long long size;
        loff_t offset;
 };
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/linux/raid/raid1.h 
hg/linux-2.6.16.13-xen/include/linux/raid/raid1.h
--- linux/linux-2.6-xen.hg/include/linux/raid/raid1.h   2006-03-07 
23:13:45.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/linux/raid/raid1.h   2006-05-03 
00:38:44.000000000 +0300
@@ -130,6 +130,6 @@ struct r1bio_s {
  * with failure when last write completes (and all failed).
  * Record that bi_end_io was called with this flag...
  */
-#define        R1BIO_Returned 4
+#define        R1BIO_Returned 6
 
 #endif
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/include/linux/rtc.h 
hg/linux-2.6.16.13-xen/include/linux/rtc.h
--- linux/linux-2.6-xen.hg/include/linux/rtc.h  2006-03-07 23:13:45.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/include/linux/rtc.h  2006-05-03 00:38:44.000000000 
+0300
@@ -11,8 +11,6 @@
 #ifndef _LINUX_RTC_H_
 #define _LINUX_RTC_H_
 
-#include <linux/interrupt.h>
-
 /*
  * The struct used to pass data via the following ioctl. Similar to the
  * struct tm in <time.h>, but it needs to be here so that the kernel 
@@ -95,6 +93,8 @@ struct rtc_pll_info {
 
 #ifdef __KERNEL__
 
+#include <linux/interrupt.h>
+
 typedef struct rtc_task {
        void (*func)(void *private_data);
        void *private_data;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/include/xen/interface/COPYING 
hg/linux-2.6.16.13-xen/include/xen/interface/COPYING
--- linux/linux-2.6-xen.hg/include/xen/interface/COPYING        1970-01-01 
02:00:00.000000000 +0200
+++ hg/linux-2.6.16.13-xen/include/xen/interface/COPYING        2006-05-11 
14:37:42.000000000 +0300
@@ -0,0 +1,28 @@
+XEN NOTICE
+==========
+
+This copyright applies to all files within this subdirectory. All
+other files in the Xen source distribution are covered by version 2 of
+the GNU General Public License.
+
+ -- Keir Fraser (on behalf of the Xen team)
+
+=====================================================================
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 
+DEALINGS IN THE SOFTWARE.
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/ipc/shm.c 
hg/linux-2.6.16.13-xen/ipc/shm.c
--- linux/linux-2.6-xen.hg/ipc/shm.c    2006-03-07 23:13:52.000000000 +0200
+++ hg/linux-2.6.16.13-xen/ipc/shm.c    2006-05-03 00:38:44.000000000 +0300
@@ -161,6 +161,8 @@ static int shm_mmap(struct file * file, 
        ret = shmem_mmap(file, vma);
        if (ret == 0) {
                vma->vm_ops = &shm_vm_ops;
+               if (!(vma->vm_flags & VM_WRITE))
+                       vma->vm_flags &= ~VM_MAYWRITE;
                shm_inc(file->f_dentry->d_inode->i_ino);
        }
 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/ipc/util.c 
hg/linux-2.6.16.13-xen/ipc/util.c
--- linux/linux-2.6-xen.hg/ipc/util.c   2006-03-07 23:13:52.000000000 +0200
+++ hg/linux-2.6.16.13-xen/ipc/util.c   2006-05-03 00:38:44.000000000 +0300
@@ -182,8 +182,7 @@ static int grow_ary(struct ipc_ids* ids,
        if(new == NULL)
                return size;
        new->size = newsize;
-       memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size +
-                                       sizeof(struct ipc_id_ary));
+       memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size);
        for(i=size;i<newsize;i++) {
                new->p[i] = NULL;
        }
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/kernel/auditsc.c 
hg/linux-2.6.16.13-xen/kernel/auditsc.c
--- linux/linux-2.6-xen.hg/kernel/auditsc.c     2006-03-07 23:13:52.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/kernel/auditsc.c     2006-05-03 00:38:44.000000000 
+0300
@@ -966,11 +966,6 @@ void audit_syscall_entry(struct task_str
        if (context->in_syscall) {
                struct audit_context *newctx;
 
-#if defined(__NR_vm86) && defined(__NR_vm86old)
-               /* vm86 mode should only be entered once */
-               if (major == __NR_vm86 || major == __NR_vm86old)
-                       return;
-#endif
 #if AUDIT_DEBUG
                printk(KERN_ERR
                       "audit(:%d) pid=%d in syscall=%d;"
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/kernel/exec_domain.c 
hg/linux-2.6.16.13-xen/kernel/exec_domain.c
--- linux/linux-2.6-xen.hg/kernel/exec_domain.c 2006-03-07 23:13:52.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/kernel/exec_domain.c 2006-05-03 00:38:44.000000000 
+0300
@@ -140,6 +140,7 @@ __set_personality(u_long personality)
        ep = lookup_exec_domain(personality);
        if (ep == current_thread_info()->exec_domain) {
                current->personality = personality;
+               module_put(ep->module);
                return 0;
        }
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/kernel/power/process.c 
hg/linux-2.6.16.13-xen/kernel/power/process.c
--- linux/linux-2.6-xen.hg/kernel/power/process.c       2006-03-07 
23:13:53.000000000 +0200
+++ hg/linux-2.6.16.13-xen/kernel/power/process.c       2006-05-03 
00:38:44.000000000 +0300
@@ -25,8 +25,7 @@ static inline int freezeable(struct task
            (p->flags & PF_NOFREEZE) ||
            (p->exit_state == EXIT_ZOMBIE) ||
            (p->exit_state == EXIT_DEAD) ||
-           (p->state == TASK_STOPPED) ||
-           (p->state == TASK_TRACED))
+           (p->state == TASK_STOPPED))
                return 0;
        return 1;
 }
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/kernel/ptrace.c 
hg/linux-2.6.16.13-xen/kernel/ptrace.c
--- linux/linux-2.6-xen.hg/kernel/ptrace.c      2006-03-07 23:13:53.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/kernel/ptrace.c      2006-05-03 00:38:44.000000000 
+0300
@@ -57,10 +57,6 @@ void ptrace_untrace(task_t *child)
                        signal_wake_up(child, 1);
                }
        }
-       if (child->signal->flags & SIGNAL_GROUP_EXIT) {
-               sigaddset(&child->pending.signal, SIGKILL);
-               signal_wake_up(child, 1);
-       }
        spin_unlock(&child->sighand->siglock);
 }
 
@@ -82,7 +78,8 @@ void __ptrace_unlink(task_t *child)
                SET_LINKS(child);
        }
 
-       ptrace_untrace(child);
+       if (child->state == TASK_TRACED)
+               ptrace_untrace(child);
 }
 
 /*
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/kernel/sched.c 
hg/linux-2.6.16.13-xen/kernel/sched.c
--- linux/linux-2.6-xen.hg/kernel/sched.c       2006-03-19 14:08:32.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/kernel/sched.c       2006-05-03 00:38:44.000000000 
+0300
@@ -237,6 +237,7 @@ struct runqueue {
 
        task_t *migration_thread;
        struct list_head migration_queue;
+       int cpu;
 #endif
 
 #ifdef CONFIG_SCHEDSTATS
@@ -1660,6 +1661,9 @@ unsigned long nr_iowait(void)
 /*
  * double_rq_lock - safely lock two runqueues
  *
+ * We must take them in cpu order to match code in
+ * dependent_sleeper and wake_dependent_sleeper.
+ *
  * Note this does not disable interrupts like task_rq_lock,
  * you need to do so manually before calling.
  */
@@ -1671,7 +1675,7 @@ static void double_rq_lock(runqueue_t *r
                spin_lock(&rq1->lock);
                __acquire(rq2->lock);   /* Fake it out ;) */
        } else {
-               if (rq1 < rq2) {
+               if (rq1->cpu < rq2->cpu) {
                        spin_lock(&rq1->lock);
                        spin_lock(&rq2->lock);
                } else {
@@ -1707,7 +1711,7 @@ static void double_lock_balance(runqueue
        __acquires(this_rq->lock)
 {
        if (unlikely(!spin_trylock(&busiest->lock))) {
-               if (busiest < this_rq) {
+               if (busiest->cpu < this_rq->cpu) {
                        spin_unlock(&this_rq->lock);
                        spin_lock(&busiest->lock);
                        spin_lock(&this_rq->lock);
@@ -6035,6 +6039,7 @@ void __init sched_init(void)
                rq->push_cpu = 0;
                rq->migration_thread = NULL;
                INIT_LIST_HEAD(&rq->migration_queue);
+               rq->cpu = i;
 #endif
                atomic_set(&rq->nr_iowait, 0);
 
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/kernel/signal.c 
hg/linux-2.6.16.13-xen/kernel/signal.c
--- linux/linux-2.6-xen.hg/kernel/signal.c      2006-03-07 23:13:53.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/kernel/signal.c      2006-05-03 00:38:44.000000000 
+0300
@@ -975,7 +975,6 @@ __group_complete_signal(int sig, struct 
                if (t == NULL)
                        /* restart balancing at this thread */
                        t = p->signal->curr_target = p;
-               BUG_ON(t->tgid != p->tgid);
 
                while (!wants_signal(sig, t)) {
                        t = next_thread(t);
@@ -1689,6 +1688,7 @@ static void ptrace_stop(int exit_code, i
        /* Let the debugger run.  */
        set_current_state(TASK_TRACED);
        spin_unlock_irq(&current->sighand->siglock);
+       try_to_freeze();
        read_lock(&tasklist_lock);
        if (likely(current->ptrace & PT_PTRACED) &&
            likely(current->parent != current->real_parent ||
@@ -1942,9 +1942,9 @@ relock:
                        /* Let the debugger run.  */
                        ptrace_stop(signr, signr, info);
 
-                       /* We're back.  Did the debugger cancel the sig or 
group_exit? */
+                       /* We're back.  Did the debugger cancel the sig?  */
                        signr = current->exit_code;
-                       if (signr == 0 || current->signal->flags & 
SIGNAL_GROUP_EXIT)
+                       if (signr == 0)
                                continue;
 
                        current->exit_code = 0;
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/kernel/sys.c 
hg/linux-2.6.16.13-xen/kernel/sys.c
--- linux/linux-2.6-xen.hg/kernel/sys.c 2006-03-07 23:13:53.000000000 +0200
+++ hg/linux-2.6.16.13-xen/kernel/sys.c 2006-05-03 00:38:44.000000000 +0300
@@ -1657,7 +1657,19 @@ asmlinkage long sys_setrlimit(unsigned i
            (cputime_eq(current->signal->it_prof_expires, cputime_zero) ||
             new_rlim.rlim_cur <= cputime_to_secs(
                     current->signal->it_prof_expires))) {
-               cputime_t cputime = secs_to_cputime(new_rlim.rlim_cur);
+               unsigned long rlim_cur = new_rlim.rlim_cur;
+               cputime_t cputime;
+
+               if (rlim_cur == 0) {
+                       /*
+                        * The caller is asking for an immediate RLIMIT_CPU
+                        * expiry.  But we use the zero value to mean "it was
+                        * never set".  So let's cheat and make it one second
+                        * instead
+                        */
+                       rlim_cur = 1;
+               }
+               cputime = secs_to_cputime(rlim_cur);
                read_lock(&tasklist_lock);
                spin_lock_irq(&current->sighand->siglock);
                set_process_cpu_timer(current, CPUCLOCK_PROF,
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/kernel/uid16.c 
hg/linux-2.6.16.13-xen/kernel/uid16.c
--- linux/linux-2.6-xen.hg/kernel/uid16.c       2006-03-07 23:13:53.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/kernel/uid16.c       2006-05-03 00:38:44.000000000 
+0300
@@ -20,43 +20,67 @@
 
 asmlinkage long sys_chown16(const char __user * filename, old_uid_t user, 
old_gid_t group)
 {
-       return sys_chown(filename, low2highuid(user), low2highgid(group));
+       long ret = sys_chown(filename, low2highuid(user), low2highgid(group));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_lchown16(const char __user * filename, old_uid_t user, 
old_gid_t group)
 {
-       return sys_lchown(filename, low2highuid(user), low2highgid(group));
+       long ret = sys_lchown(filename, low2highuid(user), low2highgid(group));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_fchown16(unsigned int fd, old_uid_t user, old_gid_t group)
 {
-       return sys_fchown(fd, low2highuid(user), low2highgid(group));
+       long ret = sys_fchown(fd, low2highuid(user), low2highgid(group));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_setregid16(old_gid_t rgid, old_gid_t egid)
 {
-       return sys_setregid(low2highgid(rgid), low2highgid(egid));
+       long ret = sys_setregid(low2highgid(rgid), low2highgid(egid));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_setgid16(old_gid_t gid)
 {
-       return sys_setgid(low2highgid(gid));
+       long ret = sys_setgid(low2highgid(gid));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_setreuid16(old_uid_t ruid, old_uid_t euid)
 {
-       return sys_setreuid(low2highuid(ruid), low2highuid(euid));
+       long ret = sys_setreuid(low2highuid(ruid), low2highuid(euid));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_setuid16(old_uid_t uid)
 {
-       return sys_setuid(low2highuid(uid));
+       long ret = sys_setuid(low2highuid(uid));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_setresuid16(old_uid_t ruid, old_uid_t euid, old_uid_t suid)
 {
-       return sys_setresuid(low2highuid(ruid), low2highuid(euid),
-               low2highuid(suid));
+       long ret = sys_setresuid(low2highuid(ruid), low2highuid(euid),
+                                low2highuid(suid));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_getresuid16(old_uid_t __user *ruid, old_uid_t __user 
*euid, old_uid_t __user *suid)
@@ -72,8 +96,11 @@ asmlinkage long sys_getresuid16(old_uid_
 
 asmlinkage long sys_setresgid16(old_gid_t rgid, old_gid_t egid, old_gid_t sgid)
 {
-       return sys_setresgid(low2highgid(rgid), low2highgid(egid),
-               low2highgid(sgid));
+       long ret = sys_setresgid(low2highgid(rgid), low2highgid(egid),
+                                low2highgid(sgid));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_getresgid16(old_gid_t __user *rgid, old_gid_t __user 
*egid, old_gid_t __user *sgid)
@@ -89,12 +116,18 @@ asmlinkage long sys_getresgid16(old_gid_
 
 asmlinkage long sys_setfsuid16(old_uid_t uid)
 {
-       return sys_setfsuid(low2highuid(uid));
+       long ret = sys_setfsuid(low2highuid(uid));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 asmlinkage long sys_setfsgid16(old_gid_t gid)
 {
-       return sys_setfsgid(low2highgid(gid));
+       long ret = sys_setfsgid(low2highgid(gid));
+       /* avoid REGPARM breakage on x86: */
+       prevent_tail_call(ret);
+       return ret;
 }
 
 static int groups16_to_user(old_gid_t __user *grouplist,
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/Makefile 
hg/linux-2.6.16.13-xen/Makefile
--- linux/linux-2.6-xen.hg/Makefile     2006-03-22 18:36:06.000000000 +0200
+++ hg/linux-2.6.16.13-xen/Makefile     2006-07-31 10:27:33.000000000 +0300
@@ -1,7 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 16
-EXTRAVERSION =
+EXTRAVERSION = .13$(XENGUEST)
+XENGUEST = -xen
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/mm/madvise.c 
hg/linux-2.6.16.13-xen/mm/madvise.c
--- linux/linux-2.6-xen.hg/mm/madvise.c 2006-03-07 23:13:53.000000000 +0200
+++ hg/linux-2.6.16.13-xen/mm/madvise.c 2006-05-03 00:38:44.000000000 +0300
@@ -168,6 +168,9 @@ static long madvise_remove(struct vm_are
                        return -EINVAL;
        }
 
+       if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
+               return -EACCES;
+
        mapping = vma->vm_file->f_mapping;
 
        offset = (loff_t)(start - vma->vm_start)
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/mm/page_alloc.c 
hg/linux-2.6.16.13-xen/mm/page_alloc.c
--- linux/linux-2.6-xen.hg/mm/page_alloc.c      2006-03-19 14:08:32.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/mm/page_alloc.c      2006-05-11 14:37:37.000000000 
+0300
@@ -153,7 +153,8 @@ static void bad_page(struct page *page)
                        1 << PG_reclaim |
                        1 << PG_slab    |
                        1 << PG_swapcache |
-                       1 << PG_writeback );
+                       1 << PG_writeback |
+                       1 << PG_buddy );
        set_page_count(page, 0);
        reset_page_mapcount(page);
        page->mapping = NULL;
@@ -224,12 +225,12 @@ static inline unsigned long page_order(s
 
 static inline void set_page_order(struct page *page, int order) {
        set_page_private(page, order);
-       __SetPagePrivate(page);
+       __SetPageBuddy(page);
 }
 
 static inline void rmv_page_order(struct page *page)
 {
-       __ClearPagePrivate(page);
+       __ClearPageBuddy(page);
        set_page_private(page, 0);
 }
 
@@ -268,11 +269,13 @@ __find_combined_index(unsigned long page
  * This function checks whether a page is free && is the buddy
  * we can do coalesce a page and its buddy if
  * (a) the buddy is not in a hole &&
- * (b) the buddy is free &&
- * (c) the buddy is on the buddy system &&
- * (d) a page and its buddy have the same order.
- * for recording page's order, we use page_private(page) and PG_private.
+ * (b) the buddy is in the buddy system &&
+ * (c) a page and its buddy have the same order.
+ *
+ * For recording whether a page is in the buddy system, we use PG_buddy.
+ * Setting, clearing, and testing PG_buddy is serialized by zone->lock.
  *
+ * For recording page's order, we use page_private(page).
  */
 static inline int page_is_buddy(struct page *page, int order)
 {
@@ -281,10 +284,10 @@ static inline int page_is_buddy(struct p
                return 0;
 #endif
 
-       if (PagePrivate(page)           &&
-           (page_order(page) == order) &&
-            page_count(page) == 0)
+       if (PageBuddy(page) && page_order(page) == order) {
+               BUG_ON(page_count(page) != 0);
                return 1;
+       }
        return 0;
 }
 
@@ -301,7 +304,7 @@ static inline int page_is_buddy(struct p
  * as necessary, plus some accounting needed to play nicely with other
  * parts of the VM system.
  * At each level, we keep a list of pages, which are heads of continuous
- * free pages of length of (1 << order) and marked with PG_Private.Page's
+ * free pages of length of (1 << order) and marked with PG_buddy. Page's
  * order is recorded in page_private(page) field.
  * So when we are allocating or freeing one, we can derive the state of the
  * other.  That is, if we allocate a small block, and both were   
@@ -364,7 +367,8 @@ static inline int free_pages_check(struc
                        1 << PG_slab    |
                        1 << PG_swapcache |
                        1 << PG_writeback |
-                       1 << PG_reserved ))))
+                       1 << PG_reserved |
+                       1 << PG_buddy ))))
                bad_page(page);
        if (PageDirty(page))
                __ClearPageDirty(page);
@@ -523,7 +527,8 @@ static int prep_new_page(struct page *pa
                        1 << PG_slab    |
                        1 << PG_swapcache |
                        1 << PG_writeback |
-                       1 << PG_reserved ))))
+                       1 << PG_reserved |
+                       1 << PG_buddy ))))
                bad_page(page);
 
        /*
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/net/atm/clip.c 
hg/linux-2.6.16.13-xen/net/atm/clip.c
--- linux/linux-2.6-xen.hg/net/atm/clip.c       2006-07-01 09:58:44.000000000 
+0300
+++ hg/linux-2.6.16.13-xen/net/atm/clip.c       2006-07-31 10:27:31.000000000 
+0300
@@ -613,12 +613,19 @@ static int clip_create(int number)
 
 
 static int clip_device_event(struct notifier_block *this,unsigned long event,
-    void *dev)
+                            void *arg)
 {
+       struct net_device *dev = arg;
+
+       if (event == NETDEV_UNREGISTER) {
+               neigh_ifdown(&clip_tbl, dev);
+               return NOTIFY_DONE;
+       }
+
        /* ignore non-CLIP devices */
-       if (((struct net_device *) dev)->type != ARPHRD_ATM ||
-           ((struct net_device *) dev)->hard_start_xmit != clip_start_xmit)
+       if (dev->type != ARPHRD_ATM || dev->hard_start_xmit != clip_start_xmit)
                return NOTIFY_DONE;
+
        switch (event) {
                case NETDEV_UP:
                        DPRINTK("clip_device_event NETDEV_UP\n");
@@ -686,14 +693,12 @@ static struct notifier_block clip_inet_n
 static void atmarpd_close(struct atm_vcc *vcc)
 {
        DPRINTK("atmarpd_close\n");
-       atmarpd = NULL; /* assumed to be atomic */
-       barrier();
-       unregister_inetaddr_notifier(&clip_inet_notifier);
-       unregister_netdevice_notifier(&clip_dev_notifier);
-       if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
-               printk(KERN_ERR "atmarpd_close: closing with requests "
-                   "pending\n");
+
+       rtnl_lock();
+       atmarpd = NULL;
        skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);
+       rtnl_unlock();
+
        DPRINTK("(done)\n");
        module_put(THIS_MODULE);
 }
@@ -714,7 +719,12 @@ static struct atm_dev atmarpd_dev = {
 
 static int atm_init_atmarp(struct atm_vcc *vcc)
 {
-       if (atmarpd) return -EADDRINUSE;
+       rtnl_lock();
+       if (atmarpd) {
+               rtnl_unlock();
+               return -EADDRINUSE;
+       }
+
        if (start_timer) {
                start_timer = 0;
                init_timer(&idle_timer);
@@ -731,10 +741,7 @@ static int atm_init_atmarp(struct atm_vc
        vcc->push = NULL;
        vcc->pop = NULL; /* crash */
        vcc->push_oam = NULL; /* crash */
-       if (register_netdevice_notifier(&clip_dev_notifier))
-               printk(KERN_ERR "register_netdevice_notifier failed\n");
-       if (register_inetaddr_notifier(&clip_inet_notifier))
-               printk(KERN_ERR "register_inetaddr_notifier failed\n");
+       rtnl_unlock();
        return 0;
 }
 
@@ -992,6 +999,8 @@ static int __init atm_clip_init(void)
 
        clip_tbl_hook = &clip_tbl;
        register_atm_ioctl(&clip_ioctl_ops);
+       register_netdevice_notifier(&clip_dev_notifier);
+       register_inetaddr_notifier(&clip_inet_notifier);
 
 #ifdef CONFIG_PROC_FS
 {
@@ -1012,6 +1021,9 @@ static void __exit atm_clip_exit(void)
 
        remove_proc_entry("arp", atm_proc_root);
 
+       unregister_inetaddr_notifier(&clip_inet_notifier);
+       unregister_netdevice_notifier(&clip_dev_notifier);
+
        deregister_atm_ioctl(&clip_ioctl_ops);
 
        /* First, stop the idle timer, so it stops banging
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/net/core/dev.c 
hg/linux-2.6.16.13-xen/net/core/dev.c
--- linux/linux-2.6-xen.hg/net/core/dev.c       2006-07-01 09:58:44.000000000 
+0300
+++ hg/linux-2.6.16.13-xen/net/core/dev.c       2006-07-13 09:27:48.000000000 
+0300
@@ -1089,9 +1089,17 @@ int skb_checksum_help(struct sk_buff *sk
        unsigned int csum;
        int ret = 0, offset = skb->h.raw - skb->data;
 
-       if (inward) {
-               skb->ip_summed = CHECKSUM_NONE;
-               goto out;
+       if (inward)
+               goto out_set_summed;
+
+       if (unlikely(skb_shinfo(skb)->gso_size)) {
+               static int warned;
+
+               WARN_ON(!warned);
+               warned = 1;
+
+               /* Let GSO fix up the checksum. */
+               goto out_set_summed;
        }
 
        if (skb_cloned(skb)) {
@@ -1108,6 +1116,8 @@ int skb_checksum_help(struct sk_buff *sk
        BUG_ON(skb->csum + 2 > offset);
 
        *(u16*)(skb->h.raw + skb->csum) = csum_fold(csum);
+
+out_set_summed:
        skb->ip_summed = CHECKSUM_NONE;
 out:   
        return ret;
@@ -1128,17 +1138,35 @@ struct sk_buff *skb_gso_segment(struct s
        struct sk_buff *segs = ERR_PTR(-EPROTONOSUPPORT);
        struct packet_type *ptype;
        int type = skb->protocol;
+       int err;
 
        BUG_ON(skb_shinfo(skb)->frag_list);
-       BUG_ON(skb->ip_summed != CHECKSUM_HW);
 
        skb->mac.raw = skb->data;
        skb->mac_len = skb->nh.raw - skb->data;
        __skb_pull(skb, skb->mac_len);
 
+       if (unlikely(skb->ip_summed != CHECKSUM_HW)) {
+               static int warned;
+
+               WARN_ON(!warned);
+               warned = 1;
+
+               if (skb_header_cloned(skb) &&
+                   (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
+                       return ERR_PTR(err);
+       }
+
        rcu_read_lock();
        list_for_each_entry_rcu(ptype, &ptype_base[ntohs(type) & 15], list) {
                if (ptype->type == type && !ptype->dev && ptype->gso_segment) {
+                       if (unlikely(skb->ip_summed != CHECKSUM_HW)) {
+                               err = ptype->gso_send_check(skb);
+                               segs = ERR_PTR(err);
+                               if (err || skb_gso_ok(skb, features))
+                                       break;
+                               __skb_push(skb, skb->data - skb->nh.raw);
+                       }
                        segs = ptype->gso_segment(skb, features);
                        break;
                }
@@ -3067,11 +3095,11 @@ void netdev_run_todo(void)
 
                switch(dev->reg_state) {
                case NETREG_REGISTERING:
+                       dev->reg_state = NETREG_REGISTERED;
                        err = netdev_register_sysfs(dev);
                        if (err)
                                printk(KERN_ERR "%s: failed sysfs registration 
(%d)\n",
                                       dev->name, err);
-                       dev->reg_state = NETREG_REGISTERED;
                        break;
 
                case NETREG_UNREGISTERING:
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/net/core/sock.c 
hg/linux-2.6.16.13-xen/net/core/sock.c
--- linux/linux-2.6-xen.hg/net/core/sock.c      2006-03-07 23:13:55.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/net/core/sock.c      2006-05-03 00:38:44.000000000 
+0300
@@ -404,8 +404,9 @@ set_rcvbuf:
                        if (!valbool) {
                                sk->sk_bound_dev_if = 0;
                        } else {
-                               if (optlen > IFNAMSIZ) 
-                                       optlen = IFNAMSIZ; 
+                               if (optlen > IFNAMSIZ - 1)
+                                       optlen = IFNAMSIZ - 1;
+                               memset(devname, 0, sizeof(devname));
                                if (copy_from_user(devname, optval, optlen)) {
                                        ret = -EFAULT;
                                        break;
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/net/ipv4/fib_trie.c 
hg/linux-2.6.16.13-xen/net/ipv4/fib_trie.c
--- linux/linux-2.6-xen.hg/net/ipv4/fib_trie.c  2006-03-07 23:13:56.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/net/ipv4/fib_trie.c  2006-05-03 00:38:44.000000000 
+0300
@@ -314,11 +314,6 @@ static void __leaf_free_rcu(struct rcu_h
        kfree(container_of(head, struct leaf, rcu));
 }
 
-static inline void free_leaf(struct leaf *leaf)
-{
-       call_rcu(&leaf->rcu, __leaf_free_rcu);
-}
-
 static void __leaf_info_free_rcu(struct rcu_head *head)
 {
        kfree(container_of(head, struct leaf_info, rcu));
@@ -357,7 +352,12 @@ static void __tnode_free_rcu(struct rcu_
 
 static inline void tnode_free(struct tnode *tn)
 {
-       call_rcu(&tn->rcu, __tnode_free_rcu);
+       if(IS_LEAF(tn)) {
+               struct leaf *l = (struct leaf *) tn;
+               call_rcu_bh(&l->rcu, __leaf_free_rcu);
+       }
+        else
+               call_rcu(&tn->rcu, __tnode_free_rcu);
 }
 
 static struct leaf *leaf_new(void)
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/net/ipv4/ip_output.c 
hg/linux-2.6.16.13-xen/net/ipv4/ip_output.c
--- linux/linux-2.6-xen.hg/net/ipv4/ip_output.c 2006-07-16 11:40:53.000000000 
+0300
+++ hg/linux-2.6.16.13-xen/net/ipv4/ip_output.c 2006-07-31 10:27:31.000000000 
+0300
@@ -1251,11 +1251,7 @@ int ip_push_pending_frames(struct sock *
        iph->tos = inet->tos;
        iph->tot_len = htons(skb->len);
        iph->frag_off = df;
-       if (!df) {
-               __ip_select_ident(iph, &rt->u.dst, 0);
-       } else {
-               iph->id = htons(inet->id++);
-       }
+       ip_select_ident(iph, &rt->u.dst, sk);
        iph->ttl = ttl;
        iph->protocol = sk->sk_protocol;
        iph->saddr = rt->rt_src;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/net/ipv4/netfilter/ip_conntrack_netlink.c 
hg/linux-2.6.16.13-xen/net/ipv4/netfilter/ip_conntrack_netlink.c
--- linux/linux-2.6-xen.hg/net/ipv4/netfilter/ip_conntrack_netlink.c    
2006-03-07 23:13:57.000000000 +0200
+++ hg/linux-2.6.16.13-xen/net/ipv4/netfilter/ip_conntrack_netlink.c    
2006-05-03 00:38:44.000000000 +0300
@@ -1619,7 +1619,7 @@ static void __exit ctnetlink_exit(void)
        printk("ctnetlink: unregistering from nfnetlink.\n");
 
 #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-       ip_conntrack_unregister_notifier(&ctnl_notifier_exp);
+       ip_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
        ip_conntrack_unregister_notifier(&ctnl_notifier);
 #endif
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/net/ipv4/netfilter/ip_conntrack_proto_sctp.c 
hg/linux-2.6.16.13-xen/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
--- linux/linux-2.6-xen.hg/net/ipv4/netfilter/ip_conntrack_proto_sctp.c 
2006-03-07 23:13:57.000000000 +0200
+++ hg/linux-2.6.16.13-xen/net/ipv4/netfilter/ip_conntrack_proto_sctp.c 
2006-05-03 00:38:44.000000000 +0300
@@ -235,12 +235,15 @@ static int do_basic_checks(struct ip_con
                        flag = 1;
                }
 
-               /* Cookie Ack/Echo chunks not the first OR 
-                  Init / Init Ack / Shutdown compl chunks not the only chunks 
*/
-               if ((sch->type == SCTP_CID_COOKIE_ACK 
+               /*
+                * Cookie Ack/Echo chunks not the first OR
+                * Init / Init Ack / Shutdown compl chunks not the only chunks
+                * OR zero-length.
+                */
+               if (((sch->type == SCTP_CID_COOKIE_ACK
                        || sch->type == SCTP_CID_COOKIE_ECHO
                        || flag)
-                    && count !=0 ) {
+                     && count !=0) || !sch->length) {
                        DEBUGP("Basic checks failed\n");
                        return 1;
                }
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/net/ipv4/route.c 
hg/linux-2.6.16.13-xen/net/ipv4/route.c
--- linux/linux-2.6-xen.hg/net/ipv4/route.c     2006-03-07 23:13:57.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/net/ipv4/route.c     2006-05-03 00:38:44.000000000 
+0300
@@ -2750,7 +2750,10 @@ int inet_rtm_getroute(struct sk_buff *in
        /* Reserve room for dummy headers, this skb can pass
           through good chunk of routing engine.
         */
-       skb->mac.raw = skb->data;
+       skb->mac.raw = skb->nh.raw = skb->data;
+
+       /* Bugfix: need to give ip_route_input enough of an IP header to not 
gag. */
+       skb->nh.iph->protocol = IPPROTO_ICMP;
        skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
 
        if (rta[RTA_SRC - 1])
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/net/ipv4/tcp_output.c 
hg/linux-2.6.16.13-xen/net/ipv4/tcp_output.c
--- linux/linux-2.6-xen.hg/net/ipv4/tcp_output.c        2006-07-01 
09:58:45.000000000 +0300
+++ hg/linux-2.6.16.13-xen/net/ipv4/tcp_output.c        2006-07-31 
10:27:31.000000000 +0300
@@ -539,7 +539,9 @@ int tcp_fragment(struct sock *sk, struct
        buff = sk_stream_alloc_skb(sk, nsize, GFP_ATOMIC);
        if (buff == NULL)
                return -ENOMEM; /* We'll just try again later. */
-       sk_charge_skb(sk, buff);
+
+       buff->truesize = skb->len - len;
+       skb->truesize -= buff->truesize;
 
        /* Correct the sequence numbers. */
        TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/net/ipv6/exthdrs.c 
hg/linux-2.6.16.13-xen/net/ipv6/exthdrs.c
--- linux/linux-2.6-xen.hg/net/ipv6/exthdrs.c   2006-03-07 23:13:58.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/net/ipv6/exthdrs.c   2006-05-03 00:38:44.000000000 
+0300
@@ -489,6 +489,18 @@ int ipv6_parse_hopopts(struct sk_buff *s
 {
        struct inet6_skb_parm *opt = IP6CB(skb);
 
+       /*
+        * skb->nh.raw is equal to skb->data, and
+        * skb->h.raw - skb->nh.raw is always equal to
+        * sizeof(struct ipv6hdr) by definition of
+        * hop-by-hop options.
+        */
+       if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
+           !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) 
<< 3))) {
+               kfree_skb(skb);
+               return -1;
+       }
+
        opt->hop = sizeof(struct ipv6hdr);
        if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
                skb->h.raw += (skb->h.raw[1]+1)<<3;
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/net/ipv6/xfrm6_policy.c 
hg/linux-2.6.16.13-xen/net/ipv6/xfrm6_policy.c
--- linux/linux-2.6-xen.hg/net/ipv6/xfrm6_policy.c      2006-03-07 
23:13:58.000000000 +0200
+++ hg/linux-2.6.16.13-xen/net/ipv6/xfrm6_policy.c      2006-05-03 
00:38:44.000000000 +0300
@@ -191,16 +191,18 @@ error:
 static inline void
 _decode_session6(struct sk_buff *skb, struct flowi *fl)
 {
-       u16 offset = sizeof(struct ipv6hdr);
+       u16 offset = skb->h.raw - skb->nh.raw;
        struct ipv6hdr *hdr = skb->nh.ipv6h;
-       struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + 
offset);
-       u8 nexthdr = skb->nh.ipv6h->nexthdr;
+       struct ipv6_opt_hdr *exthdr;
+       u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
 
        memset(fl, 0, sizeof(struct flowi));
        ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
        ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
 
        while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
+               exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+
                switch (nexthdr) {
                case NEXTHDR_ROUTING:
                case NEXTHDR_HOP:
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/net/netfilter/nf_conntrack_netlink.c 
hg/linux-2.6.16.13-xen/net/netfilter/nf_conntrack_netlink.c
--- linux/linux-2.6-xen.hg/net/netfilter/nf_conntrack_netlink.c 2006-03-07 
23:13:59.000000000 +0200
+++ hg/linux-2.6.16.13-xen/net/netfilter/nf_conntrack_netlink.c 2006-05-03 
00:38:44.000000000 +0300
@@ -1641,7 +1641,7 @@ static void __exit ctnetlink_exit(void)
        printk("ctnetlink: unregistering from nfnetlink.\n");
 
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
-       nf_conntrack_unregister_notifier(&ctnl_notifier_exp);
+       nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
        nf_conntrack_unregister_notifier(&ctnl_notifier);
 #endif
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/net/netfilter/nf_conntrack_proto_sctp.c 
hg/linux-2.6.16.13-xen/net/netfilter/nf_conntrack_proto_sctp.c
--- linux/linux-2.6-xen.hg/net/netfilter/nf_conntrack_proto_sctp.c      
2006-03-07 23:13:59.000000000 +0200
+++ hg/linux-2.6.16.13-xen/net/netfilter/nf_conntrack_proto_sctp.c      
2006-05-03 00:38:44.000000000 +0300
@@ -240,12 +240,15 @@ static int do_basic_checks(struct nf_con
                        flag = 1;
                }
 
-               /* Cookie Ack/Echo chunks not the first OR 
-                  Init / Init Ack / Shutdown compl chunks not the only chunks 
*/
-               if ((sch->type == SCTP_CID_COOKIE_ACK 
+               /*
+                * Cookie Ack/Echo chunks not the first OR
+                * Init / Init Ack / Shutdown compl chunks not the only chunks
+                * OR zero-length.
+                */
+               if (((sch->type == SCTP_CID_COOKIE_ACK
                        || sch->type == SCTP_CID_COOKIE_ECHO
                        || flag)
-                    && count !=0 ) {
+                     && count !=0) || !sch->length) {
                        DEBUGP("Basic checks failed\n");
                        return 1;
                }
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/security/keys/key.c 
hg/linux-2.6.16.13-xen/security/keys/key.c
--- linux/linux-2.6-xen.hg/security/keys/key.c  2006-03-07 23:14:04.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/security/keys/key.c  2006-05-03 00:38:44.000000000 
+0300
@@ -785,6 +785,10 @@ key_ref_t key_create_or_update(key_ref_t
 
        key_check(keyring);
 
+       key_ref = ERR_PTR(-ENOTDIR);
+       if (keyring->type != &key_type_keyring)
+               goto error_2;
+
        down_write(&keyring->sem);
 
        /* if we're going to allocate a new key, we're going to have
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/security/keys/keyring.c 
hg/linux-2.6.16.13-xen/security/keys/keyring.c
--- linux/linux-2.6-xen.hg/security/keys/keyring.c      2006-03-07 
23:14:04.000000000 +0200
+++ hg/linux-2.6.16.13-xen/security/keys/keyring.c      2006-05-03 
00:38:44.000000000 +0300
@@ -437,6 +437,7 @@ EXPORT_SYMBOL(keyring_search);
 /*
  * search the given keyring only (no recursion)
  * - keyring must be locked by caller
+ * - caller must guarantee that the keyring is a keyring
  */
 key_ref_t __keyring_search_one(key_ref_t keyring_ref,
                               const struct key_type *ktype,
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/security/selinux/ss/mls.c 
hg/linux-2.6.16.13-xen/security/selinux/ss/mls.c
--- linux/linux-2.6-xen.hg/security/selinux/ss/mls.c    2006-03-07 
23:14:04.000000000 +0200
+++ hg/linux-2.6.16.13-xen/security/selinux/ss/mls.c    2006-05-03 
00:38:44.000000000 +0300
@@ -264,7 +264,7 @@ int mls_context_to_sid(char oldc,
 
        if (!selinux_mls_enabled) {
                if (def_sid != SECSID_NULL && oldc)
-                       *scontext += strlen(*scontext);
+                       *scontext += strlen(*scontext)+1;
                return 0;
        }
 
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/sound/isa/opti9xx/opti92x-ad1848.c 
hg/linux-2.6.16.13-xen/sound/isa/opti9xx/opti92x-ad1848.c
--- linux/linux-2.6-xen.hg/sound/isa/opti9xx/opti92x-ad1848.c   2006-03-07 
23:14:07.000000000 +0200
+++ hg/linux-2.6.16.13-xen/sound/isa/opti9xx/opti92x-ad1848.c   2006-05-03 
00:38:44.000000000 +0300
@@ -2088,9 +2088,11 @@ static int __init alsa_card_opti9xx_init
        int error;
        struct platform_device *device;
 
+#ifdef CONFIG_PNP
        pnp_register_card_driver(&opti9xx_pnpc_driver);
        if (snd_opti9xx_pnp_is_probed)
                return 0;
+#endif
        if (! is_isapnp_selected()) {
                error = platform_driver_register(&snd_opti9xx_driver);
                if (error < 0)
@@ -2102,7 +2104,9 @@ static int __init alsa_card_opti9xx_init
                }
                platform_driver_unregister(&snd_opti9xx_driver);
        }
+#ifdef CONFIG_PNP
        pnp_unregister_card_driver(&opti9xx_pnpc_driver);
+#endif
 #ifdef MODULE
        printk(KERN_ERR "no OPTi " CHIP_NAME " soundcard found\n");
 #endif
@@ -2115,7 +2119,9 @@ static void __exit alsa_card_opti9xx_exi
                platform_device_unregister(snd_opti9xx_platform_device);
                platform_driver_unregister(&snd_opti9xx_driver);
        }
+#ifdef CONFIG_PNP
        pnp_unregister_card_driver(&opti9xx_pnpc_driver);
+#endif
 }
 
 module_init(alsa_card_opti9xx_init)
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/sound/oss/dmasound/tas_common.c 
hg/linux-2.6.16.13-xen/sound/oss/dmasound/tas_common.c
--- linux/linux-2.6-xen.hg/sound/oss/dmasound/tas_common.c      2006-03-07 
23:14:08.000000000 +0200
+++ hg/linux-2.6.16.13-xen/sound/oss/dmasound/tas_common.c      2006-05-03 
00:38:44.000000000 +0300
@@ -195,8 +195,8 @@ tas_init(int driver_id, const char *driv
 
        printk(KERN_INFO "tas driver [%s])\n", driver_name);
 
-#ifndef CONFIG_I2C_KEYWEST
-       request_module("i2c-keywest");
+#ifndef CONFIG_I2C_POWERMAC
+       request_module("i2c-powermac");
 #endif
        tas_node = find_devices("deq");
        if (tas_node == NULL)
diff -Naurp -X /home/muli/w/dontdiff 
linux/linux-2.6-xen.hg/sound/pci/hda/patch_realtek.c 
hg/linux-2.6.16.13-xen/sound/pci/hda/patch_realtek.c
--- linux/linux-2.6-xen.hg/sound/pci/hda/patch_realtek.c        2006-03-07 
23:14:14.000000000 +0200
+++ hg/linux-2.6.16.13-xen/sound/pci/hda/patch_realtek.c        2006-05-03 
00:38:44.000000000 +0300
@@ -2948,6 +2948,8 @@ static struct hda_board_config alc260_cf
        { .modelname = "basic", .config = ALC260_BASIC },
        { .pci_subvendor = 0x104d, .pci_subdevice = 0x81bb,
          .config = ALC260_BASIC }, /* Sony VAIO */
+       { .pci_subvendor = 0x152d, .pci_subdevice = 0x0729,
+         .config = ALC260_BASIC }, /* CTL Travel Master U553W */
        { .modelname = "hp", .config = ALC260_HP },
        { .pci_subvendor = 0x103c, .pci_subdevice = 0x3010, .config = ALC260_HP 
},
        { .pci_subvendor = 0x103c, .pci_subdevice = 0x3011, .config = ALC260_HP 
},
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/sound/ppc/daca.c 
hg/linux-2.6.16.13-xen/sound/ppc/daca.c
--- linux/linux-2.6-xen.hg/sound/ppc/daca.c     2006-03-07 23:14:15.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/sound/ppc/daca.c     2006-05-03 00:38:44.000000000 
+0300
@@ -256,7 +256,7 @@ int __init snd_pmac_daca_init(struct snd
 
 #ifdef CONFIG_KMOD
        if (current->fs->root)
-               request_module("i2c-keywest");
+               request_module("i2c-powermac");
 #endif /* CONFIG_KMOD */       
 
        mix = kmalloc(sizeof(*mix), GFP_KERNEL);
diff -Naurp -X /home/muli/w/dontdiff linux/linux-2.6-xen.hg/sound/ppc/tumbler.c 
hg/linux-2.6.16.13-xen/sound/ppc/tumbler.c
--- linux/linux-2.6-xen.hg/sound/ppc/tumbler.c  2006-03-07 23:14:15.000000000 
+0200
+++ hg/linux-2.6.16.13-xen/sound/ppc/tumbler.c  2006-05-03 00:38:44.000000000 
+0300
@@ -1314,7 +1314,7 @@ int __init snd_pmac_tumbler_init(struct 
 
 #ifdef CONFIG_KMOD
        if (current->fs->root)
-               request_module("i2c-keywest");
+               request_module("i2c-powermac");
 #endif /* CONFIG_KMOD */       
 
        mix = kmalloc(sizeof(*mix), GFP_KERNEL);


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.