rpms/kernel-xen-2.6/devel linux-2.6-drm-git-i915-remove-priv-access.patch, NONE, 1.1.2.1 linux-2.6-drm-git-mm-revert-nopfn.patch, NONE, 1.1.2.1 linux-2.6-ia32-syscall-restart.patch, NONE, 1.1.2.1 linux-2.6-vio-modalias.patch, NONE, 1.1.2.1 linux-2.6-virtio_blk-fix-sysfs-bits.patch, NONE, 1.1.2.1 linux-2.6-wireless-pending-too.patch, NONE, 1.1.2.1 linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch.patch, NONE, 1.1.2.1 linux-2.6-xen-0002-squashfs-Fix-build-without-CONFIG_SMP.patch, NONE, 1.1.2.1 linux-2.6-xen-0003-xen-Make-hvc0-the-preferred-console-in-domU.patch, NONE, 1.1.2.1 linux-2.6-xen-0004-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch, NONE, 1.1.2.1 linux-2.6-xen-0005-fbdev-Make-deferred-I-O-work-as-advertized.patch, NONE, 1.1.2.1 linux-2.6-xen-0006-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch, NONE, 1.1.2.1 linux-2.6-xen-0007-xen-Module-autoprobing-support-for-frontend-drivers.patch, NONE, 1.1.2.1 linux-2.6-xen-0008-xen-Add-compatibility-aliases-for-frontend-drivers.patch, NONE, 1.1.2.1 linux-2.6-xen-0009-xen-dom0-Add-a-vmlinuz-target.patch, NONE, 1.1.2.1 linux-2.6-xen-0010-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch, NONE, 1.1.2.1 linux-2.6-xen-0011-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch, NONE, 1.1.2.1 patch-2.6.25-rc4.bz2.sign, NONE, 1.1.2.1 .cvsignore, 1.11.2.2, 1.11.2.3 .gitignore, 1.1.2.2, 1.1.2.3 Makefile, 1.2.6.4, 1.2.6.5 Makefile.config, 1.2.4.4, 1.2.4.5 config-generic, 1.2.4.2, 1.2.4.3 config-powerpc-generic, 1.2.4.2, 1.2.4.3 kernel.spec, 1.11.2.13, 1.11.2.14 linux-2.6-debug-taint-vm.patch, 1.3.8.2, 1.3.8.3 linux-2.6-firewire-git-pending.patch, 1.1.2.2, 1.1.2.3 linux-2.6-firewire-git-update.patch, 1.1.2.2, 1.1.2.3 linux-2.6-silence-noise.patch, 1.3.8.2, 1.3.8.3 linux-2.6-wireless-pending.patch, 1.1.2.2, 1.1.2.3 linux-2.6-wireless.patch, 1.2.8.2, 1.2.8.3 sources, 1.11.2.2, 1.11.2.3 upstream, 1.1.2.2, 1.1.2.3 linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch-from-kernel-2_6_25.patch, 1.1.2.1, NONE linux-2.6-xen-0002-x86-xen-Construct-e820-map-with-a-hole-between-640K.patch, 1.1.2.1, NONE linux-2.6-xen-0003-squashfs-Fix-build-without-CONFIG_SMP.patch, 1.1.2.1, NONE linux-2.6-xen-0004-xen-Make-hvc0-the-preferred-console-in-domU.patch, 1.1.2.1, NONE linux-2.6-xen-0005-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch, 1.1.2.1, NONE linux-2.6-xen-0006-fbdev-Make-deferred-I-O-work-as-advertized.patch, 1.1.2.1, NONE linux-2.6-xen-0007-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch, 1.1.2.1, NONE linux-2.6-xen-0008-xen-Module-autoprobing-support-for-frontend-drivers.patch, 1.1.2.1, NONE linux-2.6-xen-0009-xen-Add-compatibility-aliases-for-frontend-drivers.patch, 1.1.2.1, NONE linux-2.6-xen-0010-xen-dom0-Add-a-vmlinuz-target.patch, 1.1.2.1, NONE linux-2.6-xen-0011-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch, 1.1.2.1, NONE linux-2.6-xen-0012-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch, 1.1.2.1, NONE patch-2.6.25-rc3-git1.bz2.sign, 1.1.2.1, NONE patch-2.6.25-rc3.bz2.sign, 1.1.2.1, NONE

Mark McLoughlin (markmc) fedora-extras-commits at redhat.com
Wed Mar 5 18:42:01 UTC 2008


Author: markmc

Update of /cvs/pkgs/rpms/kernel-xen-2.6/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv5197

Modified Files:
      Tag: private-markmc-pv-ops-branch
	.cvsignore .gitignore Makefile Makefile.config config-generic 
	config-powerpc-generic kernel.spec 
	linux-2.6-debug-taint-vm.patch 
	linux-2.6-firewire-git-pending.patch 
	linux-2.6-firewire-git-update.patch 
	linux-2.6-silence-noise.patch linux-2.6-wireless-pending.patch 
	linux-2.6-wireless.patch sources upstream 
Added Files:
      Tag: private-markmc-pv-ops-branch
	linux-2.6-drm-git-i915-remove-priv-access.patch 
	linux-2.6-drm-git-mm-revert-nopfn.patch 
	linux-2.6-ia32-syscall-restart.patch 
	linux-2.6-vio-modalias.patch 
	linux-2.6-virtio_blk-fix-sysfs-bits.patch 
	linux-2.6-wireless-pending-too.patch 
	linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch.patch 
	linux-2.6-xen-0002-squashfs-Fix-build-without-CONFIG_SMP.patch 
	linux-2.6-xen-0003-xen-Make-hvc0-the-preferred-console-in-domU.patch 
	linux-2.6-xen-0004-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch 
	linux-2.6-xen-0005-fbdev-Make-deferred-I-O-work-as-advertized.patch 
	linux-2.6-xen-0006-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch 
	linux-2.6-xen-0007-xen-Module-autoprobing-support-for-frontend-drivers.patch 
	linux-2.6-xen-0008-xen-Add-compatibility-aliases-for-frontend-drivers.patch 
	linux-2.6-xen-0009-xen-dom0-Add-a-vmlinuz-target.patch 
	linux-2.6-xen-0010-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch 
	linux-2.6-xen-0011-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch 
	patch-2.6.25-rc4.bz2.sign 
Removed Files:
      Tag: private-markmc-pv-ops-branch
	linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch-from-kernel-2_6_25.patch 
	linux-2.6-xen-0002-x86-xen-Construct-e820-map-with-a-hole-between-640K.patch 
	linux-2.6-xen-0003-squashfs-Fix-build-without-CONFIG_SMP.patch 
	linux-2.6-xen-0004-xen-Make-hvc0-the-preferred-console-in-domU.patch 
	linux-2.6-xen-0005-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch 
	linux-2.6-xen-0006-fbdev-Make-deferred-I-O-work-as-advertized.patch 
	linux-2.6-xen-0007-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch 
	linux-2.6-xen-0008-xen-Module-autoprobing-support-for-frontend-drivers.patch 
	linux-2.6-xen-0009-xen-Add-compatibility-aliases-for-frontend-drivers.patch 
	linux-2.6-xen-0010-xen-dom0-Add-a-vmlinuz-target.patch 
	linux-2.6-xen-0011-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch 
	linux-2.6-xen-0012-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch 
	patch-2.6.25-rc3-git1.bz2.sign patch-2.6.25-rc3.bz2.sign 
Log Message:
* Wed Mar 05 2008 Mark McLoughlin <markmc at redhat.com>
- Re-base to kernel-2_6_25-0_93_rc4_fc9


linux-2.6-drm-git-i915-remove-priv-access.patch:

--- NEW FILE linux-2.6-drm-git-i915-remove-priv-access.patch ---
diff --git a/drivers/char/drm/i915_dma.c b/drivers/char/drm/i915_dma.c
index d2b7d3f..30ab367 100644
--- a/drivers/char/drm/i915_dma.c
+++ b/drivers/char/drm/i915_dma.c
@@ -51,7 +51,7 @@ int i915_wait_ring(struct drm_device *dev, int n, const char *caller)
 		if (ring->space >= n)
 			return 0;
 
-		dev_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
+		//dev_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
 
 		if (ring->head != last_head)
 			i = 0;
@@ -73,8 +73,8 @@ void i915_kernel_lost_context(struct drm_device *dev)
 	if (ring->space < 0)
 		ring->space += ring->Size;
 
-	if (ring->head == ring->tail)
-		dev_priv->sarea_priv->perf_boxes |= I915_BOX_RING_EMPTY;
+//	if (ring->head == ring->tail)
+//		dev_priv->sarea_priv->perf_boxes |= I915_BOX_RING_EMPTY;
 }
 
 static int i915_dma_cleanup(struct drm_device *dev)

linux-2.6-drm-git-mm-revert-nopfn.patch:

--- NEW FILE linux-2.6-drm-git-mm-revert-nopfn.patch ---
commit 4825484968daa23b3a55446c5f40f4d35fb6ff21
Author: Dave Airlie <airlied at dhcp-64-219.bne.redhat.com>
Date:   Mon Mar 3 13:29:52 2008 +1000

    Revert "drm:  reimplement nopfn callers with fault"
    
    This reverts commit ae0bdbd7e1d02e978323640256125f8a5391510a.

diff --git a/drivers/char/drm/drm_vm.c b/drivers/char/drm/drm_vm.c
index 6184b98..3cd0b1c 100644
--- a/drivers/char/drm/drm_vm.c
+++ b/drivers/char/drm/drm_vm.c
@@ -679,8 +679,8 @@ EXPORT_SYMBOL(drm_mmap);
  * \c Pagefault method for buffer objects.
  *
  * \param vma Virtual memory area.
- * \param vmf vm fault data
- * \return Error or VM_FAULT_NOPAGE: the pfn is manually inserted.
+ * \param address File offset.
+ * \return Error or refault. The pfn is manually inserted.
  *
  * It's important that pfns are inserted while holding the bo->mutex lock.
  * otherwise we might race with unmap_mapping_range() which is always
@@ -692,7 +692,8 @@ EXPORT_SYMBOL(drm_mmap);
  * protected by the bo->mutex lock.
  */
 
-static int drm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+static unsigned long drm_bo_vm_nopfn(struct vm_area_struct *vma,
+				     unsigned long address)
 {
 	struct drm_buffer_object *bo = (struct drm_buffer_object *) vma->vm_private_data;
 	unsigned long page_offset;
@@ -704,22 +705,25 @@ static int drm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 	unsigned long bus_base;
 	unsigned long bus_offset;
 	unsigned long bus_size;
-	unsigned long ret = VM_FAULT_NOPAGE;
+	unsigned long ret = NOPFN_REFAULT;
+
+	if (address > vma->vm_end)
+		return NOPFN_SIGBUS;
 
 	dev = bo->dev;
 	err = drm_bo_read_lock(&dev->bm.bm_lock);
 	if (err)
-		return VM_FAULT_NOPAGE;
+		return NOPFN_REFAULT;
 
 	err = mutex_lock_interruptible(&bo->mutex);
 	if (err) {
 		drm_bo_read_unlock(&dev->bm.bm_lock);
-		return VM_FAULT_NOPAGE;
+		return NOPFN_REFAULT;
 	}
 
 	err = drm_bo_wait(bo, 0, 0, 0);
 	if (err) {
-		ret = (err != -EAGAIN) ? VM_FAULT_SIGBUS : VM_FAULT_NOPAGE;
+		ret = (err != -EAGAIN) ? NOPFN_SIGBUS : NOPFN_REFAULT;
 		goto out_unlock;
 	}
 
@@ -734,7 +738,7 @@ static int drm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 			DRM_BO_FLAG_FORCE_MAPPABLE;
 		err = drm_bo_move_buffer(bo, new_flags, 0, 0);
 		if (err) {
-			ret = (err != -EAGAIN) ? VM_FAULT_SIGBUS : VM_FAULT_NOPAGE;
+			ret = (err != -EAGAIN) ? NOPFN_SIGBUS : NOPFN_REFAULT;
 			goto out_unlock;
 		}
 	}
@@ -743,12 +747,11 @@ static int drm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 				&bus_size);
 
 	if (err) {
-		ret = VM_FAULT_SIGBUS;
+		ret = NOPFN_SIGBUS;
 		goto out_unlock;
 	}
 
-	/* XXX: vmf->pgoff may work here, but it adds on vma->vm_pgoff */
-	page_offset = ((unsigned long)vmf->virtual_address - vma->vm_start) >> PAGE_SHIFT;
+	page_offset = (address - vma->vm_start) >> PAGE_SHIFT;
 
 	if (bus_size) {
 		struct drm_mem_type_manager *man = &dev->bm.man[bo->mem.mem_type];
@@ -761,7 +764,7 @@ static int drm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 		drm_ttm_fixup_caching(ttm);
 		page = drm_ttm_get_page(ttm, page_offset);
 		if (!page) {
-			ret = VM_FAULT_OOM;
+			ret = NOPFN_OOM;
 			goto out_unlock;
 		}
 		pfn = page_to_pfn(page);
@@ -770,9 +773,9 @@ static int drm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 			drm_io_prot(_DRM_TTM, vma);
 	}
 
-	err = vm_insert_pfn(vma, (unsigned long)vmf->virtual_address, pfn);
+	err = vm_insert_pfn(vma, address, pfn);
 	if (err) {
-		ret = (err != -EAGAIN) ? VM_FAULT_OOM : VM_FAULT_NOPAGE;
+		ret = (err != -EAGAIN) ? NOPFN_OOM : NOPFN_REFAULT;
 		goto out_unlock;
 	}
 out_unlock:
@@ -827,7 +830,7 @@ static void drm_bo_vm_close(struct vm_area_struct *vma)
 }
 
 static struct vm_operations_struct drm_bo_vm_ops = {
-	.fault = drm_bo_vm_fault,
+	.nopfn = drm_bo_vm_nopfn,
 	.open = drm_bo_vm_open,
 	.close = drm_bo_vm_close,
 };

linux-2.6-ia32-syscall-restart.patch:

--- NEW FILE linux-2.6-ia32-syscall-restart.patch ---
>From 702b92b212afb1cb9d9590f5a9133113c2b4168c Mon Sep 17 00:00:00 2001
From: Roland McGrath <roland at redhat.com>
Date: Thu, 28 Feb 2008 19:40:17 -0800
Subject: [PATCH] x86_64 ia32 syscall restart fix

The code to restart syscalls after signals depends on checking for a
negative orig_ax, and for particular negative -ERESTART* values in ax.
These fields are 64 bits and for a 32-bit task they get zero-extended.
The syscall restart behavior is lost, a regression from a native 32-bit
kernel and from 64-bit tasks' behavior.  This patch fixes the problem by
doing sign-extension where it matters.  For orig_ax, the only time the
value should be -1 but winds up as 0x0ffffffff is via a 32-bit ptrace
call.  So the patch changes ptrace to sign-extend the 32-bit orig_eax
value when it's stored; it doesn't change the checks on orig_ax, though
it uses the new current_syscall() inline to better document the subtle
importance of the used of signedness there.  The ax value is stored a
lot of ways and it seems hard to get them all sign-extended at their
origins.  So for that, we use the current_syscall_ret() to sign-extend
it only for 32-bit tasks at the time of the -ERESTART* comparisons.

Signed-off-by: Roland McGrath <roland at redhat.com>
---
 arch/x86/kernel/ptrace.c    |    9 ++++++++-
 arch/x86/kernel/signal_64.c |   38 +++++++++++++++++++++++++++++++++-----
 2 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index f41fdc9..f8eed1b 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1045,10 +1045,17 @@ static int putreg32(struct task_struct *child, unsigned regno, u32 value)
 	R32(esi, si);
 	R32(ebp, bp);
 	R32(eax, ax);
-	R32(orig_eax, orig_ax);
 	R32(eip, ip);
 	R32(esp, sp);
 
+	case offsetof(struct user32, regs.orig_eax):
+		/*
+		 * Sign-extend the value so that orig_eax = -1
+		 * causes (long)orig_ax < 0 tests to fire correctly.
+		 */
+		regs->orig_ax = (long) (s32) value;
+		break;
+
 	case offsetof(struct user32, regs.eflags):
 		return set_flags(child, value);
 
diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
index 7347bb1..ce317ee 100644
--- a/arch/x86/kernel/signal_64.c
+++ b/arch/x86/kernel/signal_64.c
@@ -311,6 +311,35 @@ give_sigsegv:
 }
 
 /*
+ * Return -1L or the syscall number that @regs is executing.
+ */
+static long current_syscall(struct pt_regs *regs)
+{
+	/*
+	 * We always sign-extend a -1 value being set here,
+	 * so this is always either -1L or a syscall number.
+	 */
+	return regs->orig_ax;
+}
+
+/*
+ * Return a value that is -EFOO if the system call in @regs->orig_ax
+ * returned an error.  This only works for @regs from @current.
+ */
+static long current_syscall_ret(struct pt_regs *regs)
+{
+#ifdef CONFIG_IA32_EMULATION
+	if (test_thread_flag(TIF_IA32))
+		/*
+		 * Sign-extend the value so (int)-EFOO becomes (long)-EFOO
+		 * and will match correctly in comparisons.
+		 */
+		return (int) regs->ax;
+#endif
+	return regs->ax;
+}
+
+/*
  * OK, we're invoking a handler
  */	
 
@@ -327,9 +356,9 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
 #endif
 
 	/* Are we from a system call? */
-	if ((long)regs->orig_ax >= 0) {
+	if (current_syscall(regs) >= 0) {
 		/* If so, check system call restarting.. */
-		switch (regs->ax) {
+		switch (current_syscall_ret(regs)) {
 		        case -ERESTART_RESTARTBLOCK:
 			case -ERESTARTNOHAND:
 				regs->ax = -EINTR;
@@ -426,10 +455,9 @@ static void do_signal(struct pt_regs *regs)
 	}
 
 	/* Did we come from a system call? */
-	if ((long)regs->orig_ax >= 0) {
+	if (current_syscall(regs) >= 0) {
 		/* Restart the system call - no handlers present */
-		long res = regs->ax;
-		switch (res) {
+		switch (current_syscall_ret(regs)) {
 		case -ERESTARTNOHAND:
 		case -ERESTARTSYS:
 		case -ERESTARTNOINTR:
-- 
1.5.4.1


linux-2.6-vio-modalias.patch:

--- NEW FILE linux-2.6-vio-modalias.patch ---
diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
index f988672..12a0851 100644
--- a/arch/powerpc/kernel/vio.c
+++ b/arch/powerpc/kernel/vio.c
@@ -294,9 +294,27 @@ static ssize_t devspec_show(struct device *dev,
 	return sprintf(buf, "%s\n", of_node ? of_node->full_name : "none");
 }
 
+static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
+			     char *buf)
+{
+	const struct vio_dev *vio_dev = to_vio_dev(dev);
+	struct device_node *dn;
+	const char *cp;
+
+	dn = dev->archdata.of_node;
+	if (!dn)
+		return -ENODEV;
+	cp = of_get_property(dn, "compatible", NULL);
+	if (!cp)
+		return -ENODEV;
+
+	return sprintf(buf, "vio:T%sS%s\n", vio_dev->type, cp);
+}
+
 static struct device_attribute vio_dev_attrs[] = {
 	__ATTR_RO(name),
 	__ATTR_RO(devspec),
+	__ATTR_RO(modalias),
 	__ATTR_NULL
 };
 

linux-2.6-virtio_blk-fix-sysfs-bits.patch:

--- NEW FILE linux-2.6-virtio_blk-fix-sysfs-bits.patch ---
From: Jeremy Katz <katzj at redhat.com>
To: rusty at rustcorp.com.au
Cc: Jeremy Katz <katzj at redhat.com>
Subject: [PATCH] Fix sysfs bits to have proper block symlink
Date: Sun, 2 Mar 2008 17:00:15 -0500

Fix up so that the virtio_blk devices in sysfs link correctly to their
block device.  This then allows them to be detected by hal, etc

Signed-off-by: Jeremy Katz <katzj at redhat.com>
---
 drivers/block/virtio_blk.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 3b1a68d..0cfbe8c 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -238,6 +238,7 @@ static int virtblk_probe(struct virtio_device *vdev)
 	vblk->disk->first_minor = index_to_minor(index);
 	vblk->disk->private_data = vblk;
 	vblk->disk->fops = &virtblk_fops;
+	vblk->disk->driverfs_dev = &vdev->dev;
 	index++;
 
 	/* If barriers are supported, tell block layer that queue is ordered */


linux-2.6-wireless-pending-too.patch:

--- NEW FILE linux-2.6-wireless-pending-too.patch ---
This is an a backport of two fixes which are based on top of the open11s
patches which are not yet in Rawhide.  They will disappear when those
later patches get merged to net-2.6.26 (probably in a few days).

	mac80211: always insert key into list
	mac80211: fix hardware scan completion

diff -up linux-2.6.24.noarch/net/mac80211/key.c.orig linux-2.6.24.noarch/net/mac80211/key.c
--- linux-2.6.24.noarch/net/mac80211/key.c.orig	2008-03-04 19:40:41.000000000 -0500
+++ linux-2.6.24.noarch/net/mac80211/key.c	2008-03-04 19:43:13.000000000 -0500
@@ -174,6 +174,9 @@ static void __ieee80211_key_replace(stru
 {
 	int idx, defkey;
 
+	if (new)
+		list_add(&new->list, &sdata->key_list);
+
 	if (sta) {
 		rcu_assign_pointer(sta->key, new);
 	} else {
@@ -190,9 +193,6 @@ static void __ieee80211_key_replace(stru
 			ieee80211_set_default_key(sdata, -1);
 
 		rcu_assign_pointer(sdata->keys[idx], new);
-		if (new)
-			list_add(&new->list, &sdata->key_list);
-
 		if (defkey && new)
 			ieee80211_set_default_key(sdata, new->conf.keyidx);
 	}
diff -up linux-2.6.24.noarch/net/mac80211/ieee80211_sta.c.orig linux-2.6.24.noarch/net/mac80211/ieee80211_sta.c
--- linux-2.6.24.noarch/net/mac80211/ieee80211_sta.c.orig	2008-03-04 19:40:41.000000000 -0500
+++ linux-2.6.24.noarch/net/mac80211/ieee80211_sta.c	2008-03-04 19:48:19.000000000 -0500
@@ -3401,22 +3401,27 @@ void ieee80211_scan_completed(struct iee
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-
 		/* No need to wake the master device. */
 		if (sdata->dev == local->mdev)
 			continue;
 
-		if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
-			if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
-				ieee80211_send_nullfunc(local, sdata, 0);
-			ieee80211_sta_timer((unsigned long)sdata);
-		}
+		/* Tell AP we're back */
+		if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
+		    sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
+			ieee80211_send_nullfunc(local, sdata, 0);
 
 		netif_wake_queue(sdata->dev);
 	}
-	rcu_read_unlock();
 
 done:
+	/* Restart STA timer for both SW and HW scan cases */
+	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+		if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
+			ieee80211_sta_timer((unsigned long)sdata);
+	}
+
+	rcu_read_unlock();
+
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
 		struct ieee80211_if_sta *ifsta = &sdata->u.sta;

linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch.patch:

--- NEW FILE linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch.patch ---
>From 77198032633b5660879bb89bae9f1682fd0ec24c Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc at redhat.com>
Date: Wed, 5 Mar 2008 17:20:11 +0000
Subject: [PATCH] Revert linux-2.6-execshield.patch

Signed-off-by: Mark McLoughlin <markmc at redhat.com>
---
 arch/x86/kernel/cpu/common.c  |   14 -----
 arch/x86/kernel/process_32.c  |   39 +--------------
 arch/x86/kernel/setup64.c     |   40 +++++++++++++++
 arch/x86/kernel/smp_32.c      |    3 -
 arch/x86/kernel/traps_32.c    |  106 +---------------------------------------
 arch/x86/mm/init_32.c         |   20 ++++----
 arch/x86/mm/mmap.c            |    4 +-
 arch/x86/vdso/vdso32-setup.c  |    2 +-
 fs/binfmt_elf.c               |   21 +-------
 fs/proc/array.c               |    8 +--
 include/asm-ia64/pgalloc.h    |    4 --
 include/asm-powerpc/pgalloc.h |    5 --
 include/asm-ppc/pgalloc.h     |    5 --
 include/asm-s390/pgalloc.h    |    4 --
 include/asm-sparc/pgalloc.h   |    4 --
 include/asm-sparc64/pgalloc.h |    4 --
 include/asm-x86/desc.h        |   16 ------
 include/asm-x86/elf.h         |    2 +
 include/asm-x86/mmu.h         |    6 --
 include/asm-x86/pgalloc_64.h  |    7 ---
 include/asm-x86/processor.h   |    6 --
 include/linux/mm.h            |    8 +---
 include/linux/mm_types.h      |    3 -
 include/linux/resource.h      |    5 +--
 include/linux/sched.h         |    7 ---
 kernel/sysctl.c               |   28 -----------
 mm/mmap.c                     |  107 +++-------------------------------------
 mm/mprotect.c                 |    9 +---
 mm/mremap.c                   |    4 +-
 29 files changed, 74 insertions(+), 417 deletions(-)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 53cb84e..a38aafa 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -478,20 +478,6 @@ void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
 	 * we do "generic changes."
 	 */
 
-	/*
-	 *  emulation of NX with segment limits unfortunately means
-	 *  we have to disable the fast system calls, due to the way that
-	 *  sysexit clears the segment limits on return.
-	 *  If we have either disabled exec-shield on the boot command line,
-	 *  or we have NX, then we don't need to do this.
-	 */
-	if (exec_shield != 0) {
-#ifdef CONFIG_X86_PAE
-		if (!test_bit(X86_FEATURE_NX, c->x86_capability))
-#endif
-			clear_bit(X86_FEATURE_SEP, c->x86_capability);
-	}
-
 	/* If the model name is still unset, do table lookup. */
 	if ( !c->x86_model_id[0] ) {
 		char *p;
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index db271a2..be3c7a2 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -679,8 +679,7 @@ struct task_struct * __switch_to(struct task_struct *prev_p, struct task_struct
 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
 
 	__unlazy_fpu(prev_p);
-	if (next_p->mm)
-		load_user_cs_desc(cpu, next_p->mm);
+
 
 	/* we're going to use this soon, after a few expensive things */
 	if (next_p->fpu_counter > 5)
@@ -850,39 +849,3 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
 	unsigned long range_end = mm->brk + 0x02000000;
 	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
 }
-
-static void modify_cs(struct mm_struct *mm, unsigned long limit)
-{
-	mm->context.exec_limit = limit;
-	set_user_cs(&mm->context.user_cs, limit);
-	if (mm == current->mm) {
-		preempt_disable();
-		load_user_cs_desc(smp_processor_id(), mm);
-		preempt_enable();
-	}
-}
-
-void arch_add_exec_range(struct mm_struct *mm, unsigned long limit)
-{
-	if (limit > mm->context.exec_limit)
-		modify_cs(mm, limit);
-}
-
-void arch_remove_exec_range(struct mm_struct *mm, unsigned long old_end)
-{
-	struct vm_area_struct *vma;
-	unsigned long limit = PAGE_SIZE;
-
-	if (old_end == mm->context.exec_limit) {
-		for (vma = mm->mmap; vma; vma = vma->vm_next)
-			if ((vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
-				limit = vma->vm_end;
-		modify_cs(mm, limit);
-	}
-}
-
-void arch_flush_exec_range(struct mm_struct *mm)
-{
-	mm->context.exec_limit = 0;
-	set_user_cs(&mm->context.user_cs, 0);
-}
diff --git a/arch/x86/kernel/setup64.c b/arch/x86/kernel/setup64.c
index 8a940dc..309366f 100644
--- a/arch/x86/kernel/setup64.c
+++ b/arch/x86/kernel/setup64.c
@@ -45,6 +45,46 @@ EXPORT_SYMBOL_GPL(__supported_pte_mask);
 
 static int do_not_nx __cpuinitdata = 0;
 
+/* noexec=on|off
+Control non executable mappings for 64bit processes.
+
+on	Enable(default)
+off	Disable
+*/ 
+static int __init nonx_setup(char *str)
+{
+	if (!str)
+		return -EINVAL;
+	if (!strncmp(str, "on", 2)) {
+                __supported_pte_mask |= _PAGE_NX; 
+ 		do_not_nx = 0; 
+	} else if (!strncmp(str, "off", 3)) {
+		do_not_nx = 1;
+		__supported_pte_mask &= ~_PAGE_NX;
+        }
+	return 0;
+} 
+early_param("noexec", nonx_setup);
+
+int force_personality32 = 0; 
+
+/* noexec32=on|off
+Control non executable heap for 32bit processes.
+To control the stack too use noexec=off
+
+on	PROT_READ does not imply PROT_EXEC for 32bit processes
+off	PROT_READ implies PROT_EXEC (default)
+*/
+static int __init nonx32_setup(char *str)
+{
+	if (!strcmp(str, "on"))
+		force_personality32 &= ~READ_IMPLIES_EXEC;
+	else if (!strcmp(str, "off"))
+		force_personality32 |= READ_IMPLIES_EXEC;
+	return 1;
+}
+__setup("noexec32=", nonx32_setup);
+
 /*
  * Copy data used in early init routines from the initial arrays to the
  * per cpu data areas.  These arrays then become expendable and the
diff --git a/arch/x86/kernel/smp_32.c b/arch/x86/kernel/smp_32.c
index cca75b4..dc0cde9 100644
--- a/arch/x86/kernel/smp_32.c
+++ b/arch/x86/kernel/smp_32.c
@@ -22,7 +22,6 @@
 
 #include <asm/mtrr.h>
 #include <asm/tlbflush.h>
-#include <asm/desc.h>
 #include <asm/mmu_context.h>
 #include <mach_apic.h>
 
@@ -317,8 +316,6 @@ void smp_invalidate_interrupt(struct pt_regs *regs)
 	unsigned long cpu;
 
 	cpu = get_cpu();
-	if (current->active_mm)
-		load_user_cs_desc(cpu, current->active_mm);
 
 	if (!cpu_isset(cpu, flush_cpumask))
 		goto out;
diff --git a/arch/x86/kernel/traps_32.c b/arch/x86/kernel/traps_32.c
index 7865615..b22c01e 100644
--- a/arch/x86/kernel/traps_32.c
+++ b/arch/x86/kernel/traps_32.c
@@ -592,91 +592,7 @@ DO_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
 DO_ERROR(11, SIGBUS,  "segment not present", segment_not_present)
 DO_ERROR(12, SIGBUS,  "stack segment", stack_segment)
 DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0, 0)
-
-/*
- * lazy-check for CS validity on exec-shield binaries:
- *
- * the original non-exec stack patch was written by
- * Solar Designer <solar at openwall.com>. Thanks!
- */
-static int
-check_lazy_exec_limit(int cpu, struct pt_regs *regs, long error_code)
-{
-	struct desc_struct *desc1, *desc2;
-	struct vm_area_struct *vma;
-	unsigned long limit;
-
-	if (current->mm == NULL)
-		return 0;
-
-	limit = -1UL;
-	if (current->mm->context.exec_limit != -1UL) {
-		limit = PAGE_SIZE;
-		spin_lock(&current->mm->page_table_lock);
-		for (vma = current->mm->mmap; vma; vma = vma->vm_next)
-			if ((vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
-				limit = vma->vm_end;
-		vma = get_gate_vma(current);
-		if (vma && (vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
-			limit = vma->vm_end;
-		spin_unlock(&current->mm->page_table_lock);
-		if (limit >= TASK_SIZE)
-			limit = -1UL;
-		current->mm->context.exec_limit = limit;
-	}
-	set_user_cs(&current->mm->context.user_cs, limit);
-
-	desc1 = &current->mm->context.user_cs;
-	desc2 = get_cpu_gdt_table(cpu) + GDT_ENTRY_DEFAULT_USER_CS;
-
-	if (desc1->a != desc2->a || desc1->b != desc2->b) {
-		/*
-		 * The CS was not in sync - reload it and retry the
-		 * instruction. If the instruction still faults then
-		 * we won't hit this branch next time around.
-		 */
-		if (print_fatal_signals >= 2) {
-			printk(KERN_ERR "#GPF fixup (%ld[seg:%lx]) at %08lx, CPU#%d.\n",
-				error_code, error_code/8, regs->ip, smp_processor_id());
-			printk(KERN_ERR "exec_limit: %08lx, user_cs: %08x/%08x, CPU_cs: %08x/%08x.\n",
-				current->mm->context.exec_limit, desc1->a, desc1->b, desc2->a, desc2->b);
-		}
-		load_user_cs_desc(cpu, current->mm);
-		return 1;
-	}
-
-	return 0;
-}
-
-/*
- * The fixup code for errors in iret jumps to here (iret_exc).  It loses
- * the original trap number and error code.  The bogus trap 32 and error
- * code 0 are what the vanilla kernel delivers via:
- * DO_ERROR_INFO(32, SIGSEGV, "iret exception", iret_error, ILL_BADSTK, 0, 1)
- *
- * NOTE: Because of the final "1" in the macro we need to enable interrupts.
- *
- * In case of a general protection fault in the iret instruction, we
- * need to check for a lazy CS update for exec-shield.
- */
-void do_iret_error(struct pt_regs *regs, long error_code)
-{
-	int ok;
-	local_irq_enable();
-	ok = check_lazy_exec_limit(get_cpu(), regs, error_code);
-	put_cpu();
-	if (!ok && notify_die(DIE_TRAP, "iret exception", regs,
-	    error_code, 32, SIGSEGV) != NOTIFY_STOP) {
-		siginfo_t info;
-		info.si_signo = SIGSEGV;
-		info.si_errno = 0;
-		info.si_code = ILL_BADSTK;
-		info.si_addr = 0;
-		do_trap(32, SIGSEGV, "iret exception", 0, regs, error_code,
-			&info);
-	}
-}
-
+DO_ERROR_INFO(32, SIGSEGV, "iret exception", iret_error, ILL_BADSTK, 0, 1)
 
 void __kprobes do_general_protection(struct pt_regs * regs,
 					      long error_code)
@@ -684,7 +600,6 @@ void __kprobes do_general_protection(struct pt_regs * regs,
 	int cpu = get_cpu();
 	struct tss_struct *tss = &per_cpu(init_tss, cpu);
 	struct thread_struct *thread = &current->thread;
-	int ok;
 
 	/*
 	 * Perform the lazy TSS's I/O bitmap copy. If the TSS has an
@@ -711,6 +626,7 @@ void __kprobes do_general_protection(struct pt_regs * regs,
 		put_cpu();
 		return;
 	}
+	put_cpu();
 
 	if (regs->flags & VM_MASK)
 		goto gp_in_vm86;
@@ -718,22 +634,6 @@ void __kprobes do_general_protection(struct pt_regs * regs,
 	if (!user_mode(regs))
 		goto gp_in_kernel;
 
-	ok = check_lazy_exec_limit(cpu, regs, error_code);
-
-	put_cpu();
-
-	if (ok)
-		return;
-
-	if (print_fatal_signals) {
-		printk(KERN_ERR "#GPF(%ld[seg:%lx]) at %08lx, CPU#%d.\n", error_code,
-			error_code/8, regs->ip, smp_processor_id());
-		printk(KERN_ERR "exec_limit: %08lx, user_cs: %08x/%08x.\n",
-			current->mm->context.exec_limit,
-			current->mm->context.user_cs.a,
-			current->mm->context.user_cs.b);
-	}
-
 	current->thread.error_code = error_code;
 	current->thread.trap_no = 13;
 	if (show_unhandled_signals && unhandled_signal(current, SIGSEGV) &&
@@ -750,13 +650,11 @@ void __kprobes do_general_protection(struct pt_regs * regs,
 	return;
 
 gp_in_vm86:
-	put_cpu();
 	local_irq_enable();
 	handle_vm86_fault((struct kernel_vm86_regs *) regs, error_code);
 	return;
 
 gp_in_kernel:
-	put_cpu();
 	if (!fixup_exception(regs)) {
 		current->thread.error_code = error_code;
 		current->thread.trap_no = 13;
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index f5926ae..ee1091a 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -474,7 +474,7 @@ static int disable_nx __initdata;
  * Control non executable mappings.
  *
  * on      Enable
- * off     Disable (disables exec-shield too)
+ * off     Disable
  */
 static int __init noexec_setup(char *str)
 {
@@ -483,12 +483,14 @@ static int __init noexec_setup(char *str)
 			__supported_pte_mask |= _PAGE_NX;
 			disable_nx = 0;
 		}
-	} else if (!strcmp(str, "off")) {
-		disable_nx = 1;
-		__supported_pte_mask &= ~_PAGE_NX;
-		exec_shield = 0;
-	} else
-		return -EINVAL;
+	} else {
+		if (!strcmp(str, "off")) {
+			disable_nx = 1;
+			__supported_pte_mask &= ~_PAGE_NX;
+		} else {
+			return -EINVAL;
+		}
+	}
 
 	return 0;
 }
@@ -526,10 +528,6 @@ void __init paging_init(void)
 	if (nx_enabled)
 		printk(KERN_INFO "NX (Execute Disable) protection: active\n");
 #endif
-	if (exec_shield)
-		printk(KERN_INFO "Using x86 segment limits to approximate "
-			"NX protection\n");
-
 	pagetable_init();
 
 	load_cr3(swapper_pg_dir);
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index ec932ae..56fe712 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -111,15 +111,13 @@ static unsigned long mmap_legacy_base(void)
  */
 void arch_pick_mmap_layout(struct mm_struct *mm)
 {
-	if (!(2 & exec_shield) && mmap_is_legacy()) {
+	if (mmap_is_legacy()) {
 		mm->mmap_base = mmap_legacy_base();
 		mm->get_unmapped_area = arch_get_unmapped_area;
 		mm->unmap_area = arch_unmap_area;
 	} else {
 		mm->mmap_base = mmap_base();
 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
-		if (!(current->personality & READ_IMPLIES_EXEC))
-			mm->get_unmapped_exec_area = arch_get_unmapped_exec_area;
 		mm->unmap_area = arch_unmap_area_topdown;
 	}
 }
diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
index 0bd5f44..348f134 100644
--- a/arch/x86/vdso/vdso32-setup.c
+++ b/arch/x86/vdso/vdso32-setup.c
@@ -336,7 +336,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int exstack)
 	if (compat)
 		addr = VDSO_HIGH_BASE;
 	else {
-		addr = get_unmapped_area_prot(NULL, 0, PAGE_SIZE, 0, 0, 1);
+		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
 		if (IS_ERR_VALUE(addr)) {
 			ret = addr;
 			goto up_fail;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 1fc8940..5e1a4fb 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -81,7 +81,7 @@ static struct linux_binfmt elf_format = {
 		.hasvdso	= 1
 };
 
-#define BAD_ADDR(x) IS_ERR_VALUE(x)
+#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
 
 static int set_brk(unsigned long start, unsigned long end)
 {
@@ -709,11 +709,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 			break;
 		}
 
-	if (current->personality == PER_LINUX && (exec_shield & 2)) {
-		executable_stack = EXSTACK_DISABLE_X;
-		current->flags |= PF_RANDOMIZE;
-	}
-
 	/* Some simple consistency checks for the interpreter */
 	if (elf_interpreter) {
 		retval = -ELIBBAD;
@@ -733,15 +728,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 	if (retval)
 		goto out_free_dentry;
 
-#ifdef CONFIG_X86_32
-	/*
-	 * Turn off the CS limit completely if exec-shield disabled or
-	 * NX active:
-	 */
-	if (!exec_shield || executable_stack != EXSTACK_DISABLE_X || nx_enabled)
-		arch_add_exec_range(current->mm, -1);
-#endif
-
 	/* Discard our unneeded old files struct */
 	if (files) {
 		put_files_struct(files);
@@ -755,8 +741,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
 	   may depend on the personality.  */
 	SET_PERSONALITY(loc->elf_ex, 0);
-	if (!(exec_shield & 2) &&
-			elf_read_implies_exec(loc->elf_ex, executable_stack))
+	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 		current->personality |= READ_IMPLIES_EXEC;
 
 	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
@@ -921,7 +906,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 					    interpreter,
 					    &interp_map_addr,
 					    load_bias);
-		if (!BAD_ADDR(elf_entry)) {
+		if (!IS_ERR((void *)elf_entry)) {
 			/*
 			 * load_elf_interp() returns relocation
 			 * adjustment
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 46adc3b..07d6c48 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -471,12 +471,8 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
 	}
 	rcu_read_unlock();
 
-	if (!whole || num_threads < 2) {
-		wchan = 0;
-		if (current->uid == task->uid || current->euid == task->uid ||
-			capable(CAP_SYS_NICE))
-				wchan = get_wchan(task);
-	}
+	if (!whole || num_threads < 2)
+		wchan = get_wchan(task);
 	if (!whole) {
 		min_flt = task->min_flt;
 		maj_flt = task->maj_flt;
diff --git a/include/asm-ia64/pgalloc.h b/include/asm-ia64/pgalloc.h
index 24f183a..b9ac1a6 100644
--- a/include/asm-ia64/pgalloc.h
+++ b/include/asm-ia64/pgalloc.h
@@ -1,10 +1,6 @@
 #ifndef _ASM_IA64_PGALLOC_H
 #define _ASM_IA64_PGALLOC_H
 
-#define arch_add_exec_range(mm, limit)		do { ; } while (0)
-#define arch_flush_exec_range(mm)		do { ; } while (0)
-#define arch_remove_exec_range(mm, limit)	do { ; } while (0)
-
 /*
  * This file contains the functions and defines necessary to allocate
  * page tables.
diff --git a/include/asm-powerpc/pgalloc.h b/include/asm-powerpc/pgalloc.h
index 25068ae..b4505ed 100644
--- a/include/asm-powerpc/pgalloc.h
+++ b/include/asm-powerpc/pgalloc.h
@@ -2,11 +2,6 @@
 #define _ASM_POWERPC_PGALLOC_H
 #ifdef __KERNEL__
 
-/* Dummy functions since we don't support execshield on ppc */
-#define arch_add_exec_range(mm, limit) do { ; } while (0)
-#define arch_flush_exec_range(mm)      do { ; } while (0)
-#define arch_remove_exec_range(mm, limit) do { ; } while (0)
-
 #ifdef CONFIG_PPC64
 #include <asm/pgalloc-64.h>
 #else
diff --git a/include/asm-ppc/pgalloc.h b/include/asm-ppc/pgalloc.h
index de55ad5..fd4d1d7 100644
--- a/include/asm-ppc/pgalloc.h
+++ b/include/asm-ppc/pgalloc.h
@@ -41,10 +41,5 @@ extern void pte_free(struct mm_struct *mm, pgtable_t pte);
 
 #define check_pgt_cache()	do { } while (0)
 
-#define arch_add_exec_range(mm, limit)         do { ; } while (0)
-#define arch_flush_exec_range(mm)              do { ; } while (0)
-#define arch_remove_exec_range(mm, limit)      do { ; } while (0)
-
-
 #endif /* _PPC_PGALLOC_H */
 #endif /* __KERNEL__ */
diff --git a/include/asm-s390/pgalloc.h b/include/asm-s390/pgalloc.h
index a43f0ec..f5b2bf3 100644
--- a/include/asm-s390/pgalloc.h
+++ b/include/asm-s390/pgalloc.h
@@ -17,10 +17,6 @@
 #include <linux/gfp.h>
 #include <linux/mm.h>
 
-#define arch_add_exec_range(mm, limit) do { ; } while (0)
-#define arch_flush_exec_range(mm)      do { ; } while (0)
-#define arch_remove_exec_range(mm, limit) do { ; } while (0)
-
 #define check_pgt_cache()	do {} while (0)
 
 unsigned long *crst_table_alloc(struct mm_struct *, int);
diff --git a/include/asm-sparc/pgalloc.h b/include/asm-sparc/pgalloc.h
index 2632807..6292cd0 100644
--- a/include/asm-sparc/pgalloc.h
+++ b/include/asm-sparc/pgalloc.h
@@ -66,8 +66,4 @@ BTFIXUPDEF_CALL(void, pte_free, pgtable_t )
 #define pte_free(mm, pte)	BTFIXUP_CALL(pte_free)(pte)
 #define __pte_free_tlb(tlb, pte)	pte_free((tlb)->mm, pte)
 
-#define arch_add_exec_range(mm, limit)		do { ; } while (0)
-#define arch_flush_exec_range(mm)		do { ; } while (0)
-#define arch_remove_exec_range(mm, limit)	do { ; } while (0)
-
 #endif /* _SPARC_PGALLOC_H */
diff --git a/include/asm-sparc64/pgalloc.h b/include/asm-sparc64/pgalloc.h
index c998da2..3ee2d40 100644
--- a/include/asm-sparc64/pgalloc.h
+++ b/include/asm-sparc64/pgalloc.h
@@ -79,8 +79,4 @@ static inline void check_pgt_cache(void)
 	quicklist_trim(0, NULL, 25, 16);
 }
 
-#define arch_add_exec_range(mm, limit)		do { ; } while (0)
-#define arch_flush_exec_range(mm)		do { ; } while (0)
-#define arch_remove_exec_range(mm, limit)	do { ; } while (0)
-
 #endif /* _SPARC64_PGALLOC_H */
diff --git a/include/asm-x86/desc.h b/include/asm-x86/desc.h
index 7ad80b9..5b6a05d 100644
--- a/include/asm-x86/desc.h
+++ b/include/asm-x86/desc.h
@@ -353,22 +353,6 @@ static inline void set_system_gate_ist(int n, void *addr, unsigned ist)
 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
 }
 
-static inline void set_user_cs(struct desc_struct *desc, unsigned long limit)
-{
-	limit = (limit - 1) / PAGE_SIZE;
-	desc->a = limit & 0xffff;
-	desc->b = (limit & 0xf0000) | 0x00c0fb00;
-}
-
-#define load_user_cs_desc(cpu, mm) \
-	get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_CS] = (mm)->context.user_cs
-
-#ifdef CONFIG_X86_32
-extern void arch_add_exec_range(struct mm_struct *mm, unsigned long limit);
-extern void arch_remove_exec_range(struct mm_struct *mm, unsigned long limit);
-extern void arch_flush_exec_range(struct mm_struct *mm);
-#endif /* CONFIG_X86_32 */
-
 #else
 /*
  * GET_DESC_BASE reads the descriptor base of the specified segment.
diff --git a/include/asm-x86/elf.h b/include/asm-x86/elf.h
index 001b577..fb62f99 100644
--- a/include/asm-x86/elf.h
+++ b/include/asm-x86/elf.h
@@ -185,6 +185,7 @@ static inline void elf_common_init(struct thread_struct *t,
 			clear_thread_flag(TIF_ABI_PENDING);	\
 		else						\
 			set_thread_flag(TIF_ABI_PENDING);	\
+		current->personality |= force_personality32;	\
 	} while (0)
 #define COMPAT_ELF_PLATFORM			("i686")
 
@@ -229,6 +230,7 @@ static inline void elf_common_init(struct thread_struct *t,
 #define ELF_PLATFORM       ("x86_64")
 extern void set_personality_64bit(void);
 extern unsigned int sysctl_vsyscall32;
+extern int force_personality32;
 
 #endif /* !CONFIG_X86_32 */
 
diff --git a/include/asm-x86/mmu.h b/include/asm-x86/mmu.h
index db9b109..efa962c 100644
--- a/include/asm-x86/mmu.h
+++ b/include/asm-x86/mmu.h
@@ -9,8 +9,6 @@
  * we put the segment information here.
  *
  * cpu_vm_mask is used to optimize ldt flushing.
- * exec_limit is used to track the range PROT_EXEC
- * mappings span.
  */
 typedef struct { 
 	void *ldt;
@@ -20,10 +18,6 @@ typedef struct {
 	int size;
 	struct mutex lock;
 	void *vdso;
-#ifdef CONFIG_X86_32
-	struct desc_struct user_cs;
-	unsigned long exec_limit;
-#endif
 } mm_context_t;
 
 #ifdef CONFIG_SMP
diff --git a/include/asm-x86/pgalloc_64.h b/include/asm-x86/pgalloc_64.h
index 982e1cb..8d67223 100644
--- a/include/asm-x86/pgalloc_64.h
+++ b/include/asm-x86/pgalloc_64.h
@@ -5,13 +5,6 @@
 #include <linux/threads.h>
 #include <linux/mm.h>
 
-#define arch_add_exec_range(mm, limit) \
-		do { (void)(mm), (void)(limit); } while (0)
-#define arch_flush_exec_range(mm) \
-		do { (void)(mm); } while (0)
-#define arch_remove_exec_range(mm, limit) \
-		do { (void)(mm), (void)(limit); } while (0)
-
 #define pmd_populate_kernel(mm, pmd, pte) \
 		set_pmd(pmd, __pmd(_PAGE_TABLE | __pa(pte)))
 #define pud_populate(mm, pud, pmd) \
diff --git a/include/asm-x86/processor.h b/include/asm-x86/processor.h
index ef01196..45a2f0a 100644
--- a/include/asm-x86/processor.h
+++ b/include/asm-x86/processor.h
@@ -674,9 +674,6 @@ extern int bootloader_type;
 extern char ignore_fpu_irq;
 #define cache_line_size() (boot_cpu_data.x86_cache_alignment)
 
-#define __HAVE_ARCH_ALIGN_STACK
-extern unsigned long arch_align_stack(unsigned long sp);
-
 #define HAVE_ARCH_PICK_MMAP_LAYOUT 1
 #define ARCH_HAS_PREFETCHW
 #define ARCH_HAS_SPINLOCK_PREFETCH
@@ -754,9 +751,6 @@ static inline void prefetchw(const void *x)
 	regs->cs = __USER_CS;					\
 	regs->ip = new_eip;					\
 	regs->sp = new_esp;					\
-	preempt_disable();					\
-	load_user_cs_desc(smp_processor_id(), current->mm);	\
-	preempt_enable();					\
 } while (0)
 
 
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 4b74dc8..3f3ccfe 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1043,13 +1043,7 @@ extern int install_special_mapping(struct mm_struct *mm,
 				   unsigned long addr, unsigned long len,
 				   unsigned long flags, struct page **pages);
 
-extern unsigned long get_unmapped_area_prot(struct file *, unsigned long, unsigned long, unsigned long, unsigned long, int);
-
-static inline unsigned long get_unmapped_area(struct file *file, unsigned long addr,
-		unsigned long len, unsigned long pgoff, unsigned long flags)
-{
-	return get_unmapped_area_prot(file, addr, len, pgoff, flags, 0);
-}
+extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
 
 extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
 	unsigned long len, unsigned long prot,
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 1f430ab..af190ce 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -163,9 +163,6 @@ struct mm_struct {
 	unsigned long (*get_unmapped_area) (struct file *filp,
 				unsigned long addr, unsigned long len,
 				unsigned long pgoff, unsigned long flags);
-       unsigned long (*get_unmapped_exec_area) (struct file *filp,
-				unsigned long addr, unsigned long len,
-				unsigned long pgoff, unsigned long flags);
 	void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
 	unsigned long mmap_base;		/* base of mmap area */
 	unsigned long task_size;		/* size of task vm space */
diff --git a/include/linux/resource.h b/include/linux/resource.h
index 14757af..ae13db7 100644
--- a/include/linux/resource.h
+++ b/include/linux/resource.h
@@ -54,11 +54,8 @@ struct rlimit {
 /*
  * Limit the stack by to some sane default: root can always
  * increase this limit if needed..  8MB seems reasonable.
- *
- * (2MB more to cover randomization effects.)
  */
-#define _STK_LIM	(10*1024*1024)
-#define EXEC_STACK_BIAS	(2*1024*1024)
+#define _STK_LIM	(8*1024*1024)
 
 /*
  * GPG wants 32kB of mlocked memory, to make sure pass phrases
diff --git a/include/linux/sched.h b/include/linux/sched.h
index a4b1a64..6361cff 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -98,9 +98,6 @@ struct futex_pi_state;
 struct robust_list_head;
 struct bio;
 
-extern int exec_shield;
-extern int print_fatal_signals;
-
 /*
  * List of flags we want to share for kernel threads,
  * if only because they are not used by them anyway.
@@ -346,10 +343,6 @@ extern int sysctl_max_map_count;
 extern unsigned long
 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
 		       unsigned long, unsigned long);
-
-extern unsigned long
-arch_get_unmapped_exec_area(struct file *, unsigned long, unsigned long,
-		       unsigned long, unsigned long);
 extern unsigned long
 arch_get_unmapped_area_topdown(struct file *filp, unsigned long addr,
 			  unsigned long len, unsigned long pgoff,
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index ea74b8c..2d35d6e 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -82,26 +82,6 @@ extern int maps_protect;
 extern int sysctl_stat_interval;
 extern int latencytop_enabled;
 
-int exec_shield = (1<<0);
-/* exec_shield is a bitmask:
- * 0: off; vdso at STACK_TOP, 1 page below TASK_SIZE
- * (1<<0) 1: on [also on if !=0]
- * (1<<1) 2: force noexecstack regardless of PT_GNU_STACK
- * The old settings
- * (1<<2) 4: vdso just below .text of main (unless too low)
- * (1<<3) 8: vdso just below .text of PT_INTERP (unless too low)
- * are ignored because the vdso is placed completely randomly
- */
-
-static int __init setup_exec_shield(char *str)
-{
-	get_option(&str, &exec_shield);
-
-	return 1;
-}
-
-__setup("exec-shield=", setup_exec_shield);
-
 /* Constants used for minimum and  maximum */
 #if defined(CONFIG_DETECT_SOFTLOCKUP) || defined(CONFIG_HIGHMEM)
 static int one = 1;
@@ -386,14 +366,6 @@ static struct ctl_table kern_table[] = {
 		.proc_handler	= &proc_dointvec,
 	},
 	{
-		.ctl_name	= CTL_UNNUMBERED,
-		.procname	= "exec-shield",
-		.data		= &exec_shield,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= &proc_dointvec,
-	},
-	{
 		.ctl_name	= KERN_CORE_USES_PID,
 		.procname	= "core_uses_pid",
 		.data		= &core_uses_pid,
diff --git a/mm/mmap.c b/mm/mmap.c
index d7c2c9d..a32d28c 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -26,7 +26,6 @@
 #include <linux/mount.h>
 #include <linux/mempolicy.h>
 #include <linux/rmap.h>
-#include <linux/random.h>
 
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
@@ -378,8 +377,6 @@ static inline void
 __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
 		struct vm_area_struct *prev, struct rb_node *rb_parent)
 {
-	if (vma->vm_flags & VM_EXEC)
-		arch_add_exec_range(mm, vma->vm_end);
 	if (prev) {
 		vma->vm_next = prev->vm_next;
 		prev->vm_next = vma;
@@ -483,8 +480,6 @@ __vma_unlink(struct mm_struct *mm, struct vm_area_struct *vma,
 	rb_erase(&vma->vm_rb, &mm->mm_rb);
 	if (mm->mmap_cache == vma)
 		mm->mmap_cache = prev;
-	if (vma->vm_flags & VM_EXEC)
-		arch_remove_exec_range(mm, vma->vm_end);
 }
 
 /*
@@ -790,8 +785,6 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
 		} else					/* cases 2, 5, 7 */
 			vma_adjust(prev, prev->vm_start,
 				end, prev->vm_pgoff, NULL);
-		if (prev->vm_flags & VM_EXEC)
-			arch_add_exec_range(mm, prev->vm_end);
 		return prev;
 	}
 
@@ -947,8 +940,7 @@ unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
 	/* Obtain the address to map to. we verify (or select) it and ensure
 	 * that it represents a valid section of the address space.
 	 */
-	addr = get_unmapped_area_prot(file, addr, len, pgoff, flags,
-		prot & PROT_EXEC);
+	addr = get_unmapped_area(file, addr, len, pgoff, flags);
 	if (addr & ~PAGE_MASK)
 		return addr;
 
@@ -1418,17 +1410,13 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
 }
 
 unsigned long
-get_unmapped_area_prot(struct file *file, unsigned long addr, unsigned long len,
-		unsigned long pgoff, unsigned long flags, int exec)
+get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
+		unsigned long pgoff, unsigned long flags)
 {
 	unsigned long (*get_area)(struct file *, unsigned long,
 				  unsigned long, unsigned long, unsigned long);
 
-	if (exec && current->mm->get_unmapped_exec_area)
-		get_area = current->mm->get_unmapped_exec_area;
-	else
-		get_area = current->mm->get_unmapped_area;
-
+	get_area = current->mm->get_unmapped_area;
 	if (file && file->f_op && file->f_op->get_unmapped_area)
 		get_area = file->f_op->get_unmapped_area;
 	addr = get_area(file, addr, len, pgoff, flags);
@@ -1442,74 +1430,8 @@ get_unmapped_area_prot(struct file *file, unsigned long addr, unsigned long len,
 
 	return arch_rebalance_pgtables(addr, len);
 }
-EXPORT_SYMBOL(get_unmapped_area_prot);
-
-#define SHLIB_BASE             0x00110000
-
-unsigned long arch_get_unmapped_exec_area(struct file *filp, unsigned long addr0,
-		unsigned long len0, unsigned long pgoff, unsigned long flags)
-{
-	unsigned long addr = addr0, len = len0;
-	struct mm_struct *mm = current->mm;
-	struct vm_area_struct *vma;
-	unsigned long tmp;
-
-	if (len > TASK_SIZE)
-		return -ENOMEM;
-
-	if (flags & MAP_FIXED)
-		return addr;
-
-	if (!addr) {
-		addr = randomize_range(SHLIB_BASE, 0x01000000, len);
-	} else {
-		addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
-		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
-			return addr;
-	}
-
-	addr = SHLIB_BASE;
-	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
-		/* At this point:  (!vma || addr < vma->vm_end). */
-		if (TASK_SIZE - len < addr)
-			return -ENOMEM;
-
-		if (!vma || addr + len <= vma->vm_start) {
-			/*
-			 * Must not let a PROT_EXEC mapping get into the
-			 * brk area:
-			 */
-			if (addr + len > mm->brk)
-				goto failed;
-
-			/*
-			 * Up until the brk area we randomize addresses
-			 * as much as possible:
-			 */
-			if (addr >= 0x01000000) {
-				tmp = randomize_range(0x01000000,
-					PAGE_ALIGN(max(mm->start_brk,
-					(unsigned long)0x08000000)), len);
-				vma = find_vma(mm, tmp);
-				if (TASK_SIZE - len >= tmp &&
-				    (!vma || tmp + len <= vma->vm_start))
-					return tmp;
-			}
-			/*
-			 * Ok, randomization didnt work out - return
-			 * the result of the linear search:
-			 */
-			return addr;
-		}
-		addr = vma->vm_end;
-	}
-
-failed:
-	return current->mm->get_unmapped_area(filp, addr0, len0, pgoff, flags);
-}
 
+EXPORT_SYMBOL(get_unmapped_area);
 
 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
 struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long addr)
@@ -1584,14 +1506,6 @@ out:
 	return prev ? prev->vm_next : vma;
 }
 
-static int over_stack_limit(unsigned long sz)
-{
-	if (sz < EXEC_STACK_BIAS)
-		return 0;
-	return (sz - EXEC_STACK_BIAS) >
-			current->signal->rlim[RLIMIT_STACK].rlim_cur;
-}
-
 /*
  * Verify that the stack growth is acceptable and
  * update accounting. This is shared with both the
@@ -1608,7 +1522,7 @@ static int acct_stack_growth(struct vm_area_struct * vma, unsigned long size, un
 		return -ENOMEM;
 
 	/* Stack limit test */
-	if (over_stack_limit(size))
+	if (size > rlim[RLIMIT_STACK].rlim_cur)
 		return -ENOMEM;
 
 	/* mlock limit tests */
@@ -1912,14 +1826,10 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
 	if (new->vm_ops && new->vm_ops->open)
 		new->vm_ops->open(new);
 
-	if (new_below) {
-		unsigned long old_end = vma->vm_end;
-
+	if (new_below)
 		vma_adjust(vma, addr, vma->vm_end, vma->vm_pgoff +
 			((addr - new->vm_start) >> PAGE_SHIFT), new);
-		if (vma->vm_flags & VM_EXEC)
-			arch_remove_exec_range(mm, old_end);
-	} else
+	else
 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
 
 	return 0;
@@ -2138,7 +2048,6 @@ void exit_mmap(struct mm_struct *mm)
 	vm_unacct_memory(nr_accounted);
 	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, 0);
 	tlb_finish_mmu(tlb, 0, end);
-	arch_flush_exec_range(mm);
 
 	/*
 	 * Walk the list again, actually closing and freeing it,
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 6d822ad..4de5468 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -23,12 +23,8 @@
 #include <linux/swapops.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
-#include <asm/pgalloc.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
-#ifdef CONFIG_X86
-#include <asm/desc.h>
-#endif
 
 static void change_pte_range(struct mm_struct *mm, pmd_t *pmd,
 		unsigned long addr, unsigned long end, pgprot_t newprot,
@@ -138,7 +134,7 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
 	struct mm_struct *mm = vma->vm_mm;
 	unsigned long oldflags = vma->vm_flags;
 	long nrpages = (end - start) >> PAGE_SHIFT;
-	unsigned long charged = 0, old_end = vma->vm_end;
+	unsigned long charged = 0;
 	pgoff_t pgoff;
 	int error;
 	int dirty_accountable = 0;
@@ -202,9 +198,6 @@ success:
 		dirty_accountable = 1;
 	}
 
-	if (oldflags & VM_EXEC)
-		arch_remove_exec_range(current->mm, old_end);
-
 	if (is_vm_hugetlb_page(vma))
 		hugetlb_change_protection(vma, start, end, vma->vm_page_prot);
 	else
diff --git a/mm/mremap.c b/mm/mremap.c
index 101f885..08e3c7f 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -392,8 +392,8 @@ unsigned long do_mremap(unsigned long addr,
 			if (vma->vm_flags & VM_MAYSHARE)
 				map_flags |= MAP_SHARED;
 
-			new_addr = get_unmapped_area_prot(vma->vm_file, 0, new_len,
-				vma->vm_pgoff, map_flags, vma->vm_flags & VM_EXEC);
+			new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
+						vma->vm_pgoff, map_flags);
 			if (new_addr & ~PAGE_MASK) {
 				ret = new_addr;
 				goto out;
-- 
1.5.4.1


linux-2.6-xen-0002-squashfs-Fix-build-without-CONFIG_SMP.patch:

--- NEW FILE linux-2.6-xen-0002-squashfs-Fix-build-without-CONFIG_SMP.patch ---
>From 1fa2a8ec8dd7f0a05035b50dec00a92710dab698 Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc at redhat.com>
Date: Wed, 5 Mar 2008 12:50:50 +0000
Subject: [PATCH] squashfs: Fix build without CONFIG_SMP

wait_event() needs various definitions from <linux/sched.h>

With CONFIG_SMP, <linux/smp_lock.h> pulls in <linux/sched.h>,
but without CONFIG_SMP it fails to build.

Signed-off-by: Mark McLoughlin <markmc at redhat.com>
---
 fs/squashfs/inode.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index f578528..f5829f2 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -32,6 +32,7 @@
 #include <linux/vmalloc.h>
 #include <linux/smp_lock.h>
 #include <linux/exportfs.h>
+#include <linux/sched.h>
 
 #include "squashfs.h"
 
-- 
1.5.4.1


linux-2.6-xen-0003-xen-Make-hvc0-the-preferred-console-in-domU.patch:

--- NEW FILE linux-2.6-xen-0003-xen-Make-hvc0-the-preferred-console-in-domU.patch ---
>From 8085f21aff0de59e5c2f6937823040dff8a003ed Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru at redhat.com>
Date: Fri, 29 Feb 2008 17:37:43 +0000
Subject: [PATCH] xen: Make hvc0 the preferred console in domU

This makes the Xen console just work.  Before, you had to ask for it
on the kernel command line with console=hvc0

Signed-off-by: Markus Armbruster <armbru at redhat.com>
Signed-off-by: Mark McLoughlin <markmc at redhat.com>
---
 arch/x86/xen/enlighten.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 8b9ee27..a94605e 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -25,6 +25,7 @@
 #include <linux/mm.h>
 #include <linux/page-flags.h>
 #include <linux/highmem.h>
+#include <linux/console.h>
 
 #include <xen/interface/xen.h>
 #include <xen/interface/physdev.h>
@@ -1210,6 +1211,9 @@ asmlinkage void __init xen_start_kernel(void)
 		? __pa(xen_start_info->mod_start) : 0;
 	boot_params.hdr.ramdisk_size = xen_start_info->mod_len;
 
+	if (!is_initial_xendomain())
+		add_preferred_console("hvc", 0, NULL);
+
 	/* Start the world */
 	start_kernel();
 }
-- 
1.5.4.1


linux-2.6-xen-0004-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch:

--- NEW FILE linux-2.6-xen-0004-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch ---
>From 6007e6d44bea69bc39ddb3a45185a1b4f3d42f06 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru at redhat.com>
Date: Mon, 25 Feb 2008 14:02:24 +0100
Subject: [PATCH] xen: Make xen-blkfront write its protocol ABI to xenstore

Frontends are expected to write their protocol ABI to xenstore.  Since
the protocol ABI defaults to the backend's native ABI, things work
fine without that as long as the frontend's native ABI is identical to
the backend's native ABI.  This is not the case for xen-blkfront
running 32-on-64, because its ABI differs between 32 and 64 bit, and
thus needs this fix.

Based on http://xenbits.xensource.com/xen-unstable.hg?rev/c545932a18f3
and http://xenbits.xensource.com/xen-unstable.hg?rev/ffe52263b430 by
Gerd Hoffmann <kraxel at suse.de>

Signed-off-by: Markus Armbruster <armbru at redhat.com>
---
 drivers/block/xen-blkfront.c         |    7 +++++++
 include/xen/interface/io/protocols.h |   21 +++++++++++++++++++++
 2 files changed, 28 insertions(+), 0 deletions(-)
 create mode 100644 include/xen/interface/io/protocols.h

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 9c6f3f9..2e7c81e 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -47,6 +47,7 @@
 
 #include <xen/interface/grant_table.h>
 #include <xen/interface/io/blkif.h>
+#include <xen/interface/io/protocols.h>
 
 #include <asm/xen/hypervisor.h>
 
@@ -614,6 +615,12 @@ again:
 		message = "writing event-channel";
 		goto abort_transaction;
 	}
+	err = xenbus_printf(xbt, dev->nodename, "protocol", "%s",
+			    XEN_IO_PROTO_ABI_NATIVE);
+	if (err) {
+		message = "writing protocol";
+		goto abort_transaction;
+	}
 
 	err = xenbus_transaction_end(xbt, 0);
 	if (err) {
diff --git a/include/xen/interface/io/protocols.h b/include/xen/interface/io/protocols.h
new file mode 100644
index 0000000..01fc8ae
--- /dev/null
+++ b/include/xen/interface/io/protocols.h
@@ -0,0 +1,21 @@
+#ifndef __XEN_PROTOCOLS_H__
+#define __XEN_PROTOCOLS_H__
+
+#define XEN_IO_PROTO_ABI_X86_32     "x86_32-abi"
+#define XEN_IO_PROTO_ABI_X86_64     "x86_64-abi"
+#define XEN_IO_PROTO_ABI_IA64       "ia64-abi"
+#define XEN_IO_PROTO_ABI_POWERPC64  "powerpc64-abi"
+
+#if defined(__i386__)
+# define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_X86_32
+#elif defined(__x86_64__)
+# define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_X86_64
+#elif defined(__ia64__)
+# define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_IA64
+#elif defined(__powerpc64__)
+# define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_POWERPC64
+#else
+# error arch fixup needed here
+#endif
+
+#endif
-- 
1.5.4.1


linux-2.6-xen-0005-fbdev-Make-deferred-I-O-work-as-advertized.patch:

--- NEW FILE linux-2.6-xen-0005-fbdev-Make-deferred-I-O-work-as-advertized.patch ---
>From 014bae01b0076eb96cd5ba1013253623dba06254 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru at redhat.com>
Date: Mon, 25 Feb 2008 14:03:52 +0100
Subject: [PATCH] fbdev: Make deferred I/O work as advertized

Deferred I/O was utterly broken.  Reading the mmap()ed framebuffer
worked, but writing it made the VM endlessly invoke
vm_ops.page_mkwrite().  That happened because we failed to set
page->mapping and page->index.

The fix is to set them, and clean up properly before the framebuffer
gets released.

Fix extracted from this linux-fbdev-devel message:

    Subject: [PATCH 1/1 2.6.24] fbdev: defio and Metronomefb
    From: Jaya Kumar <jayakumar.lkml at gmail.com>
    Date: 2008-02-18 13:41:26

Signed-off-by: Jaya Kumar <jayakumar.lkml at gmail.com>
Signed-off-by: Markus Armbruster <armbru at redhat.com>
---
 drivers/video/fb_defio.c |   22 ++++++++++++++++++++--
 1 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c
index 0f8cfb9..24843fd 100644
--- a/drivers/video/fb_defio.c
+++ b/drivers/video/fb_defio.c
@@ -4,7 +4,7 @@
  *  Copyright (C) 2006 Jaya Kumar
  *
  * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file COPYING in the main directory of this archive
+ * License. See the file COPYING in the main directory of this archive
  * for more details.
  */
 
@@ -31,7 +31,7 @@ static int fb_deferred_io_fault(struct vm_area_struct *vma,
 	unsigned long offset;
 	struct page *page;
 	struct fb_info *info = vma->vm_private_data;
-	/* info->screen_base is in System RAM */
+	/* info->screen_base is virtual memory */
 	void *screen_base = (void __force *) info->screen_base;
 
 	offset = vmf->pgoff << PAGE_SHIFT;
@@ -43,6 +43,15 @@ static int fb_deferred_io_fault(struct vm_area_struct *vma,
 		return VM_FAULT_SIGBUS;
 
 	get_page(page);
+
+	if (vma->vm_file)
+		page->mapping = vma->vm_file->f_mapping;
+	else
+		printk(KERN_ERR "no mapping available\n");
+
+	BUG_ON(!page->mapping);
+	page->index = vmf->pgoff;
+
 	vmf->page = page;
 	return 0;
 }
@@ -138,11 +147,20 @@ EXPORT_SYMBOL_GPL(fb_deferred_io_init);
 
 void fb_deferred_io_cleanup(struct fb_info *info)
 {
+	void *screen_base = (void __force *) info->screen_base;
 	struct fb_deferred_io *fbdefio = info->fbdefio;
+	struct page *page;
+	int i;
 
 	BUG_ON(!fbdefio);
 	cancel_delayed_work(&info->deferred_work);
 	flush_scheduled_work();
+
+	/* clear out the mapping that we setup */
+	for (i = 0 ; i < info->fix.smem_len; i += PAGE_SIZE) {
+		page = vmalloc_to_page(screen_base + i);
+		page->mapping = NULL;
+	}
 }
 EXPORT_SYMBOL_GPL(fb_deferred_io_cleanup);
 
-- 
1.5.4.1


linux-2.6-xen-0006-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch:

--- NEW FILE linux-2.6-xen-0006-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch ---
>From 38a7237d6e5d70a4deafc7ef14e90c76b391834f Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru at redhat.com>
Date: Mon, 25 Feb 2008 14:06:46 +0100
Subject: [PATCH] xen pvfb: Para-virtual framebuffer, keyboard and pointer driver

This is a pair of Xen para-virtual frontend device drivers:
drivers/video/xen-fbfront.c provides a framebuffer, and
drivers/input/xen-kbdfront provides keyboard and mouse.

The backends run in dom0 user space.

The two drivers are not in two separate patches, because the
intermediate step (one driver, not the other) is somewhat problematic:
the backend in dom0 needs both drivers, and will refuse to complete
device initialization unless they're both present.

Signed-off-by: Markus Armbruster <armbru at redhat.com>
---
 drivers/input/Kconfig            |    9 +
 drivers/input/Makefile           |    2 +
 drivers/input/xen-kbdfront.c     |  340 +++++++++++++++++++++++
 drivers/video/Kconfig            |   14 +
 drivers/video/Makefile           |    1 +
 drivers/video/xen-fbfront.c      |  550 ++++++++++++++++++++++++++++++++++++++
 include/xen/interface/io/fbif.h  |  124 +++++++++
 include/xen/interface/io/kbdif.h |  114 ++++++++
 8 files changed, 1154 insertions(+), 0 deletions(-)
 create mode 100644 drivers/input/xen-kbdfront.c
 create mode 100644 drivers/video/xen-fbfront.c
 create mode 100644 include/xen/interface/io/fbif.h
 create mode 100644 include/xen/interface/io/kbdif.h

diff --git a/drivers/input/Kconfig b/drivers/input/Kconfig
index d84ac4a..747633c 100644
--- a/drivers/input/Kconfig
+++ b/drivers/input/Kconfig
@@ -149,6 +149,15 @@ config INPUT_APMPOWER
 	  To compile this driver as a module, choose M here: the
 	  module will be called apm-power.
 
+config XEN_KBDDEV_FRONTEND
+	tristate "Xen virtual keyboard and mouse support"
+	depends on XEN_FBDEV_FRONTEND
+	default y
+	help
+	  This driver implements the front-end of the Xen virtual
+	  keyboard and mouse device driver.  It communicates with a back-end
+	  in another domain.
+
 comment "Input Device Drivers"
 
 source "drivers/input/keyboard/Kconfig"
diff --git a/drivers/input/Makefile b/drivers/input/Makefile
index 24bdec1..606e1b9 100644
--- a/drivers/input/Makefile
+++ b/drivers/input/Makefile
@@ -24,3 +24,5 @@ obj-$(CONFIG_INPUT_MISC)	+= misc/
 obj-$(CONFIG_INPUT_LIRC)	+= lirc/
 
 obj-$(CONFIG_INPUT_APMPOWER)	+= apm-power.o
+
+obj-$(CONFIG_XEN_KBDDEV_FRONTEND)	+= xen-kbdfront.o
diff --git a/drivers/input/xen-kbdfront.c b/drivers/input/xen-kbdfront.c
new file mode 100644
index 0000000..0f47f46
--- /dev/null
+++ b/drivers/input/xen-kbdfront.c
@@ -0,0 +1,340 @@
+/*
+ * Xen para-virtual input device
+ *
+ * Copyright (C) 2005 Anthony Liguori <aliguori at us.ibm.com>
+ * Copyright (C) 2006-2008 Red Hat, Inc., Markus Armbruster <armbru at redhat.com>
+ *
+ *  Based on linux/drivers/input/mouse/sermouse.c
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License. See the file COPYING in the main directory of this archive for
+ *  more details.
+ */
+
+/*
+ * TODO:
+ *
+ * Switch to grant tables together with xen-fbfront.c.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <linux/input.h>
+#include <asm/xen/hypervisor.h>
+#include <xen/events.h>
+#include <xen/page.h>
+#include <xen/interface/io/fbif.h>
+#include <xen/interface/io/kbdif.h>
+#include <xen/xenbus.h>
+
+struct xenkbd_info {
+	struct input_dev *kbd;
+	struct input_dev *ptr;
+	struct xenkbd_page *page;
+	int irq;
+	struct xenbus_device *xbdev;
+	char phys[32];
+};
+
+static int xenkbd_remove(struct xenbus_device *);
+static int xenkbd_connect_backend(struct xenbus_device *, struct xenkbd_info *);
+static void xenkbd_disconnect_backend(struct xenkbd_info *);
+
+/*
+ * Note: if you need to send out events, see xenfb_do_update() for how
+ * to do that.
+ */
+
+static irqreturn_t input_handler(int rq, void *dev_id)
+{
+	struct xenkbd_info *info = dev_id;
+	struct xenkbd_page *page = info->page;
+	__u32 cons, prod;
+
+	prod = page->in_prod;
+	if (prod == page->in_cons)
+		return IRQ_HANDLED;
+	rmb();			/* ensure we see ring contents up to prod */
+	for (cons = page->in_cons; cons != prod; cons++) {
+		union xenkbd_in_event *event;
+		struct input_dev *dev;
+		event = &XENKBD_IN_RING_REF(page, cons);
+
+		dev = info->ptr;
+		switch (event->type) {
+		case XENKBD_TYPE_MOTION:
+			input_report_rel(dev, REL_X, event->motion.rel_x);
+			input_report_rel(dev, REL_Y, event->motion.rel_y);
+			break;
+		case XENKBD_TYPE_KEY:
+			dev = NULL;
+			if (test_bit(event->key.keycode, info->kbd->keybit))
+				dev = info->kbd;
+			if (test_bit(event->key.keycode, info->ptr->keybit))
+				dev = info->ptr;
+			if (dev)
+				input_report_key(dev, event->key.keycode,
+						 event->key.pressed);
+			else
+				printk(KERN_WARNING
+				       "xenkbd: unhandled keycode 0x%x\n",
+				       event->key.keycode);
+			break;
+		case XENKBD_TYPE_POS:
+			input_report_abs(dev, ABS_X, event->pos.abs_x);
+			input_report_abs(dev, ABS_Y, event->pos.abs_y);
+			break;
+		}
+		if (dev)
+			input_sync(dev);
+	}
+	mb();			/* ensure we got ring contents */
+	page->in_cons = cons;
+	notify_remote_via_irq(info->irq);
+
+	return IRQ_HANDLED;
+}
+
+static int __devinit xenkbd_probe(struct xenbus_device *dev,
+				  const struct xenbus_device_id *id)
+{
+	int ret, i;
+	struct xenkbd_info *info;
+	struct input_dev *kbd, *ptr;
+
+	info = kzalloc(sizeof(*info), GFP_KERNEL);
+	if (!info) {
+		xenbus_dev_fatal(dev, -ENOMEM, "allocating info structure");
+		return -ENOMEM;
+	}
+	dev->dev.driver_data = info;
+	info->xbdev = dev;
+	info->irq = -1;
+	snprintf(info->phys, sizeof(info->phys), "xenbus/%s", dev->nodename);
+
+	info->page = (void *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
+	if (!info->page)
+		goto error_nomem;
+
+	/* keyboard */
+	kbd = input_allocate_device();
+	if (!kbd)
+		goto error_nomem;
+	kbd->name = "Xen Virtual Keyboard";
+	kbd->phys = info->phys;
+	kbd->id.bustype = BUS_PCI;
+	kbd->id.vendor = 0x5853;
+	kbd->id.product = 0xffff;
+	kbd->evbit[0] = BIT(EV_KEY);
+	for (i = KEY_ESC; i < KEY_UNKNOWN; i++)
+		set_bit(i, kbd->keybit);
+	for (i = KEY_OK; i < KEY_MAX; i++)
+		set_bit(i, kbd->keybit);
+
+	ret = input_register_device(kbd);
+	if (ret) {
+		input_free_device(kbd);
+		xenbus_dev_fatal(dev, ret, "input_register_device(kbd)");
+		goto error;
+	}
+	info->kbd = kbd;
+
+	/* pointing device */
+	ptr = input_allocate_device();
+	if (!ptr)
+		goto error_nomem;
+	ptr->name = "Xen Virtual Pointer";
+	ptr->phys = info->phys;
+	ptr->id.bustype = BUS_PCI;
+	ptr->id.vendor = 0x5853;
+	ptr->id.product = 0xfffe;
+	ptr->evbit[0] = BIT(EV_KEY) | BIT(EV_REL) | BIT(EV_ABS);
+	for (i = BTN_LEFT; i <= BTN_TASK; i++)
+		set_bit(i, ptr->keybit);
+	ptr->relbit[0] = BIT(REL_X) | BIT(REL_Y);
+	input_set_abs_params(ptr, ABS_X, 0, XENFB_WIDTH, 0, 0);
+	input_set_abs_params(ptr, ABS_Y, 0, XENFB_HEIGHT, 0, 0);
+
+	ret = input_register_device(ptr);
+	if (ret) {
+		input_free_device(ptr);
+		xenbus_dev_fatal(dev, ret, "input_register_device(ptr)");
+		goto error;
+	}
+	info->ptr = ptr;
+
+	ret = xenkbd_connect_backend(dev, info);
+	if (ret < 0)
+		goto error;
+
+	return 0;
+
+ error_nomem:
+	ret = -ENOMEM;
+	xenbus_dev_fatal(dev, ret, "allocating device memory");
+ error:
+	xenkbd_remove(dev);
+	return ret;
+}
+
+static int xenkbd_resume(struct xenbus_device *dev)
+{
+	struct xenkbd_info *info = dev->dev.driver_data;
+
+	xenkbd_disconnect_backend(info);
+	memset(info->page, 0, PAGE_SIZE);
+	return xenkbd_connect_backend(dev, info);
+}
+
+static int xenkbd_remove(struct xenbus_device *dev)
+{
+	struct xenkbd_info *info = dev->dev.driver_data;
+
+	xenkbd_disconnect_backend(info);
+	if (info->kbd)
+		input_unregister_device(info->kbd);
+	if (info->ptr)
+		input_unregister_device(info->ptr);
+	free_page((unsigned long)info->page);
+	kfree(info);
+	return 0;
+}
+
+static int xenkbd_connect_backend(struct xenbus_device *dev,
+				  struct xenkbd_info *info)
+{
+	int ret, evtchn;
+	struct xenbus_transaction xbt;
+
+	ret = xenbus_alloc_evtchn(dev, &evtchn);
+	if (ret)
+		return ret;
+	ret = bind_evtchn_to_irqhandler(evtchn, input_handler,
+					0, dev->devicetype, info);
+	if (ret < 0) {
+		xenbus_free_evtchn(dev, evtchn);
+		xenbus_dev_fatal(dev, ret, "bind_evtchn_to_irqhandler");
+		return ret;
+	}
+	info->irq = ret;
+
+ again:
+	ret = xenbus_transaction_start(&xbt);
+	if (ret) {
+		xenbus_dev_fatal(dev, ret, "starting transaction");
+		return ret;
+	}
+	ret = xenbus_printf(xbt, dev->nodename, "page-ref", "%lu",
+			    virt_to_mfn(info->page));
+	if (ret)
+		goto error_xenbus;
+	ret = xenbus_printf(xbt, dev->nodename, "event-channel", "%u",
+			    evtchn);
+	if (ret)
+		goto error_xenbus;
+	ret = xenbus_transaction_end(xbt, 0);
+	if (ret) {
+		if (ret == -EAGAIN)
+			goto again;
+		xenbus_dev_fatal(dev, ret, "completing transaction");
+		return ret;
+	}
+
+	xenbus_switch_state(dev, XenbusStateInitialised);
+	return 0;
+
+ error_xenbus:
+	xenbus_transaction_end(xbt, 1);
+	xenbus_dev_fatal(dev, ret, "writing xenstore");
+	return ret;
+}
+
+static void xenkbd_disconnect_backend(struct xenkbd_info *info)
+{
+	if (info->irq >= 0)
+		unbind_from_irqhandler(info->irq, info);
+	info->irq = -1;
+}
+
+static void xenkbd_backend_changed(struct xenbus_device *dev,
+				   enum xenbus_state backend_state)
+{
+	struct xenkbd_info *info = dev->dev.driver_data;
+	int ret, val;
+
+	switch (backend_state) {
+	case XenbusStateInitialising:
+	case XenbusStateInitialised:
+	case XenbusStateUnknown:
+	case XenbusStateClosed:
+		break;
+
+	case XenbusStateInitWait:
+InitWait:
+		ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+				   "feature-abs-pointer", "%d", &val);
+		if (ret < 0)
+			val = 0;
+		if (val) {
+			ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
+					    "request-abs-pointer", "1");
+			if (ret)
+				printk(KERN_WARNING
+				       "xenkbd: can't request abs-pointer");
+		}
+		xenbus_switch_state(dev, XenbusStateConnected);
+		break;
+
+	case XenbusStateConnected:
+		/*
+		 * Work around xenbus race condition: If backend goes
+		 * through InitWait to Connected fast enough, we can
+		 * get Connected twice here.
+		 */
+		if (dev->state != XenbusStateConnected)
+			goto InitWait; /* no InitWait seen yet, fudge it */
+		break;
+
+	case XenbusStateClosing:
+		xenbus_frontend_closed(dev);
+		break;
+	}
+}
+
+static struct xenbus_device_id xenkbd_ids[] = {
+	{ "vkbd" },
+	{ "" }
+};
+
+static struct xenbus_driver xenkbd = {
+	.name = "vkbd",
+	.owner = THIS_MODULE,
+	.ids = xenkbd_ids,
+	.probe = xenkbd_probe,
+	.remove = xenkbd_remove,
+	.resume = xenkbd_resume,
+	.otherend_changed = xenkbd_backend_changed,
+};
+
+static int __init xenkbd_init(void)
+{
+	if (!is_running_on_xen())
+		return -ENODEV;
+
+	/* Nothing to do if running in dom0. */
+	if (is_initial_xendomain())
+		return -ENODEV;
+
+	return xenbus_register_frontend(&xenkbd);
+}
+
+static void __exit xenkbd_cleanup(void)
+{
+	xenbus_unregister_driver(&xenkbd);
+}
+
+module_init(xenkbd_init);
+module_exit(xenkbd_cleanup);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 758435f..67de177 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1903,6 +1903,20 @@ config FB_VIRTUAL
 
 	  If unsure, say N.
 
+config XEN_FBDEV_FRONTEND
+	tristate "Xen virtual frame buffer support"
+	depends on FB && XEN
+	select FB_SYS_FILLRECT
+	select FB_SYS_COPYAREA
+	select FB_SYS_IMAGEBLIT
+	select FB_SYS_FOPS
+	select FB_DEFERRED_IO
+	default y
+	help
+	  This driver implements the front-end of the Xen virtual
+	  frame buffer driver.  It communicates with a back-end
+	  in another domain.
+
 source "drivers/video/omap/Kconfig"
 
 source "drivers/video/backlight/Kconfig"
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 83e02b3..d3ab9b2 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -113,6 +113,7 @@ obj-$(CONFIG_FB_PS3)		  += ps3fb.o
 obj-$(CONFIG_FB_SM501)            += sm501fb.o
 obj-$(CONFIG_FB_XILINX)           += xilinxfb.o
 obj-$(CONFIG_FB_OMAP)             += omap/
+obj-$(CONFIG_XEN_FBDEV_FRONTEND)  += xen-fbfront.o
 
 # Platform or fallback drivers go here
 obj-$(CONFIG_FB_UVESA)            += uvesafb.o
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
new file mode 100644
index 0000000..619a6f8
--- /dev/null
+++ b/drivers/video/xen-fbfront.c
@@ -0,0 +1,550 @@
+/*
+ * Xen para-virtual frame buffer device
+ *
+ * Copyright (C) 2005-2006 Anthony Liguori <aliguori at us.ibm.com>
+ * Copyright (C) 2006-2008 Red Hat, Inc., Markus Armbruster <armbru at redhat.com>
+ *
+ *  Based on linux/drivers/video/q40fb.c
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License. See the file COPYING in the main directory of this archive for
+ *  more details.
+ */
+
+/*
+ * TODO:
+ *
+ * Switch to grant tables when they become capable of dealing with the
+ * frame buffer.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/fb.h>
+#include <linux/module.h>
+#include <linux/vmalloc.h>
+#include <linux/mm.h>
+#include <asm/xen/hypervisor.h>
+#include <xen/events.h>
+#include <xen/page.h>
+#include <xen/interface/io/fbif.h>
+#include <xen/interface/io/protocols.h>
+#include <xen/xenbus.h>
+
+struct xenfb_info {
+	unsigned char		*fb;
+	struct fb_info		*fb_info;
+	int			x1, y1, x2, y2;	/* dirty rectangle,
+						   protected by dirty_lock */
+	spinlock_t		dirty_lock;
+	int			nr_pages;
+	int			irq;
+	struct xenfb_page	*page;
+	unsigned long 		*mfns;
+	int			update_wanted; /* XENFB_TYPE_UPDATE wanted */
+
+	struct xenbus_device	*xbdev;
+};
+
+static u32 xenfb_mem_len = XENFB_WIDTH * XENFB_HEIGHT * XENFB_DEPTH / 8;
+
+static int xenfb_remove(struct xenbus_device *);
+static void xenfb_init_shared_page(struct xenfb_info *);
+static int xenfb_connect_backend(struct xenbus_device *, struct xenfb_info *);
+static void xenfb_disconnect_backend(struct xenfb_info *);
+
+static void xenfb_do_update(struct xenfb_info *info,
+			    int x, int y, int w, int h)
+{
+	union xenfb_out_event event;
+	u32 prod;
+
+	event.type = XENFB_TYPE_UPDATE;
+	event.update.x = x;
+	event.update.y = y;
+	event.update.width = w;
+	event.update.height = h;
+
+	prod = info->page->out_prod;
+	/* caller ensures !xenfb_queue_full() */
+	mb();			/* ensure ring space available */
+	XENFB_OUT_RING_REF(info->page, prod) = event;
+	wmb();			/* ensure ring contents visible */
+	info->page->out_prod = prod + 1;
+
+	notify_remote_via_irq(info->irq);
+}
+
+static int xenfb_queue_full(struct xenfb_info *info)
+{
+	u32 cons, prod;
+
+	prod = info->page->out_prod;
+	cons = info->page->out_cons;
+	return prod - cons == XENFB_OUT_RING_LEN;
+}
+
+static void xenfb_refresh(struct xenfb_info *info,
+			  int x1, int y1, int w, int h)
+{
+	unsigned long flags;
+	int y2 = y1 + h - 1;
+	int x2 = x1 + w - 1;
+
+	if (!info->update_wanted)
+		return;
+
+	spin_lock_irqsave(&info->dirty_lock, flags);
+
+	/* Combine with dirty rectangle: */
+	if (info->y1 < y1)
+		y1 = info->y1;
+	if (info->y2 > y2)
+		y2 = info->y2;
+	if (info->x1 < x1)
+		x1 = info->x1;
+	if (info->x2 > x2)
+		x2 = info->x2;
+
+	if (xenfb_queue_full(info)) {
+		/* Can't send right now, stash it in the dirty rectangle */
+		info->x1 = x1;
+		info->x2 = x2;
+		info->y1 = y1;
+		info->y2 = y2;
+		spin_unlock_irqrestore(&info->dirty_lock, flags);
+		return;
+	}
+
+	/* Clear dirty rectangle: */
+	info->x1 = info->y1 = INT_MAX;
+	info->x2 = info->y2 = 0;
+
+	spin_unlock_irqrestore(&info->dirty_lock, flags);
+
+	if (x1 <= x2 && y1 <= y2)
+		xenfb_do_update(info, x1, y1, x2 - x1 + 1, y2 - y1 + 1);
+}
+
+static void xenfb_deferred_io(struct fb_info *fb_info,
+			      struct list_head *pagelist)
+{
+	struct xenfb_info *info = fb_info->par;
+	struct page *page;
+	unsigned long beg, end;
+	int y1, y2, miny, maxy;
+
+	miny = INT_MAX;
+	maxy = 0;
+	list_for_each_entry(page, pagelist, lru) {
+		beg = page->index << PAGE_SHIFT;
+		end = beg + PAGE_SIZE - 1;
+		y1 = beg / fb_info->fix.line_length;
+		y2 = end / fb_info->fix.line_length;
+		if (y2 >= fb_info->var.yres)
+			y2 = fb_info->var.yres - 1;
+		if (miny > y1)
+			miny = y1;
+		if (maxy < y2)
+			maxy = y2;
+	}
+	xenfb_refresh(info, 0, miny, fb_info->var.xres, maxy - miny + 1);
+}
+
+static struct fb_deferred_io xenfb_defio = {
+	.delay		= HZ / 20,
+	.deferred_io	= xenfb_deferred_io,
+};
+
+static int xenfb_setcolreg(unsigned regno, unsigned red, unsigned green,
+			   unsigned blue, unsigned transp,
+			   struct fb_info *info)
+{
+	u32 v;
+
+	if (regno > info->cmap.len)
+		return 1;
+
+#define CNVT_TOHW(val, width) ((((val)<<(width))+0x7FFF-(val))>>16)
+	red = CNVT_TOHW(red, info->var.red.length);
+	green = CNVT_TOHW(green, info->var.green.length);
+	blue = CNVT_TOHW(blue, info->var.blue.length);
+	transp = CNVT_TOHW(transp, info->var.transp.length);
+#undef CNVT_TOHW
+
+	v = (red << info->var.red.offset) |
+	    (green << info->var.green.offset) |
+	    (blue << info->var.blue.offset);
+
+	switch (info->var.bits_per_pixel) {
+	case 16:
+	case 24:
+	case 32:
+		((u32 *)info->pseudo_palette)[regno] = v;
+		break;
+	}
+
+	return 0;
+}
+
+static void xenfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
+{
+	struct xenfb_info *info = p->par;
+
+	sys_fillrect(p, rect);
+	xenfb_refresh(info, rect->dx, rect->dy, rect->width, rect->height);
+}
+
+static void xenfb_imageblit(struct fb_info *p, const struct fb_image *image)
+{
+	struct xenfb_info *info = p->par;
+
+	sys_imageblit(p, image);
+	xenfb_refresh(info, image->dx, image->dy, image->width, image->height);
+}
+
+static void xenfb_copyarea(struct fb_info *p, const struct fb_copyarea *area)
+{
+	struct xenfb_info *info = p->par;
+
+	sys_copyarea(p, area);
+	xenfb_refresh(info, area->dx, area->dy, area->width, area->height);
+}
+
+static ssize_t xenfb_write(struct fb_info *p, const char __user *buf,
+			size_t count, loff_t *ppos)
+{
+	struct xenfb_info *info = p->par;
+	ssize_t res;
+
+	res = fb_sys_write(p, buf, count, ppos);
+	xenfb_refresh(info, 0, 0, info->page->width, info->page->height);
+	return res;
+}
+
+static struct fb_ops xenfb_fb_ops = {
+	.owner		= THIS_MODULE,
+	.fb_read	= fb_sys_read,
+	.fb_write	= xenfb_write,
+	.fb_setcolreg	= xenfb_setcolreg,
+	.fb_fillrect	= xenfb_fillrect,
+	.fb_copyarea	= xenfb_copyarea,
+	.fb_imageblit	= xenfb_imageblit,
+};
+
+static irqreturn_t xenfb_event_handler(int rq, void *dev_id)
+{
+	/*
+	 * No in events recognized, simply ignore them all.
+	 * If you need to recognize some, see xen-kbdfront's
+	 * input_handler() for how to do that.
+	 */
+	struct xenfb_info *info = dev_id;
+	struct xenfb_page *page = info->page;
+
+	if (page->in_cons != page->in_prod) {
+		info->page->in_cons = info->page->in_prod;
+		notify_remote_via_irq(info->irq);
+	}
+
+	/* Flush dirty rectangle: */
+	xenfb_refresh(info, INT_MAX, INT_MAX, -INT_MAX, -INT_MAX);
+
+	return IRQ_HANDLED;
+}
+
+static int __devinit xenfb_probe(struct xenbus_device *dev,
+				 const struct xenbus_device_id *id)
+{
+	struct xenfb_info *info;
+	struct fb_info *fb_info;
+	int ret;
+
+	info = kzalloc(sizeof(*info), GFP_KERNEL);
+	if (info == NULL) {
+		xenbus_dev_fatal(dev, -ENOMEM, "allocating info structure");
+		return -ENOMEM;
+	}
+	dev->dev.driver_data = info;
+	info->xbdev = dev;
+	info->irq = -1;
+	info->x1 = info->y1 = INT_MAX;
+	spin_lock_init(&info->dirty_lock);
+
+	info->fb = vmalloc(xenfb_mem_len);
+	if (info->fb == NULL)
+		goto error_nomem;
+	memset(info->fb, 0, xenfb_mem_len);
+
+	info->nr_pages = (xenfb_mem_len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+	info->mfns = vmalloc(sizeof(unsigned long) * info->nr_pages);
+	if (!info->mfns)
+		goto error_nomem;
+
+	/* set up shared page */
+	info->page = (void *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
+	if (!info->page)
+		goto error_nomem;
+
+	xenfb_init_shared_page(info);
+
+	/* abusing framebuffer_alloc() to allocate pseudo_palette */
+	fb_info = framebuffer_alloc(sizeof(u32) * 256, NULL);
+	if (fb_info == NULL)
+		goto error_nomem;
+
+	/* complete the abuse: */
+	fb_info->pseudo_palette = fb_info->par;
+	fb_info->par = info;
+
+	fb_info->screen_base = info->fb;
+
+	fb_info->fbops = &xenfb_fb_ops;
+	fb_info->var.xres_virtual = fb_info->var.xres = info->page->width;
+	fb_info->var.yres_virtual = fb_info->var.yres = info->page->height;
+	fb_info->var.bits_per_pixel = info->page->depth;
+
+	fb_info->var.red = (struct fb_bitfield){16, 8, 0};
+	fb_info->var.green = (struct fb_bitfield){8, 8, 0};
+	fb_info->var.blue = (struct fb_bitfield){0, 8, 0};
+
+	fb_info->var.activate = FB_ACTIVATE_NOW;
+	fb_info->var.height = -1;
+	fb_info->var.width = -1;
+	fb_info->var.vmode = FB_VMODE_NONINTERLACED;
+
+	fb_info->fix.visual = FB_VISUAL_TRUECOLOR;
+	fb_info->fix.line_length = info->page->line_length;
+	fb_info->fix.smem_start = 0;
+	fb_info->fix.smem_len = xenfb_mem_len;
+	strcpy(fb_info->fix.id, "xen");
+	fb_info->fix.type = FB_TYPE_PACKED_PIXELS;
+	fb_info->fix.accel = FB_ACCEL_NONE;
+
+	fb_info->flags = FBINFO_FLAG_DEFAULT;
+
+	ret = fb_alloc_cmap(&fb_info->cmap, 256, 0);
+	if (ret < 0) {
+		framebuffer_release(fb_info);
+		xenbus_dev_fatal(dev, ret, "fb_alloc_cmap");
+		goto error;
+	}
+
+	fb_info->fbdefio = &xenfb_defio;
+	fb_deferred_io_init(fb_info);
+
+	ret = register_framebuffer(fb_info);
+	if (ret) {
+		fb_deferred_io_cleanup(fb_info);
+		fb_dealloc_cmap(&fb_info->cmap);
+		framebuffer_release(fb_info);
+		xenbus_dev_fatal(dev, ret, "register_framebuffer");
+		goto error;
+	}
+	info->fb_info = fb_info;
+
+	ret = xenfb_connect_backend(dev, info);
+	if (ret < 0)
+		goto error;
+
+	return 0;
+
+ error_nomem:
+	ret = -ENOMEM;
+	xenbus_dev_fatal(dev, ret, "allocating device memory");
+ error:
+	xenfb_remove(dev);
+	return ret;
+}
+
+static int xenfb_resume(struct xenbus_device *dev)
+{
+	struct xenfb_info *info = dev->dev.driver_data;
+
+	xenfb_disconnect_backend(info);
+	xenfb_init_shared_page(info);
+	return xenfb_connect_backend(dev, info);
+}
+
+static int xenfb_remove(struct xenbus_device *dev)
+{
+	struct xenfb_info *info = dev->dev.driver_data;
+
+	xenfb_disconnect_backend(info);
+	if (info->fb_info) {
+		fb_deferred_io_cleanup(info->fb_info);
+		unregister_framebuffer(info->fb_info);
+		fb_dealloc_cmap(&info->fb_info->cmap);
+		framebuffer_release(info->fb_info);
+	}
+	free_page((unsigned long)info->page);
+	vfree(info->mfns);
+	vfree(info->fb);
+	kfree(info);
+
+	return 0;
+}
+
+static unsigned long vmalloc_to_mfn(void *address)
+{
+	return pfn_to_mfn(vmalloc_to_pfn(address));
+}
+
+static void xenfb_init_shared_page(struct xenfb_info *info)
+{
+	int i;
+
+	for (i = 0; i < info->nr_pages; i++)
+		info->mfns[i] = vmalloc_to_mfn(info->fb + i * PAGE_SIZE);
+
+	info->page->pd[0] = vmalloc_to_mfn(info->mfns);
+	info->page->pd[1] = 0;
+	info->page->width = XENFB_WIDTH;
+	info->page->height = XENFB_HEIGHT;
+	info->page->depth = XENFB_DEPTH;
+	info->page->line_length = (info->page->depth / 8) * info->page->width;
+	info->page->mem_length = xenfb_mem_len;
+	info->page->in_cons = info->page->in_prod = 0;
+	info->page->out_cons = info->page->out_prod = 0;
+}
+
+static int xenfb_connect_backend(struct xenbus_device *dev,
+				 struct xenfb_info *info)
+{
+	int ret, evtchn;
+	struct xenbus_transaction xbt;
+
+	ret = xenbus_alloc_evtchn(dev, &evtchn);
+	if (ret)
+		return ret;
+	ret = bind_evtchn_to_irqhandler(evtchn, xenfb_event_handler,
+					0, dev->devicetype, info);
+	if (ret < 0) {
+		xenbus_free_evtchn(dev, evtchn);
+		xenbus_dev_fatal(dev, ret, "bind_evtchn_to_irqhandler");
+		return ret;
+	}
+	info->irq = ret;
+
+ again:
+	ret = xenbus_transaction_start(&xbt);
+	if (ret) {
+		xenbus_dev_fatal(dev, ret, "starting transaction");
+		return ret;
+	}
+	ret = xenbus_printf(xbt, dev->nodename, "page-ref", "%lu",
+			    virt_to_mfn(info->page));
+	if (ret)
+		goto error_xenbus;
+	ret = xenbus_printf(xbt, dev->nodename, "event-channel", "%u",
+			    evtchn);
+	if (ret)
+		goto error_xenbus;
+	ret = xenbus_printf(xbt, dev->nodename, "protocol", "%s",
+			    XEN_IO_PROTO_ABI_NATIVE);
+	if (ret)
+		goto error_xenbus;
+	ret = xenbus_printf(xbt, dev->nodename, "feature-update", "1");
+	if (ret)
+		goto error_xenbus;
+	ret = xenbus_transaction_end(xbt, 0);
+	if (ret) {
+		if (ret == -EAGAIN)
+			goto again;
+		xenbus_dev_fatal(dev, ret, "completing transaction");
+		return ret;
+	}
+
+	xenbus_switch_state(dev, XenbusStateInitialised);
+	return 0;
+
+ error_xenbus:
+	xenbus_transaction_end(xbt, 1);
+	xenbus_dev_fatal(dev, ret, "writing xenstore");
+	return ret;
+}
+
+static void xenfb_disconnect_backend(struct xenfb_info *info)
+{
+	if (info->irq >= 0)
+		unbind_from_irqhandler(info->irq, info);
+	info->irq = -1;
+}
+
+static void xenfb_backend_changed(struct xenbus_device *dev,
+				  enum xenbus_state backend_state)
+{
+	struct xenfb_info *info = dev->dev.driver_data;
+	int val;
+
+	switch (backend_state) {
+	case XenbusStateInitialising:
+	case XenbusStateInitialised:
+	case XenbusStateUnknown:
+	case XenbusStateClosed:
+		break;
+
+	case XenbusStateInitWait:
+InitWait:
+		xenbus_switch_state(dev, XenbusStateConnected);
+		break;
+
+	case XenbusStateConnected:
+		/*
+		 * Work around xenbus race condition: If backend goes
+		 * through InitWait to Connected fast enough, we can
+		 * get Connected twice here.
+		 */
+		if (dev->state != XenbusStateConnected)
+			goto InitWait; /* no InitWait seen yet, fudge it */
+
+		if (xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+				 "request-update", "%d", &val) < 0)
+			val = 0;
+		if (val)
+			info->update_wanted = 1;
+		break;
+
+	case XenbusStateClosing:
+		xenbus_frontend_closed(dev);
+		break;
+	}
+}
+
+static struct xenbus_device_id xenfb_ids[] = {
+	{ "vfb" },
+	{ "" }
+};
+
+static struct xenbus_driver xenfb = {
+	.name = "vfb",
+	.owner = THIS_MODULE,
+	.ids = xenfb_ids,
+	.probe = xenfb_probe,
+	.remove = xenfb_remove,
+	.resume = xenfb_resume,
+	.otherend_changed = xenfb_backend_changed,
+};
+
+static int __init xenfb_init(void)
+{
+	if (!is_running_on_xen())
+		return -ENODEV;
+
+	/* Nothing to do if running in dom0. */
+	if (is_initial_xendomain())
+		return -ENODEV;
+
+	return xenbus_register_frontend(&xenfb);
+}
+
+static void __exit xenfb_cleanup(void)
+{
+	xenbus_unregister_driver(&xenfb);
+}
+
+module_init(xenfb_init);
+module_exit(xenfb_cleanup);
+
+MODULE_LICENSE("GPL");
diff --git a/include/xen/interface/io/fbif.h b/include/xen/interface/io/fbif.h
new file mode 100644
index 0000000..5a934dd
--- /dev/null
+++ b/include/xen/interface/io/fbif.h
@@ -0,0 +1,124 @@
+/*
+ * fbif.h -- Xen virtual frame buffer device
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Copyright (C) 2005 Anthony Liguori <aliguori at us.ibm.com>
+ * Copyright (C) 2006 Red Hat, Inc., Markus Armbruster <armbru at redhat.com>
+ */
+
+#ifndef __XEN_PUBLIC_IO_FBIF_H__
+#define __XEN_PUBLIC_IO_FBIF_H__
+
+/* Out events (frontend -> backend) */
+
+/*
+ * Out events may be sent only when requested by backend, and receipt
+ * of an unknown out event is an error.
+ */
+
+/* Event type 1 currently not used */
+/*
+ * Framebuffer update notification event
+ * Capable frontend sets feature-update in xenstore.
+ * Backend requests it by setting request-update in xenstore.
+ */
+#define XENFB_TYPE_UPDATE 2
+
+struct xenfb_update {
+	uint8_t type;		/* XENFB_TYPE_UPDATE */
+	int32_t x;		/* source x */
+	int32_t y;		/* source y */
+	int32_t width;		/* rect width */
+	int32_t height;		/* rect height */
+};
+
+#define XENFB_OUT_EVENT_SIZE 40
+
+union xenfb_out_event {
+	uint8_t type;
+	struct xenfb_update update;
+	char pad[XENFB_OUT_EVENT_SIZE];
+};
+
+/* In events (backend -> frontend) */
+
+/*
+ * Frontends should ignore unknown in events.
+ * No in events currently defined.
+ */
+
+#define XENFB_IN_EVENT_SIZE 40
+
+union xenfb_in_event {
+	uint8_t type;
+	char pad[XENFB_IN_EVENT_SIZE];
+};
+
+/* shared page */
+
+#define XENFB_IN_RING_SIZE 1024
+#define XENFB_IN_RING_LEN (XENFB_IN_RING_SIZE / XENFB_IN_EVENT_SIZE)
+#define XENFB_IN_RING_OFFS 1024
+#define XENFB_IN_RING(page) \
+	((union xenfb_in_event *)((char *)(page) + XENFB_IN_RING_OFFS))
+#define XENFB_IN_RING_REF(page, idx) \
+	(XENFB_IN_RING((page))[(idx) % XENFB_IN_RING_LEN])
+
+#define XENFB_OUT_RING_SIZE 2048
+#define XENFB_OUT_RING_LEN (XENFB_OUT_RING_SIZE / XENFB_OUT_EVENT_SIZE)
+#define XENFB_OUT_RING_OFFS (XENFB_IN_RING_OFFS + XENFB_IN_RING_SIZE)
+#define XENFB_OUT_RING(page) \
+	((union xenfb_out_event *)((char *)(page) + XENFB_OUT_RING_OFFS))
+#define XENFB_OUT_RING_REF(page, idx) \
+	(XENFB_OUT_RING((page))[(idx) % XENFB_OUT_RING_LEN])
+
+struct xenfb_page {
+	uint32_t in_cons, in_prod;
+	uint32_t out_cons, out_prod;
+
+	int32_t width;          /* width of the framebuffer (in pixels) */
+	int32_t height;         /* height of the framebuffer (in pixels) */
+	uint32_t line_length;   /* length of a row of pixels (in bytes) */
+	uint32_t mem_length;    /* length of the framebuffer (in bytes) */
+	uint8_t depth;          /* depth of a pixel (in bits) */
+
+	/*
+	 * Framebuffer page directory
+	 *
+	 * Each directory page holds PAGE_SIZE / sizeof(*pd)
+	 * framebuffer pages, and can thus map up to PAGE_SIZE *
+	 * PAGE_SIZE / sizeof(*pd) bytes.  With PAGE_SIZE == 4096 and
+	 * sizeof(unsigned long) == 4, that's 4 Megs.  Two directory
+	 * pages should be enough for a while.
+	 */
+	unsigned long pd[2];
+};
+
+/*
+ * Wart: xenkbd needs to know resolution.  Put it here until a better
+ * solution is found, but don't leak it to the backend.
+ */
+#ifdef __KERNEL__
+#define XENFB_WIDTH 800
+#define XENFB_HEIGHT 600
+#define XENFB_DEPTH 32
+#endif
+
+#endif
diff --git a/include/xen/interface/io/kbdif.h b/include/xen/interface/io/kbdif.h
new file mode 100644
index 0000000..fb97f42
--- /dev/null
+++ b/include/xen/interface/io/kbdif.h
@@ -0,0 +1,114 @@
+/*
+ * kbdif.h -- Xen virtual keyboard/mouse
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Copyright (C) 2005 Anthony Liguori <aliguori at us.ibm.com>
+ * Copyright (C) 2006 Red Hat, Inc., Markus Armbruster <armbru at redhat.com>
+ */
+
+#ifndef __XEN_PUBLIC_IO_KBDIF_H__
+#define __XEN_PUBLIC_IO_KBDIF_H__
+
+/* In events (backend -> frontend) */
+
+/*
+ * Frontends should ignore unknown in events.
+ */
+
+/* Pointer movement event */
+#define XENKBD_TYPE_MOTION  1
+/* Event type 2 currently not used */
+/* Key event (includes pointer buttons) */
+#define XENKBD_TYPE_KEY     3
+/*
+ * Pointer position event
+ * Capable backend sets feature-abs-pointer in xenstore.
+ * Frontend requests ot instead of XENKBD_TYPE_MOTION by setting
+ * request-abs-update in xenstore.
+ */
+#define XENKBD_TYPE_POS     4
+
+struct xenkbd_motion {
+	uint8_t type;		/* XENKBD_TYPE_MOTION */
+	int32_t rel_x;		/* relative X motion */
+	int32_t rel_y;		/* relative Y motion */
+};
+
+struct xenkbd_key {
+	uint8_t type;		/* XENKBD_TYPE_KEY */
+	uint8_t pressed;	/* 1 if pressed; 0 otherwise */
+	uint32_t keycode;	/* KEY_* from linux/input.h */
+};
+
+struct xenkbd_position {
+	uint8_t type;		/* XENKBD_TYPE_POS */
+	int32_t abs_x;		/* absolute X position (in FB pixels) */
+	int32_t abs_y;		/* absolute Y position (in FB pixels) */
+};
+
+#define XENKBD_IN_EVENT_SIZE 40
+
+union xenkbd_in_event {
+	uint8_t type;
+	struct xenkbd_motion motion;
+	struct xenkbd_key key;
+	struct xenkbd_position pos;
+	char pad[XENKBD_IN_EVENT_SIZE];
+};
+
+/* Out events (frontend -> backend) */
+
+/*
+ * Out events may be sent only when requested by backend, and receipt
+ * of an unknown out event is an error.
+ * No out events currently defined.
+ */
+
+#define XENKBD_OUT_EVENT_SIZE 40
+
+union xenkbd_out_event {
+	uint8_t type;
+	char pad[XENKBD_OUT_EVENT_SIZE];
+};
+
+/* shared page */
+
+#define XENKBD_IN_RING_SIZE 2048
+#define XENKBD_IN_RING_LEN (XENKBD_IN_RING_SIZE / XENKBD_IN_EVENT_SIZE)
+#define XENKBD_IN_RING_OFFS 1024
+#define XENKBD_IN_RING(page) \
+	((union xenkbd_in_event *)((char *)(page) + XENKBD_IN_RING_OFFS))
+#define XENKBD_IN_RING_REF(page, idx) \
+	(XENKBD_IN_RING((page))[(idx) % XENKBD_IN_RING_LEN])
+
+#define XENKBD_OUT_RING_SIZE 1024
+#define XENKBD_OUT_RING_LEN (XENKBD_OUT_RING_SIZE / XENKBD_OUT_EVENT_SIZE)
+#define XENKBD_OUT_RING_OFFS (XENKBD_IN_RING_OFFS + XENKBD_IN_RING_SIZE)
+#define XENKBD_OUT_RING(page) \
+	((union xenkbd_out_event *)((char *)(page) + XENKBD_OUT_RING_OFFS))
+#define XENKBD_OUT_RING_REF(page, idx) \
+	(XENKBD_OUT_RING((page))[(idx) % XENKBD_OUT_RING_LEN])
+
+struct xenkbd_page {
+	uint32_t in_cons, in_prod;
+	uint32_t out_cons, out_prod;
+};
+
+#endif
-- 
1.5.4.1


linux-2.6-xen-0007-xen-Module-autoprobing-support-for-frontend-drivers.patch:

--- NEW FILE linux-2.6-xen-0007-xen-Module-autoprobing-support-for-frontend-drivers.patch ---
>From 422407af4fdf82e12748b36174a17d857f08ebee Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc at redhat.com>
Date: Fri, 22 Feb 2008 12:42:52 +0000
Subject: [PATCH] xen: Module autoprobing support for frontend drivers

Add module aliases to support autoprobing modules
for xen frontend devices.

Signed-off-by: Mark McLoughlin <markmc at redhat.com>
---
 drivers/block/xen-blkfront.c      |    1 +
 drivers/net/xen-netfront.c        |    1 +
 drivers/xen/xenbus/xenbus_probe.c |   27 +++++++++++++++++++++++++--
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 2e7c81e..0c47c02 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1005,3 +1005,4 @@ module_exit(xlblk_exit);
 MODULE_DESCRIPTION("Xen virtual block device frontend");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_BLOCKDEV_MAJOR(XENVBD_MAJOR);
+MODULE_ALIAS("xen:vbd");
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 7483d45..b3fa27e 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1809,3 +1809,4 @@ module_exit(netif_exit);
 
 MODULE_DESCRIPTION("Xen virtual network device frontend");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("xen:vif");
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 4750de3..336363c 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -88,6 +88,16 @@ int xenbus_match(struct device *_dev, struct device_driver *_drv)
 	return match_device(drv->ids, to_xenbus_device(_dev)) != NULL;
 }
 
+static int xenbus_uevent(struct device *_dev, struct kobj_uevent_env *env)
+{
+	struct xenbus_device *dev = to_xenbus_device(_dev);
+
+	if (add_uevent_var(env, "MODALIAS=xen:%s", dev->devicetype))
+		return -ENOMEM;
+
+	return 0;
+}
+
 /* device/<type>/<id> => <type>-<id> */
 static int frontend_bus_id(char bus_id[BUS_ID_SIZE], const char *nodename)
 {
@@ -166,6 +176,7 @@ static struct xen_bus_type xenbus_frontend = {
 	.bus = {
 		.name     = "xen",
 		.match    = xenbus_match,
+		.uevent   = xenbus_uevent,
 		.probe    = xenbus_dev_probe,
 		.remove   = xenbus_dev_remove,
 		.shutdown = xenbus_dev_shutdown,
@@ -438,6 +449,12 @@ static ssize_t xendev_show_devtype(struct device *dev,
 }
 DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL);
 
+static ssize_t xendev_show_modalias(struct device *dev,
+				    struct device_attribute *attr, char *buf)
+{
+	return sprintf(buf, "xen:%s\n", to_xenbus_device(dev)->devicetype);
+}
+DEVICE_ATTR(modalias, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_modalias, NULL);
 
 int xenbus_probe_node(struct xen_bus_type *bus,
 		      const char *type,
@@ -492,10 +509,16 @@ int xenbus_probe_node(struct xen_bus_type *bus,
 
 	err = device_create_file(&xendev->dev, &dev_attr_devtype);
 	if (err)
-		goto fail_remove_file;
+		goto fail_remove_nodename;
+
+	err = device_create_file(&xendev->dev, &dev_attr_modalias);
+	if (err)
+		goto fail_remove_devtype;
 
 	return 0;
-fail_remove_file:
+fail_remove_devtype:
+	device_remove_file(&xendev->dev, &dev_attr_devtype);
+fail_remove_nodename:
 	device_remove_file(&xendev->dev, &dev_attr_nodename);
 fail_unregister:
 	device_unregister(&xendev->dev);
-- 
1.5.4.1


linux-2.6-xen-0008-xen-Add-compatibility-aliases-for-frontend-drivers.patch:

--- NEW FILE linux-2.6-xen-0008-xen-Add-compatibility-aliases-for-frontend-drivers.patch ---
>From 6025fff31cba456d0e44e6120af376454658890d Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc at redhat.com>
Date: Thu, 21 Feb 2008 11:13:12 +0000
Subject: [PATCH] xen: Add compatibility aliases for frontend drivers

Before getting merged, xen-blkfront was xenblk and
xen-netfront was xennet.

Add compatibility module aliases to ease upgrades.

Signed-off-by: Mark McLoughlin <markmc at redhat.com>
---
 drivers/block/xen-blkfront.c |    1 +
 drivers/net/xen-netfront.c   |    1 +
 2 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 0c47c02..8ce168d 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1006,3 +1006,4 @@ MODULE_DESCRIPTION("Xen virtual block device frontend");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_BLOCKDEV_MAJOR(XENVBD_MAJOR);
 MODULE_ALIAS("xen:vbd");
+MODULE_ALIAS("xenblk");
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index b3fa27e..e62018a 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1810,3 +1810,4 @@ module_exit(netif_exit);
 MODULE_DESCRIPTION("Xen virtual network device frontend");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("xen:vif");
+MODULE_ALIAS("xennet");
-- 
1.5.4.1


linux-2.6-xen-0009-xen-dom0-Add-a-vmlinuz-target.patch:

--- NEW FILE linux-2.6-xen-0009-xen-dom0-Add-a-vmlinuz-target.patch ---
>From 4fb0e1246a57f5b97b6912c0c806c7fa26bba634 Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc at redhat.com>
Date: Tue, 19 Feb 2008 15:34:32 +0000
Subject: [PATCH] xen dom0: Add a vmlinuz target

Although patches are in progress to allow Xen boot
a DomU using a bzImage, support for booting a Dom0
using a bzImage is still a ways off.

For now, just add a target to build a gzip-ed ELF
file which Xen can use to boot Dom0.

Signed-off-by: Mark McLoughlin <markmc at redhat.com>
---
 arch/x86/Makefile        |    9 +++++++++
 arch/x86/boot/.gitignore |    1 +
 arch/x86/boot/Makefile   |    9 +++++++++
 3 files changed, 19 insertions(+), 0 deletions(-)

diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index f1e739a..14a752e 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -206,6 +206,15 @@ boot := arch/x86/boot
 PHONY += zImage bzImage compressed zlilo bzlilo \
          zdisk bzdisk fdimage fdimage144 fdimage288 isoimage install
 
+ifdef CONFIG_XEN
+PHONY += vmlinuz
+all: vmlinuz
+
+vmlinuz: KBUILD_IMAGE := $(boot)/vmlinuz
+vmlinuz: vmlinux
+	$(Q)$(MAKE) $(build)=$(boot) $(KBUILD_IMAGE)
+endif
+
 # Default kernel to build
 all: bzImage
 
diff --git a/arch/x86/boot/.gitignore b/arch/x86/boot/.gitignore
index b1bdc4c..35e7956 100644
--- a/arch/x86/boot/.gitignore
+++ b/arch/x86/boot/.gitignore
@@ -5,3 +5,4 @@ setup.bin
 setup.elf
 cpustr.h
 mkcpustr
+vmlinuz
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index f88458e..61bba92 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -26,6 +26,7 @@ SVGA_MODE := -DSVGA_MODE=NORMAL_VGA
 #RAMDISK := -DRAMDISK=512
 
 targets		:= vmlinux.bin setup.bin setup.elf zImage bzImage
+targets		+= vmlinuz vmlinux-stripped
 subdir-		:= compressed
 
 setup-y		+= a20.o cmdline.o copy.o cpu.o cpucheck.o edd.o
@@ -105,6 +106,14 @@ $(obj)/setup.bin: $(obj)/setup.elf FORCE
 $(obj)/compressed/vmlinux: FORCE
 	$(Q)$(MAKE) $(build)=$(obj)/compressed IMAGE_OFFSET=$(IMAGE_OFFSET) $@
 
+$(obj)/vmlinuz: $(obj)/vmlinux-stripped FORCE
+	$(call if_changed,gzip)
+	@echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+$(obj)/vmlinux-stripped: OBJCOPYFLAGS := -g --strip-unneeded
+$(obj)/vmlinux-stripped: vmlinux FORCE
+	$(call if_changed,objcopy)
+
 # Set this if you want to pass append arguments to the zdisk/fdimage/isoimage kernel
 FDARGS =
 # Set this if you want an initrd included with the zdisk/fdimage/isoimage kernel
-- 
1.5.4.1


linux-2.6-xen-0010-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch:

--- NEW FILE linux-2.6-xen-0010-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch ---
>From fbd13951ece893daa2e4444750cd04d10abeb4f7 Mon Sep 17 00:00:00 2001
From: Stephen Tweedie <sct at redhat.com>
Date: Wed, 21 Nov 2007 18:40:31 +0000
Subject: [PATCH] xen debug: Add xprintk to log directly via hypercall

For early debugging, it is useful to have a way of doing debugging output
direct to the hypervisor without having to rely on console being fully
initialised.

Signed-off-by: Stephen Tweedie <sct at redhat.com>
---
 arch/x86/xen/enlighten.c  |   32 ++++++++++++++++++++++++++++++++
 include/xen/hvc-console.h |    1 +
 2 files changed, 33 insertions(+), 0 deletions(-)

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index a94605e..e1702e1 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -33,6 +33,7 @@
 #include <xen/interface/sched.h>
 #include <xen/features.h>
 #include <xen/page.h>
+#include <xen/hvc-console.h>
 
 #include <asm/paravirt.h>
 #include <asm/page.h>
@@ -142,6 +143,37 @@ static void __init xen_banner(void)
 	printk(KERN_INFO "Hypervisor signature: %s\n", xen_start_info->magic);
 }
 
+static void kcons_write_dom0(const char *s, unsigned int count)
+{
+       int rc;
+
+       while ((count > 0) &&
+              ((rc = HYPERVISOR_console_io(
+                       CONSOLEIO_write, count, (char *)s)) > 0)) {
+               count -= rc;
+               s += rc;
+       }
+}
+
+
+/*** Useful function for console debugging -- goes straight to Xen. ***/
+asmlinkage int xprintk(const char *fmt, ...)
+{
+       va_list args;
+       int printk_len;
+       static char printk_buf[1024];
+
+       /* Emit the output into the temporary buffer */
+       va_start(args, fmt);
+       printk_len = vsnprintf(printk_buf, sizeof(printk_buf), fmt, args);
+       va_end(args);
+
+       /* Send the processed output directly to Xen. */
+       kcons_write_dom0(printk_buf, printk_len);
+
+       return 0;
+}
+
 static void xen_cpuid(unsigned int *ax, unsigned int *bx,
 		      unsigned int *cx, unsigned int *dx)
 {
diff --git a/include/xen/hvc-console.h b/include/xen/hvc-console.h
index 21c0ecf..cb7a3c9 100644
--- a/include/xen/hvc-console.h
+++ b/include/xen/hvc-console.h
@@ -2,5 +2,6 @@
 #define XEN_HVC_CONSOLE_H
 
 extern struct console xenboot_console;
+extern asmlinkage int xprintk(const char *fmt, ...);
 
 #endif	/* XEN_HVC_CONSOLE_H */
-- 
1.5.4.1


linux-2.6-xen-0011-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch:

--- NEW FILE linux-2.6-xen-0011-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch ---
>From 6d1e8fc91a0e533f42f7141e5032082e932e3387 Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc at redhat.com>
Date: Tue, 4 Mar 2008 17:59:50 +0000
Subject: [PATCH] xen x86_64: Initial x86_64 support for Xen paravirt_ops

Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
Signed-off-by: Mark McLoughlin <markmc at redhat.com>
---
 arch/x86/Kconfig                     |    3 +-
 arch/x86/kernel/acpi/boot.c          |    4 +-
 arch/x86/kernel/apic_32.c            |    4 +-
 arch/x86/kernel/apic_64.c            |    2 +-
 arch/x86/kernel/asm-offsets_64.c     |   15 +
 arch/x86/kernel/early_printk.c       |    5 +-
 arch/x86/kernel/efi_64.c             |    4 +-
 arch/x86/kernel/entry_32.S           |   83 +-----
 arch/x86/kernel/entry_64.S           |   72 ++++-
 arch/x86/kernel/genapic_64.c         |   12 +
 arch/x86/kernel/head64.c             |    4 +
 arch/x86/kernel/head_64.S            |   23 ++
 arch/x86/kernel/hpet.c               |    4 +-
 arch/x86/kernel/io_apic_64.c         |    2 +-
 arch/x86/kernel/irq_64.c             |    5 +
 arch/x86/kernel/mpparse_32.c         |    4 +-
 arch/x86/kernel/mpparse_64.c         |    4 +-
 arch/x86/kernel/paravirt.c           |    3 +
 arch/x86/kernel/process_64.c         |    9 +
 arch/x86/kernel/setup64.c            |    5 +
 arch/x86/kernel/setup_64.c           |   41 +++-
 arch/x86/kernel/smpboot_64.c         |    4 +-
 arch/x86/kernel/vsyscall_64.c        |   31 ++-
 arch/x86/mach-visws/traps.c          |   10 +-
 arch/x86/mm/init_32.c                |    2 +-
 arch/x86/mm/init_64.c                |  558 ++++++++++++++++++++++++++++++++--
 arch/x86/mm/ioremap.c                |    4 +-
 arch/x86/mm/pgtable_32.c             |   25 ++-
 arch/x86/pci/mmconfig_32.c           |    2 +-
 arch/x86/vdso/vdso32-setup.c         |    6 +-
 arch/x86/xen/Kconfig                 |    1 -
 arch/x86/xen/Makefile                |    6 +
 arch/x86/xen/enlighten.c             |  268 +++++++++++-----
 arch/x86/xen/entry.S                 |    5 +
 arch/x86/xen/entry_32.S              |   81 +++++
 arch/x86/xen/entry_64.S              |   68 ++++
 arch/x86/xen/events.c                |   13 +-
 arch/x86/xen/genapic.c               |  190 ++++++++++++
 arch/x86/xen/init.h                  |   20 ++
 arch/x86/xen/init_32.c               |    3 +
 arch/x86/xen/init_64.c               |  181 +++++++++++
 arch/x86/xen/mmu.c                   |  407 ++++++++++++++++++-------
 arch/x86/xen/mmu.h                   |   46 ++--
 arch/x86/xen/multicalls.c            |    9 +-
 arch/x86/xen/setup.c                 |   22 ++
 arch/x86/xen/smp.c                   |   16 +
 arch/x86/xen/xen-asm.S               |  219 +++-----------
 arch/x86/xen/xen-asm_32.S            |  184 +++++++++++
 arch/x86/xen/xen-asm_64.S            |   75 +++++
 arch/x86/xen/xen-head.S              |   21 +-
 arch/x86/xen/xen-ops.h               |   11 +
 drivers/acpi/thermal.c               |    5 +
 drivers/char/hvc_xen.c               |    6 +
 drivers/ieee1394/init_ohci1394_dma.c |    2 +-
 drivers/serial/8250_early.c          |    2 +-
 include/asm-x86/asm-hack.h           |   27 ++
 include/asm-x86/cmpxchg_64.h         |   36 +++
 include/asm-x86/desc_defs.h          |    4 +
 include/asm-x86/fixmap_32.h          |   22 +-
 include/asm-x86/fixmap_64.h          |   31 ++-
 include/asm-x86/mmu_context_64.h     |    6 +-
 include/asm-x86/page_64.h            |    2 +-
 include/asm-x86/paravirt.h           |   46 ++-
 include/asm-x86/percpu.h             |   32 ++
 include/asm-x86/pgalloc_64.h         |   69 ++++-
 include/asm-x86/pgtable.h            |   15 +-
 include/asm-x86/pgtable_64.h         |    3 +-
 include/asm-x86/proto.h              |    1 +
 include/asm-x86/smp_64.h             |    3 +
 include/asm-x86/system.h             |    3 +-
 include/asm-x86/xen/hypercall.h      |  205 ++++++++++---
 include/asm-x86/xen/hypervisor.h     |    3 -
 include/asm-x86/xen/interface.h      |   35 ++-
 include/linux/dmi.h                  |    1 +
 include/linux/elfnote.h              |    2 +-
 include/xen/events.h                 |    2 +
 include/xen/interface/elfnote.h      |   16 +
 include/xen/page.h                   |   34 ++-
 init/main.c                          |   10 +
 mm/slab.c                            |    8 +-
 80 files changed, 2759 insertions(+), 668 deletions(-)
 create mode 100644 arch/x86/xen/entry.S
 create mode 100644 arch/x86/xen/entry_32.S
 create mode 100644 arch/x86/xen/entry_64.S
 create mode 100644 arch/x86/xen/genapic.c
 create mode 100644 arch/x86/xen/init.h
 create mode 100644 arch/x86/xen/init_32.c
 create mode 100644 arch/x86/xen/init_64.c
 create mode 100644 arch/x86/xen/xen-asm_32.S
 create mode 100644 arch/x86/xen/xen-asm_64.S
 create mode 100644 include/asm-x86/asm-hack.h

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index f41c953..6f466aa 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -92,7 +92,7 @@ config ARCH_MAY_HAVE_PC_FDC
 	def_bool y
 
 config DMI
-	def_bool y
+	def_bool !XEN
 
 config RWSEM_GENERIC_SPINLOCK
 	def_bool !X86_XADD
@@ -330,6 +330,7 @@ config X86_RDC321X
 
 config X86_VSMP
 	bool "Support for ScaleMP vSMP"
+	depends on !XEN
 	depends on X86_64 && PCI
 	 help
 	  Support for ScaleMP vSMP systems.  Say 'Y' here if this kernel is
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 2cdc9de..cfc79ac 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -141,7 +141,7 @@ char *__init __acpi_map_table(unsigned long phys, unsigned long size)
 
 	offset = phys & (PAGE_SIZE - 1);
 	mapped_size = PAGE_SIZE - offset;
-	set_fixmap(FIX_ACPI_END, phys);
+	set_fixmap_ma(FIX_ACPI_END, phys);
 	base = fix_to_virt(FIX_ACPI_END);
 
 	/*
@@ -152,7 +152,7 @@ char *__init __acpi_map_table(unsigned long phys, unsigned long size)
 		if (--idx < FIX_ACPI_BEGIN)
 			return NULL;	/* cannot handle this */
 		phys += PAGE_SIZE;
-		set_fixmap(idx, phys);
+		set_fixmap_ma(idx, phys);
 		mapped_size += PAGE_SIZE;
 	}
 
diff --git a/arch/x86/kernel/apic_32.c b/arch/x86/kernel/apic_32.c
index 35a568e..40fc1b3 100644
--- a/arch/x86/kernel/apic_32.c
+++ b/arch/x86/kernel/apic_32.c
@@ -1138,7 +1138,7 @@ void __init init_apic_mappings(void)
 	} else
 		apic_phys = mp_lapic_addr;
 
-	set_fixmap_nocache(FIX_APIC_BASE, apic_phys);
+	set_fixmap_ma_nocache(FIX_APIC_BASE, apic_phys);
 	printk(KERN_DEBUG "mapped APIC to %08lx (%08lx)\n", APIC_BASE,
 	       apic_phys);
 
@@ -1172,7 +1172,7 @@ fake_ioapic_page:
 					      alloc_bootmem_pages(PAGE_SIZE);
 				ioapic_phys = __pa(ioapic_phys);
 			}
-			set_fixmap_nocache(idx, ioapic_phys);
+			set_fixmap_ma_nocache(idx, ioapic_phys);
 			printk(KERN_DEBUG "mapped IOAPIC to %08lx (%08lx)\n",
 			       __fix_to_virt(idx), ioapic_phys);
 			idx++;
diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
index d8d03e0..a611520 100644
--- a/arch/x86/kernel/apic_64.c
+++ b/arch/x86/kernel/apic_64.c
@@ -877,7 +877,7 @@ void __init init_apic_mappings(void)
 	} else
 		apic_phys = mp_lapic_addr;
 
-	set_fixmap_nocache(FIX_APIC_BASE, apic_phys);
+	set_fixmap_ma_nocache(FIX_APIC_BASE, apic_phys);
 	apic_printk(APIC_VERBOSE, "mapped APIC to %16lx (%16lx)\n",
 				APIC_BASE, apic_phys);
 
diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
index 494e1e0..d0fabfd 100644
--- a/arch/x86/kernel/asm-offsets_64.c
+++ b/arch/x86/kernel/asm-offsets_64.c
@@ -25,6 +25,8 @@
 #define OFFSET(sym, str, mem) \
 	DEFINE(sym, offsetof(struct str, mem))
 
+#include <xen/interface/xen.h>
+
 #define __NO_STUBS 1
 #undef __SYSCALL
 #undef _ASM_X86_64_UNISTD_H_
@@ -92,6 +94,13 @@ int main(void)
 	       offsetof (struct rt_sigframe32, uc.uc_mcontext));
 	BLANK();
 #endif
+
+#ifdef CONFIG_XEN
+	BLANK();
+	OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
[...5539 lines suppressed...]
-#define ELFNOTE(name, type, desc)		\
+#define ELFNOTE(name, type, desc...)		\
 	ELFNOTE_START(name, type, "")		\
 		desc			;	\
 	ELFNOTE_END
diff --git a/include/xen/events.h b/include/xen/events.h
index 2bde54d..c18d2bf 100644
--- a/include/xen/events.h
+++ b/include/xen/events.h
@@ -3,6 +3,8 @@
 
 #include <linux/interrupt.h>
 
+#include <asm/xen/interface.h>
+#include <xen/interface/xen.h>
 #include <xen/interface/event_channel.h>
 #include <asm/xen/hypercall.h>
 
diff --git a/include/xen/interface/elfnote.h b/include/xen/interface/elfnote.h
index a64d3df..ee5501d 100644
--- a/include/xen/interface/elfnote.h
+++ b/include/xen/interface/elfnote.h
@@ -120,6 +120,22 @@
  */
 #define XEN_ELFNOTE_BSD_SYMTAB    11
 
+/*
+ * The lowest address the hypervisor hole can begin at (numeric).
+ *
+ * This must not be set higher than HYPERVISOR_VIRT_START. Its presence
+ * also indicates to the hypervisor that the kernel can deal with the
+ * hole starting at a higher address.
+ */
+#define XEN_ELFNOTE_HV_START_LOW  12
+
+/*
+ * List of maddr_t-sized mask/value pairs describing how to recognize
+ * (non-present) L1 page table entries carrying valid MFNs (numeric).
+ */
+#define XEN_ELFNOTE_L1_MFN_VALID  13
+
+
 #endif /* __XEN_PUBLIC_ELFNOTE_H__ */
 
 /*
diff --git a/include/xen/page.h b/include/xen/page.h
index 031ef22..158fb60 100644
--- a/include/xen/page.h
+++ b/include/xen/page.h
@@ -8,6 +8,10 @@
 
 #include <xen/features.h>
 
+#include <asm/xen/interface.h>
+
+#include <xen/hvc-console.h>
+
 #ifdef CONFIG_X86_PAE
 /* Xen machine address */
 typedef struct xmaddr {
@@ -70,6 +74,8 @@ static inline unsigned long mfn_to_pfn(unsigned long mfn)
 #endif
 
 	pfn = 0;
+	//xprintk("mfn_to_pfn(%lx):\n", mfn);
+
 	/*
 	 * The array access can fail (e.g., device space beyond end of RAM).
 	 * In such cases it doesn't matter what we return (we return garbage),
@@ -77,6 +83,7 @@ static inline unsigned long mfn_to_pfn(unsigned long mfn)
 	 */
 	__get_user(pfn, &machine_to_phys_mapping[mfn]);
 
+	//xprintk("mfn_to_pfn(%lx) = %lx\n", mfn, pfn);
 	return pfn;
 }
 
@@ -143,34 +150,29 @@ static inline void set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 
 static inline pte_t mfn_pte(unsigned long page_nr, pgprot_t pgprot)
 {
-	pte_t pte;
-
-	pte.pte_high = (page_nr >> (32 - PAGE_SHIFT)) |
-		(pgprot_val(pgprot) >> 32);
-	pte.pte_high &= (__supported_pte_mask >> 32);
-	pte.pte_low = ((page_nr << PAGE_SHIFT) | pgprot_val(pgprot));
-	pte.pte_low &= __supported_pte_mask;
-
-	return pte;
+	pteval_t val;
+	
+	val = (page_nr << PAGE_SHIFT) | pgprot_val(pgprot);
+	val &= __supported_pte_mask;
+	return native_make_pte(val);
 }
 
-static inline unsigned long long pte_val_ma(pte_t x)
+static inline pteval_t pte_val_ma(pte_t x)
 {
-	return x.pte;
+	return native_pte_val(x);
 }
-#define pmd_val_ma(v) ((v).pmd)
-#define pud_val_ma(v) ((v).pgd.pgd)
-#define __pte_ma(x)	((pte_t) { .pte = (x) })
+#define __pte_ma(x)	(native_make_pte(x))
 #define __pmd_ma(x)	((pmd_t) { (x) } )
 #else  /* !X86_PAE */
-#define pte_mfn(_pte) ((_pte).pte_low >> PAGE_SHIFT)
+#define pte_mfn(_pte) ((native_pte_val(_pte) & __PHYSICAL_MASK) >> PAGE_SHIFT)
 #define mfn_pte(pfn, prot)	__pte_ma(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
 #define pte_val_ma(x)	((x).pte)
-#define pmd_val_ma(v)	((v).pud.pgd.pgd)
 #define __pte_ma(x)	((pte_t) { (x) } )
 #endif	/* CONFIG_X86_PAE */
 
 #define pgd_val_ma(x)	((x).pgd)
+#define pmd_val_ma(x)	(native_pmd_val((x)))
+#define pud_val_ma(x)	(native_pud_val((x)))
 
 
 xmaddr_t arbitrary_virt_to_machine(unsigned long address);
diff --git a/init/main.c b/init/main.c
index 80f5aaf..4a84f60 100644
--- a/init/main.c
+++ b/init/main.c
@@ -590,17 +590,25 @@ asmlinkage void __init start_kernel(void)
 	rcu_init();
 	init_IRQ();
 	pidhash_init();
+	printk("init_timers:\n");
 	init_timers();
 	hrtimers_init();
 	softirq_init();
+	printk("timekeeping:\n");
 	timekeeping_init();
+	printk("time:\n");
 	time_init();
+	printk("profile:\n");
 	profile_init();
+	printk("irqs_disabled:\n");
 	if (!irqs_disabled())
 		printk("start_kernel(): bug: interrupts were enabled early\n");
+	printk("early_boot_irqs_on:\n");
 	early_boot_irqs_on();
+	printk("local_irq_enable:\n");
 	local_irq_enable();
 
+	printk("console_init:\n");
 	/*
 	 * HACK ALERT! This is early. We're enabling the console before
 	 * we've done PCI setups etc, and console_init() must be aware of
@@ -637,7 +645,9 @@ asmlinkage void __init start_kernel(void)
 	numa_policy_init();
 	if (late_time_init)
 		late_time_init();
+	printk("calibrate_delay:\n");
 	calibrate_delay();
+	printk("pidmap_init:\n");
 	pidmap_init();
 	pgtable_cache_init();
 	prio_tree_init();
diff --git a/mm/slab.c b/mm/slab.c
index e499669..c18daa3 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3202,6 +3202,8 @@ static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags)
 		STATS_INC_ALLOCHIT(cachep);
 		ac->touched = 1;
 		objp = ac->entry[--ac->avail];
+		if (!objp)
+			printk("really weird: avail objp for cache %s is null\n", cachep->name);
 	} else {
 		STATS_INC_ALLOCMISS(cachep);
 		objp = cache_alloc_refill(cachep, flags);
@@ -3464,8 +3466,10 @@ __cache_alloc(struct kmem_cache *cachep, gfp_t flags, void *caller)
 	unsigned long save_flags;
 	void *objp;
 
-	if (should_failslab(cachep, flags))
+	if (should_failslab(cachep, flags)) {
+		printk("cache %s should fail\n", cachep->name);
 		return NULL;
+	}
 
 	cache_alloc_debugcheck_before(cachep, flags);
 	local_irq_save(save_flags);
@@ -3477,6 +3481,8 @@ __cache_alloc(struct kmem_cache *cachep, gfp_t flags, void *caller)
 	if (unlikely((flags & __GFP_ZERO) && objp))
 		memset(objp, 0, obj_size(cachep));
 
+	if (!objp)
+		printk("allocation from cache %s failed!!!\n", cachep->name);
 	return objp;
 }
 
-- 
1.5.4.1



--- NEW FILE patch-2.6.25-rc4.bz2.sign ---
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: See http://www.kernel.org/signature.html for info

iD8DBQBHzihsyGugalF9Dw4RAmvmAJ9ksQ5jf9yUO9KIUeo1adCPfKJrMQCfa3Ob
5SYdhp9yFKCV9a4cvu3nF70=
=9t/0
-----END PGP SIGNATURE-----


Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/.cvsignore,v
retrieving revision 1.11.2.2
retrieving revision 1.11.2.3
diff -u -r1.11.2.2 -r1.11.2.3
--- .cvsignore	29 Feb 2008 18:58:22 -0000	1.11.2.2
+++ .cvsignore	5 Mar 2008 18:41:17 -0000	1.11.2.3
@@ -4,7 +4,5 @@
 temp-*
 kernel-2.6.24
 linux-2.6.24.tar.bz2
-patch-2.6.25-rc3.bz2
-patch-2.6.25-rc2-git7.bz2
-patch-2.6.25-rc3-git1.bz2
+patch-2.6.25-rc4.bz2
 xen-3.2.0.tar.gz


Index: .gitignore
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/Attic/.gitignore,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -u -r1.1.2.2 -r1.1.2.3
--- .gitignore	29 Feb 2008 18:58:22 -0000	1.1.2.2
+++ .gitignore	5 Mar 2008 18:41:17 -0000	1.1.2.3
@@ -4,7 +4,5 @@
 temp-*
 kernel-2.6.24
 linux-2.6.24.tar.bz2
-patch-2.6.25-rc3.bz2
-patch-2.6.25-rc2-git7.bz2
-patch-2.6.25-rc3-git1.bz2
+patch-2.6.25-rc4.bz2
 xen-3.2.0.tar.gz






Index: config-generic
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/config-generic,v
retrieving revision 1.2.4.2
retrieving revision 1.2.4.3
diff -u -r1.2.4.2 -r1.2.4.3
--- config-generic	29 Feb 2008 18:58:22 -0000	1.2.4.2
+++ config-generic	5 Mar 2008 18:41:17 -0000	1.2.4.3
@@ -1984,6 +1984,7 @@
 CONFIG_RTC_DRV_X1205=m
 CONFIG_RTC_DRV_V3020=m
 CONFIG_RTC_DRV_STK17TA8=m
+# CONFIG_RTC_DRV_S35390A is not set
 
 CONFIG_DTLK=m
 CONFIG_R3964=m
@@ -3149,6 +3150,7 @@
 CONFIG_PROC_PID_CPUSET=y
 
 # CONFIG_SYSFS_DEPRECATED is not set
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 
 CONFIG_RELAY=y
 # CONFIG_PRINTK_TIME is not set
@@ -3461,4 +3463,6 @@
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 CONFIG_CGROUP_SCHED=y
+# CONFIG_CGROUP_MEM_RES_CTLR is not set
 
+# CONFIG_FIREWIRE_OHCI_REMOTE_DMA is not set


Index: config-powerpc-generic
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/config-powerpc-generic,v
retrieving revision 1.2.4.2
retrieving revision 1.2.4.3
diff -u -r1.2.4.2 -r1.2.4.3
--- config-powerpc-generic	29 Feb 2008 18:58:22 -0000	1.2.4.2
+++ config-powerpc-generic	5 Mar 2008 18:41:17 -0000	1.2.4.3
@@ -218,3 +218,6 @@
 CONFIG_THERMAL=y
 
 # CONFIG_MEMORY_HOTREMOVE is not set
+
+CONFIG_DMADEVICES=y
+# CONFIG_FSL_DMA is not set


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/kernel.spec,v
retrieving revision 1.11.2.13
retrieving revision 1.11.2.14
diff -u -r1.11.2.13 -r1.11.2.14
--- kernel.spec	5 Mar 2008 14:01:21 -0000	1.11.2.13
+++ kernel.spec	5 Mar 2008 18:41:17 -0000	1.11.2.14
@@ -20,7 +20,7 @@
 # kernel spec when the kernel is rebased, so fedora_build automatically
 # works out to the offset from the rebase, so it doesn't get too ginormous.
 #
-%define fedora_cvs_origin 78
+%define fedora_cvs_origin 93
 %define private_markmc_pv_ops_branch 1.11.2.
 %define fedora_build %(R="$Revision$"; R="${R%% \$}"; echo "%{fedora_cvs_origin}.${R##: %{private_markmc_pv_ops_branch}}")
 
@@ -44,9 +44,9 @@
 # The next upstream release sublevel (base_sublevel+1)
 %define upstream_sublevel %(expr %{base_sublevel} + 1)
 # The rc snapshot level
-%define rcrev 3
+%define rcrev 4
 # The git snapshot level
-%define gitrev 1
+%define gitrev 0
 # Set rpm version accordingly
 %define rpmversion 2.6.%{upstream_sublevel}
 %endif
@@ -594,11 +594,14 @@
 Patch42: linux-2.6-x86-tune-generic.patch
 Patch75: linux-2.6-x86-debug-boot.patch
 
+Patch80: linux-2.6-ia32-syscall-restart.patch
+
 Patch123: linux-2.6-ppc-rtc.patch
 Patch140: linux-2.6-ps3-ehci-iso.patch
 Patch141: linux-2.6-ps3-storage-alias.patch
 Patch142: linux-2.6-ps3-legacy-bootloader-hack.patch
 Patch143: linux-2.6-g5-therm-shutdown.patch
+Patch144: linux-2.6-vio-modalias.patch
 
 Patch160: linux-2.6-execshield.patch
 Patch250: linux-2.6-debug-sizeof-structs.patch
@@ -622,6 +625,7 @@
 
 Patch680: linux-2.6-wireless.patch
 Patch681: linux-2.6-wireless-pending.patch
+Patch682: linux-2.6-wireless-pending-too.patch
 Patch690: linux-2.6-at76.patch
 
 Patch820: linux-2.6-compile-fixes.patch
@@ -634,6 +638,8 @@
 Patch1801: linux-2.6-drm-git-mm.patch
 Patch1802: linux-2.6-ppc32-ucmpdi2.patch
 Patch1803: nouveau-drm.patch
+Patch1804: linux-2.6-drm-git-mm-revert-nopfn.patch
+Patch1805: linux-2.6-drm-git-i915-remove-priv-access.patch
 
 # kludge to make ich9 e1000 work
 Patch2000: linux-2.6-e1000-ich9.patch
@@ -659,22 +665,23 @@
 
 Patch2501: linux-2.6-ppc-use-libgcc.patch
 
+Patch2503: linux-2.6-virtio_blk-fix-sysfs-bits.patch
+
 ### HACK ###
 Patch2502: linux-2.6-blkcipher-depend-on-chainiv.patch
 
 # kernel-xen patches start
-Patch5000: linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch-from-kernel-2_6_25.patch
-Patch5001: linux-2.6-xen-0002-x86-xen-Construct-e820-map-with-a-hole-between-640K.patch
-Patch5002: linux-2.6-xen-0003-squashfs-Fix-build-without-CONFIG_SMP.patch
-Patch5003: linux-2.6-xen-0004-xen-Make-hvc0-the-preferred-console-in-domU.patch
-Patch5004: linux-2.6-xen-0005-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch
-Patch5005: linux-2.6-xen-0006-fbdev-Make-deferred-I-O-work-as-advertized.patch
-Patch5006: linux-2.6-xen-0007-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch
-Patch5007: linux-2.6-xen-0008-xen-Module-autoprobing-support-for-frontend-drivers.patch
-Patch5008: linux-2.6-xen-0009-xen-Add-compatibility-aliases-for-frontend-drivers.patch
-Patch5009: linux-2.6-xen-0010-xen-dom0-Add-a-vmlinuz-target.patch
-Patch5010: linux-2.6-xen-0011-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch
-Patch5011: linux-2.6-xen-0012-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch
+Patch5000: linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch.patch
+Patch5001: linux-2.6-xen-0002-squashfs-Fix-build-without-CONFIG_SMP.patch
+Patch5002: linux-2.6-xen-0003-xen-Make-hvc0-the-preferred-console-in-domU.patch
+Patch5003: linux-2.6-xen-0004-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch
+Patch5004: linux-2.6-xen-0005-fbdev-Make-deferred-I-O-work-as-advertized.patch
+Patch5005: linux-2.6-xen-0006-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch
+Patch5006: linux-2.6-xen-0007-xen-Module-autoprobing-support-for-frontend-drivers.patch
+Patch5007: linux-2.6-xen-0008-xen-Add-compatibility-aliases-for-frontend-drivers.patch
+Patch5008: linux-2.6-xen-0009-xen-dom0-Add-a-vmlinuz-target.patch
+Patch5009: linux-2.6-xen-0010-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch
+Patch5010: linux-2.6-xen-0011-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch
 # kernel-xen patches end
 
 # Xen hypervisor patches (20000+)
@@ -1062,6 +1069,8 @@
 # Compile 686 kernels tuned for Pentium4.
 ApplyPatch linux-2.6-x86-tune-generic.patch
 
+ApplyPatch linux-2.6-ia32-syscall-restart.patch
+
 #
 # PowerPC
 #
@@ -1079,6 +1088,8 @@
 ApplyPatch linux-2.6-ps3-legacy-bootloader-hack.patch
 # Alleviate G5 thermal shutdown problems
 ApplyPatch linux-2.6-g5-therm-shutdown.patch
+# Provide modalias in sysfs for vio devices
+ApplyPatch linux-2.6-vio-modalias.patch
 
 #
 # Exec shield
@@ -1155,9 +1166,11 @@
 ApplyPatch linux-2.6-ata-quirk.patch
 
 # wireless patches headed for 2.6.25
-ApplyPatch linux-2.6-wireless.patch
+#ApplyPatch linux-2.6-wireless.patch
 # wireless patches headed for 2.6.26
 ApplyPatch linux-2.6-wireless-pending.patch
+# temporary backport of some later wireless patches
+ApplyPatch linux-2.6-wireless-pending-too.patch
 
 # Add misc wireless bits from upstream wireless tree
 ApplyPatch linux-2.6-at76.patch
@@ -1190,12 +1203,14 @@
 ApplyPatch linux-2.6-drm-git-mm.patch
 ApplyPatch linux-2.6-ppc32-ucmpdi2.patch
 ApplyPatch nouveau-drm.patch
+ApplyPatch linux-2.6-drm-git-mm-revert-nopfn.patch
+ApplyPatch linux-2.6-drm-git-i915-remove-priv-access.patch
 
 # ext4dev stable patch queue, slated for 2.6.25
 #ApplyPatch linux-2.6-ext4-stable-queue.patch
 
 # linux1394 git patches
-#ApplyPatch linux-2.6-firewire-git-update.patch
+ApplyPatch linux-2.6-firewire-git-update.patch
 C=$(wc -l $RPM_SOURCE_DIR/linux-2.6-firewire-git-pending.patch | awk '{print $1}')
 if [ "$C" -gt 10 ]; then
 ApplyPatch linux-2.6-firewire-git-pending.patch
@@ -1206,24 +1221,25 @@
 
 ApplyPatch linux-2.6-ppc-use-libgcc.patch
 
+ApplyPatch linux-2.6-virtio_blk-fix-sysfs-bits.patch
+
 ApplyPatch linux-2.6-blkcipher-depend-on-chainiv.patch
 
 # ---------- below all scheduled for 2.6.24 -----------------
 
 # kernel-xen apply start
-ApplyPatch linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch-from-kernel-2_6_25.patch
-ApplyPatch linux-2.6-xen-0002-x86-xen-Construct-e820-map-with-a-hole-between-640K.patch
-ApplyPatch linux-2.6-xen-0003-squashfs-Fix-build-without-CONFIG_SMP.patch
-ApplyPatch linux-2.6-xen-0004-xen-Make-hvc0-the-preferred-console-in-domU.patch
-ApplyPatch linux-2.6-xen-0005-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch
-ApplyPatch linux-2.6-xen-0006-fbdev-Make-deferred-I-O-work-as-advertized.patch
-ApplyPatch linux-2.6-xen-0007-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch
-ApplyPatch linux-2.6-xen-0008-xen-Module-autoprobing-support-for-frontend-drivers.patch
-ApplyPatch linux-2.6-xen-0009-xen-Add-compatibility-aliases-for-frontend-drivers.patch
-ApplyPatch linux-2.6-xen-0010-xen-dom0-Add-a-vmlinuz-target.patch
-ApplyPatch linux-2.6-xen-0011-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch
+ApplyPatch linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch.patch
+ApplyPatch linux-2.6-xen-0002-squashfs-Fix-build-without-CONFIG_SMP.patch
+ApplyPatch linux-2.6-xen-0003-xen-Make-hvc0-the-preferred-console-in-domU.patch
+ApplyPatch linux-2.6-xen-0004-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch
+ApplyPatch linux-2.6-xen-0005-fbdev-Make-deferred-I-O-work-as-advertized.patch
+ApplyPatch linux-2.6-xen-0006-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch
+ApplyPatch linux-2.6-xen-0007-xen-Module-autoprobing-support-for-frontend-drivers.patch
+ApplyPatch linux-2.6-xen-0008-xen-Add-compatibility-aliases-for-frontend-drivers.patch
+ApplyPatch linux-2.6-xen-0009-xen-dom0-Add-a-vmlinuz-target.patch
+ApplyPatch linux-2.6-xen-0010-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch
 %ifarch x86_64
-ApplyPatch linux-2.6-xen-0012-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch
+ApplyPatch linux-2.6-xen-0011-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch
 %endif
 # kernel-xen apply end
 
@@ -1377,6 +1393,7 @@
     fi
     $CopyKernel $KernelImage \
     		$RPM_BUILD_ROOT/%{image_install_path}/$InstallName-$KernelVer
+    chmod 755 $RPM_BUILD_ROOT/%{image_install_path}/$InstallName-$KernelVer
 
     mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer
     make -s ARCH=$Arch INSTALL_MOD_PATH=$RPM_BUILD_ROOT modules_install KERNELRELEASE=$KernelVer
@@ -1825,6 +1842,9 @@
 
 %changelog
 * Wed Mar 05 2008 Mark McLoughlin <markmc at redhat.com>
+- Re-base to kernel-2_6_25-0_93_rc4_fc9
+
+* Wed Mar 05 2008 Mark McLoughlin <markmc at redhat.com>
 - Re-base to kernel-2_6_25-0_78_rc3_git1_fc9
 - Revert the execshield patch for now
 - Include xen pv fb and kbd drivers

linux-2.6-debug-taint-vm.patch:

Index: linux-2.6-debug-taint-vm.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/linux-2.6-debug-taint-vm.patch,v
retrieving revision 1.3.8.2
retrieving revision 1.3.8.3
diff -u -r1.3.8.2 -r1.3.8.3
--- linux-2.6-debug-taint-vm.patch	29 Feb 2008 18:58:22 -0000	1.3.8.2
+++ linux-2.6-debug-taint-vm.patch	5 Mar 2008 18:41:17 -0000	1.3.8.3
@@ -10,25 +10,6 @@
  
  void add_taint(unsigned flag)
  {
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index b5a58d4..7a0c25d 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -221,12 +221,12 @@ static inline int bad_range(struct zone *zone, struct page *page)
- static void bad_page(struct page *page)
- {
- 	printk(KERN_EMERG "Bad page state in process '%s'\n"
--		KERN_EMERG "page:%p flags:0x%0*lx mapping:%p mapcount:%d count:%d\n"
-+		KERN_EMERG "page:%p flags:0x%0*lx mapping:%p mapcount:%d count:%d (%s)\n"
- 		KERN_EMERG "Trying to fix it up, but a reboot is needed\n"
- 		KERN_EMERG "Backtrace:\n",
- 		current->comm, page, (int)(2*sizeof(unsigned long)),
- 		(unsigned long)page->flags, page->mapping,
--		page_mapcount(page), page_count(page));
-+		page_mapcount(page), page_count(page), print_tainted());
- 	dump_stack();
- 	page->flags &= ~(1 << PG_lru	|
- 			1 << PG_private |
 diff --git a/mm/slab.c b/mm/slab.c
 index 2e338a5..e5627f9 100644
 --- a/mm/slab.c
@@ -83,3 +64,20 @@
  	print_modules();
  	dump_stack();
  	print_oops_end_marker();
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 402a504..2085092 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -225,10 +225,10 @@ static void bad_page(struct page *page)
+ 	void *pc = page_get_page_cgroup(page);
+ 
+ 	printk(KERN_EMERG "Bad page state in process '%s'\n" KERN_EMERG
+-		"page:%p flags:0x%0*lx mapping:%p mapcount:%d count:%d\n",
++		"page:%p flags:0x%0*lx mapping:%p mapcount:%d count:%d (%s)\n",
+ 		current->comm, page, (int)(2*sizeof(unsigned long)),
+ 		(unsigned long)page->flags, page->mapping,
+-		page_mapcount(page), page_count(page));
++		page_mapcount(page), page_count(page), print_tainted());
+ 	if (pc) {
+ 		printk(KERN_EMERG "cgroup:%p\n", pc);
+ 		page_reset_bad_cgroup(page);

linux-2.6-firewire-git-pending.patch:

Index: linux-2.6-firewire-git-pending.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/Attic/linux-2.6-firewire-git-pending.patch,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -u -r1.1.2.2 -r1.1.2.3
--- linux-2.6-firewire-git-pending.patch	29 Feb 2008 18:58:22 -0000	1.1.2.2
+++ linux-2.6-firewire-git-pending.patch	5 Mar 2008 18:41:17 -0000	1.1.2.3
@@ -3,988 +3,485 @@
 # tree, which we think we're going to want...
 #
 
-The generation of incoming requests was filled in in wrong byte order on
-machines with big endian CPU.
+read_bus_info_block() is repeatedly called by workqueue jobs.
+These will step on each others toes eventually if there are multiple
+workqueue threads, and we end up with corrupt config ROM images.
 
 Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
-Cc: sparclinux at vger.kernel.org
-Cc: linuxppc-dev at ozlabs.org
 ---
+ drivers/firewire/fw-device.c |   41 +++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 14 deletions(-)
 
-This patch is a shot in the dark, based on a warning when building with
-C=1 CHECKFLAGS="-D__CHECK_ENDIAN__".  Is it really a fix, or was the
-previous code accidentally correct?
-
-This needs to be tested on different big endian PCs, if possible with
-the Apple Uninorth FireWire controller and other types of controllers.
-One test which involves ohci->request_generation is simply with an SBP-2
-device (harddisk, CD-ROM...).  Does SBP-2 login etc. work?
-
-If possible, also test whether the device remains accessible after
-forcing a bus reset, e.g. by "echo br short > firecontrol".  You need
-the easy to build utility firecontrol and a libraw1394 with "juju"
-backend.  See wiki.linux1394.org for directions.
-
-
- drivers/firewire/fw-ohci.c |    2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-Index: linux/drivers/firewire/fw-ohci.c
-===================================================================
---- linux.orig/drivers/firewire/fw-ohci.c
-+++ linux/drivers/firewire/fw-ohci.c
-@@ -375,7 +375,7 @@ static __le32 *handle_ar_packet(struct a
- 	 */
- 
- 	if (p.ack + 16 == 0x09)
--		ohci->request_generation = (buffer[2] >> 16) & 0xff;
-+		ohci->request_generation = (p.header[2] >> 16) & 0xff;
- 	else if (ctx == &ohci->ar_request_ctx)
- 		fw_core_handle_request(&ohci->card, &p);
- 	else
-
--- 
-Stefan Richter
--=====-==--- --=- =-===
-http://arcgraph.de/sr/
-
-
-Kills warnings from 'make C=1 CHECKFLAGS="-D__CHECK_ENDIAN__" modules':
-
-drivers/firewire/fw-transaction.c:771:10: warning: incorrect type in assignment (different base types)
-drivers/firewire/fw-transaction.c:771:10:    expected unsigned int [unsigned] [usertype] <noident>
-drivers/firewire/fw-transaction.c:771:10:    got restricted unsigned int [usertype] <noident>
-drivers/firewire/fw-transaction.h:93:10: warning: incorrect type in assignment (different base types)
-drivers/firewire/fw-transaction.h:93:10:    expected unsigned int [unsigned] [usertype] <noident>
-drivers/firewire/fw-transaction.h:93:10:    got restricted unsigned int [usertype] <noident>
-drivers/firewire/fw-ohci.c:1490:8: warning: restricted degrades to integer
-drivers/firewire/fw-ohci.c:1490:35: warning: restricted degrades to integer
-drivers/firewire/fw-ohci.c:1516:5: warning: cast to restricted type
-
-Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
-Cc: sparclinux at vger.kernel.org
-Cc: linuxppc-dev at ozlabs.org
----
- drivers/firewire/fw-ohci.c        |    4 ++--
- drivers/firewire/fw-transaction.c |    2 +-
- drivers/firewire/fw-transaction.h |    6 +++---
- 3 files changed, 6 insertions(+), 6 deletions(-)
-
-Index: linux/drivers/firewire/fw-ohci.c
-===================================================================
---- linux.orig/drivers/firewire/fw-ohci.c
-+++ linux/drivers/firewire/fw-ohci.c
-@@ -1487,7 +1487,7 @@ static int handle_ir_dualbuffer_packet(s
- 	void *p, *end;
- 	int i;
- 
--	if (db->first_res_count > 0 && db->second_res_count > 0) {
-+	if (db->first_res_count != 0 && db->second_res_count != 0) {
- 		if (ctx->excess_bytes <= le16_to_cpu(db->second_req_count)) {
- 			/* This descriptor isn't done yet, stop iteration. */
- 			return 0;
-@@ -1513,7 +1513,7 @@ static int handle_ir_dualbuffer_packet(s
- 		memcpy(ctx->header + i + 4, p + 8, ctx->base.header_size - 4);
- 		i += ctx->base.header_size;
- 		ctx->excess_bytes +=
--			(le32_to_cpu(*(u32 *)(p + 4)) >> 16) & 0xffff;
-+			(le32_to_cpu(*(__le32 *)(p + 4)) >> 16) & 0xffff;
- 		p += ctx->base.header_size + 4;
- 	}
- 	ctx->header_length = i;
-Index: linux/drivers/firewire/fw-transaction.c
-===================================================================
---- linux.orig/drivers/firewire/fw-transaction.c
-+++ linux/drivers/firewire/fw-transaction.c
-@@ -751,7 +751,7 @@ handle_topology_map(struct fw_card *card
- 		    void *payload, size_t length, void *callback_data)
- {
- 	int i, start, end;
--	u32 *map;
-+	__be32 *map;
- 
- 	if (!TCODE_IS_READ_REQUEST(tcode)) {
- 		fw_send_response(card, request, RCODE_TYPE_ERROR);
-Index: linux/drivers/firewire/fw-transaction.h
-===================================================================
---- linux.orig/drivers/firewire/fw-transaction.h
-+++ linux/drivers/firewire/fw-transaction.h
-@@ -85,12 +85,12 @@
- static inline void
- fw_memcpy_from_be32(void *_dst, void *_src, size_t size)
- {
--	u32 *dst = _dst;
--	u32 *src = _src;
-+	u32    *dst = _dst;
-+	__be32 *src = _src;
- 	int i;
- 
- 	for (i = 0; i < size / 4; i++)
--		dst[i] = cpu_to_be32(src[i]);
-+		dst[i] = be32_to_cpu(src[i]);
- }
- 
- static inline void
-
--- 
-Stefan Richter
--=====-==--- --=- =-===
-http://arcgraph.de/sr/
-
-
-Patch "firewire: fw-sbp2: fix NULL pointer deref. in scsi_remove_device"
-had the unintended effect that firewire-sbp2 could not be unloaded
-anymore until all SBP-2 devices were unplugged.
-
-We now fix the NULL pointer bug by reacquiring a reference to the sdev
-instead of holding a reference to the sdev (and to the module) all the
-time.
-
-Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
----
-
-This applies on top of current linux-2.6.git master as well as on top of
-linux1394-2.6.git master.
-
-
- drivers/firewire/fw-sbp2.c |   46 +++++++++++++++++++++----------------
- 1 file changed, 27 insertions(+), 19 deletions(-)
-
-Index: linux/drivers/firewire/fw-sbp2.c
+Index: linux/drivers/firewire/fw-device.c
 ===================================================================
---- linux.orig/drivers/firewire/fw-sbp2.c
-+++ linux/drivers/firewire/fw-sbp2.c
-@@ -122,7 +122,6 @@ static const char sbp2_driver_name[] = "
- struct sbp2_logical_unit {
- 	struct sbp2_target *tgt;
- 	struct list_head link;
--	struct scsi_device *sdev;
- 	struct fw_address_handler address_handler;
- 	struct list_head orb_list;
- 
-@@ -139,6 +138,7 @@ struct sbp2_logical_unit {
- 	int generation;
- 	int retries;
- 	struct delayed_work work;
-+	bool has_sdev;
- 	bool blocked;
- };
- 
-@@ -751,20 +751,33 @@ static void sbp2_unblock(struct sbp2_tar
- 	scsi_unblock_requests(shost);
+--- linux.orig/drivers/firewire/fw-device.c
++++ linux/drivers/firewire/fw-device.c
+@@ -400,6 +400,9 @@ read_rom(struct fw_device *device, int g
+ 	return callback_data.rcode;
  }
  
-+static int sbp2_lun2int(u16 lun)
-+{
-+	struct scsi_lun eight_bytes_lun;
++#define READ_BIB_ROM_SIZE	256
++#define READ_BIB_STACK_SIZE	16
 +
-+	memset(&eight_bytes_lun, 0, sizeof(eight_bytes_lun));
-+	eight_bytes_lun.scsi_lun[0] = (lun >> 8) & 0xff;
-+	eight_bytes_lun.scsi_lun[1] = lun & 0xff;
-+
-+	return scsilun_to_int(&eight_bytes_lun);
-+}
-+
- static void sbp2_release_target(struct kref *kref)
- {
- 	struct sbp2_target *tgt = container_of(kref, struct sbp2_target, kref);
- 	struct sbp2_logical_unit *lu, *next;
- 	struct Scsi_Host *shost =
- 		container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
-+	struct scsi_device *sdev;
- 
- 	/* prevent deadlocks */
- 	sbp2_unblock(tgt);
- 
- 	list_for_each_entry_safe(lu, next, &tgt->lu_list, link) {
--		if (lu->sdev) {
--			scsi_remove_device(lu->sdev);
--			scsi_device_put(lu->sdev);
-+		sdev = scsi_device_lookup(shost, 0, 0, sbp2_lun2int(lu->lun));
-+		if (sdev) {
-+			scsi_remove_device(sdev);
-+			scsi_device_put(sdev);
- 		}
- 		sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
- 				SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
-@@ -807,7 +820,6 @@ static void sbp2_login(struct work_struc
- 	struct fw_device *device = fw_device(tgt->unit->device.parent);
- 	struct Scsi_Host *shost;
- 	struct scsi_device *sdev;
--	struct scsi_lun eight_bytes_lun;
- 	struct sbp2_login_response response;
- 	int generation, node_id, local_node_id;
- 
-@@ -820,7 +832,7 @@ static void sbp2_login(struct work_struc
- 	local_node_id = device->card->node_id;
- 
- 	/* If this is a re-login attempt, log out, or we might be rejected. */
--	if (lu->sdev)
-+	if (lu->has_sdev)
- 		sbp2_send_management_orb(lu, device->node_id, generation,
- 				SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
- 
-@@ -859,7 +871,7 @@ static void sbp2_login(struct work_struc
- 	sbp2_agent_reset(lu);
- 
- 	/* This was a re-login. */
--	if (lu->sdev) {
-+	if (lu->has_sdev) {
- 		sbp2_cancel_orbs(lu);
- 		sbp2_conditionally_unblock(lu);
- 		goto out;
-@@ -868,13 +880,8 @@ static void sbp2_login(struct work_struc
- 	if (lu->tgt->workarounds & SBP2_WORKAROUND_DELAY_INQUIRY)
- 		ssleep(SBP2_INQUIRY_DELAY);
- 
--	memset(&eight_bytes_lun, 0, sizeof(eight_bytes_lun));
--	eight_bytes_lun.scsi_lun[0] = (lu->lun >> 8) & 0xff;
--	eight_bytes_lun.scsi_lun[1] = lu->lun & 0xff;
- 	shost = container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
--
--	sdev = __scsi_add_device(shost, 0, 0,
--				 scsilun_to_int(&eight_bytes_lun), lu);
-+	sdev = __scsi_add_device(shost, 0, 0, sbp2_lun2int(lu->lun), lu);
- 	/*
- 	 * FIXME:  We are unable to perform reconnects while in sbp2_login().
- 	 * Therefore __scsi_add_device() will get into trouble if a bus reset
-@@ -896,7 +903,8 @@ static void sbp2_login(struct work_struc
- 	}
- 
- 	/* No error during __scsi_add_device() */
--	lu->sdev = sdev;
-+	lu->has_sdev = true;
-+	scsi_device_put(sdev);
- 	sbp2_allow_block(lu);
- 	goto out;
- 
-@@ -934,11 +942,11 @@ static int sbp2_add_logical_unit(struct 
- 		return -ENOMEM;
+ /*
+  * Read the bus info block, perform a speed probe, and read all of the rest of
+  * the config ROM.  We do all this with a cached bus generation.  If the bus
+@@ -409,16 +412,23 @@ read_rom(struct fw_device *device, int g
+  */
+ static int read_bus_info_block(struct fw_device *device, int generation)
+ {
+-	static u32 rom[256];
+-	u32 stack[16], sp, key;
+-	int i, end, length;
++	u32 *rom, *stack;
++	u32 sp, key;
++	int i, end, length, ret = -1;
++
++	rom = kmalloc(sizeof(*rom) * READ_BIB_ROM_SIZE +
++		      sizeof(*stack) * READ_BIB_STACK_SIZE, GFP_KERNEL);
++	if (rom == NULL)
++		return -ENOMEM;
++
++	stack = &rom[READ_BIB_ROM_SIZE];
+ 
+ 	device->max_speed = SCODE_100;
+ 
+ 	/* First read the bus info block. */
+ 	for (i = 0; i < 5; i++) {
+ 		if (read_rom(device, generation, i, &rom[i]) != RCODE_COMPLETE)
+-			return -1;
++			goto out;
+ 		/*
+ 		 * As per IEEE1212 7.2, during power-up, devices can
+ 		 * reply with a 0 for the first quadlet of the config
+@@ -428,7 +438,7 @@ static int read_bus_info_block(struct fw
+ 		 * retry mechanism will try again later.
+ 		 */
+ 		if (i == 0 && rom[i] == 0)
+-			return -1;
++			goto out;
  	}
  
--	lu->tgt  = tgt;
--	lu->sdev = NULL;
--	lu->lun  = lun_entry & 0xffff;
--	lu->retries = 0;
--	lu->blocked = false;
-+	lu->tgt      = tgt;
-+	lu->lun      = lun_entry & 0xffff;
-+	lu->retries  = 0;
-+	lu->has_sdev = false;
-+	lu->blocked  = false;
- 	++tgt->dont_block;
- 	INIT_LIST_HEAD(&lu->orb_list);
- 	INIT_DELAYED_WORK(&lu->work, sbp2_login);
-
--- 
-Stefan Richter
--=====-==--- --=- ==-=-
-http://arcgraph.de/sr/
-
-
-The bus management workqueue job was in danger to dereference NULL
-pointers.  Also, after having temporarily lifted card->lock, a few node
-pointers and a device pointer may have become invalid.
-
-Add NULL pointer checks and get the necessary references.  Also, move
-card->local_node out of fw_card_bm_work's sight during shutdown of the
-card.
-
-Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
----
- drivers/firewire/fw-card.c     |   51 ++++++++++++++++++++++-----------
- drivers/firewire/fw-topology.c |    1 
- 2 files changed, 35 insertions(+), 17 deletions(-)
-
-Index: linux/drivers/firewire/fw-card.c
-===================================================================
---- linux.orig/drivers/firewire/fw-card.c
-+++ linux/drivers/firewire/fw-card.c
-@@ -214,17 +214,29 @@ static void
- fw_card_bm_work(struct work_struct *work)
- {
- 	struct fw_card *card = container_of(work, struct fw_card, work.work);
--	struct fw_device *root;
-+	struct fw_device *root_device;
-+	struct fw_node *root_node, *local_node;
- 	struct bm_data bmd;
- 	unsigned long flags;
- 	int root_id, new_root_id, irm_id, gap_count, generation, grace;
- 	int do_reset = 0;
- 
- 	spin_lock_irqsave(&card->lock, flags);
-+	local_node = card->local_node;
-+	root_node  = card->root_node;
-+
-+	if (local_node == NULL) {
-+		spin_unlock_irqrestore(&card->lock, flags);
-+		return;
-+	}
-+	fw_node_get(local_node);
-+	fw_node_get(root_node);
- 
- 	generation = card->generation;
--	root = card->root_node->data;
--	root_id = card->root_node->node_id;
-+	root_device = root_node->data;
-+	if (root_device)
-+		fw_device_get(root_device);
-+	root_id = root_node->node_id;
- 	grace = time_after(jiffies, card->reset_jiffies + DIV_ROUND_UP(HZ, 10));
- 
- 	if (card->bm_generation + 1 == generation ||
-@@ -243,14 +255,14 @@ fw_card_bm_work(struct work_struct *work
- 
- 		irm_id = card->irm_node->node_id;
- 		if (!card->irm_node->link_on) {
--			new_root_id = card->local_node->node_id;
-+			new_root_id = local_node->node_id;
- 			fw_notify("IRM has link off, making local node (%02x) root.\n",
- 				  new_root_id);
- 			goto pick_me;
- 		}
- 
- 		bmd.lock.arg = cpu_to_be32(0x3f);
--		bmd.lock.data = cpu_to_be32(card->local_node->node_id);
-+		bmd.lock.data = cpu_to_be32(local_node->node_id);
- 
- 		spin_unlock_irqrestore(&card->lock, flags);
- 
-@@ -267,12 +279,12 @@ fw_card_bm_work(struct work_struct *work
- 			 * Another bus reset happened. Just return,
- 			 * the BM work has been rescheduled.
+ 	device->max_speed = device->node->max_speed;
+@@ -478,26 +488,26 @@ static int read_bus_info_block(struct fw
+ 		 */
+ 		key = stack[--sp];
+ 		i = key & 0xffffff;
+-		if (i >= ARRAY_SIZE(rom))
++		if (i >= READ_BIB_ROM_SIZE)
+ 			/*
+ 			 * The reference points outside the standard
+ 			 * config rom area, something's fishy.
  			 */
--			return;
+-			return -1;
 +			goto out;
- 		}
  
- 		if (bmd.rcode == RCODE_COMPLETE && bmd.old != 0x3f)
- 			/* Somebody else is BM, let them do the work. */
--			return;
+ 		/* Read header quadlet for the block to get the length. */
+ 		if (read_rom(device, generation, i, &rom[i]) != RCODE_COMPLETE)
+-			return -1;
 +			goto out;
- 
- 		spin_lock_irqsave(&card->lock, flags);
- 		if (bmd.rcode != RCODE_COMPLETE) {
-@@ -282,7 +294,7 @@ fw_card_bm_work(struct work_struct *work
- 			 * do a bus reset and pick the local node as
- 			 * root, and thus, IRM.
+ 		end = i + (rom[i] >> 16) + 1;
+ 		i++;
+-		if (end > ARRAY_SIZE(rom))
++		if (end > READ_BIB_ROM_SIZE)
+ 			/*
+ 			 * This block extends outside standard config
+ 			 * area (and the array we're reading it
+ 			 * into).  That's broken, so ignore this
+ 			 * device.
  			 */
--			new_root_id = card->local_node->node_id;
-+			new_root_id = local_node->node_id;
- 			fw_notify("BM lock failed, making local node (%02x) root.\n",
- 				  new_root_id);
- 			goto pick_me;
-@@ -295,7 +307,7 @@ fw_card_bm_work(struct work_struct *work
- 		 */
- 		spin_unlock_irqrestore(&card->lock, flags);
- 		schedule_delayed_work(&card->work, DIV_ROUND_UP(HZ, 10));
--		return;
-+		goto out;
- 	}
- 
- 	/*
-@@ -305,20 +317,20 @@ fw_card_bm_work(struct work_struct *work
- 	 */
- 	card->bm_generation = generation;
+-			return -1;
++			goto out;
  
--	if (root == NULL) {
-+	if (root_device == NULL) {
- 		/*
- 		 * Either link_on is false, or we failed to read the
- 		 * config rom.  In either case, pick another root.
- 		 */
--		new_root_id = card->local_node->node_id;
--	} else if (atomic_read(&root->state) != FW_DEVICE_RUNNING) {
-+		new_root_id = local_node->node_id;
-+	} else if (atomic_read(&root_device->state) != FW_DEVICE_RUNNING) {
- 		/*
- 		 * If we haven't probed this device yet, bail out now
- 		 * and let's try again once that's done.
- 		 */
- 		spin_unlock_irqrestore(&card->lock, flags);
--		return;
--	} else if (root->config_rom[2] & BIB_CMC) {
-+		goto out;
-+	} else if (root_device->config_rom[2] & BIB_CMC) {
  		/*
- 		 * FIXME: I suppose we should set the cmstr bit in the
- 		 * STATE_CLEAR register of this node, as described in
-@@ -332,7 +344,7 @@ fw_card_bm_work(struct work_struct *work
- 		 * successfully read the config rom, but it's not
- 		 * cycle master capable.
- 		 */
--		new_root_id = card->local_node->node_id;
-+		new_root_id = local_node->node_id;
- 	}
+ 		 * Now read in the block.  If this is a directory
+@@ -507,9 +517,9 @@ static int read_bus_info_block(struct fw
+ 		while (i < end) {
+ 			if (read_rom(device, generation, i, &rom[i]) !=
+ 			    RCODE_COMPLETE)
+-				return -1;
++				goto out;
+ 			if ((key >> 30) == 3 && (rom[i] >> 30) > 1 &&
+-			    sp < ARRAY_SIZE(stack))
++			    sp < READ_BIB_STACK_SIZE)
+ 				stack[sp++] = i + rom[i];
+ 			i++;
+ 		}
+@@ -519,11 +529,14 @@ static int read_bus_info_block(struct fw
  
-  pick_me:
-@@ -341,8 +353,8 @@ fw_card_bm_work(struct work_struct *work
- 	 * the typically much larger 1394b beta repeater delays though.
- 	 */
- 	if (!card->beta_repeaters_present &&
--	    card->root_node->max_hops < ARRAY_SIZE(gap_count_table))
--		gap_count = gap_count_table[card->root_node->max_hops];
-+	    root_node->max_hops < ARRAY_SIZE(gap_count_table))
-+		gap_count = gap_count_table[root_node->max_hops];
- 	else
- 		gap_count = 63;
- 
-@@ -364,6 +376,11 @@ fw_card_bm_work(struct work_struct *work
- 		fw_send_phy_config(card, new_root_id, generation, gap_count);
- 		fw_core_initiate_bus_reset(card, 1);
- 	}
+ 	device->config_rom = kmalloc(length * 4, GFP_KERNEL);
+ 	if (device->config_rom == NULL)
+-		return -1;
++		goto out;
+ 	memcpy(device->config_rom, rom, length * 4);
+ 	device->config_rom_length = length;
++	ret = 0;
 + out:
-+	if (root_device)
-+		fw_device_put(root_device);
-+	fw_node_put(root_node);
-+	fw_node_put(local_node);
- }
++	kfree(rom);
  
- static void
-Index: linux/drivers/firewire/fw-topology.c
-===================================================================
---- linux.orig/drivers/firewire/fw-topology.c
-+++ linux/drivers/firewire/fw-topology.c
-@@ -383,6 +383,7 @@ void fw_destroy_nodes(struct fw_card *ca
- 	card->color++;
- 	if (card->local_node != NULL)
- 		for_each_fw_node(card, card->local_node, report_lost_node);
-+	card->local_node = NULL;
- 	spin_unlock_irqrestore(&card->lock, flags);
+-	return 0;
++	return ret;
  }
  
+ static void fw_unit_release(struct device *dev)
 
 -- 
 Stefan Richter
--=====-==--- --=- ==---
+-=====-==--- --== ---=-
 http://arcgraph.de/sr/
 
 
-"modprobe firewire-ohci; sleep .1; modprobe -r firewire-ohci" used to
-result in crashes like this:
-
-    BUG: unable to handle kernel paging request at ffffffff8807b455
-    IP: [<ffffffff8807b455>]
-    PGD 203067 PUD 207063 PMD 7c170067 PTE 0
-    Oops: 0010 [1] PREEMPT SMP 
-    CPU 0 
-    Modules linked in: i915 drm cpufreq_ondemand acpi_cpufreq freq_table applesmc input_polldev led_class coretemp hwmon eeprom snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss button thermal processor sg snd_hda_intel snd_pcm snd_timer snd snd_page_alloc sky2 i2c_i801 rtc [last unloaded: crc_itu_t]
-    Pid: 9, comm: events/0 Not tainted 2.6.25-rc2 #3
-    RIP: 0010:[<ffffffff8807b455>]  [<ffffffff8807b455>]
-    RSP: 0018:ffff81007dcdde88  EFLAGS: 00010246
-    RAX: ffff81007dc95040 RBX: ffff81007dee5390 RCX: 0000000000005e13
-    RDX: 0000000000008c8b RSI: 0000000000000001 RDI: ffff81007dee5388
-    RBP: ffff81007dc5eb40 R08: 0000000000000002 R09: ffffffff8022d05c
-    R10: ffffffff8023b34c R11: ffffffff8041a353 R12: ffff81007dee5388
-    R13: ffffffff8807b455 R14: ffffffff80593bc0 R15: 0000000000000000
-    FS:  0000000000000000(0000) GS:ffffffff8055a000(0000) knlGS:0000000000000000
-    CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
-    CR2: ffffffff8807b455 CR3: 0000000000201000 CR4: 00000000000006e0
-    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
-    Process events/0 (pid: 9, threadinfo ffff81007dcdc000, task ffff81007dc95040)
-    Stack:  ffffffff8023b396 ffffffff88082524 0000000000000000 ffffffff8807d9ae
-    ffff81007dc5eb40 ffff81007dc9dce0 ffff81007dc5eb40 ffff81007dc5eb80
-    ffff81007dc9dce0 ffffffffffffffff ffffffff8023be87 0000000000000000
-    Call Trace:
-    [<ffffffff8023b396>] ? run_workqueue+0xdf/0x1df
-    [<ffffffff8023be87>] ? worker_thread+0xd8/0xe3
-    [<ffffffff8023e917>] ? autoremove_wake_function+0x0/0x2e
-    [<ffffffff8023bdaf>] ? worker_thread+0x0/0xe3
-    [<ffffffff8023e813>] ? kthread+0x47/0x74
-    [<ffffffff804198e0>] ? trace_hardirqs_on_thunk+0x35/0x3a
-    [<ffffffff8020c008>] ? child_rip+0xa/0x12
-    [<ffffffff8020b6e3>] ? restore_args+0x0/0x3d
-    [<ffffffff8023e68a>] ? kthreadd+0x14c/0x171
-    [<ffffffff8023e68a>] ? kthreadd+0x14c/0x171
-    [<ffffffff8023e7cc>] ? kthread+0x0/0x74
-    [<ffffffff8020bffe>] ? child_rip+0x0/0x12
-
-
-    Code:  Bad RIP value.
-    RIP  [<ffffffff8807b455>]
-    RSP <ffff81007dcdde88>
-    CR2: ffffffff8807b455
-    ---[ end trace c7366c6657fe5bed ]---
-
-Note that this crash happened _after_ firewire-core was unloaded.  The
-shared workqueue tried to run firewire-core's device initialization jobs
-or similar jobs.
-
-The fix makes sure that firewire-ohci and hence firewire-core is not
-unloaded before all device shutdown jobs have been completed.  This is
-determined by the count of device initializations minus device releases.
-
-Also skip useless retries in the node initialization job if the node is
-to be shut down.
+When a device changes its configuration ROM, it announces this with a
+bus reset.  firewire-core has to check which node initiated a bus reset
+and whether any unit directories went away or were added on this node.
+
+Tested with an IOI FWB-IDE01AB which has its link-on bit set if bus
+power is available but does not respond to ROM read requests if self
+power is off.  This implements
+  - recognition of the units if self power is switched on after fw-core
+    gave up the initial attempt to read the config ROM,
+  - shutdown of the units when self power is switched off.
+
+Also tested with a second PC running Linux/ieee1394.  When the eth1394
+driver is inserted and removed on that node, fw-core now notices the
+addition and removal of the IPv4 unit on the ieee1394 node.
 
 Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
 ---
 
-Update:  Refreshed to be applicable after patch "firewire: fw-sbp2:
-better fix for NULL pointer dereference in scsi_remove_device".
-
-Update 2:  Update 1 had a use-after-free bug. #-|
-
-
- drivers/firewire/fw-card.c        |   10 +++++++++-
- drivers/firewire/fw-device.c      |   21 ++++++---------------
- drivers/firewire/fw-device.h      |   16 ++++++++++++++--
- drivers/firewire/fw-sbp2.c        |    4 ++++
- drivers/firewire/fw-transaction.h |    2 ++
- 5 files changed, 35 insertions(+), 18 deletions(-)
+Applies after "firewire: replace static ROM cache by allocated cache".
 
-Index: linux/drivers/firewire/fw-card.c
-===================================================================
---- linux.orig/drivers/firewire/fw-card.c
-+++ linux/drivers/firewire/fw-card.c
-@@ -18,6 +18,7 @@
- 
- #include <linux/module.h>
- #include <linux/errno.h>
-+#include <linux/delay.h>
- #include <linux/device.h>
- #include <linux/mutex.h>
- #include <linux/crc-itu-t.h>
-@@ -398,6 +399,7 @@ fw_card_initialize(struct fw_card *card,
- 	static atomic_t index = ATOMIC_INIT(-1);
- 
- 	kref_init(&card->kref);
-+	atomic_set(&card->device_count, 0);
- 	card->index = atomic_inc_return(&index);
- 	card->driver = driver;
- 	card->device = device;
-@@ -528,8 +530,14 @@ fw_core_remove_card(struct fw_card *card
- 	card->driver = &dummy_driver;
- 
- 	fw_destroy_nodes(card);
--	flush_scheduled_work();
-+	/*
-+	 * Wait for all device workqueue jobs to finish.  Otherwise the
-+	 * firewire-core module could be unloaded before the jobs ran.
-+	 */
-+	while (atomic_read(&card->device_count) > 0)
-+		msleep(100);
+ drivers/firewire/fw-cdev.c     |   18 ++--
+ drivers/firewire/fw-device.c   |  147 ++++++++++++++++++++++++++++++---
+ drivers/firewire/fw-topology.c |    3 
+ drivers/firewire/fw-topology.h |   11 +-
+ 4 files changed, 158 insertions(+), 21 deletions(-)
+
+Index: linux/drivers/firewire/fw-cdev.c
+===================================================================
+--- linux.orig/drivers/firewire/fw-cdev.c
++++ linux/drivers/firewire/fw-cdev.c
+@@ -32,6 +32,7 @@
+ #include <linux/idr.h>
+ #include <linux/compat.h>
+ #include <linux/firewire-cdev.h>
++#include <asm/semaphore.h>
+ #include <asm/system.h>
+ #include <asm/uaccess.h>
+ #include "fw-transaction.h"
+@@ -269,20 +270,25 @@ static int ioctl_get_info(struct client 
+ {
+ 	struct fw_cdev_get_info *get_info = buffer;
+ 	struct fw_cdev_event_bus_reset bus_reset;
++	struct fw_device *device = client->device;
++	unsigned long ret = 0;
+ 
+ 	client->version = get_info->version;
+ 	get_info->version = FW_CDEV_VERSION;
+ 
++	down(&device->device.sem);
+ 	if (get_info->rom != 0) {
+ 		void __user *uptr = u64_to_uptr(get_info->rom);
+ 		size_t want = get_info->rom_length;
+-		size_t have = client->device->config_rom_length * 4;
++		size_t have;
+ 
+-		if (copy_to_user(uptr, client->device->config_rom,
+-				 min(want, have)))
+-			return -EFAULT;
++		have = device->config_rom_length * 4;
++		ret = copy_to_user(uptr, device->config_rom, min(want, have));
+ 	}
+-	get_info->rom_length = client->device->config_rom_length * 4;
++	get_info->rom_length = device->config_rom_length * 4;
++	up(&device->device.sem);
++	if (ret != 0)
++		return -EFAULT;
+ 
+ 	client->bus_reset_closure = get_info->bus_reset_closure;
+ 	if (get_info->bus_reset != 0) {
+@@ -293,7 +299,7 @@ static int ioctl_get_info(struct client 
+ 			return -EFAULT;
+ 	}
  
-+	cancel_delayed_work_sync(&card->work);
- 	fw_flush_transactions(card);
- 	del_timer_sync(&card->flush_timer);
+-	get_info->card = client->device->card->index;
++	get_info->card = device->card->index;
  
+ 	return 0;
+ }
 Index: linux/drivers/firewire/fw-device.c
 ===================================================================
 --- linux.orig/drivers/firewire/fw-device.c
 +++ linux/drivers/firewire/fw-device.c
-@@ -150,21 +150,10 @@ struct bus_type fw_bus_type = {
- };
- EXPORT_SYMBOL(fw_bus_type);
- 
--struct fw_device *fw_device_get(struct fw_device *device)
--{
--	get_device(&device->device);
--
--	return device;
--}
--
--void fw_device_put(struct fw_device *device)
--{
--	put_device(&device->device);
--}
--
- static void fw_device_release(struct device *dev)
- {
- 	struct fw_device *device = fw_device(dev);
-+	struct fw_card *card = device->card;
- 	unsigned long flags;
- 
- 	/*
-@@ -176,9 +165,9 @@ static void fw_device_release(struct dev
- 	spin_unlock_irqrestore(&device->card->lock, flags);
+@@ -26,6 +26,7 @@
+ #include <linux/delay.h>
+ #include <linux/idr.h>
+ #include <linux/rwsem.h>
++#include <linux/string.h>
+ #include <asm/semaphore.h>
+ #include <asm/system.h>
+ #include <linux/ctype.h>
+@@ -160,9 +161,9 @@ static void fw_device_release(struct dev
+ 	 * Take the card lock so we don't set this to NULL while a
+ 	 * FW_NODE_UPDATED callback is being handled.
+ 	 */
+-	spin_lock_irqsave(&device->card->lock, flags);
++	spin_lock_irqsave(&card->lock, flags);
+ 	device->node->data = NULL;
+-	spin_unlock_irqrestore(&device->card->lock, flags);
++	spin_unlock_irqrestore(&card->lock, flags);
  
  	fw_node_put(device->node);
--	fw_card_put(device->card);
  	kfree(device->config_rom);
- 	kfree(device);
-+	atomic_dec(&card->device_count);
- }
+@@ -337,10 +338,14 @@ static ssize_t
+ config_rom_show(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+ 	struct fw_device *device = fw_device(dev);
++	size_t length;
  
- int fw_device_enable_phys_dma(struct fw_device *device)
-@@ -668,7 +657,8 @@ static void fw_device_init(struct work_s
- 	 */
+-	memcpy(buf, device->config_rom, device->config_rom_length * 4);
++	down(&dev->sem);
++	length = device->config_rom_length * 4;
++	memcpy(buf, device->config_rom, length);
++	up(&dev->sem);
+ 
+-	return device->config_rom_length * 4;
++	return length;
+ }
+ 
+ static ssize_t
+@@ -412,7 +417,7 @@ read_rom(struct fw_device *device, int g
+  */
+ static int read_bus_info_block(struct fw_device *device, int generation)
+ {
+-	u32 *rom, *stack;
++	u32 *rom, *stack, *old_rom, *new_rom;
+ 	u32 sp, key;
+ 	int i, end, length, ret = -1;
  
- 	if (read_bus_info_block(device, device->generation) < 0) {
--		if (device->config_rom_retries < MAX_RETRIES) {
-+		if (device->config_rom_retries < MAX_RETRIES &&
-+		    atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
- 			device->config_rom_retries++;
- 			schedule_delayed_work(&device->work, RETRY_DELAY);
- 		} else {
-@@ -805,7 +795,8 @@ void fw_node_event(struct fw_card *card,
- 		 */
- 		device_initialize(&device->device);
- 		atomic_set(&device->state, FW_DEVICE_INITIALIZING);
--		device->card = fw_card_get(card);
-+		atomic_inc(&card->device_count);
-+		device->card = card;
- 		device->node = fw_node_get(node);
- 		device->node_id = node->node_id;
- 		device->generation = card->generation;
-Index: linux/drivers/firewire/fw-sbp2.c
-===================================================================
---- linux.orig/drivers/firewire/fw-sbp2.c
-+++ linux/drivers/firewire/fw-sbp2.c
-@@ -769,6 +769,7 @@ static void sbp2_release_target(struct k
- 	struct Scsi_Host *shost =
- 		container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
- 	struct scsi_device *sdev;
-+	struct fw_device *device = fw_device(tgt->unit->device.parent);
- 
- 	/* prevent deadlocks */
- 	sbp2_unblock(tgt);
-@@ -791,6 +792,7 @@ static void sbp2_release_target(struct k
- 
- 	put_device(&tgt->unit->device);
- 	scsi_host_put(shost);
-+	fw_device_put(device);
- }
+@@ -527,11 +532,18 @@ static int read_bus_info_block(struct fw
+ 			length = i;
+ 	}
  
- static struct workqueue_struct *sbp2_wq;
-@@ -1088,6 +1090,8 @@ static int sbp2_probe(struct device *dev
- 	if (scsi_add_host(shost, &unit->device) < 0)
- 		goto fail_shost_put;
- 
-+	fw_device_get(device);
-+
- 	/* Initialize to values that won't match anything in our table. */
- 	firmware_revision = 0xff000000;
- 	model = 0xff000000;
-Index: linux/drivers/firewire/fw-transaction.h
-===================================================================
---- linux.orig/drivers/firewire/fw-transaction.h
-+++ linux/drivers/firewire/fw-transaction.h
-@@ -26,6 +26,7 @@
- #include <linux/fs.h>
- #include <linux/dma-mapping.h>
- #include <linux/firewire-constants.h>
-+#include <asm/atomic.h>
- 
- #define TCODE_IS_READ_REQUEST(tcode)	(((tcode) & ~1) == 4)
- #define TCODE_IS_BLOCK_PACKET(tcode)	(((tcode) &  1) != 0)
-@@ -219,6 +220,7 @@ extern struct bus_type fw_bus_type;
- struct fw_card {
- 	const struct fw_card_driver *driver;
- 	struct device *device;
-+	atomic_t device_count;
- 	struct kref kref;
+-	device->config_rom = kmalloc(length * 4, GFP_KERNEL);
+-	if (device->config_rom == NULL)
++	old_rom = device->config_rom;
++	new_rom = kmemdup(rom, length * 4, GFP_KERNEL);
++	if (new_rom == NULL)
+ 		goto out;
+-	memcpy(device->config_rom, rom, length * 4);
++
++	/* serialize with readers via sysfs or ioctl */
++	down(&device->device.sem);
++	device->config_rom = new_rom;
+ 	device->config_rom_length = length;
++	up(&device->device.sem);
++
++	kfree(old_rom);
+ 	ret = 0;
+  out:
+ 	kfree(rom);
+@@ -724,7 +736,7 @@ static void fw_device_init(struct work_s
+ 	if (atomic_cmpxchg(&device->state,
+ 		    FW_DEVICE_INITIALIZING,
+ 		    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN) {
+-		fw_device_shutdown(&device->work.work);
++		fw_device_shutdown(work);
+ 	} else {
+ 		if (device->config_rom_retries)
+ 			fw_notify("created device %s: GUID %08x%08x, S%d00, "
+@@ -738,6 +750,7 @@ static void fw_device_init(struct work_s
+ 				  device->device.bus_id,
+ 				  device->config_rom[3], device->config_rom[4],
+ 				  1 << device->max_speed);
++		device->config_rom_retries = 0;
+ 	}
  
- 	int node_id;
-Index: linux/drivers/firewire/fw-device.h
-===================================================================
---- linux.orig/drivers/firewire/fw-device.h
-+++ linux/drivers/firewire/fw-device.h
-@@ -76,9 +76,21 @@ fw_device_is_shutdown(struct fw_device *
- 	return atomic_read(&device->state) == FW_DEVICE_SHUTDOWN;
+ 	/*
+@@ -784,6 +797,104 @@ static void fw_device_update(struct work
+ 	device_for_each_child(&device->device, NULL, update_unit);
  }
  
--struct fw_device *fw_device_get(struct fw_device *device);
-+static inline struct fw_device *
-+fw_device_get(struct fw_device *device)
++enum {
++	REREAD_BIB_ERROR,
++	REREAD_BIB_GONE,
++	REREAD_BIB_UNCHANGED,
++	REREAD_BIB_CHANGED,
++};
++
++/* Reread and compare bus info block and header of root directory */
++static int reread_bus_info_block(struct fw_device *device, int generation)
 +{
-+	get_device(&device->device);
++	u32 q;
++	int i;
 +
-+	return device;
-+}
++	for (i = 0; i < 6; i++) {
++		if (read_rom(device, generation, i, &q) != RCODE_COMPLETE)
++			return REREAD_BIB_ERROR;
 +
-+static inline void
-+fw_device_put(struct fw_device *device)
-+{
-+	put_device(&device->device);
-+}
++		if (i == 0 && q == 0)
++			return REREAD_BIB_GONE;
 +
- struct fw_device *fw_device_get_by_devt(dev_t devt);
--void fw_device_put(struct fw_device *device);
- int fw_device_enable_phys_dma(struct fw_device *device);
- 
- void fw_device_cdev_update(struct fw_device *device);
-
--- 
-Stefan Richter
--=====-==--- --=- ==-==
-http://arcgraph.de/sr/
-
-
-
-The card->kref became obsolete since patch "firewire: fix crash in
-automatic module unloading" added another counter of card users.
-
-Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
----
- drivers/firewire/fw-card.c        |   38 ------------------------------
- drivers/firewire/fw-ohci.c        |    8 +++---
- drivers/firewire/fw-transaction.h |    4 ---
- 3 files changed, 4 insertions(+), 46 deletions(-)
-
-Index: linux/drivers/firewire/fw-card.c
-===================================================================
---- linux.orig/drivers/firewire/fw-card.c
-+++ linux/drivers/firewire/fw-card.c
-@@ -398,7 +398,6 @@ fw_card_initialize(struct fw_card *card,
- {
- 	static atomic_t index = ATOMIC_INIT(-1);
- 
--	kref_init(&card->kref);
- 	atomic_set(&card->device_count, 0);
- 	card->index = atomic_inc_return(&index);
- 	card->driver = driver;
-@@ -429,12 +428,6 @@ fw_card_add(struct fw_card *card,
- 	card->link_speed = link_speed;
- 	card->guid = guid;
- 
--	/*
--	 * The subsystem grabs a reference when the card is added and
--	 * drops it when the driver calls fw_core_remove_card.
--	 */
--	fw_card_get(card);
--
- 	mutex_lock(&card_mutex);
- 	config_rom = generate_config_rom(card, &length);
- 	list_add_tail(&card->link, &card_list);
-@@ -540,40 +533,9 @@ fw_core_remove_card(struct fw_card *card
- 	cancel_delayed_work_sync(&card->work);
- 	fw_flush_transactions(card);
- 	del_timer_sync(&card->flush_timer);
--
--	fw_card_put(card);
- }
- EXPORT_SYMBOL(fw_core_remove_card);
- 
--struct fw_card *
--fw_card_get(struct fw_card *card)
--{
--	kref_get(&card->kref);
--
--	return card;
--}
--EXPORT_SYMBOL(fw_card_get);
--
--static void
--release_card(struct kref *kref)
--{
--	struct fw_card *card = container_of(kref, struct fw_card, kref);
--
--	kfree(card);
--}
--
--/*
-- * An assumption for fw_card_put() is that the card driver allocates
-- * the fw_card struct with kalloc and that it has been shut down
-- * before the last ref is dropped.
-- */
--void
--fw_card_put(struct fw_card *card)
--{
--	kref_put(&card->kref, release_card);
--}
--EXPORT_SYMBOL(fw_card_put);
--
- int
- fw_core_initiate_bus_reset(struct fw_card *card, int short_reset)
- {
-Index: linux/drivers/firewire/fw-ohci.c
-===================================================================
---- linux.orig/drivers/firewire/fw-ohci.c
-+++ linux/drivers/firewire/fw-ohci.c
-@@ -2059,7 +2059,7 @@ pci_probe(struct pci_dev *dev, const str
- 	err = pci_enable_device(dev);
- 	if (err) {
- 		fw_error("Failed to enable OHCI hardware.\n");
--		goto fail_put_card;
-+		goto fail_free;
- 	}
- 
- 	pci_set_master(dev);
-@@ -2151,8 +2151,8 @@ pci_probe(struct pci_dev *dev, const str
- 	pci_release_region(dev, 0);
-  fail_disable:
- 	pci_disable_device(dev);
-- fail_put_card:
--	fw_card_put(&ohci->card);
-+ fail_free:
-+	kfree(&ohci->card);
- 
- 	return err;
- }
-@@ -2180,7 +2180,7 @@ static void pci_remove(struct pci_dev *d
- 	pci_iounmap(dev, ohci->registers);
- 	pci_release_region(dev, 0);
- 	pci_disable_device(dev);
--	fw_card_put(&ohci->card);
-+	kfree(&ohci->card);
- 
- 	fw_notify("Removed fw-ohci device.\n");
- }
-Index: linux/drivers/firewire/fw-transaction.h
-===================================================================
---- linux.orig/drivers/firewire/fw-transaction.h
-+++ linux/drivers/firewire/fw-transaction.h
-@@ -221,7 +221,6 @@ struct fw_card {
- 	const struct fw_card_driver *driver;
- 	struct device *device;
- 	atomic_t device_count;
--	struct kref kref;
- 
- 	int node_id;
- 	int generation;
-@@ -263,9 +262,6 @@ struct fw_card {
- 	int bm_generation;
- };
- 
--struct fw_card *fw_card_get(struct fw_card *card);
--void fw_card_put(struct fw_card *card);
--
- /*
-  * The iso packet format allows for an immediate header/payload part
-  * stored in 'header' immediately after the packet info plus an
-
--- 
-Stefan Richter
--=====-==--- --=- ==---
-http://arcgraph.de/sr/
-
-
-The reference count of the unit dropped too low in an error path in
-sbp2_probe.  Fixed by moving the _get further up.
-
-Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
----
- drivers/firewire/fw-sbp2.c |    3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-Index: linux/drivers/firewire/fw-sbp2.c
-===================================================================
---- linux.orig/drivers/firewire/fw-sbp2.c
-+++ linux/drivers/firewire/fw-sbp2.c
-@@ -1083,6 +1083,7 @@ static int sbp2_probe(struct device *dev
- 		goto fail_shost_put;
- 
- 	fw_device_get(device);
-+	get_device(&unit->device);
- 
- 	/* Initialize to values that won't match anything in our table. */
- 	firmware_revision = 0xff000000;
-@@ -1098,8 +1099,6 @@ static int sbp2_probe(struct device *dev
- 
- 	sbp2_init_workarounds(tgt, model, firmware_revision);
- 
--	get_device(&unit->device);
--
- 	/* Do the login in a workqueue so we can easily reschedule retries. */
- 	list_for_each_entry(lu, &tgt->lu_list, link)
- 		sbp2_queue_work(lu, 0);
-
--- 
-Stefan Richter
--=====-==--- --=- ==---
-http://arcgraph.de/sr/
-
-
-Add wrappers for getting and putting a unit.
-Remove some line breaks.
-
-Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
----
- drivers/firewire/fw-device.h |   27 +++++++++++++++++----------
- drivers/firewire/fw-sbp2.c   |    4 ++--
- 2 files changed, 19 insertions(+), 12 deletions(-)
-
-Index: linux/drivers/firewire/fw-device.h
-===================================================================
---- linux.orig/drivers/firewire/fw-device.h
-+++ linux/drivers/firewire/fw-device.h
-@@ -64,28 +64,24 @@ struct fw_device {
- 	struct fw_attribute_group attribute_group;
- };
- 
--static inline struct fw_device *
--fw_device(struct device *dev)
-+static inline struct fw_device *fw_device(struct device *dev)
- {
- 	return container_of(dev, struct fw_device, device);
- }
- 
--static inline int
--fw_device_is_shutdown(struct fw_device *device)
-+static inline int fw_device_is_shutdown(struct fw_device *device)
- {
- 	return atomic_read(&device->state) == FW_DEVICE_SHUTDOWN;
- }
- 
--static inline struct fw_device *
--fw_device_get(struct fw_device *device)
-+static inline struct fw_device *fw_device_get(struct fw_device *device)
- {
- 	get_device(&device->device);
- 
- 	return device;
- }
- 
--static inline void
--fw_device_put(struct fw_device *device)
-+static inline void fw_device_put(struct fw_device *device)
- {
- 	put_device(&device->device);
- }
-@@ -104,12 +100,23 @@ struct fw_unit {
- 	struct fw_attribute_group attribute_group;
- };
- 
--static inline struct fw_unit *
--fw_unit(struct device *dev)
-+static inline struct fw_unit *fw_unit(struct device *dev)
- {
- 	return container_of(dev, struct fw_unit, device);
- }
- 
-+static inline struct fw_unit *fw_unit_get(struct fw_unit *unit)
-+{
-+	get_device(&unit->device);
++		if (i > device->config_rom_length || q != device->config_rom[i])
++			return REREAD_BIB_CHANGED;
++	}
 +
-+	return unit;
++	return REREAD_BIB_UNCHANGED;
 +}
 +
-+static inline void fw_unit_put(struct fw_unit *unit)
++static void fw_device_refresh(struct work_struct *work)
 +{
-+	put_device(&unit->device);
++	struct fw_device *device =
++		container_of(work, struct fw_device, work.work);
++	struct fw_card *card = device->card;
++	int node_id = device->node_id;
++
++	switch (reread_bus_info_block(device, device->generation)) {
++	case REREAD_BIB_ERROR:
++		if (device->config_rom_retries < MAX_RETRIES / 2 &&
++		    atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
++			device->config_rom_retries++;
++			schedule_delayed_work(&device->work, RETRY_DELAY / 2);
++
++			return;
++		}
++		goto give_up;
++
++	case REREAD_BIB_GONE:
++		goto gone;
++
++	case REREAD_BIB_UNCHANGED:
++		if (atomic_cmpxchg(&device->state,
++			    FW_DEVICE_INITIALIZING,
++			    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
++			goto gone;
++
++		fw_device_update(work);
++		device->config_rom_retries = 0;
++
++		return;
++	}
++
++	/*
++	 * Something changed.  We keep things simple and don't investigate
++	 * further.  We just destroy all previous units and create new ones.
++	 */
++	device_for_each_child(&device->device, NULL, shutdown_unit);
++
++	if (read_bus_info_block(device, device->generation) < 0) {
++		if (device->config_rom_retries < MAX_RETRIES &&
++		    atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
++			device->config_rom_retries++;
++			schedule_delayed_work(&device->work, RETRY_DELAY);
++
++			return;
++		}
++		goto give_up;
++	}
++
++	create_units(device);
++
++	if (atomic_cmpxchg(&device->state,
++		    FW_DEVICE_INITIALIZING,
++		    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
++		goto gone;
++
++	fw_notify("refreshed device %s\n", device->device.bus_id);
++	device->config_rom_retries = 0;
++	goto out;
++
++ give_up:
++	fw_notify("giving up on refresh of device %s\n", device->device.bus_id);
++ gone:
++	atomic_set(&device->state, FW_DEVICE_SHUTDOWN);
++	fw_device_shutdown(work);
++ out:
++	if (node_id == card->root_node->node_id)
++		schedule_delayed_work(&card->work, 0);
 +}
 +
- #define CSR_OFFSET	0x40
- #define CSR_LEAF	0x80
- #define CSR_DIRECTORY	0xc0
-Index: linux/drivers/firewire/fw-sbp2.c
+ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
+ {
+ 	struct fw_device *device;
+@@ -793,7 +904,7 @@ void fw_node_event(struct fw_card *card,
+ 	case FW_NODE_LINK_ON:
+ 		if (!node->link_on)
+ 			break;
+-
++ create:
+ 		device = kzalloc(sizeof(*device), GFP_ATOMIC);
+ 		if (device == NULL)
+ 			break;
+@@ -832,6 +943,22 @@ void fw_node_event(struct fw_card *card,
+ 		schedule_delayed_work(&device->work, INITIAL_DELAY);
+ 		break;
+ 
++	case FW_NODE_INITIATED_RESET:
++		device = node->data;
++		if (device == NULL)
++			goto create;
++
++		device->node_id = node->node_id;
++		smp_wmb();  /* update node_id before generation */
++		device->generation = card->generation;
++		if (atomic_cmpxchg(&device->state,
++			    FW_DEVICE_RUNNING,
++			    FW_DEVICE_INITIALIZING) == FW_DEVICE_RUNNING) {
++			PREPARE_DELAYED_WORK(&device->work, fw_device_refresh);
++			schedule_delayed_work(&device->work, INITIAL_DELAY);
++		}
++		break;
++
+ 	case FW_NODE_UPDATED:
+ 		if (!node->link_on || node->data == NULL)
+ 			break;
+Index: linux/drivers/firewire/fw-topology.c
 ===================================================================
---- linux.orig/drivers/firewire/fw-sbp2.c
-+++ linux/drivers/firewire/fw-sbp2.c
-@@ -790,7 +790,7 @@ static void sbp2_release_target(struct k
- 	scsi_remove_host(shost);
- 	fw_notify("released %s\n", tgt->bus_id);
- 
--	put_device(&tgt->unit->device);
-+	fw_unit_put(tgt->unit);
- 	scsi_host_put(shost);
- 	fw_device_put(device);
- }
-@@ -1091,7 +1091,7 @@ static int sbp2_probe(struct device *dev
- 		goto fail_shost_put;
- 
- 	fw_device_get(device);
--	get_device(&unit->device);
-+	fw_unit_get(unit);
+--- linux.orig/drivers/firewire/fw-topology.c
++++ linux/drivers/firewire/fw-topology.c
+@@ -107,6 +107,7 @@ static struct fw_node *fw_node_create(u3
+ 	node->node_id = LOCAL_BUS | SELF_ID_PHY_ID(sid);
+ 	node->link_on = SELF_ID_LINK_ON(sid);
+ 	node->phy_speed = SELF_ID_PHY_SPEED(sid);
++	node->initiated_reset = SELF_ID_PHY_INITIATOR(sid);
+ 	node->port_count = port_count;
+ 
+ 	atomic_set(&node->ref_count, 1);
+@@ -430,6 +431,8 @@ update_tree(struct fw_card *card, struct
+ 			event = FW_NODE_LINK_OFF;
+ 		else if (!node0->link_on && node1->link_on)
+ 			event = FW_NODE_LINK_ON;
++		else if (node1->initiated_reset && node1->link_on)
++			event = FW_NODE_INITIATED_RESET;
+ 		else
+ 			event = FW_NODE_UPDATED;
+ 
+Index: linux/drivers/firewire/fw-topology.h
+===================================================================
+--- linux.orig/drivers/firewire/fw-topology.h
++++ linux/drivers/firewire/fw-topology.h
+@@ -20,11 +20,12 @@
+ #define __fw_topology_h
+ 
+ enum {
+-	FW_NODE_CREATED =   0x00,
+-	FW_NODE_UPDATED =   0x01,
+-	FW_NODE_DESTROYED = 0x02,
+-	FW_NODE_LINK_ON =   0x03,
+-	FW_NODE_LINK_OFF =  0x04,
++	FW_NODE_CREATED,
++	FW_NODE_UPDATED,
++	FW_NODE_DESTROYED,
++	FW_NODE_LINK_ON,
++	FW_NODE_LINK_OFF,
++	FW_NODE_INITIATED_RESET,
+ };
  
- 	/* Initialize to values that won't match anything in our table. */
- 	firmware_revision = 0xff000000;
+ struct fw_node {
 
 -- 
 Stefan Richter
--=====-==--- --=- ==---
+-=====-==--- --== ---==
 http://arcgraph.de/sr/
 
 

linux-2.6-firewire-git-update.patch:

Index: linux-2.6-firewire-git-update.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/Attic/linux-2.6-firewire-git-update.patch,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -u -r1.1.2.2 -r1.1.2.3
--- linux-2.6-firewire-git-update.patch	29 Feb 2008 18:58:22 -0000	1.1.2.2
+++ linux-2.6-firewire-git-update.patch	5 Mar 2008 18:41:17 -0000	1.1.2.3
@@ -1,905 +1,1102 @@
-git diff in linux1394-git tree vs. 2.6.25-rc1, 02/20/2008
+git diff in linux1394-git tree vs. 2.6.25-rc3-git4, 03/03/2008
 
- Documentation/debugging-via-ohci1394.txt |   17 +-
- drivers/firewire/fw-cdev.c               |    8 +-
- drivers/firewire/fw-device.c             |   48 +++--
- drivers/firewire/fw-device.h             |    2 +-
- drivers/firewire/fw-sbp2.c               |  358 +++++++++++++++++++++++-------
- drivers/ieee1394/sbp2.c                  |   22 ++-
- drivers/ieee1394/sbp2.h                  |    2 +
- 7 files changed, 345 insertions(+), 112 deletions(-)
-
----
+ Documentation/debugging-via-ohci1394.txt |   13 ++-
+ drivers/firewire/fw-card.c               |   38 ----------
+ drivers/firewire/fw-device.h             |   27 ++++---
+ drivers/firewire/fw-ohci.c               |  114 +++++++++++++++++++++-------
+ drivers/firewire/fw-sbp2.c               |  120 ++++++++++++------------------
+ drivers/firewire/fw-transaction.c        |    2 +-
+ drivers/firewire/fw-transaction.h        |   10 +--
+ drivers/ieee1394/csr.c                   |    6 +-
+ drivers/ieee1394/dv1394.c                |    3 +-
+ drivers/ieee1394/nodemgr.c               |    6 +-
+ drivers/ieee1394/ohci1394.c              |  109 ++++++++++++---------------
+ drivers/ieee1394/raw1394.c               |    1 -
+ drivers/ieee1394/sbp2.c                  |    7 +-
+ drivers/ieee1394/video1394.c             |    3 +-
+ lib/Kconfig.debug                        |   10 +++
+ 15 files changed, 233 insertions(+), 236 deletions(-)
 
 diff --git a/Documentation/debugging-via-ohci1394.txt b/Documentation/debugging-via-ohci1394.txt
-index de4804e..c360d4e 100644
+index c360d4e..371ba27 100644
 --- a/Documentation/debugging-via-ohci1394.txt
 +++ b/Documentation/debugging-via-ohci1394.txt
-@@ -36,14 +36,15 @@ available (notebooks) or too slow for extensive debug information (like ACPI).
- Drivers
- -------
- 
--The OHCI-1394 drivers in drivers/firewire and drivers/ieee1394 initialize
--the OHCI-1394 controllers to a working state and can be used to enable
--physical DMA. By default you only have to load the driver, and physical
--DMA access will be granted to all remote nodes, but it can be turned off
--when using the ohci1394 driver.
--
--Because these drivers depend on the PCI enumeration to be completed, an
--initialization routine which can runs pretty early (long before console_init(),
-+The ohci1394 driver in drivers/ieee1394 initializes the OHCI-1394 controllers
-+to a working state and enables physical DMA by default for all remote nodes.
-+This can be turned off by ohci1394's module parameter phys_dma=0.
-+
-+The alternative firewire-ohci driver in drivers/firewire uses filtered physical
-+DMA, hence is not yet suitable for remote debugging.
-+
-+Because ohci1394 depends on the PCI enumeration to be completed, an
-+initialization routine which runs pretty early (long before console_init()
- which makes the printk buffer appear on the console can be called) was written.
+@@ -41,11 +41,14 @@ to a working state and enables physical DMA by default for all remote nodes.
+ This can be turned off by ohci1394's module parameter phys_dma=0.
+ 
+ The alternative firewire-ohci driver in drivers/firewire uses filtered physical
+-DMA, hence is not yet suitable for remote debugging.
+-
+-Because ohci1394 depends on the PCI enumeration to be completed, an
+-initialization routine which runs pretty early (long before console_init()
+-which makes the printk buffer appear on the console can be called) was written.
++DMA by default, which is more secure but not suitable for remote debugging.
++Compile the driver with CONFIG_FIREWIRE_OHCI_REMOTE_DMA to get unfiltered
++physical DMA.
++
++Because ohci1394 and firewire-ohci depend on the PCI enumeration to be
++completed, an initialization routine which runs pretty early has been
++implemented for x86.  This routine runs long before console_init() can be
++called, i.e. before the printk buffer appears on the console.
  
  To activate it, enable CONFIG_PROVIDE_OHCI1394_DMA_INIT (Kernel hacking menu:
-diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
-index 7e73cba..44ccee2 100644
---- a/drivers/firewire/fw-cdev.c
-+++ b/drivers/firewire/fw-cdev.c
-@@ -109,15 +109,17 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
- 	struct client *client;
- 	unsigned long flags;
+ Provide code for enabling DMA over FireWire early on boot) and pass the
+diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
+index a034627..140b34d 100644
+--- a/drivers/firewire/fw-card.c
++++ b/drivers/firewire/fw-card.c
+@@ -398,7 +398,6 @@ fw_card_initialize(struct fw_card *card, const struct fw_card_driver *driver,
+ {
+ 	static atomic_t index = ATOMIC_INIT(-1);
  
--	device = fw_device_from_devt(inode->i_rdev);
-+	device = fw_device_get_by_devt(inode->i_rdev);
- 	if (device == NULL)
- 		return -ENODEV;
- 
- 	client = kzalloc(sizeof(*client), GFP_KERNEL);
--	if (client == NULL)
-+	if (client == NULL) {
-+		fw_device_put(device);
- 		return -ENOMEM;
-+	}
+-	kref_init(&card->kref);
+ 	atomic_set(&card->device_count, 0);
+ 	card->index = atomic_inc_return(&index);
+ 	card->driver = driver;
+@@ -429,12 +428,6 @@ fw_card_add(struct fw_card *card,
+ 	card->link_speed = link_speed;
+ 	card->guid = guid;
+ 
+-	/*
+-	 * The subsystem grabs a reference when the card is added and
+-	 * drops it when the driver calls fw_core_remove_card.
+-	 */
+-	fw_card_get(card);
+-
+ 	mutex_lock(&card_mutex);
+ 	config_rom = generate_config_rom(card, &length);
+ 	list_add_tail(&card->link, &card_list);
+@@ -540,40 +533,9 @@ fw_core_remove_card(struct fw_card *card)
+ 	cancel_delayed_work_sync(&card->work);
+ 	fw_flush_transactions(card);
+ 	del_timer_sync(&card->flush_timer);
+-
+-	fw_card_put(card);
+ }
+ EXPORT_SYMBOL(fw_core_remove_card);
+ 
+-struct fw_card *
+-fw_card_get(struct fw_card *card)
+-{
+-	kref_get(&card->kref);
+-
+-	return card;
+-}
+-EXPORT_SYMBOL(fw_card_get);
+-
+-static void
+-release_card(struct kref *kref)
+-{
+-	struct fw_card *card = container_of(kref, struct fw_card, kref);
+-
+-	kfree(card);
+-}
+-
+-/*
+- * An assumption for fw_card_put() is that the card driver allocates
+- * the fw_card struct with kalloc and that it has been shut down
+- * before the last ref is dropped.
+- */
+-void
+-fw_card_put(struct fw_card *card)
+-{
+-	kref_put(&card->kref, release_card);
+-}
+-EXPORT_SYMBOL(fw_card_put);
+-
+ int
+ fw_core_initiate_bus_reset(struct fw_card *card, int short_reset)
+ {
+diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
+index 78ecd39..0d771fd 100644
+--- a/drivers/firewire/fw-device.h
++++ b/drivers/firewire/fw-device.h
+@@ -64,28 +64,24 @@ struct fw_device {
+ 	struct fw_attribute_group attribute_group;
+ };
  
--	client->device = fw_device_get(device);
-+	client->device = device;
- 	INIT_LIST_HEAD(&client->event_list);
- 	INIT_LIST_HEAD(&client->resource_list);
- 	spin_lock_init(&client->lock);
-diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
-index de9066e..2ab13e0 100644
---- a/drivers/firewire/fw-device.c
-+++ b/drivers/firewire/fw-device.c
-@@ -358,12 +358,9 @@ static ssize_t
- guid_show(struct device *dev, struct device_attribute *attr, char *buf)
- {
- 	struct fw_device *device = fw_device(dev);
--	u64 guid;
- 
--	guid = ((u64)device->config_rom[3] << 32) | device->config_rom[4];
--
--	return snprintf(buf, PAGE_SIZE, "0x%016llx\n",
--			(unsigned long long)guid);
-+	return snprintf(buf, PAGE_SIZE, "0x%08x%08x\n",
-+			device->config_rom[3], device->config_rom[4]);
- }
- 
- static struct device_attribute fw_device_attributes[] = {
-@@ -610,12 +607,14 @@ static DECLARE_RWSEM(idr_rwsem);
- static DEFINE_IDR(fw_device_idr);
- int fw_cdev_major;
+-static inline struct fw_device *
+-fw_device(struct device *dev)
++static inline struct fw_device *fw_device(struct device *dev)
+ {
+ 	return container_of(dev, struct fw_device, device);
+ }
  
--struct fw_device *fw_device_from_devt(dev_t devt)
-+struct fw_device *fw_device_get_by_devt(dev_t devt)
+-static inline int
+-fw_device_is_shutdown(struct fw_device *device)
++static inline int fw_device_is_shutdown(struct fw_device *device)
  {
- 	struct fw_device *device;
+ 	return atomic_read(&device->state) == FW_DEVICE_SHUTDOWN;
+ }
  
- 	down_read(&idr_rwsem);
- 	device = idr_find(&fw_device_idr, MINOR(devt));
-+	if (device)
-+		fw_device_get(device);
- 	up_read(&idr_rwsem);
+-static inline struct fw_device *
+-fw_device_get(struct fw_device *device)
++static inline struct fw_device *fw_device_get(struct fw_device *device)
+ {
+ 	get_device(&device->device);
  
  	return device;
-@@ -627,13 +626,14 @@ static void fw_device_shutdown(struct work_struct *work)
- 		container_of(work, struct fw_device, work.work);
- 	int minor = MINOR(device->device.devt);
+ }
  
--	down_write(&idr_rwsem);
--	idr_remove(&fw_device_idr, minor);
--	up_write(&idr_rwsem);
--
- 	fw_device_cdev_remove(device);
- 	device_for_each_child(&device->device, NULL, shutdown_unit);
- 	device_unregister(&device->device);
-+
-+	down_write(&idr_rwsem);
-+	idr_remove(&fw_device_idr, minor);
-+	up_write(&idr_rwsem);
-+	fw_device_put(device);
+-static inline void
+-fw_device_put(struct fw_device *device)
++static inline void fw_device_put(struct fw_device *device)
+ {
+ 	put_device(&device->device);
  }
+@@ -104,12 +100,23 @@ struct fw_unit {
+ 	struct fw_attribute_group attribute_group;
+ };
  
- static struct device_type fw_device_type = {
-@@ -682,10 +682,13 @@ static void fw_device_init(struct work_struct *work)
- 	}
+-static inline struct fw_unit *
+-fw_unit(struct device *dev)
++static inline struct fw_unit *fw_unit(struct device *dev)
+ {
+ 	return container_of(dev, struct fw_unit, device);
+ }
  
- 	err = -ENOMEM;
++static inline struct fw_unit *fw_unit_get(struct fw_unit *unit)
++{
++	get_device(&unit->device);
 +
-+	fw_device_get(device);
- 	down_write(&idr_rwsem);
- 	if (idr_pre_get(&fw_device_idr, GFP_KERNEL))
- 		err = idr_get_new(&fw_device_idr, device, &minor);
- 	up_write(&idr_rwsem);
++	return unit;
++}
 +
- 	if (err < 0)
- 		goto error;
++static inline void fw_unit_put(struct fw_unit *unit)
++{
++	put_device(&unit->device);
++}
++
+ #define CSR_OFFSET	0x40
+ #define CSR_LEAF	0x80
+ #define CSR_DIRECTORY	0xc0
+diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
+index 7ebad3c..28ea78c 100644
+--- a/drivers/firewire/fw-ohci.c
++++ b/drivers/firewire/fw-ohci.c
+@@ -33,6 +33,10 @@
+ #include <asm/page.h>
+ #include <asm/system.h>
+ 
++#ifdef CONFIG_PPC_PMAC
++#include <asm/pmac_feature.h>
++#endif
++
+ #include "fw-ohci.h"
+ #include "fw-transaction.h"
  
-@@ -717,13 +720,22 @@ static void fw_device_init(struct work_struct *work)
+@@ -175,6 +179,7 @@ struct fw_ohci {
+ 	int generation;
+ 	int request_generation;
+ 	u32 bus_seconds;
++	bool old_uninorth;
+ 
+ 	/*
+ 	 * Spinlock for accessing fw_ohci data.  Never call out of
+@@ -311,15 +316,22 @@ static int ar_context_add_page(struct ar_context *ctx)
+ 	return 0;
+ }
+ 
++#if defined(CONFIG_PPC_PMAC) && defined(CONFIG_PPC32)
++#define cond_le32_to_cpu(v) \
++	(ohci->old_uninorth ? (__force __u32)(v) : le32_to_cpu(v))
++#else
++#define cond_le32_to_cpu(v) le32_to_cpu(v)
++#endif
++
+ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
+ {
+ 	struct fw_ohci *ohci = ctx->ohci;
+ 	struct fw_packet p;
+ 	u32 status, length, tcode;
+ 
+-	p.header[0] = le32_to_cpu(buffer[0]);
+-	p.header[1] = le32_to_cpu(buffer[1]);
+-	p.header[2] = le32_to_cpu(buffer[2]);
++	p.header[0] = cond_le32_to_cpu(buffer[0]);
++	p.header[1] = cond_le32_to_cpu(buffer[1]);
++	p.header[2] = cond_le32_to_cpu(buffer[2]);
+ 
+ 	tcode = (p.header[0] >> 4) & 0x0f;
+ 	switch (tcode) {
+@@ -331,7 +343,7 @@ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
+ 		break;
+ 
+ 	case TCODE_READ_BLOCK_REQUEST :
+-		p.header[3] = le32_to_cpu(buffer[3]);
++		p.header[3] = cond_le32_to_cpu(buffer[3]);
+ 		p.header_length = 16;
+ 		p.payload_length = 0;
+ 		break;
+@@ -340,7 +352,7 @@ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
+ 	case TCODE_READ_BLOCK_RESPONSE:
+ 	case TCODE_LOCK_REQUEST:
+ 	case TCODE_LOCK_RESPONSE:
+-		p.header[3] = le32_to_cpu(buffer[3]);
++		p.header[3] = cond_le32_to_cpu(buffer[3]);
+ 		p.header_length = 16;
+ 		p.payload_length = p.header[3] >> 16;
+ 		break;
+@@ -357,7 +369,7 @@ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
+ 
+ 	/* FIXME: What to do about evt_* errors? */
+ 	length = (p.header_length + p.payload_length + 3) / 4;
+-	status = le32_to_cpu(buffer[length]);
++	status = cond_le32_to_cpu(buffer[length]);
+ 
+ 	p.ack        = ((status >> 16) & 0x1f) - 16;
+ 	p.speed      = (status >> 21) & 0x7;
+@@ -375,7 +387,7 @@ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
  	 */
- 	if (atomic_cmpxchg(&device->state,
- 		    FW_DEVICE_INITIALIZING,
--		    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
-+		    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN) {
- 		fw_device_shutdown(&device->work.work);
--	else
--		fw_notify("created new fw device %s "
--			  "(%d config rom retries, S%d00)\n",
--			  device->device.bus_id, device->config_rom_retries,
--			  1 << device->max_speed);
-+	} else {
-+		if (device->config_rom_retries)
-+			fw_notify("created device %s: GUID %08x%08x, S%d00, "
-+				  "%d config ROM retries\n",
-+				  device->device.bus_id,
-+				  device->config_rom[3], device->config_rom[4],
-+				  1 << device->max_speed,
-+				  device->config_rom_retries);
-+		else
-+			fw_notify("created device %s: GUID %08x%08x, S%d00\n",
-+				  device->device.bus_id,
-+				  device->config_rom[3], device->config_rom[4],
-+				  1 << device->max_speed);
-+	}
+ 
+ 	if (p.ack + 16 == 0x09)
+-		ohci->request_generation = (buffer[2] >> 16) & 0xff;
++		ohci->request_generation = (p.header[2] >> 16) & 0xff;
+ 	else if (ctx == &ohci->ar_request_ctx)
+ 		fw_core_handle_request(&ohci->card, &p);
+ 	else
+@@ -532,7 +544,7 @@ static int
+ context_add_buffer(struct context *ctx)
+ {
+ 	struct descriptor_buffer *desc;
+-	dma_addr_t bus_addr;
++	dma_addr_t uninitialized_var(bus_addr);
+ 	int offset;
  
  	/*
- 	 * Reschedule the IRM work if we just finished reading the
-@@ -741,7 +753,9 @@ static void fw_device_init(struct work_struct *work)
- 	idr_remove(&fw_device_idr, minor);
- 	up_write(&idr_rwsem);
-  error:
--	put_device(&device->device);
-+	fw_device_put(device);		/* fw_device_idr's reference */
+@@ -1022,13 +1034,14 @@ static void bus_reset_tasklet(unsigned long data)
+ 	 */
+ 
+ 	self_id_count = (reg_read(ohci, OHCI1394_SelfIDCount) >> 3) & 0x3ff;
+-	generation = (le32_to_cpu(ohci->self_id_cpu[0]) >> 16) & 0xff;
++	generation = (cond_le32_to_cpu(ohci->self_id_cpu[0]) >> 16) & 0xff;
+ 	rmb();
+ 
+ 	for (i = 1, j = 0; j < self_id_count; i += 2, j++) {
+ 		if (ohci->self_id_cpu[i] != ~ohci->self_id_cpu[i + 1])
+ 			fw_error("inconsistent self IDs\n");
+-		ohci->self_id_buffer[j] = le32_to_cpu(ohci->self_id_cpu[i]);
++		ohci->self_id_buffer[j] =
++				cond_le32_to_cpu(ohci->self_id_cpu[i]);
+ 	}
+ 	rmb();
+ 
+@@ -1091,6 +1104,11 @@ static void bus_reset_tasklet(unsigned long data)
+ 		reg_write(ohci, OHCI1394_ConfigROMhdr, ohci->next_header);
+ 	}
+ 
++#ifdef CONFIG_FIREWIRE_OHCI_REMOTE_DMA
++	reg_write(ohci, OHCI1394_PhyReqFilterHiSet, ~0);
++	reg_write(ohci, OHCI1394_PhyReqFilterLoSet, ~0);
++#endif
 +
-+	put_device(&device->device);	/* our reference */
+ 	spin_unlock_irqrestore(&ohci->lock, flags);
+ 
+ 	if (free_rom)
+@@ -1316,7 +1334,7 @@ ohci_set_config_rom(struct fw_card *card, u32 *config_rom, size_t length)
+ 	unsigned long flags;
+ 	int retval = -EBUSY;
+ 	__be32 *next_config_rom;
+-	dma_addr_t next_config_rom_bus;
++	dma_addr_t uninitialized_var(next_config_rom_bus);
+ 
+ 	ohci = fw_ohci(card);
+ 
+@@ -1429,6 +1447,9 @@ static int ohci_cancel_packet(struct fw_card *card, struct fw_packet *packet)
+ static int
+ ohci_enable_phys_dma(struct fw_card *card, int node_id, int generation)
+ {
++#ifdef CONFIG_FIREWIRE_OHCI_REMOTE_DMA
++	return 0;
++#else
+ 	struct fw_ohci *ohci = fw_ohci(card);
+ 	unsigned long flags;
+ 	int n, retval = 0;
+@@ -1460,6 +1481,7 @@ ohci_enable_phys_dma(struct fw_card *card, int node_id, int generation)
+  out:
+ 	spin_unlock_irqrestore(&ohci->lock, flags);
+ 	return retval;
++#endif /* CONFIG_FIREWIRE_OHCI_REMOTE_DMA */
  }
  
- static int update_unit(struct device *dev, void *data)
-diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
-index 0854fe2..43808c0 100644
---- a/drivers/firewire/fw-device.h
-+++ b/drivers/firewire/fw-device.h
-@@ -77,13 +77,13 @@ fw_device_is_shutdown(struct fw_device *device)
+ static u64
+@@ -1487,7 +1509,7 @@ static int handle_ir_dualbuffer_packet(struct context *context,
+ 	void *p, *end;
+ 	int i;
+ 
+-	if (db->first_res_count > 0 && db->second_res_count > 0) {
++	if (db->first_res_count != 0 && db->second_res_count != 0) {
+ 		if (ctx->excess_bytes <= le16_to_cpu(db->second_req_count)) {
+ 			/* This descriptor isn't done yet, stop iteration. */
+ 			return 0;
+@@ -1513,7 +1535,7 @@ static int handle_ir_dualbuffer_packet(struct context *context,
+ 		memcpy(ctx->header + i + 4, p + 8, ctx->base.header_size - 4);
+ 		i += ctx->base.header_size;
+ 		ctx->excess_bytes +=
+-			(le32_to_cpu(*(u32 *)(p + 4)) >> 16) & 0xffff;
++			(le32_to_cpu(*(__le32 *)(p + 4)) >> 16) & 0xffff;
+ 		p += ctx->base.header_size + 4;
+ 	}
+ 	ctx->header_length = i;
+@@ -2039,6 +2061,35 @@ static const struct fw_card_driver ohci_driver = {
+ 	.stop_iso		= ohci_stop_iso,
+ };
+ 
++#ifdef CONFIG_PPC_PMAC
++static void ohci_pmac_on(struct pci_dev *dev)
++{
++	if (machine_is(powermac)) {
++		struct device_node *ofn = pci_device_to_OF_node(dev);
++
++		if (ofn) {
++			pmac_call_feature(PMAC_FTR_1394_CABLE_POWER, ofn, 0, 1);
++			pmac_call_feature(PMAC_FTR_1394_ENABLE, ofn, 0, 1);
++		}
++	}
++}
++
++static void ohci_pmac_off(struct pci_dev *dev)
++{
++	if (machine_is(powermac)) {
++		struct device_node *ofn = pci_device_to_OF_node(dev);
++
++		if (ofn) {
++			pmac_call_feature(PMAC_FTR_1394_ENABLE, ofn, 0, 0);
++			pmac_call_feature(PMAC_FTR_1394_CABLE_POWER, ofn, 0, 0);
++		}
++	}
++}
++#else
++#define ohci_pmac_on(dev)
++#define ohci_pmac_off(dev)
++#endif /* CONFIG_PPC_PMAC */
++
+ static int __devinit
+ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
+ {
+@@ -2048,6 +2099,8 @@ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
+ 	int err;
+ 	size_t size;
+ 
++	ohci_pmac_on(dev);
++
+ 	ohci = kzalloc(sizeof(*ohci), GFP_KERNEL);
+ 	if (ohci == NULL) {
+ 		fw_error("Could not malloc fw_ohci data.\n");
+@@ -2059,13 +2112,17 @@ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
+ 	err = pci_enable_device(dev);
+ 	if (err) {
+ 		fw_error("Failed to enable OHCI hardware.\n");
+-		goto fail_put_card;
++		goto fail_free;
+ 	}
+ 
+ 	pci_set_master(dev);
+ 	pci_write_config_dword(dev, OHCI1394_PCI_HCI_Control, 0);
+ 	pci_set_drvdata(dev, ohci);
+ 
++#if defined(CONFIG_PPC_PMAC) && defined(CONFIG_PPC32)
++	ohci->old_uninorth = dev->vendor == PCI_VENDOR_ID_APPLE &&
++			     dev->device == PCI_DEVICE_ID_APPLE_UNI_N_FW;
++#endif
+ 	spin_lock_init(&ohci->lock);
+ 
+ 	tasklet_init(&ohci->bus_reset_tasklet,
+@@ -2151,8 +2208,8 @@ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
+ 	pci_release_region(dev, 0);
+  fail_disable:
+ 	pci_disable_device(dev);
+- fail_put_card:
+-	fw_card_put(&ohci->card);
++ fail_free:
++	kfree(&ohci->card);
+ 
+ 	return err;
  }
+@@ -2180,39 +2237,42 @@ static void pci_remove(struct pci_dev *dev)
+ 	pci_iounmap(dev, ohci->registers);
+ 	pci_release_region(dev, 0);
+ 	pci_disable_device(dev);
+-	fw_card_put(&ohci->card);
++	ohci_pmac_off(dev);
++	kfree(&ohci->card);
  
- struct fw_device *fw_device_get(struct fw_device *device);
-+struct fw_device *fw_device_get_by_devt(dev_t devt);
- void fw_device_put(struct fw_device *device);
- int fw_device_enable_phys_dma(struct fw_device *device);
+ 	fw_notify("Removed fw-ohci device.\n");
+ }
  
- void fw_device_cdev_update(struct fw_device *device);
- void fw_device_cdev_remove(struct fw_device *device);
+ #ifdef CONFIG_PM
+-static int pci_suspend(struct pci_dev *pdev, pm_message_t state)
++static int pci_suspend(struct pci_dev *dev, pm_message_t state)
+ {
+-	struct fw_ohci *ohci = pci_get_drvdata(pdev);
++	struct fw_ohci *ohci = pci_get_drvdata(dev);
+ 	int err;
+ 
+ 	software_reset(ohci);
+-	free_irq(pdev->irq, ohci);
+-	err = pci_save_state(pdev);
++	free_irq(dev->irq, ohci);
++	err = pci_save_state(dev);
+ 	if (err) {
+ 		fw_error("pci_save_state failed\n");
+ 		return err;
+ 	}
+-	err = pci_set_power_state(pdev, pci_choose_state(pdev, state));
++	err = pci_set_power_state(dev, pci_choose_state(dev, state));
+ 	if (err)
+ 		fw_error("pci_set_power_state failed with %d\n", err);
++	ohci_pmac_off(dev);
  
--struct fw_device *fw_device_from_devt(dev_t devt);
- extern int fw_cdev_major;
+ 	return 0;
+ }
  
- struct fw_unit {
+-static int pci_resume(struct pci_dev *pdev)
++static int pci_resume(struct pci_dev *dev)
+ {
+-	struct fw_ohci *ohci = pci_get_drvdata(pdev);
++	struct fw_ohci *ohci = pci_get_drvdata(dev);
+ 	int err;
+ 
+-	pci_set_power_state(pdev, PCI_D0);
+-	pci_restore_state(pdev);
+-	err = pci_enable_device(pdev);
++	ohci_pmac_on(dev);
++	pci_set_power_state(dev, PCI_D0);
++	pci_restore_state(dev);
++	err = pci_enable_device(dev);
+ 	if (err) {
+ 		fw_error("pci_enable_device failed\n");
+ 		return err;
 diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
-index 19ece9b..5259491 100644
+index 03069a4..d6d62c6 100644
 --- a/drivers/firewire/fw-sbp2.c
 +++ b/drivers/firewire/fw-sbp2.c
-@@ -28,14 +28,15 @@
-  * and many others.
-  */
- 
-+#include <linux/blkdev.h>
-+#include <linux/delay.h>
-+#include <linux/device.h>
-+#include <linux/dma-mapping.h>
- #include <linux/kernel.h>
-+#include <linux/mod_devicetable.h>
- #include <linux/module.h>
- #include <linux/moduleparam.h>
--#include <linux/mod_devicetable.h>
--#include <linux/device.h>
- #include <linux/scatterlist.h>
--#include <linux/dma-mapping.h>
--#include <linux/blkdev.h>
- #include <linux/string.h>
- #include <linux/stringify.h>
- #include <linux/timer.h>
-@@ -47,9 +48,9 @@
- #include <scsi/scsi_device.h>
- #include <scsi/scsi_host.h>
- 
--#include "fw-transaction.h"
--#include "fw-topology.h"
- #include "fw-device.h"
-+#include "fw-topology.h"
-+#include "fw-transaction.h"
+@@ -174,9 +174,6 @@ struct sbp2_target {
+ #define SBP2_ORB_NULL			0x80000000
+ #define SBP2_MAX_SG_ELEMENT_LENGTH	0xf000
  
- /*
-  * So far only bridges from Oxford Semiconductor are known to support
-@@ -82,6 +83,9 @@ MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device "
-  *   Avoids access beyond actual disk limits on devices with an off-by-one bug.
-  *   Don't use this with devices which don't have this bug.
-  *
-+ * - delay inquiry
-+ *   Wait extra SBP2_INQUIRY_DELAY seconds after login before SCSI inquiry.
-+ *
-  * - override internal blacklist
-  *   Instead of adding to the built-in blacklist, use only the workarounds
-  *   specified in the module load parameter.
-@@ -91,6 +95,8 @@ MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device "
- #define SBP2_WORKAROUND_INQUIRY_36	0x2
- #define SBP2_WORKAROUND_MODE_SENSE_8	0x4
- #define SBP2_WORKAROUND_FIX_CAPACITY	0x8
-+#define SBP2_WORKAROUND_DELAY_INQUIRY	0x10
-+#define SBP2_INQUIRY_DELAY		12
- #define SBP2_WORKAROUND_OVERRIDE	0x100
- 
- static int sbp2_param_workarounds;
-@@ -100,6 +106,7 @@ MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
- 	", 36 byte inquiry = "    __stringify(SBP2_WORKAROUND_INQUIRY_36)
- 	", skip mode page 8 = "   __stringify(SBP2_WORKAROUND_MODE_SENSE_8)
- 	", fix capacity = "       __stringify(SBP2_WORKAROUND_FIX_CAPACITY)
-+	", delay inquiry = "      __stringify(SBP2_WORKAROUND_DELAY_INQUIRY)
- 	", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
- 	", or a combination)");
+-#define SBP2_DIRECTION_TO_MEDIA		0x0
+-#define SBP2_DIRECTION_FROM_MEDIA	0x1
+-
+ /* Unit directory keys */
+ #define SBP2_CSR_UNIT_CHARACTERISTICS	0x3a
+ #define SBP2_CSR_FIRMWARE_REVISION	0x3c
+@@ -223,8 +220,8 @@ struct sbp2_status {
+ };
  
-@@ -132,6 +139,7 @@ struct sbp2_logical_unit {
- 	int generation;
- 	int retries;
- 	struct delayed_work work;
-+	bool blocked;
+ struct sbp2_pointer {
+-	u32 high;
+-	u32 low;
++	__be32 high;
++	__be32 low;
  };
  
- /*
-@@ -141,16 +149,18 @@ struct sbp2_logical_unit {
- struct sbp2_target {
- 	struct kref kref;
- 	struct fw_unit *unit;
-+	const char *bus_id;
-+	struct list_head lu_list;
+ struct sbp2_orb {
+@@ -252,8 +249,8 @@ struct sbp2_management_orb {
+ 	struct {
+ 		struct sbp2_pointer password;
+ 		struct sbp2_pointer response;
+-		u32 misc;
+-		u32 length;
++		__be32 misc;
++		__be32 length;
+ 		struct sbp2_pointer status_fifo;
+ 	} request;
+ 	__be32 response[4];
+@@ -262,20 +259,17 @@ struct sbp2_management_orb {
+ 	struct sbp2_status status;
+ };
  
- 	u64 management_agent_address;
- 	int directory_id;
- 	int node_id;
- 	int address_high;
+-#define LOGIN_RESPONSE_GET_LOGIN_ID(v)	((v).misc & 0xffff)
+-#define LOGIN_RESPONSE_GET_LENGTH(v)	(((v).misc >> 16) & 0xffff)
 -
--	unsigned workarounds;
--	struct list_head lu_list;
--
-+	unsigned int workarounds;
- 	unsigned int mgt_orb_timeout;
-+
-+	int dont_block;	/* counter for each logical unit */
-+	int blocked;	/* ditto */
+ struct sbp2_login_response {
+-	u32 misc;
++	__be32 misc;
+ 	struct sbp2_pointer command_block_agent;
+-	u32 reconnect_hold;
++	__be32 reconnect_hold;
  };
+ #define COMMAND_ORB_DATA_SIZE(v)	((v))
+ #define COMMAND_ORB_PAGE_SIZE(v)	((v) << 16)
+ #define COMMAND_ORB_PAGE_TABLE_PRESENT	((1) << 19)
+ #define COMMAND_ORB_MAX_PAYLOAD(v)	((v) << 20)
+ #define COMMAND_ORB_SPEED(v)		((v) << 24)
+-#define COMMAND_ORB_DIRECTION(v)	((v) << 27)
++#define COMMAND_ORB_DIRECTION		((1) << 27)
+ #define COMMAND_ORB_REQUEST_FORMAT(v)	((v) << 29)
+ #define COMMAND_ORB_NOTIFY		((1) << 31)
+ 
+@@ -284,7 +278,7 @@ struct sbp2_command_orb {
+ 	struct {
+ 		struct sbp2_pointer next;
+ 		struct sbp2_pointer data_descriptor;
+-		u32 misc;
++		__be32 misc;
+ 		u8 command_block[12];
+ 	} request;
+ 	struct scsi_cmnd *cmd;
+@@ -453,8 +447,7 @@ sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
+ 	unsigned long flags;
+ 
+ 	orb->pointer.high = 0;
+-	orb->pointer.low = orb->request_bus;
+-	fw_memcpy_to_be32(&orb->pointer, &orb->pointer, sizeof(orb->pointer));
++	orb->pointer.low = cpu_to_be32(orb->request_bus);
+ 
+ 	spin_lock_irqsave(&device->card->lock, flags);
+ 	list_add_tail(&orb->link, &lu->orb_list);
+@@ -530,31 +523,31 @@ sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
+ 	if (dma_mapping_error(orb->response_bus))
+ 		goto fail_mapping_response;
+ 
+-	orb->request.response.high    = 0;
+-	orb->request.response.low     = orb->response_bus;
++	orb->request.response.high = 0;
++	orb->request.response.low  = cpu_to_be32(orb->response_bus);
+ 
+-	orb->request.misc =
++	orb->request.misc = cpu_to_be32(
+ 		MANAGEMENT_ORB_NOTIFY |
+ 		MANAGEMENT_ORB_FUNCTION(function) |
+-		MANAGEMENT_ORB_LUN(lun_or_login_id);
+-	orb->request.length =
+-		MANAGEMENT_ORB_RESPONSE_LENGTH(sizeof(orb->response));
++		MANAGEMENT_ORB_LUN(lun_or_login_id));
++	orb->request.length = cpu_to_be32(
++		MANAGEMENT_ORB_RESPONSE_LENGTH(sizeof(orb->response)));
+ 
+-	orb->request.status_fifo.high = lu->address_handler.offset >> 32;
+-	orb->request.status_fifo.low  = lu->address_handler.offset;
++	orb->request.status_fifo.high =
++		cpu_to_be32(lu->address_handler.offset >> 32);
++	orb->request.status_fifo.low  =
++		cpu_to_be32(lu->address_handler.offset);
+ 
+ 	if (function == SBP2_LOGIN_REQUEST) {
+ 		/* Ask for 2^2 == 4 seconds reconnect grace period */
+-		orb->request.misc |=
++		orb->request.misc |= cpu_to_be32(
+ 			MANAGEMENT_ORB_RECONNECT(2) |
+-			MANAGEMENT_ORB_EXCLUSIVE(sbp2_param_exclusive_login);
++			MANAGEMENT_ORB_EXCLUSIVE(sbp2_param_exclusive_login));
+ 		timeout = lu->tgt->mgt_orb_timeout;
+ 	} else {
+ 		timeout = SBP2_ORB_TIMEOUT;
+ 	}
+ 
+-	fw_memcpy_to_be32(&orb->request, &orb->request, sizeof(orb->request));
+-
+ 	init_completion(&orb->done);
+ 	orb->base.callback = complete_management_orb;
+ 
+@@ -599,8 +592,7 @@ sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
+ 			 sizeof(orb->response), DMA_FROM_DEVICE);
+  fail_mapping_response:
+ 	if (response)
+-		fw_memcpy_from_be32(response,
+-				    orb->response, sizeof(orb->response));
++		memcpy(response, orb->response, sizeof(orb->response));
+ 	kref_put(&orb->base.kref, free_orb);
+ 
+ 	return retval;
+@@ -695,10 +687,8 @@ static void sbp2_conditionally_block(struct sbp2_logical_unit *lu)
+ 	if (!tgt->dont_block && !lu->blocked &&
+ 	    lu->generation != card->generation) {
+ 		lu->blocked = true;
+-		if (++tgt->blocked == 1) {
++		if (++tgt->blocked == 1)
+ 			scsi_block_requests(shost);
+-			fw_notify("blocked %s\n", lu->tgt->bus_id);
+-		}
+ 	}
+ 	spin_unlock_irqrestore(&card->lock, flags);
+ }
+@@ -725,10 +715,8 @@ static void sbp2_conditionally_unblock(struct sbp2_logical_unit *lu)
+ 	}
+ 	spin_unlock_irqrestore(&card->lock, flags);
+ 
+-	if (unblock) {
++	if (unblock)
+ 		scsi_unblock_requests(shost);
+-		fw_notify("unblocked %s\n", lu->tgt->bus_id);
+-	}
+ }
  
  /*
-@@ -160,7 +170,7 @@ struct sbp2_target {
-  */
- #define SBP2_MIN_LOGIN_ORB_TIMEOUT	5000U	/* Timeout in ms */
- #define SBP2_MAX_LOGIN_ORB_TIMEOUT	40000U	/* Timeout in ms */
--#define SBP2_ORB_TIMEOUT		2000	/* Timeout in ms */
-+#define SBP2_ORB_TIMEOUT		2000U	/* Timeout in ms */
- #define SBP2_ORB_NULL			0x80000000
- #define SBP2_MAX_SG_ELEMENT_LENGTH	0xf000
+@@ -790,7 +778,7 @@ static void sbp2_release_target(struct kref *kref)
+ 	scsi_remove_host(shost);
+ 	fw_notify("released %s\n", tgt->bus_id);
  
-@@ -297,7 +307,7 @@ struct sbp2_command_orb {
- static const struct {
- 	u32 firmware_revision;
- 	u32 model;
--	unsigned workarounds;
-+	unsigned int workarounds;
- } sbp2_workarounds_table[] = {
- 	/* DViCO Momobay CX-1 with TSB42AA9 bridge */ {
- 		.firmware_revision	= 0x002800,
-@@ -305,6 +315,11 @@ static const struct {
- 		.workarounds		= SBP2_WORKAROUND_INQUIRY_36 |
- 					  SBP2_WORKAROUND_MODE_SENSE_8,
- 	},
-+	/* DViCO Momobay FX-3A with TSB42AA9A bridge */ {
-+		.firmware_revision	= 0x002800,
-+		.model			= 0x000000,
-+		.workarounds		= SBP2_WORKAROUND_DELAY_INQUIRY,
-+	},
- 	/* Initio bridges, actually only needed for some older ones */ {
- 		.firmware_revision	= 0x000200,
- 		.model			= ~0,
-@@ -501,6 +516,9 @@ sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
- 	unsigned int timeout;
- 	int retval = -ENOMEM;
+-	put_device(&tgt->unit->device);
++	fw_unit_put(tgt->unit);
+ 	scsi_host_put(shost);
+ 	fw_device_put(device);
+ }
+@@ -855,11 +843,10 @@ static void sbp2_login(struct work_struct *work)
+ 	tgt->address_high = local_node_id << 16;
+ 	sbp2_set_generation(lu, generation);
  
-+	if (function == SBP2_LOGOUT_REQUEST && fw_device_is_shutdown(device))
-+		return 0;
-+
- 	orb = kzalloc(sizeof(*orb), GFP_ATOMIC);
- 	if (orb == NULL)
- 		return -ENOMEM;
-@@ -553,20 +571,20 @@ sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
- 
- 	retval = -EIO;
- 	if (sbp2_cancel_orbs(lu) == 0) {
--		fw_error("orb reply timed out, rcode=0x%02x\n",
--			 orb->base.rcode);
-+		fw_error("%s: orb reply timed out, rcode=0x%02x\n",
-+			 lu->tgt->bus_id, orb->base.rcode);
- 		goto out;
+-	/* Get command block agent offset and login id. */
+ 	lu->command_block_agent_address =
+-		((u64) (response.command_block_agent.high & 0xffff) << 32) |
+-		response.command_block_agent.low;
+-	lu->login_id = LOGIN_RESPONSE_GET_LOGIN_ID(response);
++		((u64)(be32_to_cpu(response.command_block_agent.high) & 0xffff)
++		      << 32) | be32_to_cpu(response.command_block_agent.low);
++	lu->login_id = be32_to_cpu(response.misc) & 0xffff;
+ 
+ 	fw_notify("%s: logged in to LUN %04x (%d retries)\n",
+ 		  tgt->bus_id, lu->lun, lu->retries);
+@@ -1091,6 +1078,7 @@ static int sbp2_probe(struct device *dev)
+ 		goto fail_shost_put;
+ 
+ 	fw_device_get(device);
++	fw_unit_get(unit);
+ 
+ 	/* Initialize to values that won't match anything in our table. */
+ 	firmware_revision = 0xff000000;
+@@ -1106,8 +1094,6 @@ static int sbp2_probe(struct device *dev)
+ 
+ 	sbp2_init_workarounds(tgt, model, firmware_revision);
+ 
+-	get_device(&unit->device);
+-
+ 	/* Do the login in a workqueue so we can easily reschedule retries. */
+ 	list_for_each_entry(lu, &tgt->lu_list, link)
+ 		sbp2_queue_work(lu, 0);
+@@ -1339,9 +1325,12 @@ sbp2_map_scatterlist(struct sbp2_command_orb *orb, struct fw_device *device,
+ 	 * tables.
+ 	 */
+ 	if (count == 1 && sg_dma_len(sg) < SBP2_MAX_SG_ELEMENT_LENGTH) {
+-		orb->request.data_descriptor.high = lu->tgt->address_high;
+-		orb->request.data_descriptor.low  = sg_dma_address(sg);
+-		orb->request.misc |= COMMAND_ORB_DATA_SIZE(sg_dma_len(sg));
++		orb->request.data_descriptor.high =
++			cpu_to_be32(lu->tgt->address_high);
++		orb->request.data_descriptor.low  =
++			cpu_to_be32(sg_dma_address(sg));
++		orb->request.misc |=
++			cpu_to_be32(COMMAND_ORB_DATA_SIZE(sg_dma_len(sg)));
+ 		return 0;
  	}
  
- 	if (orb->base.rcode != RCODE_COMPLETE) {
--		fw_error("management write failed, rcode 0x%02x\n",
--			 orb->base.rcode);
-+		fw_error("%s: management write failed, rcode 0x%02x\n",
-+			 lu->tgt->bus_id, orb->base.rcode);
- 		goto out;
+@@ -1362,16 +1351,14 @@ sbp2_map_scatterlist(struct sbp2_command_orb *orb, struct fw_device *device,
+ 				goto fail_page_table;
+ 			}
+ 			l = min(sg_len, SBP2_MAX_SG_ELEMENT_LENGTH);
+-			orb->page_table[j].low = sg_addr;
+-			orb->page_table[j].high = (l << 16);
++			orb->page_table[j].low = cpu_to_be32(sg_addr);
++			orb->page_table[j].high = cpu_to_be32(l << 16);
+ 			sg_addr += l;
+ 			sg_len -= l;
+ 			j++;
+ 		}
  	}
  
- 	if (STATUS_GET_RESPONSE(orb->status) != 0 ||
- 	    STATUS_GET_SBP_STATUS(orb->status) != 0) {
--		fw_error("error status: %d:%d\n",
-+		fw_error("%s: error status: %d:%d\n", lu->tgt->bus_id,
- 			 STATUS_GET_RESPONSE(orb->status),
- 			 STATUS_GET_SBP_STATUS(orb->status));
+-	fw_memcpy_to_be32(orb->page_table, orb->page_table,
+-			  sizeof(orb->page_table[0]) * j);
+ 	orb->page_table_bus =
+ 		dma_map_single(device->card->device, orb->page_table,
+ 			       sizeof(orb->page_table), DMA_TO_DEVICE);
+@@ -1385,11 +1372,10 @@ sbp2_map_scatterlist(struct sbp2_command_orb *orb, struct fw_device *device,
+ 	 * initiator (i.e. us), but data_descriptor can refer to data
+ 	 * on other nodes so we need to put our ID in descriptor.high.
+ 	 */
+-	orb->request.data_descriptor.high = lu->tgt->address_high;
+-	orb->request.data_descriptor.low  = orb->page_table_bus;
+-	orb->request.misc |=
+-		COMMAND_ORB_PAGE_TABLE_PRESENT |
+-		COMMAND_ORB_DATA_SIZE(j);
++	orb->request.data_descriptor.high = cpu_to_be32(lu->tgt->address_high);
++	orb->request.data_descriptor.low  = cpu_to_be32(orb->page_table_bus);
++	orb->request.misc |= cpu_to_be32(COMMAND_ORB_PAGE_TABLE_PRESENT |
++					 COMMAND_ORB_DATA_SIZE(j));
+ 
+ 	return 0;
+ 
+@@ -1435,8 +1421,7 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
+ 	orb->done = done;
+ 	orb->cmd  = cmd;
+ 
+-	orb->request.next.high   = SBP2_ORB_NULL;
+-	orb->request.next.low    = 0x0;
++	orb->request.next.high   = cpu_to_be32(SBP2_ORB_NULL);
+ 	/*
+ 	 * At speed 100 we can do 512 bytes per packet, at speed 200,
+ 	 * 1024 bytes per packet etc.  The SBP-2 max_payload field
+@@ -1445,25 +1430,17 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
+ 	 */
+ 	max_payload = min(device->max_speed + 7,
+ 			  device->card->max_receive - 1);
+-	orb->request.misc =
++	orb->request.misc = cpu_to_be32(
+ 		COMMAND_ORB_MAX_PAYLOAD(max_payload) |
+ 		COMMAND_ORB_SPEED(device->max_speed) |
+-		COMMAND_ORB_NOTIFY;
++		COMMAND_ORB_NOTIFY);
+ 
+ 	if (cmd->sc_data_direction == DMA_FROM_DEVICE)
+-		orb->request.misc |=
+-			COMMAND_ORB_DIRECTION(SBP2_DIRECTION_FROM_MEDIA);
+-	else if (cmd->sc_data_direction == DMA_TO_DEVICE)
+-		orb->request.misc |=
+-			COMMAND_ORB_DIRECTION(SBP2_DIRECTION_TO_MEDIA);
++		orb->request.misc |= cpu_to_be32(COMMAND_ORB_DIRECTION);
+ 
+ 	if (scsi_sg_count(cmd) && sbp2_map_scatterlist(orb, device, lu) < 0)
  		goto out;
-@@ -590,29 +608,147 @@ sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
  
- static void
- complete_agent_reset_write(struct fw_card *card, int rcode,
--			   void *payload, size_t length, void *data)
-+			   void *payload, size_t length, void *done)
-+{
-+	complete(done);
-+}
-+
-+static void sbp2_agent_reset(struct sbp2_logical_unit *lu)
+-	fw_memcpy_to_be32(&orb->request, &orb->request, sizeof(orb->request));
+-
+-	memset(orb->request.command_block,
+-	       0, sizeof(orb->request.command_block));
+ 	memcpy(orb->request.command_block, cmd->cmnd, COMMAND_SIZE(*cmd->cmnd));
+ 
+ 	orb->base.callback = complete_command_orb;
+@@ -1491,11 +1468,8 @@ static int sbp2_scsi_slave_alloc(struct scsi_device *sdev)
+ 
+ 	sdev->allow_restart = 1;
+ 
+-	/*
+-	 * Update the dma alignment (minimum alignment requirements for
+-	 * start and end of DMA transfers) to be a sector
+-	 */
+-	blk_queue_update_dma_alignment(sdev->request_queue, 511);
++	/* SBP-2 requires quadlet alignment of the data buffers. */
++	blk_queue_update_dma_alignment(sdev->request_queue, 4 - 1);
+ 
+ 	if (lu->tgt->workarounds & SBP2_WORKAROUND_INQUIRY_36)
+ 		sdev->inquiry_len = 36;
+diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c
+index 7fcc59d..99529e5 100644
+--- a/drivers/firewire/fw-transaction.c
++++ b/drivers/firewire/fw-transaction.c
+@@ -751,7 +751,7 @@ handle_topology_map(struct fw_card *card, struct fw_request *request,
+ 		    void *payload, size_t length, void *callback_data)
  {
--	struct fw_transaction *t = data;
-+	struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
-+	DECLARE_COMPLETION_ONSTACK(done);
-+	struct fw_transaction t;
-+	static u32 z;
-+
-+	fw_send_request(device->card, &t, TCODE_WRITE_QUADLET_REQUEST,
-+			lu->tgt->node_id, lu->generation, device->max_speed,
-+			lu->command_block_agent_address + SBP2_AGENT_RESET,
-+			&z, sizeof(z), complete_agent_reset_write, &done);
-+	wait_for_completion(&done);
-+}
+ 	int i, start, end;
+-	u32 *map;
++	__be32 *map;
+ 
+ 	if (!TCODE_IS_READ_REQUEST(tcode)) {
+ 		fw_send_response(card, request, RCODE_TYPE_ERROR);
+diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
+index 09cb728..1a22a23 100644
+--- a/drivers/firewire/fw-transaction.h
++++ b/drivers/firewire/fw-transaction.h
+@@ -86,12 +86,12 @@
+ static inline void
+ fw_memcpy_from_be32(void *_dst, void *_src, size_t size)
+ {
+-	u32 *dst = _dst;
+-	u32 *src = _src;
++	u32    *dst = _dst;
++	__be32 *src = _src;
+ 	int i;
  
--	kfree(t);
-+static void
-+complete_agent_reset_write_no_wait(struct fw_card *card, int rcode,
-+				   void *payload, size_t length, void *data)
-+{
-+	kfree(data);
+ 	for (i = 0; i < size / 4; i++)
+-		dst[i] = cpu_to_be32(src[i]);
++		dst[i] = be32_to_cpu(src[i]);
  }
  
--static int sbp2_agent_reset(struct sbp2_logical_unit *lu)
-+static void sbp2_agent_reset_no_wait(struct sbp2_logical_unit *lu)
- {
- 	struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
- 	struct fw_transaction *t;
--	static u32 zero;
-+	static u32 z;
- 
--	t = kzalloc(sizeof(*t), GFP_ATOMIC);
-+	t = kmalloc(sizeof(*t), GFP_ATOMIC);
- 	if (t == NULL)
--		return -ENOMEM;
-+		return;
- 
- 	fw_send_request(device->card, t, TCODE_WRITE_QUADLET_REQUEST,
- 			lu->tgt->node_id, lu->generation, device->max_speed,
- 			lu->command_block_agent_address + SBP2_AGENT_RESET,
--			&zero, sizeof(zero), complete_agent_reset_write, t);
-+			&z, sizeof(z), complete_agent_reset_write_no_wait, t);
-+}
+ static inline void
+@@ -221,7 +221,6 @@ struct fw_card {
+ 	const struct fw_card_driver *driver;
+ 	struct device *device;
+ 	atomic_t device_count;
+-	struct kref kref;
  
--	return 0;
-+static void sbp2_set_generation(struct sbp2_logical_unit *lu, int generation)
-+{
-+	struct fw_card *card = fw_device(lu->tgt->unit->device.parent)->card;
-+	unsigned long flags;
-+
-+	/* serialize with comparisons of lu->generation and card->generation */
-+	spin_lock_irqsave(&card->lock, flags);
-+	lu->generation = generation;
-+	spin_unlock_irqrestore(&card->lock, flags);
-+}
-+
-+static inline void sbp2_allow_block(struct sbp2_logical_unit *lu)
-+{
-+	/*
-+	 * We may access dont_block without taking card->lock here:
-+	 * All callers of sbp2_allow_block() and all callers of sbp2_unblock()
-+	 * are currently serialized against each other.
-+	 * And a wrong result in sbp2_conditionally_block()'s access of
-+	 * dont_block is rather harmless, it simply misses its first chance.
-+	 */
-+	--lu->tgt->dont_block;
-+}
+ 	int node_id;
+ 	int generation;
+@@ -263,9 +262,6 @@ struct fw_card {
+ 	int bm_generation;
+ };
+ 
+-struct fw_card *fw_card_get(struct fw_card *card);
+-void fw_card_put(struct fw_card *card);
+-
+ /*
+  * The iso packet format allows for an immediate header/payload part
+  * stored in 'header' immediately after the packet info plus an
+diff --git a/drivers/ieee1394/csr.c b/drivers/ieee1394/csr.c
+index 52ac83e..c90be40 100644
+--- a/drivers/ieee1394/csr.c
++++ b/drivers/ieee1394/csr.c
+@@ -133,8 +133,7 @@ static void host_reset(struct hpsb_host *host)
+                 host->csr.state &= ~0x100;
+         }
+ 
+-        host->csr.topology_map[1] =
+-                cpu_to_be32(be32_to_cpu(host->csr.topology_map[1]) + 1);
++	be32_add_cpu(&host->csr.topology_map[1], 1);
+         host->csr.topology_map[2] = cpu_to_be32(host->node_count << 16
+                                                 | host->selfid_count);
+         host->csr.topology_map[0] =
+@@ -142,8 +141,7 @@ static void host_reset(struct hpsb_host *host)
+                             | csr_crc16(host->csr.topology_map + 1,
+                                         host->selfid_count + 2));
+ 
+-        host->csr.speed_map[1] =
+-                cpu_to_be32(be32_to_cpu(host->csr.speed_map[1]) + 1);
++	be32_add_cpu(&host->csr.speed_map[1], 1);
+         host->csr.speed_map[0] = cpu_to_be32(0x3f1 << 16
+                                              | csr_crc16(host->csr.speed_map+1,
+                                                          0x3f1));
+diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
+index 6572211..8c72f36 100644
+--- a/drivers/ieee1394/dv1394.c
++++ b/drivers/ieee1394/dv1394.c
+@@ -2179,8 +2179,7 @@ static struct ieee1394_device_id dv1394_id_table[] = {
+ MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
+ 
+ static struct hpsb_protocol_driver dv1394_driver = {
+-	.name		= "dv1394",
+-	.id_table	= dv1394_id_table,
++	.name = "dv1394",
+ };
+ 
+ 
+diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
+index 511e432..70afa37 100644
+--- a/drivers/ieee1394/nodemgr.c
++++ b/drivers/ieee1394/nodemgr.c
+@@ -701,7 +701,11 @@ static int nodemgr_bus_match(struct device * dev, struct device_driver * drv)
+ 		return 0;
+ 
+ 	driver = container_of(drv, struct hpsb_protocol_driver, driver);
+-	for (id = driver->id_table; id->match_flags != 0; id++) {
++	id = driver->id_table;
++	if (!id)
++		return 0;
 +
-+/*
-+ * Blocks lu->tgt if all of the following conditions are met:
-+ *   - Login, INQUIRY, and high-level SCSI setup of all of the target's
-+ *     logical units have been finished (indicated by dont_block == 0).
-+ *   - lu->generation is stale.
-+ *
-+ * Note, scsi_block_requests() must be called while holding card->lock,
-+ * otherwise it might foil sbp2_[conditionally_]unblock()'s attempt to
-+ * unblock the target.
-+ */
-+static void sbp2_conditionally_block(struct sbp2_logical_unit *lu)
++	for (; id->match_flags != 0; id++) {
+ 		if ((id->match_flags & IEEE1394_MATCH_VENDOR_ID) &&
+ 		    id->vendor_id != ud->vendor_id)
+ 			continue;
+diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
+index 969de2a..29b8910 100644
+--- a/drivers/ieee1394/ohci1394.c
++++ b/drivers/ieee1394/ohci1394.c
+@@ -2993,15 +2993,9 @@ do {						\
+ 	return err;				\
+ } while (0)
+ 
+-static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
+-					const struct pci_device_id *ent)
+-{
+-	struct hpsb_host *host;
+-	struct ti_ohci *ohci;	/* shortcut to currently handled device */
+-	resource_size_t ohci_base;
+-
+ #ifdef CONFIG_PPC_PMAC
+-	/* Necessary on some machines if ohci1394 was loaded/ unloaded before */
++static void ohci1394_pmac_on(struct pci_dev *dev)
 +{
-+	struct sbp2_target *tgt = lu->tgt;
-+	struct fw_card *card = fw_device(tgt->unit->device.parent)->card;
-+	struct Scsi_Host *shost =
-+		container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&card->lock, flags);
-+	if (!tgt->dont_block && !lu->blocked &&
-+	    lu->generation != card->generation) {
-+		lu->blocked = true;
-+		if (++tgt->blocked == 1) {
-+			scsi_block_requests(shost);
-+			fw_notify("blocked %s\n", lu->tgt->bus_id);
-+		}
-+	}
-+	spin_unlock_irqrestore(&card->lock, flags);
+ 	if (machine_is(powermac)) {
+ 		struct device_node *ofn = pci_device_to_OF_node(dev);
+ 
+@@ -3010,8 +3004,32 @@ static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
+ 			pmac_call_feature(PMAC_FTR_1394_ENABLE, ofn, 0, 1);
+ 		}
+ 	}
 +}
 +
-+/*
-+ * Unblocks lu->tgt as soon as all its logical units can be unblocked.
-+ * Note, it is harmless to run scsi_unblock_requests() outside the
-+ * card->lock protected section.  On the other hand, running it inside
-+ * the section might clash with shost->host_lock.
-+ */
-+static void sbp2_conditionally_unblock(struct sbp2_logical_unit *lu)
++static void ohci1394_pmac_off(struct pci_dev *dev)
 +{
-+	struct sbp2_target *tgt = lu->tgt;
-+	struct fw_card *card = fw_device(tgt->unit->device.parent)->card;
-+	struct Scsi_Host *shost =
-+		container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
-+	unsigned long flags;
-+	bool unblock = false;
-+
-+	spin_lock_irqsave(&card->lock, flags);
-+	if (lu->blocked && lu->generation == card->generation) {
-+		lu->blocked = false;
-+		unblock = --tgt->blocked == 0;
-+	}
-+	spin_unlock_irqrestore(&card->lock, flags);
++	if (machine_is(powermac)) {
++		struct device_node *ofn = pci_device_to_OF_node(dev);
 +
-+	if (unblock) {
-+		scsi_unblock_requests(shost);
-+		fw_notify("unblocked %s\n", lu->tgt->bus_id);
++		if (ofn) {
++			pmac_call_feature(PMAC_FTR_1394_ENABLE, ofn, 0, 0);
++			pmac_call_feature(PMAC_FTR_1394_CABLE_POWER, ofn, 0, 0);
++		}
 +	}
 +}
-+
-+/*
-+ * Prevents future blocking of tgt and unblocks it.
-+ * Note, it is harmless to run scsi_unblock_requests() outside the
-+ * card->lock protected section.  On the other hand, running it inside
-+ * the section might clash with shost->host_lock.
-+ */
-+static void sbp2_unblock(struct sbp2_target *tgt)
-+{
-+	struct fw_card *card = fw_device(tgt->unit->device.parent)->card;
-+	struct Scsi_Host *shost =
-+		container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&card->lock, flags);
-+	++tgt->dont_block;
-+	spin_unlock_irqrestore(&card->lock, flags);
-+
-+	scsi_unblock_requests(shost);
- }
- 
- static void sbp2_release_target(struct kref *kref)
-@@ -621,23 +757,24 @@ static void sbp2_release_target(struct kref *kref)
- 	struct sbp2_logical_unit *lu, *next;
- 	struct Scsi_Host *shost =
- 		container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
--	struct fw_device *device = fw_device(tgt->unit->device.parent);
-+
-+	/* prevent deadlocks */
-+	sbp2_unblock(tgt);
- 
- 	list_for_each_entry_safe(lu, next, &tgt->lu_list, link) {
--		if (lu->sdev)
-+		if (lu->sdev) {
- 			scsi_remove_device(lu->sdev);
--
--		if (!fw_device_is_shutdown(device))
--			sbp2_send_management_orb(lu, tgt->node_id,
--					lu->generation, SBP2_LOGOUT_REQUEST,
--					lu->login_id, NULL);
-+			scsi_device_put(lu->sdev);
-+		}
-+		sbp2_send_management_orb(lu, tgt->node_id, lu->generation,
-+				SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
++#else
++#define ohci1394_pmac_on(dev)
++#define ohci1394_pmac_off(dev)
+ #endif /* CONFIG_PPC_PMAC */
  
- 		fw_core_remove_address_handler(&lu->address_handler);
- 		list_del(&lu->link);
- 		kfree(lu);
- 	}
- 	scsi_remove_host(shost);
--	fw_notify("released %s\n", tgt->unit->device.bus_id);
-+	fw_notify("released %s\n", tgt->bus_id);
++static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
++					const struct pci_device_id *ent)
++{
++	struct hpsb_host *host;
++	struct ti_ohci *ohci;	/* shortcut to currently handled device */
++	resource_size_t ohci_base;
++
++	ohci1394_pmac_on(dev);
+         if (pci_enable_device(dev))
+ 		FAIL(-ENXIO, "Failed to enable OHCI hardware");
+         pci_set_master(dev);
+@@ -3203,16 +3221,16 @@ static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
+ #undef FAIL
+ }
  
- 	put_device(&tgt->unit->device);
- 	scsi_host_put(shost);
-@@ -666,33 +803,43 @@ static void sbp2_login(struct work_struct *work)
+-static void ohci1394_pci_remove(struct pci_dev *pdev)
++static void ohci1394_pci_remove(struct pci_dev *dev)
  {
- 	struct sbp2_logical_unit *lu =
- 		container_of(work, struct sbp2_logical_unit, work.work);
--	struct Scsi_Host *shost =
--		container_of((void *)lu->tgt, struct Scsi_Host, hostdata[0]);
-+	struct sbp2_target *tgt = lu->tgt;
-+	struct fw_device *device = fw_device(tgt->unit->device.parent);
-+	struct Scsi_Host *shost;
- 	struct scsi_device *sdev;
- 	struct scsi_lun eight_bytes_lun;
--	struct fw_unit *unit = lu->tgt->unit;
--	struct fw_device *device = fw_device(unit->device.parent);
- 	struct sbp2_login_response response;
- 	int generation, node_id, local_node_id;
- 
-+	if (fw_device_is_shutdown(device))
-+		goto out;
-+
- 	generation    = device->generation;
- 	smp_rmb();    /* node_id must not be older than generation */
- 	node_id       = device->node_id;
- 	local_node_id = device->card->node_id;
- 
-+	/* If this is a re-login attempt, log out, or we might be rejected. */
-+	if (lu->sdev)
-+		sbp2_send_management_orb(lu, device->node_id, generation,
-+				SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
-+
- 	if (sbp2_send_management_orb(lu, node_id, generation,
- 				SBP2_LOGIN_REQUEST, lu->lun, &response) < 0) {
--		if (lu->retries++ < 5)
-+		if (lu->retries++ < 5) {
- 			sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
--		else
--			fw_error("failed to login to %s LUN %04x\n",
--				 unit->device.bus_id, lu->lun);
-+		} else {
-+			fw_error("%s: failed to login to LUN %04x\n",
-+				 tgt->bus_id, lu->lun);
-+			/* Let any waiting I/O fail from now on. */
-+			sbp2_unblock(lu->tgt);
-+		}
- 		goto out;
+ 	struct ti_ohci *ohci;
+-	struct device *dev;
++	struct device *device;
+ 
+-	ohci = pci_get_drvdata(pdev);
++	ohci = pci_get_drvdata(dev);
+ 	if (!ohci)
+ 		return;
+ 
+-	dev = get_device(&ohci->host->device);
++	device = get_device(&ohci->host->device);
+ 
+ 	switch (ohci->init_state) {
+ 	case OHCI_INIT_DONE:
+@@ -3246,7 +3264,7 @@ static void ohci1394_pci_remove(struct pci_dev *pdev)
+ 		/* Soft reset before we start - this disables
+ 		 * interrupts and clears linkEnable and LPS. */
+ 		ohci_soft_reset(ohci);
+-		free_irq(ohci->dev->irq, ohci);
++		free_irq(dev->irq, ohci);
+ 
+ 	case OHCI_INIT_HAVE_TXRX_BUFFERS__MAYBE:
+ 		/* The ohci_soft_reset() stops all DMA contexts, so we
+@@ -3257,12 +3275,12 @@ static void ohci1394_pci_remove(struct pci_dev *pdev)
+ 		free_dma_trm_ctx(&ohci->at_resp_context);
+ 
+ 	case OHCI_INIT_HAVE_SELFID_BUFFER:
+-		pci_free_consistent(ohci->dev, OHCI1394_SI_DMA_BUF_SIZE,
++		pci_free_consistent(dev, OHCI1394_SI_DMA_BUF_SIZE,
+ 				    ohci->selfid_buf_cpu,
+ 				    ohci->selfid_buf_bus);
+ 
+ 	case OHCI_INIT_HAVE_CONFIG_ROM_BUFFER:
+-		pci_free_consistent(ohci->dev, OHCI_CONFIG_ROM_LEN,
++		pci_free_consistent(dev, OHCI_CONFIG_ROM_LEN,
+ 				    ohci->csr_config_rom_cpu,
+ 				    ohci->csr_config_rom_bus);
+ 
+@@ -3270,35 +3288,24 @@ static void ohci1394_pci_remove(struct pci_dev *pdev)
+ 		iounmap(ohci->registers);
+ 
+ 	case OHCI_INIT_HAVE_MEM_REGION:
+-		release_mem_region(pci_resource_start(ohci->dev, 0),
++		release_mem_region(pci_resource_start(dev, 0),
+ 				   OHCI1394_REGISTER_SIZE);
+ 
+-#ifdef CONFIG_PPC_PMAC
+-	/* On UniNorth, power down the cable and turn off the chip clock
+-	 * to save power on laptops */
+-	if (machine_is(powermac)) {
+-		struct device_node* ofn = pci_device_to_OF_node(ohci->dev);
+-
+-		if (ofn) {
+-			pmac_call_feature(PMAC_FTR_1394_ENABLE, ofn, 0, 0);
+-			pmac_call_feature(PMAC_FTR_1394_CABLE_POWER, ofn, 0, 0);
+-		}
+-	}
+-#endif /* CONFIG_PPC_PMAC */
++		ohci1394_pmac_off(dev);
+ 
+ 	case OHCI_INIT_ALLOC_HOST:
+-		pci_set_drvdata(ohci->dev, NULL);
++		pci_set_drvdata(dev, NULL);
  	}
  
--	lu->generation        = generation;
--	lu->tgt->node_id      = node_id;
--	lu->tgt->address_high = local_node_id << 16;
-+	tgt->node_id	  = node_id;
-+	tgt->address_high = local_node_id << 16;
-+	sbp2_set_generation(lu, generation);
- 
- 	/* Get command block agent offset and login id. */
- 	lu->command_block_agent_address =
-@@ -700,8 +847,8 @@ static void sbp2_login(struct work_struct *work)
- 		response.command_block_agent.low;
- 	lu->login_id = LOGIN_RESPONSE_GET_LOGIN_ID(response);
- 
--	fw_notify("logged in to %s LUN %04x (%d retries)\n",
--		  unit->device.bus_id, lu->lun, lu->retries);
-+	fw_notify("%s: logged in to LUN %04x (%d retries)\n",
-+		  tgt->bus_id, lu->lun, lu->retries);
- 
- #if 0
- 	/* FIXME: The linux1394 sbp2 does this last step. */
-@@ -711,26 +858,62 @@ static void sbp2_login(struct work_struct *work)
- 	PREPARE_DELAYED_WORK(&lu->work, sbp2_reconnect);
- 	sbp2_agent_reset(lu);
- 
-+	/* This was a re-login. */
-+	if (lu->sdev) {
-+		sbp2_cancel_orbs(lu);
-+		sbp2_conditionally_unblock(lu);
-+		goto out;
-+	}
-+
-+	if (lu->tgt->workarounds & SBP2_WORKAROUND_DELAY_INQUIRY)
-+		ssleep(SBP2_INQUIRY_DELAY);
-+
- 	memset(&eight_bytes_lun, 0, sizeof(eight_bytes_lun));
- 	eight_bytes_lun.scsi_lun[0] = (lu->lun >> 8) & 0xff;
- 	eight_bytes_lun.scsi_lun[1] = lu->lun & 0xff;
-+	shost = container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
- 
- 	sdev = __scsi_add_device(shost, 0, 0,
- 				 scsilun_to_int(&eight_bytes_lun), lu);
--	if (IS_ERR(sdev)) {
--		sbp2_send_management_orb(lu, node_id, generation,
--				SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
--		/*
--		 * Set this back to sbp2_login so we fall back and
--		 * retry login on bus reset.
--		 */
--		PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
--	} else {
--		lu->sdev = sdev;
-+	/*
-+	 * FIXME:  We are unable to perform reconnects while in sbp2_login().
-+	 * Therefore __scsi_add_device() will get into trouble if a bus reset
-+	 * happens in parallel.  It will either fail or leave us with an
-+	 * unusable sdev.  As a workaround we check for this and retry the
-+	 * whole login and SCSI probing.
-+	 */
-+
-+	/* Reported error during __scsi_add_device() */
-+	if (IS_ERR(sdev))
-+		goto out_logout_login;
-+
-+	/* Unreported error during __scsi_add_device() */
-+	smp_rmb(); /* get current card generation */
-+	if (generation != device->card->generation) {
-+		scsi_remove_device(sdev);
- 		scsi_device_put(sdev);
-+		goto out_logout_login;
- 	}
-+
-+	/* No error during __scsi_add_device() */
-+	lu->sdev = sdev;
-+	sbp2_allow_block(lu);
-+	goto out;
-+
-+ out_logout_login:
-+	smp_rmb(); /* generation may have changed */
-+	generation = device->generation;
-+	smp_rmb(); /* node_id must not be older than generation */
-+
-+	sbp2_send_management_orb(lu, device->node_id, generation,
-+				 SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
-+	/*
-+	 * If a bus reset happened, sbp2_update will have requeued
-+	 * lu->work already.  Reset the work from reconnect to login.
-+	 */
-+	PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
-  out:
--	sbp2_target_put(lu->tgt);
-+	sbp2_target_put(tgt);
+-	if (dev)
+-		put_device(dev);
++	if (device)
++		put_device(device);
  }
  
- static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
-@@ -755,6 +938,8 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
- 	lu->sdev = NULL;
- 	lu->lun  = lun_entry & 0xffff;
- 	lu->retries = 0;
-+	lu->blocked = false;
-+	++tgt->dont_block;
- 	INIT_LIST_HEAD(&lu->orb_list);
- 	INIT_DELAYED_WORK(&lu->work, sbp2_login);
- 
-@@ -813,7 +998,7 @@ static int sbp2_scan_unit_dir(struct sbp2_target *tgt, u32 *directory,
- 			if (timeout > tgt->mgt_orb_timeout)
- 				fw_notify("%s: config rom contains %ds "
- 					  "management ORB timeout, limiting "
--					  "to %ds\n", tgt->unit->device.bus_id,
-+					  "to %ds\n", tgt->bus_id,
- 					  timeout / 1000,
- 					  tgt->mgt_orb_timeout / 1000);
- 			break;
-@@ -836,12 +1021,12 @@ static void sbp2_init_workarounds(struct sbp2_target *tgt, u32 model,
- 				  u32 firmware_revision)
- {
- 	int i;
--	unsigned w = sbp2_param_workarounds;
-+	unsigned int w = sbp2_param_workarounds;
- 
- 	if (w)
- 		fw_notify("Please notify linux1394-devel at lists.sourceforge.net "
- 			  "if you need the workarounds parameter for %s\n",
--			  tgt->unit->device.bus_id);
-+			  tgt->bus_id);
- 
- 	if (w & SBP2_WORKAROUND_OVERRIDE)
- 		goto out;
-@@ -863,8 +1048,7 @@ static void sbp2_init_workarounds(struct sbp2_target *tgt, u32 model,
- 	if (w)
- 		fw_notify("Workarounds for %s: 0x%x "
- 			  "(firmware_revision 0x%06x, model_id 0x%06x)\n",
--			  tgt->unit->device.bus_id,
--			  w, firmware_revision, model);
-+			  tgt->bus_id, w, firmware_revision, model);
- 	tgt->workarounds = w;
- }
- 
-@@ -888,6 +1072,7 @@ static int sbp2_probe(struct device *dev)
- 	tgt->unit = unit;
- 	kref_init(&tgt->kref);
- 	INIT_LIST_HEAD(&tgt->lu_list);
-+	tgt->bus_id = unit->device.bus_id;
- 
- 	if (fw_device_enable_phys_dma(device) < 0)
- 		goto fail_shost_put;
-@@ -938,10 +1123,13 @@ static void sbp2_reconnect(struct work_struct *work)
+ #ifdef CONFIG_PM
+-static int ohci1394_pci_suspend(struct pci_dev *pdev, pm_message_t state)
++static int ohci1394_pci_suspend(struct pci_dev *dev, pm_message_t state)
  {
- 	struct sbp2_logical_unit *lu =
- 		container_of(work, struct sbp2_logical_unit, work.work);
--	struct fw_unit *unit = lu->tgt->unit;
--	struct fw_device *device = fw_device(unit->device.parent);
-+	struct sbp2_target *tgt = lu->tgt;
-+	struct fw_device *device = fw_device(tgt->unit->device.parent);
- 	int generation, node_id, local_node_id;
- 
-+	if (fw_device_is_shutdown(device))
-+		goto out;
-+
- 	generation    = device->generation;
- 	smp_rmb();    /* node_id must not be older than generation */
- 	node_id       = device->node_id;
-@@ -950,10 +1138,17 @@ static void sbp2_reconnect(struct work_struct *work)
- 	if (sbp2_send_management_orb(lu, node_id, generation,
- 				     SBP2_RECONNECT_REQUEST,
- 				     lu->login_id, NULL) < 0) {
--		if (lu->retries++ >= 5) {
--			fw_error("failed to reconnect to %s\n",
--				 unit->device.bus_id);
--			/* Fall back and try to log in again. */
-+		/*
-+		 * If reconnect was impossible even though we are in the
-+		 * current generation, fall back and try to log in again.
-+		 *
-+		 * We could check for "Function rejected" status, but
-+		 * looking at the bus generation as simpler and more general.
-+		 */
-+		smp_rmb(); /* get current card generation */
-+		if (generation == device->card->generation ||
-+		    lu->retries++ >= 5) {
-+			fw_error("%s: failed to reconnect\n", tgt->bus_id);
- 			lu->retries = 0;
- 			PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
- 		}
-@@ -961,17 +1156,18 @@ static void sbp2_reconnect(struct work_struct *work)
- 		goto out;
+ 	int err;
+-	struct ti_ohci *ohci = pci_get_drvdata(pdev);
++	struct ti_ohci *ohci = pci_get_drvdata(dev);
+ 
+ 	if (!ohci) {
+ 		printk(KERN_ERR "%s: tried to suspend nonexisting host\n",
+@@ -3326,32 +3333,23 @@ static int ohci1394_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+ 	ohci_devctl(ohci->host, RESET_BUS, LONG_RESET_NO_FORCE_ROOT);
+ 	ohci_soft_reset(ohci);
+ 
+-	err = pci_save_state(pdev);
++	err = pci_save_state(dev);
+ 	if (err) {
+ 		PRINT(KERN_ERR, "pci_save_state failed with %d", err);
+ 		return err;
  	}
+-	err = pci_set_power_state(pdev, pci_choose_state(pdev, state));
++	err = pci_set_power_state(dev, pci_choose_state(dev, state));
+ 	if (err)
+ 		DBGMSG("pci_set_power_state failed with %d", err);
+-
+-/* PowerMac suspend code comes last */
+-#ifdef CONFIG_PPC_PMAC
+-	if (machine_is(powermac)) {
+-		struct device_node *ofn = pci_device_to_OF_node(pdev);
+-
+-		if (ofn)
+-			pmac_call_feature(PMAC_FTR_1394_ENABLE, ofn, 0, 0);
+-	}
+-#endif /* CONFIG_PPC_PMAC */
++	ohci1394_pmac_off(dev);
  
--	lu->generation        = generation;
--	lu->tgt->node_id      = node_id;
--	lu->tgt->address_high = local_node_id << 16;
-+	tgt->node_id      = node_id;
-+	tgt->address_high = local_node_id << 16;
-+	sbp2_set_generation(lu, generation);
- 
--	fw_notify("reconnected to %s LUN %04x (%d retries)\n",
--		  unit->device.bus_id, lu->lun, lu->retries);
-+	fw_notify("%s: reconnected to LUN %04x (%d retries)\n",
-+		  tgt->bus_id, lu->lun, lu->retries);
- 
- 	sbp2_agent_reset(lu);
- 	sbp2_cancel_orbs(lu);
-+	sbp2_conditionally_unblock(lu);
-  out:
--	sbp2_target_put(lu->tgt);
-+	sbp2_target_put(tgt);
+ 	return 0;
  }
  
- static void sbp2_update(struct fw_unit *unit)
-@@ -986,6 +1182,7 @@ static void sbp2_update(struct fw_unit *unit)
- 	 * Iteration over tgt->lu_list is therefore safe here.
- 	 */
- 	list_for_each_entry(lu, &tgt->lu_list, link) {
-+		sbp2_conditionally_block(lu);
- 		lu->retries = 0;
- 		sbp2_queue_work(lu, 0);
- 	}
-@@ -1063,7 +1260,7 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
- 
- 	if (status != NULL) {
- 		if (STATUS_GET_DEAD(*status))
--			sbp2_agent_reset(orb->lu);
-+			sbp2_agent_reset_no_wait(orb->lu);
- 
- 		switch (STATUS_GET_RESPONSE(*status)) {
- 		case SBP2_STATUS_REQUEST_COMPLETE:
-@@ -1089,6 +1286,7 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
- 		 * or when sending the write (less likely).
- 		 */
- 		result = DID_BUS_BUSY << 16;
-+		sbp2_conditionally_block(orb->lu);
- 	}
- 
- 	dma_unmap_single(device->card->device, orb->base.request_bus,
-@@ -1197,7 +1395,7 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
- 	struct sbp2_logical_unit *lu = cmd->device->hostdata;
- 	struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
- 	struct sbp2_command_orb *orb;
--	unsigned max_payload;
-+	unsigned int max_payload;
- 	int retval = SCSI_MLQUEUE_HOST_BUSY;
- 
- 	/*
-@@ -1275,6 +1473,10 @@ static int sbp2_scsi_slave_alloc(struct scsi_device *sdev)
+-static int ohci1394_pci_resume(struct pci_dev *pdev)
++static int ohci1394_pci_resume(struct pci_dev *dev)
  {
- 	struct sbp2_logical_unit *lu = sdev->hostdata;
- 
-+	/* (Re-)Adding logical units via the SCSI stack is not supported. */
-+	if (!lu)
-+		return -ENOSYS;
-+
- 	sdev->allow_restart = 1;
- 
- 	/*
-@@ -1319,7 +1521,7 @@ static int sbp2_scsi_abort(struct scsi_cmnd *cmd)
- {
- 	struct sbp2_logical_unit *lu = cmd->device->hostdata;
+ 	int err;
+-	struct ti_ohci *ohci = pci_get_drvdata(pdev);
++	struct ti_ohci *ohci = pci_get_drvdata(dev);
+ 
+ 	if (!ohci) {
+ 		printk(KERN_ERR "%s: tried to resume nonexisting host\n",
+@@ -3360,19 +3358,10 @@ static int ohci1394_pci_resume(struct pci_dev *pdev)
+ 	}
+ 	DBGMSG("resume called");
  
--	fw_notify("sbp2_scsi_abort\n");
-+	fw_notify("%s: sbp2_scsi_abort\n", lu->tgt->bus_id);
- 	sbp2_agent_reset(lu);
- 	sbp2_cancel_orbs(lu);
+-/* PowerMac resume code comes first */
+-#ifdef CONFIG_PPC_PMAC
+-	if (machine_is(powermac)) {
+-		struct device_node *ofn = pci_device_to_OF_node(pdev);
+-
+-		if (ofn)
+-			pmac_call_feature(PMAC_FTR_1394_ENABLE, ofn, 0, 1);
+-	}
+-#endif /* CONFIG_PPC_PMAC */
+-
+-	pci_set_power_state(pdev, PCI_D0);
+-	pci_restore_state(pdev);
+-	err = pci_enable_device(pdev);
++	ohci1394_pmac_on(dev);
++	pci_set_power_state(dev, PCI_D0);
++	pci_restore_state(dev);
++	err = pci_enable_device(dev);
+ 	if (err) {
+ 		PRINT(KERN_ERR, "pci_enable_device failed with %d", err);
+ 		return err;
+diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
+index 37e7e10..3634785 100644
+--- a/drivers/ieee1394/raw1394.c
++++ b/drivers/ieee1394/raw1394.c
+@@ -2959,7 +2959,6 @@ MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
+ 
+ static struct hpsb_protocol_driver raw1394_driver = {
+ 	.name = "raw1394",
+-	.id_table = raw1394_id_table,
+ };
  
+ /******************************************************************************/
 diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
-index 28e155a..29e6663 100644
+index 9e2b196..29e6663 100644
 --- a/drivers/ieee1394/sbp2.c
 +++ b/drivers/ieee1394/sbp2.c
-@@ -183,6 +183,9 @@ MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device "
-  *   Avoids access beyond actual disk limits on devices with an off-by-one bug.
-  *   Don't use this with devices which don't have this bug.
-  *
-+ * - delay inquiry
-+ *   Wait extra SBP2_INQUIRY_DELAY seconds after login before SCSI inquiry.
-+ *
-  * - override internal blacklist
-  *   Instead of adding to the built-in blacklist, use only the workarounds
-  *   specified in the module load parameter.
-@@ -195,6 +198,7 @@ MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
- 	", 36 byte inquiry = "    __stringify(SBP2_WORKAROUND_INQUIRY_36)
- 	", skip mode page 8 = "   __stringify(SBP2_WORKAROUND_MODE_SENSE_8)
- 	", fix capacity = "       __stringify(SBP2_WORKAROUND_FIX_CAPACITY)
-+	", delay inquiry = "      __stringify(SBP2_WORKAROUND_DELAY_INQUIRY)
- 	", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
- 	", or a combination)");
- 
-@@ -357,6 +361,11 @@ static const struct {
- 		.workarounds		= SBP2_WORKAROUND_INQUIRY_36 |
- 					  SBP2_WORKAROUND_MODE_SENSE_8,
- 	},
-+	/* DViCO Momobay FX-3A with TSB42AA9A bridge */ {
-+		.firmware_revision	= 0x002800,
-+		.model_id		= 0x000000,
-+		.workarounds		= SBP2_WORKAROUND_DELAY_INQUIRY,
-+	},
- 	/* Initio bridges, actually only needed for some older ones */ {
- 		.firmware_revision	= 0x000200,
- 		.model_id		= SBP2_ROM_VALUE_WILDCARD,
-@@ -914,6 +923,9 @@ static int sbp2_start_device(struct sbp2_lu *lu)
- 	sbp2_agent_reset(lu, 1);
- 	sbp2_max_speed_and_size(lu);
- 
-+	if (lu->workarounds & SBP2_WORKAROUND_DELAY_INQUIRY)
-+		ssleep(SBP2_INQUIRY_DELAY);
-+
- 	error = scsi_add_device(lu->shost, 0, lu->ud->id, 0);
- 	if (error) {
- 		SBP2_ERR("scsi_add_device failed");
-@@ -1962,14 +1974,14 @@ static int sbp2scsi_slave_alloc(struct scsi_device *sdev)
- {
- 	struct sbp2_lu *lu = (struct sbp2_lu *)sdev->host->hostdata[0];
- 
-+	if (sdev->lun != 0 || sdev->id != lu->ud->id || sdev->channel != 0)
-+		return -ENODEV;
-+
+@@ -1980,11 +1980,8 @@ static int sbp2scsi_slave_alloc(struct scsi_device *sdev)
  	lu->sdev = sdev;
  	sdev->allow_restart = 1;
  
@@ -913,16 +1110,38 @@
  
  	if (lu->workarounds & SBP2_WORKAROUND_INQUIRY_36)
  		sdev->inquiry_len = 36;
-diff --git a/drivers/ieee1394/sbp2.h b/drivers/ieee1394/sbp2.h
-index d2ecb0d..80d8e09 100644
---- a/drivers/ieee1394/sbp2.h
-+++ b/drivers/ieee1394/sbp2.h
-@@ -343,6 +343,8 @@ enum sbp2lu_state_types {
- #define SBP2_WORKAROUND_INQUIRY_36	0x2
- #define SBP2_WORKAROUND_MODE_SENSE_8	0x4
- #define SBP2_WORKAROUND_FIX_CAPACITY	0x8
-+#define SBP2_WORKAROUND_DELAY_INQUIRY	0x10
-+#define SBP2_INQUIRY_DELAY		12
- #define SBP2_WORKAROUND_OVERRIDE	0x100
+diff --git a/drivers/ieee1394/video1394.c b/drivers/ieee1394/video1394.c
+index bd28adf..cc240b2 100644
+--- a/drivers/ieee1394/video1394.c
++++ b/drivers/ieee1394/video1394.c
+@@ -1315,8 +1315,7 @@ static struct ieee1394_device_id video1394_id_table[] = {
+ MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
+ 
+ static struct hpsb_protocol_driver video1394_driver = {
+-	.name		= VIDEO1394_DRIVER_NAME,
+-	.id_table	= video1394_id_table,
++	.name = VIDEO1394_DRIVER_NAME,
+ };
+ 
  
- #endif /* SBP2_H */
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 0796c1a..4e370e1 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -592,6 +592,16 @@ config LATENCYTOP
+ 	  Enable this option if you want to use the LatencyTOP tool
+ 	  to find out which userspace is blocking on what kernel operations.
+ 
++config FIREWIRE_OHCI_REMOTE_DMA
++	bool "Remote debugging via firewire-ohci"
++	depends on FIREWIRE_OHCI
++	help
++	  This option lets you use the FireWire bus for remote debugging.
++	  It enables unfiltered remote DMA in the firewire-ohci driver.
++	  See Documentation/debugging-via-ohci1394.txt for more information.
++
++	  If unsure, say N.
++
+ config PROVIDE_OHCI1394_DMA_INIT
+ 	bool "Provide code for enabling DMA over FireWire early on boot"
+ 	depends on PCI && X86

linux-2.6-silence-noise.patch:

Index: linux-2.6-silence-noise.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/linux-2.6-silence-noise.patch,v
retrieving revision 1.3.8.2
retrieving revision 1.3.8.3
diff -u -r1.3.8.2 -r1.3.8.3
--- linux-2.6-silence-noise.patch	29 Feb 2008 18:58:23 -0000	1.3.8.2
+++ linux-2.6-silence-noise.patch	5 Mar 2008 18:41:17 -0000	1.3.8.3
@@ -78,19 +78,24 @@
  	pci_restore_msi_state(dev);
 
 
---- linux-2.6.22.noarch/drivers/base/power/main.c~	2007-07-13 15:44:37.000000000 -0400
-+++ linux-2.6.22.noarch/drivers/base/power/main.c	2007-07-13 15:44:44.000000000 -0400
-@@ -37,6 +37,3 @@ int device_pm_add(struct device *dev)
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index d887d5c..80be564 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -64,9 +64,6 @@ int (*platform_enable_wakeup)(struct device *dev, int is_on);
+  */
+ void device_pm_add(struct device *dev)
  {
 -	pr_debug("PM: Adding info for %s:%s\n",
 -		 dev->bus ? dev->bus->name : "No Bus",
 -		 kobject_name(&dev->kobj));
  	mutex_lock(&dpm_list_mtx);
  	list_add_tail(&dev->power.entry, &dpm_active);
-@@ -51,9 +48,6 @@ int device_pm_add(struct device *dev)
- 			down(&dev->sem);
- 		}
- 	}
+ 	mutex_unlock(&dpm_list_mtx);
+@@ -80,9 +77,6 @@ void device_pm_add(struct device *dev)
+  */
+ void device_pm_remove(struct device *dev)
+ {
 -	pr_debug("PM: Removing info for %s:%s\n",
 -		 dev->bus ? dev->bus->name : "No Bus",
 -		 kobject_name(&dev->kobj));

linux-2.6-wireless-pending.patch:

View full diff with command:
/usr/bin/cvs -f diff  -kk -u -N -r 1.1.2.2 -r 1.1.2.3 linux-2.6-wireless-pending.patch
Index: linux-2.6-wireless-pending.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/Attic/linux-2.6-wireless-pending.patch,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -u -r1.1.2.2 -r1.1.2.3
--- linux-2.6-wireless-pending.patch	29 Feb 2008 18:58:23 -0000	1.1.2.2
+++ linux-2.6-wireless-pending.patch	5 Mar 2008 18:41:17 -0000	1.1.2.3
@@ -1,3 +1,260 @@
+commit e4861829072c61883114c64a3af61f305a789ff0
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Wed Feb 27 13:39:00 2008 +0100
+
+    mac80211: fix key replacing, hw accel
+    
+    Even though I thought about it a lot and had also tested it, some
+    of my recent changes in the key code broke replacing keys, making
+    the kernel oops because a key is removed from a list while not on
+    it.
+    
+    This patch fixes that using the list as an indication whether or
+    not the key is on it (an empty list means it's not on any list.)
+    
+    Also, this patch fixes hw accel enabling, the check for not doing
+    hw accel when the interface is down was lost and is restored by
+    this.
+    
+    Additionally, move adding the key to the list into the function
+    __ieee80211_key_replace() for more consistency.
+    
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit db4d1169d0b893bfb7923b6526748fe2c5a7373f
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Mon Feb 25 16:27:45 2008 +0100
+
+    mac80211: split ieee80211_key_alloc/free
+    
+    In order to RCU-ify sta_info, we need to be able to allocate
+    a key without linking it to an sdata/sta structure (because
+    allocation cannot be done in an rcu critical section). This
+    patch splits up ieee80211_key_alloc() and updates all users
+    appropriately.
+    
+    While at it, this patch fixes a number of race conditions
+    such as finally making key replacement atomic, unfortunately
+    at the expense of more complex code.
+    
+    Note that this patch documents /existing/ bugs with sta info
+    and key interaction, there is currently a race condition
+    when a sta info is freed without holding the RTNL. This will
+    finally be fixed by a followup patch.
+    
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit 6f48422a29714ed92f6136d9e7d3ff39c75607d7
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Mon Feb 25 16:27:44 2008 +0100
+
+    mac80211: remove STA infos last_ack stuff
+    
+    These things aren't used and the only possible use is within
+    rate control algorithms, however those can, if they need it,
+    keep track of it in their private data. last_ack_ms isn't
+    even updated so completely useless.
+    
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit e6a5ddf20886206caf1c4a2431f6ff01198ab0f7
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Mon Feb 25 16:27:42 2008 +0100
+
+    mac80211: safely free beacon in ieee80211_if_reinit
+    
+    If ieee80211_if_reinit() is called from ieee80211_unregister_hw()
+    then it is possible that the driver will still request a beacon
+    (it is allowed to until ieee80211_unregister_hw() has returned.)
+    This means we need to use an RCU-protected write to the beacon
+    information even in this function.
+    
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit 2485f7105f20f85c2dbebc67be6b2cb97175fa7e
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Mon Feb 25 16:27:41 2008 +0100
+
+    mac80211: clarify use of TX status/RX callbacks
+    
+    This patch clarifies the use of the irqsafe vs. non-irq-safe
+    functions and their respective locking requirements.
+    
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit 38c07b430b50172b803fe4c7f76cba580ba9931f
+Author: Pavel Roskin <proski at gnu.org>
+Date:   Tue Feb 26 17:59:14 2008 -0500
+
+    ath5k: fix all endian issues reported by sparse
+    
+    Changes-licensed-under: ISC
+    Signed-off-by: Pavel Roskin <proski at gnu.org>
+    Acked-by: Luis R. Rodriguez <mcgrof at winlab.rutgers.edu>
+    Acked-by: Nick Kossifidis <mickflemm at gmail.com>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit e6084239d39a10bac1186611fe7c523cea92c9ec
+Author: Ivo van Doorn <ivdoorn at gmail.com>
+Date:   Mon Feb 25 23:22:13 2008 +0100
+
+    rt2x00: Release rt2x00 2.1.3
+    
+    Signed-off-by: Ivo van Doorn <IvDoorn at gmail.com>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit 1497074ad79009f8fb465d795f9e0d2a428b7fa2
+Author: Ivo van Doorn <ivdoorn at gmail.com>
+Date:   Mon Feb 25 23:20:33 2008 +0100
+
+    rt2x00: Check for 5GHz band in link tuner
+    
+    Fix a typo in the link tuner where accidently the
+    2GHz band was checked instead of the 5GHz band.
+    This forced the link tuner to work in an invalid
+    range for the currently active band.
+    
+    Signed-off-by: Ivo van Doorn <IvDoorn at gmail.com>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit 58e307398317ab55470547a7d72859c89edd187d
+Author: Florian Fainelli <florian.fainelli at telecomint.eu>
+Date:   Mon Feb 25 17:51:53 2008 +0100
+
+    p54: print unknown eeprom fields
+    
+    This patch allows p54common to print the
+    uknown EEPROM fields, which can help
+    when debugging/testing devices.
+    
+    Signed-off-by: Florian Fainelli <florian.fainelli at telecomint.eu>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit 9a89c839f79395426b84cf6da9d56773402b4c0e
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Mon Feb 25 11:12:18 2008 +0100
+
+    adm8211: fix cfg80211 band API conversion
+    
+    Insert a missing band assignment.
+    
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit 8f300ae5b819f7655197925cdb1954edfd906a87
+Author: Michael Buesch <mb at bu3sch.de>
+Date:   Sun Feb 24 14:42:29 2008 +0100
+
+    b43legacy: Fix nondebug build
+    
+    Fix a typo.
+    
+    Signed-off-by: Michael Buesch <mb at bu3sch.de>
+    Acked-by: Stefano Brivio <stefano.brivio at polimi.it>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit 28de57d1a9eb7e67badb731297197fcbef0cc19e
+Author: Aurelien Jarno <aurelien at aurel32.net>
+Date:   Fri Feb 22 16:14:58 2008 +0100
+
+    ssb: Add CHIPCO IRQ access functions
+    
+    This patch adds functions to setup and read the CHIPCO IRQ.
+    
+    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>
+    Signed-off-by: Michael Buesch <mb at bu3sch.de>
+    Signed-off-by: John W. Linville <linville at tuxdriver.com>
+
+commit fba4a1e63723b5ef16c21a90f06520ae37c5da98
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Thu Feb 21 11:08:33 2008 +0100
+
+    mac80211: fix IBSS code
+    
+    This patch fixes two errors introduced by
+    
+        commit 19d35612f3cd7f60dd9174c0100584e21f5a1025
+        Author: Bruno Randolf <bruno at thinktube.com>
+        Date:   Mon Feb 18 11:21:36 2008 +0900
+    
+            mac80211: enable IBSS merging
+    
+    The first error is an endianness problem that sparse found and
+    the second is a build failure when CONFIG_MAC80211_IBSS_DEBUG
+    is not set.
+    
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
[...5319 lines suppressed...]
  		 * its 14 bytes. Note we use the control rate and not the
-@@ -533,7 +532,7 @@ static inline void ath5k_hw_write_rate_d
+ 		 * actual rate for this rate. See mac80211 tx.c
  		 * ieee80211_duration() for a brief description of
  		 * what rate we should choose to TX ACKs. */
- 		tx_time = ieee80211_generic_frame_duration(sc->hw,
+-		tx_time = ieee80211_generic_frame_duration(sc->hw,
 -			sc->vif, 10, control_rate->rate_kbps/100);
-+			sc->vif, 10, &srate);
++		tx_time = le16_to_cpu(ieee80211_generic_frame_duration(sc->hw,
++							sc->vif, 10, &srate));
  
  		ath5k_hw_reg_write(ah, tx_time, reg);
  
@@ -32056,8 +33353,8 @@
  
  /****************\
 diff -up linux-2.6.24.noarch/drivers/net/wireless/ath5k/initvals.c.orig linux-2.6.24.noarch/drivers/net/wireless/ath5k/initvals.c
---- linux-2.6.24.noarch/drivers/net/wireless/ath5k/initvals.c.orig	2008-02-21 14:01:26.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/initvals.c	2008-02-21 14:02:20.000000000 -0500
+--- linux-2.6.24.noarch/drivers/net/wireless/ath5k/initvals.c.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/initvals.c	2008-03-04 19:35:36.000000000 -0500
 @@ -1317,8 +1317,10 @@ int ath5k_hw_write_initvals(struct ath5k
  	/* For AR5211 */
  	} else if (ah->ah_version == AR5K_AR5211) {
@@ -32072,8 +33369,8 @@
  		}
  
 diff -up /dev/null linux-2.6.24.noarch/drivers/net/wireless/ath5k/Kconfig
---- /dev/null	2008-02-21 08:21:48.545426467 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/Kconfig	2008-02-21 14:02:20.000000000 -0500
+--- /dev/null	2008-03-04 08:34:47.546307750 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/Kconfig	2008-03-04 19:35:36.000000000 -0500
 @@ -0,0 +1,37 @@
 +config ATH5K
 +	tristate "Atheros 5xxx wireless cards support"
@@ -32113,8 +33410,8 @@
 +	  modprobe ath5k debug=0x00000400
 +
 diff -up linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.c.orig linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.c
---- linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.c.orig	2008-02-21 14:01:26.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.c	2008-02-21 14:02:20.000000000 -0500
+--- linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.c.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.c	2008-03-04 19:35:36.000000000 -0500
 @@ -80,7 +80,7 @@ MODULE_AUTHOR("Nick Kossifidis");
  MODULE_DESCRIPTION("Support for 5xxx series of Atheros 802.11 wireless LAN cards.");
  MODULE_SUPPORTED_DEVICE("Atheros 5xxx WLAN cards");
@@ -32641,6 +33938,30 @@
  	if (ret)
  		goto err_unmap;
  
+@@ -1660,11 +1717,11 @@ ath5k_check_ibss_hw_merge(struct ath5k_s
+ 	u32 hw_tu;
+ 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
+ 
+-	if ((mgmt->frame_control & IEEE80211_FCTL_FTYPE) ==
++	if ((le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_FTYPE) ==
+ 		IEEE80211_FTYPE_MGMT &&
+-	    (mgmt->frame_control & IEEE80211_FCTL_STYPE) ==
++	    (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) ==
+ 		IEEE80211_STYPE_BEACON &&
+-	    mgmt->u.beacon.capab_info & WLAN_CAPABILITY_IBSS &&
++	    le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS &&
+ 	    memcmp(mgmt->bssid, sc->ah->ah_bssid, ETH_ALEN) == 0) {
+ 		/*
+ 		 * Received an IBSS beacon with the same BSSID. Hardware might
+@@ -1673,7 +1730,7 @@ ath5k_check_ibss_hw_merge(struct ath5k_s
+ 		hw_tu = TSF_TO_TU(ath5k_hw_get_tsf64(sc->ah));
+ 		if (hw_tu >= sc->nexttbtt) {
+ 			ath5k_beacon_update_timers(sc,
+-				mgmt->u.beacon.timestamp);
++				le64_to_cpu(mgmt->u.beacon.timestamp));
+ 			ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON,
+ 				"detected HW merge from received beacon\n");
+ 		}
 @@ -1791,9 +1848,8 @@ accept:
  		rxs.mactime = ath5k_extend_tsf(sc->ah, ds->ds_rxstat.rs_tstamp);
  		rxs.flag |= RX_FLAG_TSFT;
@@ -32760,8 +34081,8 @@
  	case ALG_CCMP:
  		return -EOPNOTSUPP;
 diff -up linux-2.6.24.noarch/drivers/net/wireless/ath5k/debug.c.orig linux-2.6.24.noarch/drivers/net/wireless/ath5k/debug.c
---- linux-2.6.24.noarch/drivers/net/wireless/ath5k/debug.c.orig	2008-02-21 14:01:26.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/debug.c	2008-02-21 14:02:20.000000000 -0500
+--- linux-2.6.24.noarch/drivers/net/wireless/ath5k/debug.c.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/debug.c	2008-03-04 19:35:36.000000000 -0500
 @@ -65,7 +65,7 @@ static unsigned int ath5k_debug;
  module_param_named(debug, ath5k_debug, uint, 0);
  
@@ -32851,8 +34172,8 @@
 -#endif /* if ATH5K_DEBUG */
 +#endif /* ifdef CONFIG_ATH5K_DEBUG */
 diff -up linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.h.orig linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.h
---- linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.h.orig	2008-02-21 14:01:26.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.h	2008-02-21 14:02:20.000000000 -0500
+--- linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.h.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/ath5k/base.h	2008-03-04 19:35:36.000000000 -0500
 @@ -83,7 +83,7 @@ struct ath5k_txq {
  #if CHAN_DEBUG
  #define ATH_CHAN_MAX	(26+26+26+200+200)
@@ -32898,8 +34219,8 @@
  
  #define ath5k_hw_hasbssidmask(_ah) \
 diff -up linux-2.6.24.noarch/drivers/net/wireless/rtl8180_max2820.c.orig linux-2.6.24.noarch/drivers/net/wireless/rtl8180_max2820.c
---- linux-2.6.24.noarch/drivers/net/wireless/rtl8180_max2820.c.orig	2008-02-21 14:01:26.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rtl8180_max2820.c	2008-02-21 14:02:20.000000000 -0500
+--- linux-2.6.24.noarch/drivers/net/wireless/rtl8180_max2820.c.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/rtl8180_max2820.c	2008-03-04 19:35:36.000000000 -0500
 @@ -78,8 +78,9 @@ static void max2820_rf_set_channel(struc
  				   struct ieee80211_conf *conf)
  {
@@ -32913,8 +34234,8 @@
  
  	/* While philips SA2400 drive the PA bias from
 diff -up linux-2.6.24.noarch/drivers/net/wireless/adm8211.c.orig linux-2.6.24.noarch/drivers/net/wireless/adm8211.c
---- linux-2.6.24.noarch/drivers/net/wireless/adm8211.c.orig	2008-02-21 14:01:26.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/adm8211.c	2008-02-21 14:05:08.000000000 -0500
+--- linux-2.6.24.noarch/drivers/net/wireless/adm8211.c.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/adm8211.c	2008-03-04 19:35:36.000000000 -0500
 @@ -48,6 +48,32 @@ static struct pci_device_id adm8211_pci_
  	{ 0 }
  };
@@ -33066,25 +34387,26 @@
  	dev->queues = 1; /* ADM8211C supports more, maybe ADM8211B too */
  
  	priv->retry_limit = 3;
-@@ -1917,14 +1930,7 @@ static int __devinit adm8211_probe(struc
+@@ -1917,14 +1930,9 @@ static int __devinit adm8211_probe(struc
  		goto err_free_desc;
  	}
  
 -	priv->channel = priv->modes[0].channels[0].chan;
--
++	priv->channel = 1;
+ 
 -	err = ieee80211_register_hwmode(dev, &priv->modes[0]);
 -	if (err) {
 -		printk(KERN_ERR "%s (adm8211): Can't register hwmode\n",
 -		       pci_name(pdev));
 -		goto err_free_desc;
 -	}
-+	priv->channel = 1;
++	dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
  
  	err = ieee80211_register_hw(dev);
  	if (err) {
 diff -up linux-2.6.24.noarch/drivers/ssb/pcmcia.c.orig linux-2.6.24.noarch/drivers/ssb/pcmcia.c
---- linux-2.6.24.noarch/drivers/ssb/pcmcia.c.orig	2008-02-21 13:44:10.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/ssb/pcmcia.c	2008-02-21 14:05:08.000000000 -0500
+--- linux-2.6.24.noarch/drivers/ssb/pcmcia.c.orig	2008-03-04 19:28:32.000000000 -0500
++++ linux-2.6.24.noarch/drivers/ssb/pcmcia.c	2008-03-04 19:35:36.000000000 -0500
 @@ -172,6 +172,22 @@ static int select_core_and_segment(struc
  	return 0;
  }
@@ -33141,8 +34463,8 @@
  	.write32	= ssb_pcmcia_write32,
  };
 diff -up linux-2.6.24.noarch/drivers/ssb/main.c.orig linux-2.6.24.noarch/drivers/ssb/main.c
---- linux-2.6.24.noarch/drivers/ssb/main.c.orig	2008-02-21 14:00:25.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/ssb/main.c	2008-02-21 14:05:08.000000000 -0500
+--- linux-2.6.24.noarch/drivers/ssb/main.c.orig	2008-03-04 19:28:32.000000000 -0500
++++ linux-2.6.24.noarch/drivers/ssb/main.c	2008-03-04 19:35:36.000000000 -0500
 @@ -505,6 +505,14 @@ error:
  	return err;
  }
@@ -33185,8 +34507,8 @@
  	.write32	= ssb_ssb_write32,
  };
 diff -up linux-2.6.24.noarch/drivers/ssb/pci.c.orig linux-2.6.24.noarch/drivers/ssb/pci.c
---- linux-2.6.24.noarch/drivers/ssb/pci.c.orig	2008-02-21 13:44:10.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/ssb/pci.c	2008-02-21 14:05:08.000000000 -0500
+--- linux-2.6.24.noarch/drivers/ssb/pci.c.orig	2008-03-04 19:28:32.000000000 -0500
++++ linux-2.6.24.noarch/drivers/ssb/pci.c	2008-03-04 19:35:36.000000000 -0500
 @@ -572,6 +572,19 @@ static inline int ssb_pci_assert_buspowe
  }
  #endif /* DEBUG */
@@ -33238,3 +34560,23 @@
  	.write16	= ssb_pci_write16,
  	.write32	= ssb_pci_write32,
  };
+diff -up linux-2.6.24.noarch/drivers/ssb/driver_chipcommon.c.orig linux-2.6.24.noarch/drivers/ssb/driver_chipcommon.c
+--- linux-2.6.24.noarch/drivers/ssb/driver_chipcommon.c.orig	2008-03-04 19:28:32.000000000 -0500
++++ linux-2.6.24.noarch/drivers/ssb/driver_chipcommon.c	2008-03-04 19:35:36.000000000 -0500
+@@ -353,6 +353,16 @@ void ssb_chipco_watchdog_timer_set(struc
+ 	chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
+ }
+ 
++void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value)
++{
++	chipco_write32_masked(cc, SSB_CHIPCO_IRQMASK, mask, value);
++}
++
++u32 ssb_chipco_irq_status(struct ssb_chipcommon *cc, u32 mask)
++{
++	return chipco_read32(cc, SSB_CHIPCO_IRQSTAT) & mask;
++}
++
+ u32 ssb_chipco_gpio_in(struct ssb_chipcommon *cc, u32 mask)
+ {
+ 	return chipco_read32(cc, SSB_CHIPCO_GPIOIN) & mask;

linux-2.6-wireless.patch:

Index: linux-2.6-wireless.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/linux-2.6-wireless.patch,v
retrieving revision 1.2.8.2
retrieving revision 1.2.8.3
diff -u -r1.2.8.2 -r1.2.8.3
--- linux-2.6-wireless.patch	29 Feb 2008 18:58:23 -0000	1.2.8.2
+++ linux-2.6-wireless.patch	5 Mar 2008 18:41:17 -0000	1.2.8.3
@@ -1,706 +1,391 @@
-commit c2893054cc823e05c723114378244c8caba084c0
-Author: Alexey Zaytsev <alexey.zaytsev at gmail.com>
-Date:   Sat Feb 23 13:33:07 2008 +0300
-
-    Don't build bcm43xx if SSB is static and b43 PCI-SSB bridge is enabled.
-    
-    This may happen e.g. when the ssb is statically enables by the b44 driver,
-    and the b43 pci-ssb bridge is enbled by the b43/b43legacy drivers, or the
-    b43/b43legacy drivers are built statically.
-    
-    Signed-off-by: Alexey Zaytsev <alexey.zaytsev at gmail.com>
-    Acked-by: Larry Finger <Larry.Finger at lwfinger.net>
-    Signed-off-by: John W. Linville <linville at tuxdriver.com>
-
-commit 82928757f3e9451c1ae520f46d327d6110a4eec1
-Author: Alexey Zaytsev <alexey.zaytsev at gmail.com>
-Date:   Sat Feb 23 12:59:26 2008 +0300
+commit c256e05b7b30fab484deacb4f8cff59ce649c75e
+Author: Michael Buesch <mb at bu3sch.de>
+Date:   Tue Mar 4 20:31:13 2008 +0100
 
-    Use a separate config option for the b43 pci to ssb bridge.
+    b43legacy: Fix module init message
     
-    The bridge code was unnecessary enabled by the b44
-    driver, but it prevents the bcm43xx driver from
-    being loaded, as the bridge claims the same pci ids.
+    This fixes the module init message to tell that the legacy
+    driver loaded. This makes it less confusing, in case both drivers are loaded.
     
-    Now we enable the birdge only if the b43{legacy}
-    drivers are selected.
-    
-    Signed-off-by: Alexey Zaytsev <alexey.zaytsev at gmail.com>
-    Acked-by: Larry Finger <Larry.Finger at lwfinger.net>
+    Signed-off-by: Michael Buesch <mb at bu3sch.de>
     Signed-off-by: John W. Linville <linville at tuxdriver.com>
 
-commit e668b6729ca1c7f88c7ea1789fb0ed4503c384ce
-Author: Roland Dreier <rdreier at cisco.com>
-Date:   Tue Feb 26 15:26:56 2008 +0100
+commit cdb2a9fe63575dd1eb82b724bbd0aa5e0dd89fa0
+Author: Jussi Kivilinna <jussi.kivilinna at mbnet.fi>
+Date:   Tue Mar 4 20:05:27 2008 +0200
 
-    libertas: Remove unused exports
-    
-    The libertas driver exports a number of symbols with no in-tree users;
-    remove these unused exports.  lbs_reset_device() is completely unused, with
-    no callers at all, so remove the function completely.
+    rndis_wlan: fix broken data copy
     
-    A couple of these unused exported symbols are static, which causes the
-    following build error on ia64 with gcc 4.2.3:
+    Replace broken code that attempted to copy 6 byte array to 64-bit
+    integer. Due to missing cast to 64-bit integer, left shift operation
+    were 32-bit and lead to bytes been copied over each other. New code
+    uses simple memcpy, for greater readability and efficiency.
     
-        drivers/net/wireless/libertas/main.c:1375: error: __ksymtab_lbs_remove_mesh causes a section type conflict
-        drivers/net/wireless/libertas/main.c:1354: error: __ksymtab_lbs_add_mesh causes a section type conflict
-    
-    Signed-off-by: Roland Dreier <rolandd at cisco.com>
-    Acked-by: Holger Schurig <hs4233 at mail.mn-solutions.de>
-    Acked-by: Dan Williams <dcbw at redhat.com>
+    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at mbnet.fi>
     Signed-off-by: John W. Linville <linville at tuxdriver.com>
 
-commit 7e0a589e4de9278215da894ba8e41ba0943e7aca
-Author: Johannes Berg <johannes at sipsolutions.net>
-Date:   Tue Feb 26 00:39:28 2008 +0100
+commit 8a96df80b3ddb2410045a26ea19eeccb5f2d2d11
+Author: Sebastian Siewior <bigeasy at tglx.de>
+Date:   Tue Mar 4 18:22:27 2008 +0100
 
-    mac80211: fix kmalloc vs. net_ratelimit
+    libertas: compare the current command with response
     
-    The "goto end;" part definitely must not be rate limited.
+    instead of with itself.
     
-    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Signed-off-by: Sebastian Siewior <bigeasy at linutronix.de>
     Signed-off-by: John W. Linville <linville at tuxdriver.com>
 
-commit 702ebfa36437c98a60ea21ac2a18b159e6aa16c6
-Author: Ivo van Doorn <ivdoorn at gmail.com>
-Date:   Mon Feb 25 23:15:13 2008 +0100
+commit 6305f498604df6c66bdb4cc533ce6332fa5ab61f
+Author: David Woodhouse <dwmw2 at infradead.org>
+Date:   Mon Mar 3 12:20:12 2008 +0100
 
-    rt2x00: Fix rt2x00lib_reset_link_tuner()
-    
-    rt2x00lib_reset_link_tuner() can be called from within
-    the link tuner itself. This means that it should
-    _not_ call rt2x00lib_stop_link_tuner() since that will
-    cause the thread to hang.
+    libertas: fix sanity check on sequence number in command response
     
-    Reorder the things that should be done during a
-    link tuner reset and during a link tuner start.
+    Slightly more useful if we compare it against the sequence number of the
+    command we have outstanding, rather than comparing the reply with itself.
     
-    Also make antenna tuning the last step of the link
-    tuner since it could possibly reset some statistical
-    information which we need for average calculation.
+    Doh. Pointed out by Sebastian Siewior
     
-    Signed-off-by: Ivo van Doorn <IvDoorn at gmail.com>
+    Signed-off-by: David Woodhouse <dwmw2 at infradead.org>
+    Acked-by: Dan Williams <dcbw at redhat.com>
     Signed-off-by: John W. Linville <linville at tuxdriver.com>
 
-commit 4460423f7cd0e1c5c0cf92e6159f151ba16e518f
-Author: Ivo van Doorn <ivdoorn at gmail.com>
-Date:   Mon Feb 25 23:15:08 2008 +0100
+commit c2f2d3a06f8b628d444cf4f396d6c6ddd47e1d1f
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Fri Feb 29 23:28:25 2008 +0100
 
-    rt2x00: Don't switch to antenna with low rssi
-    
-    When rssi_a > rssi_b is true and the current antenna
-    was already antenna A, then rt2x00 incorrectly jumped
-    to antenna B.
+    p54: fix eeprom parser length sanity checks
     
-    Also don't configure the antenna when there has been
-    no change in the antenna setup.
-    
-    Signed-off-by: Ivo van Doorn <IvDoorn at gmail.com>
-    Signed-off-by: John W. Linville <linville at tuxdriver.com>
-
-commit 50cbbe9cf17c52588a6b709273547c93b7c3d329
-Author: Ivo van Doorn <ivdoorn at gmail.com>
-Date:   Mon Feb 25 23:15:05 2008 +0100
-
-    rt2x00: Add link tuner safe RX toggle states
-    
-    This adds 2 new states which both are used to toggle
-    the RX. These new states are required for usage
-    inside the link tuner thread, because the normal
-    RX toggling will stop the link tuner thread.
-    While it is possible that the link tuner thread itself
-    is the caller of the RX toggle (when using software
-    antenna diversity).
+    When I called p54_parse_eeprom() on a hand-coded structure
+    I managed to make a small mistake with wrap->len which caused
+    a segfault a few lines down when trying to read entry->len.
+    This patch changes the validation code to avoid such problems.
     
-    Signed-off-by: Ivo van Doorn <IvDoorn at gmail.com>
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Tested-by: Florian Fainelli <florian.fainelli at telecomint.eu>
     Signed-off-by: John W. Linville <linville at tuxdriver.com>
 
-commit b268ed34199317e1c627106f1bc60317f2d5c44c
-Author: Ivo van Doorn <ivdoorn at gmail.com>
-Date:   Mon Feb 25 23:15:01 2008 +0100
+commit 8c28293f5514f64ba064bac7946aebeda4a663c6
+Author: Johannes Berg <johannes at sipsolutions.net>
+Date:   Fri Feb 29 13:56:33 2008 +0100
 
-    rt2x00: Fix antenna diversity
-    
-    Fix 2 issues in antenna diversity selection.
-    
-    1) the following statement will always return true.
-    	if ((rssi_curr - rssi_old) > -5 || (rssi_curr - rssi_old) < 5)
-    It is cleaner to check if the absolute value is smaller then 5.
+    p54: fix EEPROM structure endianness
     
-    2) Only enable software diversity when default antenna setup
-    indicates support for it. Don't select it when the hardware
-    does not indicate support for it...
+    Since the EEPROM structure is read from hardware, it is
+    always little endian, annotate that in the struct and
+    make sure to convert where applicable.
     
-    Signed-off-by: Ivo van Doorn <IvDoorn at gmail.com>
-    Signed-off-by: John W. Linville <linville at tuxdriver.com>
-
-commit 57b7ed05c7e68e1b14cc7da232cba2967fb670a7
-Author: Sebastian Siewior <linux+wireless at ml.breakpoint.cc>
-Date:   Sat Feb 23 21:46:31 2008 +0100
-
-    gelic wireless driver needs WIRELESS_EXT support
-    
-    |   CC      drivers/net/ps3_gelic_wireless.o
-    | /home/bigeasy/git/linux-2.6/drivers/net/ps3_gelic_wireless.c: In function 'gelic_wl_setup_netdev_ops':
-    | /home/bigeasy/git/linux-2.6/drivers/net/ps3_gelic_wireless.c:2660: error: 'struct net_device' has no member named 'wireless_data'
-    | /home/bigeasy/git/linux-2.6/drivers/net/ps3_gelic_wireless.c:2661: error: 'struct net_device' has no member named 'wireless_handlers'
-    | make[3]: *** [drivers/net/ps3_gelic_wireless.o] Error 1
-    | make[2]: *** [drivers/net] Error 2
-    | make[1]: *** [drivers] Error 2
-    | make[1]: *** Waiting for unfinished jobs....
-    | make: *** [sub-make] Error 2
-    
-    Signed-off-by: Sebastian Siewior <sebastian at breakpoint.cc>
-    Acked-by: Masakazu Mokuno <mokuno at sm.sony.co.jp>
+    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
+    Cc: Michael Wu <flamingice at sourmilk.net>
+    Tested-by: Florian Fainelli <florian.fainelli at telecomint.eu>
     Signed-off-by: John W. Linville <linville at tuxdriver.com>
 
-commit 3da83bba86f2aef628919469db5707db6a785868
-Author: Masakazu Mokuno <mokuno at sm.sony.co.jp>
-Date:   Fri Feb 22 16:45:26 2008 +0900
+commit dc63644b0ee3b447e879ef8e124657b40e9ea81c
+Author: Yoichi Yuasa <yoichi_yuasa at tripeaks.co.jp>
+Date:   Fri Feb 29 11:09:31 2008 +0100
 
-    PS3: gelic: Link the wireless net_device structure to the corresponding device structure
-    
-    Link the net_device structure of the wireless part to the
-    corresponding device structure.
+    ssb: Add pcibios_enable_device() return value check
     
-    Without this, the sysfs node for this net_device would not have
-    'device' link.
+    This patch has added pcibios_enable_device() return value check.
     
-    Signed-off-by: Masakazu Mokuno <mokuno at sm.sony.co.jp>
-    Acked-by: Dan Williams <dcbw at redhat.com>
+    Signed-off-by: Yoichi Yuasa <yoichi_yuasa at tripeaks.co.jp>
+    Signed-off-by: Michael Buesch <mb at bu3sch.de>
     Signed-off-by: John W. Linville <linville at tuxdriver.com>
 
-commit 04d0a24457e249388ec3ee32b345617d1bc6ebf2
-Author: Johannes Berg <johannes at sipsolutions.net>
-Date:   Wed Feb 20 11:47:45 2008 +0100
+commit 1d60ab0574fae362b1cca0ef52181ef75fd46832
+Author: Stefano Brivio <stefano.brivio at polimi.it>
+Date:   Sun Mar 2 11:33:10 2008 +0100
 
-    rndis_wlan: fix sparse warnings
+    rc80211-pid: fix rate adjustment
     
-    It is obviously wrong to use an enum in a little endian struct,
-    and those other enums should be declared differently.
+    Merge rate_control_pid_shift_adjust() to rate_control_pid_adjust_rate()
+    in order to make the learning algorithm aware of constraints on rates. Also
+    add some comments and rename variables.
     
-    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
-    Acked-by: Jussi Kivilinna <jussi.kivilinna at mbnet.fi>
-    Signed-off-by: John W. Linville <linville at tuxdriver.com>
-
-commit 7672b302058148f0e9a4a2be36c851510ff9cb88
-Author: Gordon Farquharson <gordonfarquharson at gmail.com>
-Date:   Sat Feb 23 03:14:23 2008 -0700
-
-    Fix b43 driver build for arm
-    
-    Align the members of the SSB device structure to a 32 bit boundary so
-    that the b43 driver can be built for arm using a cross compiler. This
-    alignment is required so that the test in scripts/mod/file2alias.c
-    that checks that the size of the device ID type against the size of
-    the section in the object file succeeds (see comment and
-    http://lkml.org/lkml/2008/2/18/481 for explanation).
+    This fixes a bug which prevented 802.11b/g non-AP STAs from working with
+    802.11b only AP STAs.
     
-    Signed-off-by: Gordon Farquharson <gordonfarquharson at gmail.com>
-    Acked-by: Michael Buesch <mb at bu3sch.de>
+    This patch was originally destined for 2.6.26, and is being backported
+    to fix a user reported problem in post-2.6.24 kernels.
+    
+    Signed-off-by: Stefano Brivio <stefano.brivio at polimi.it>
     Signed-off-by: John W. Linville <linville at tuxdriver.com>
 
-diff -up linux-2.6.24.noarch/include/linux/mod_devicetable.h.orig linux-2.6.24.noarch/include/linux/mod_devicetable.h
---- linux-2.6.24.noarch/include/linux/mod_devicetable.h.orig	2008-02-27 20:46:37.000000000 -0500
-+++ linux-2.6.24.noarch/include/linux/mod_devicetable.h	2008-02-27 20:47:51.000000000 -0500
-@@ -351,7 +351,13 @@ struct sdio_device_id {
- struct ssb_device_id {
- 	__u16	vendor;
- 	__u16	coreid;
--	__u8	revision;
-+	/* Explicit padding to support a broken sanity check in file2alias.c.
-+	 * The check compares the size of the structure in the kernel
-+	 * object file to the size of the structure reported in userspace for
-+	 * the system on which the kernel is compiled. The check breaks on
-+	 * cross-compilation, and the padding is a workaround for this. */
-+	__u8	revision
-+		__attribute__((aligned(sizeof(__u32))));
- };
- #define SSB_DEVICE(_vendor, _coreid, _revision)  \
- 	{ .vendor = _vendor, .coreid = _coreid, .revision = _revision, }
-diff -up linux-2.6.24.noarch/net/mac80211/ieee80211_sta.c.orig linux-2.6.24.noarch/net/mac80211/ieee80211_sta.c
---- linux-2.6.24.noarch/net/mac80211/ieee80211_sta.c.orig	2008-02-27 20:46:37.000000000 -0500
-+++ linux-2.6.24.noarch/net/mac80211/ieee80211_sta.c	2008-02-27 20:47:51.000000000 -0500
-@@ -1116,9 +1116,10 @@ static void ieee80211_sta_process_addba_
- 	/* prepare reordering buffer */
- 	tid_agg_rx->reorder_buf =
- 		kmalloc(buf_size * sizeof(struct sk_buf *), GFP_ATOMIC);
--	if ((!tid_agg_rx->reorder_buf) && net_ratelimit()) {
--		printk(KERN_ERR "can not allocate reordering buffer "
--						"to tid %d\n", tid);
-+	if (!tid_agg_rx->reorder_buf) {
-+		if (net_ratelimit())
-+			printk(KERN_ERR "can not allocate reordering buffer "
-+			       "to tid %d\n", tid);
- 		goto end;
- 	}
- 	memset(tid_agg_rx->reorder_buf, 0,
-diff -up linux-2.6.24.noarch/drivers/net/ps3_gelic_wireless.c.orig linux-2.6.24.noarch/drivers/net/ps3_gelic_wireless.c
---- linux-2.6.24.noarch/drivers/net/ps3_gelic_wireless.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/ps3_gelic_wireless.c	2008-02-27 20:47:51.000000000 -0500
-@@ -2690,6 +2690,7 @@ int gelic_wl_driver_probe(struct gelic_c
- 		return -ENOMEM;
- 
- 	/* setup net_device structure */
-+	SET_NETDEV_DEV(netdev, &card->dev->core);
- 	gelic_wl_setup_netdev_ops(netdev);
- 
- 	/* setup some of net_device and register it */
-diff -up linux-2.6.24.noarch/drivers/net/Kconfig.orig linux-2.6.24.noarch/drivers/net/Kconfig
---- linux-2.6.24.noarch/drivers/net/Kconfig.orig	2008-02-27 20:46:43.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/Kconfig	2008-02-27 20:47:51.000000000 -0500
-@@ -2374,6 +2374,7 @@ config GELIC_NET
- config GELIC_WIRELESS
-        bool "PS3 Wireless support"
-        depends on GELIC_NET
-+       select WIRELESS_EXT
-        help
-         This option adds the support for the wireless feature of PS3.
-         If you have the wireless-less model of PS3 or have no plan to
-diff -up linux-2.6.24.noarch/drivers/net/wireless/b43/Kconfig.orig linux-2.6.24.noarch/drivers/net/wireless/b43/Kconfig
---- linux-2.6.24.noarch/drivers/net/wireless/b43/Kconfig.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/b43/Kconfig	2008-02-27 20:47:51.000000000 -0500
-@@ -32,6 +32,7 @@ config B43_PCI_AUTOSELECT
- 	bool
- 	depends on B43 && SSB_PCIHOST_POSSIBLE
- 	select SSB_PCIHOST
-+	select SSB_B43_PCI_BRIDGE
- 	default y
- 
- # Auto-select SSB PCICORE driver, if possible
-diff -up linux-2.6.24.noarch/drivers/net/wireless/b43legacy/Kconfig.orig linux-2.6.24.noarch/drivers/net/wireless/b43legacy/Kconfig
---- linux-2.6.24.noarch/drivers/net/wireless/b43legacy/Kconfig.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/b43legacy/Kconfig	2008-02-27 20:47:51.000000000 -0500
-@@ -25,6 +25,7 @@ config B43LEGACY_PCI_AUTOSELECT
- 	bool
- 	depends on B43LEGACY && SSB_PCIHOST_POSSIBLE
- 	select SSB_PCIHOST
-+	select SSB_B43_PCI_BRIDGE
- 	default y
- 
- # Auto-select SSB PCICORE driver, if possible
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rndis_wlan.c.orig linux-2.6.24.noarch/drivers/net/wireless/rndis_wlan.c
---- linux-2.6.24.noarch/drivers/net/wireless/rndis_wlan.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rndis_wlan.c	2008-02-27 20:47:51.000000000 -0500
-@@ -228,9 +228,9 @@ struct NDIS_WLAN_BSSID_EX {
- 	struct NDIS_802_11_SSID Ssid;
- 	__le32 Privacy;
- 	__le32 Rssi;
--	enum NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
-+	__le32 NetworkTypeInUse;
- 	struct NDIS_802_11_CONFIGURATION Configuration;
--	enum NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
-+	__le32 InfrastructureMode;
- 	u8 SupportedRates[NDIS_802_11_LENGTH_RATES_EX];
- 	__le32 IELength;
- 	u8 IEs[0];
-@@ -279,11 +279,11 @@ struct RNDIS_CONFIG_PARAMETER_INFOBUFFER
- } __attribute__((packed));
+diff -up linux-2.6.24.noarch/net/mac80211/rc80211_pid_algo.c.orig linux-2.6.24.noarch/net/mac80211/rc80211_pid_algo.c
+--- linux-2.6.24.noarch/net/mac80211/rc80211_pid_algo.c.orig	2008-03-04 19:28:35.000000000 -0500
++++ linux-2.6.24.noarch/net/mac80211/rc80211_pid_algo.c	2008-03-04 19:30:56.000000000 -0500
+@@ -2,7 +2,7 @@
+  * Copyright 2002-2005, Instant802 Networks, Inc.
+  * Copyright 2005, Devicescape Software, Inc.
+  * Copyright 2007, Mattias Nissler <mattias.nissler at gmx.de>
+- * Copyright 2007, Stefano Brivio <stefano.brivio at polimi.it>
++ * Copyright 2007-2008, Stefano Brivio <stefano.brivio at polimi.it>
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License version 2 as
+@@ -63,72 +63,66 @@
+  * RC_PID_ARITH_SHIFT.
+  */
  
- /* these have to match what is in wpa_supplicant */
--enum { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP } wpa_alg;
--enum { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP, CIPHER_WEP104 }
--	wpa_cipher;
--enum { KEY_MGMT_802_1X, KEY_MGMT_PSK, KEY_MGMT_NONE, KEY_MGMT_802_1X_NO_WPA,
--	KEY_MGMT_WPA_NONE } wpa_key_mgmt;
-+enum wpa_alg { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP };
-+enum wpa_cipher { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP,
-+		  CIPHER_WEP104 };
-+enum wpa_key_mgmt { KEY_MGMT_802_1X, KEY_MGMT_PSK, KEY_MGMT_NONE,
-+		    KEY_MGMT_802_1X_NO_WPA, KEY_MGMT_WPA_NONE };
- 
- /*
-  *  private data
-diff -up linux-2.6.24.noarch/drivers/net/wireless/libertas/main.c.orig linux-2.6.24.noarch/drivers/net/wireless/libertas/main.c
---- linux-2.6.24.noarch/drivers/net/wireless/libertas/main.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/libertas/main.c	2008-02-27 20:47:51.000000000 -0500
-@@ -1351,8 +1351,6 @@ done:
- 	lbs_deb_leave_args(LBS_DEB_MESH, "ret %d", ret);
- 	return ret;
- }
--EXPORT_SYMBOL_GPL(lbs_add_mesh);
 -
- 
- static void lbs_remove_mesh(struct lbs_private *priv)
- {
-@@ -1372,7 +1370,6 @@ static void lbs_remove_mesh(struct lbs_p
- 	free_netdev(mesh_dev);
- 	lbs_deb_leave(LBS_DEB_MESH);
- }
--EXPORT_SYMBOL_GPL(lbs_remove_mesh);
- 
- /**
-  *  @brief This function finds the CFP in
-@@ -1458,20 +1455,6 @@ void lbs_interrupt(struct lbs_private *p
- }
- EXPORT_SYMBOL_GPL(lbs_interrupt);
- 
--int lbs_reset_device(struct lbs_private *priv)
+-/* Shift the adjustment so that we won't switch to a lower rate if it exhibited
+- * a worse failed frames behaviour and we'll choose the highest rate whose
+- * failed frames behaviour is not worse than the one of the original rate
+- * target. While at it, check that the adjustment is within the ranges. Then,
+- * provide the new rate index. */
+-static int rate_control_pid_shift_adjust(struct rc_pid_rateinfo *r,
+-					 int adj, int cur, int l)
 -{
--	int ret;
+-	int i, j, k, tmp;
+-
+-	j = r[cur].rev_index;
+-	i = j + adj;
 -
--	lbs_deb_enter(LBS_DEB_MAIN);
--	ret = lbs_prepare_and_send_command(priv, CMD_802_11_RESET,
--				    CMD_ACT_HALT, 0, 0, NULL);
--	msleep_interruptible(10);
+-	if (i < 0)
+-		return r[0].index;
+-	if (i >= l - 1)
+-		return r[l - 1].index;
 -
--	lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
--	return ret;
+-	tmp = i;
+-
+-	if (adj < 0) {
+-		for (k = j; k >= i; k--)
+-			if (r[k].diff <= r[j].diff)
+-				tmp = k;
+-	} else {
+-		for (k = i + 1; k + i < l; k++)
+-			if (r[k].diff <= r[i].diff)
+-				tmp = k;
+-	}
+-
+-	return r[tmp].index;
 -}
--EXPORT_SYMBOL_GPL(lbs_reset_device);
 -
- static int __init lbs_init_module(void)
++/* Adjust the rate while ensuring that we won't switch to a lower rate if it
++ * exhibited a worse failed frames behaviour and we'll choose the highest rate
++ * whose failed frames behaviour is not worse than the one of the original rate
++ * target. While at it, check that the new rate is valid. */
+ static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
+ 					 struct sta_info *sta, int adj,
+ 					 struct rc_pid_rateinfo *rinfo)
  {
- 	lbs_deb_enter(LBS_DEB_MAIN);
-diff -up linux-2.6.24.noarch/drivers/net/wireless/libertas/cmd.c.orig linux-2.6.24.noarch/drivers/net/wireless/libertas/cmd.c
---- linux-2.6.24.noarch/drivers/net/wireless/libertas/cmd.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/libertas/cmd.c	2008-02-27 20:47:51.000000000 -0500
-@@ -1040,7 +1040,6 @@ int lbs_mesh_access(struct lbs_private *
- 	lbs_deb_leave(LBS_DEB_CMD);
- 	return ret;
- }
--EXPORT_SYMBOL_GPL(lbs_mesh_access);
+ 	struct ieee80211_sub_if_data *sdata;
+ 	struct ieee80211_hw_mode *mode;
+-	int newidx;
+-	int maxrate;
+-	int back = (adj > 0) ? 1 : -1;
++	int cur_sorted, new_sorted, probe, tmp, n_bitrates;
++	int cur = sta->txrate;
+ 
+ 	sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+ 
+ 	mode = local->oper_hw_mode;
+-	maxrate = sdata->bss ? sdata->bss->max_ratectrl_rateidx : -1;
++	n_bitrates = mode->num_rates;
+ 
+-	newidx = rate_control_pid_shift_adjust(rinfo, adj, sta->txrate,
+-					       mode->num_rates);
++	/* Map passed arguments to sorted values. */
++	cur_sorted = rinfo[cur].rev_index;
++	new_sorted = cur_sorted + adj;
++
++	/* Check limits. */
++	if (new_sorted < 0)
++		new_sorted = rinfo[0].rev_index;
++	else if (new_sorted >= n_bitrates)
++		new_sorted = rinfo[n_bitrates - 1].rev_index;
+ 
+-	while (newidx != sta->txrate) {
+-		if (rate_supported(sta, mode, newidx) &&
+-		    (maxrate < 0 || newidx <= maxrate)) {
+-			sta->txrate = newidx;
+-			break;
+-		}
++	tmp = new_sorted;
+ 
+-		newidx += back;
++	if (adj < 0) {
++		/* Ensure that the rate decrease isn't disadvantageous. */
++		for (probe = cur_sorted; probe >= new_sorted; probe--)
++			if (rinfo[probe].diff <= rinfo[cur_sorted].diff &&
++			    rate_supported(sta, mode, rinfo[probe].index))
++				tmp = probe;
++	} else {
++		/* Look for rate increase with zero (or below) cost. */
++		for (probe = new_sorted + 1; probe < n_bitrates; probe++)
++			if (rinfo[probe].diff <= rinfo[new_sorted].diff &&
++			    rate_supported(sta, mode, rinfo[probe].index))
++				tmp = probe;
+ 	}
  
- int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan)
- {
-@@ -1576,7 +1575,6 @@ done:
- 	lbs_deb_leave_args(LBS_DEB_HOST, "ret %d", ret);
- 	return ret;
++	/* Fit the rate found to the nearest supported rate. */
++	do {
++		if (rate_supported(sta, mode, rinfo[tmp].index)) {
++			sta->txrate = rinfo[tmp].index;
++			break;
++		}
++		if (adj < 0)
++			tmp--;
++		else
++			tmp++;
++	} while (tmp < n_bitrates && tmp >= 0);
++
+ #ifdef CONFIG_MAC80211_DEBUGFS
+ 	rate_control_pid_event_rate_change(
+ 		&((struct rc_pid_sta_info *)sta->rate_ctrl_priv)->events,
+-		newidx, mode->rates[newidx].rate);
++		cur, mode->rates[cur].rate);
+ #endif
  }
--EXPORT_SYMBOL_GPL(lbs_prepare_and_send_command);
  
- /**
-  *  @brief This function allocates the command buffer and link
-diff -up linux-2.6.24.noarch/drivers/net/wireless/libertas/decl.h.orig linux-2.6.24.noarch/drivers/net/wireless/libertas/decl.h
---- linux-2.6.24.noarch/drivers/net/wireless/libertas/decl.h.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/libertas/decl.h	2008-02-27 20:47:51.000000000 -0500
-@@ -69,7 +69,6 @@ struct lbs_private *lbs_add_card(void *c
- int lbs_remove_card(struct lbs_private *priv);
- int lbs_start_card(struct lbs_private *priv);
- int lbs_stop_card(struct lbs_private *priv);
--int lbs_reset_device(struct lbs_private *priv);
- void lbs_host_to_card_done(struct lbs_private *priv);
- 
- int lbs_update_channel(struct lbs_private *priv);
-diff -up linux-2.6.24.noarch/drivers/net/wireless/bcm43xx/Kconfig.orig linux-2.6.24.noarch/drivers/net/wireless/bcm43xx/Kconfig
---- linux-2.6.24.noarch/drivers/net/wireless/bcm43xx/Kconfig.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/bcm43xx/Kconfig	2008-02-27 20:47:51.000000000 -0500
-@@ -1,6 +1,6 @@
- config BCM43XX
- 	tristate "Broadcom BCM43xx wireless support (DEPRECATED)"
--	depends on PCI && IEEE80211 && IEEE80211_SOFTMAC && WLAN_80211 && EXPERIMENTAL
-+	depends on PCI && IEEE80211 && IEEE80211_SOFTMAC && WLAN_80211 && (!SSB_B43_PCI_BRIDGE || SSB != y) && EXPERIMENTAL
- 	select WIRELESS_EXT
- 	select FW_LOADER
- 	select HW_RANDOM
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00dev.c.orig linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00dev.c
---- linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00dev.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00dev.c	2008-02-27 20:47:51.000000000 -0500
-@@ -61,11 +61,33 @@ EXPORT_SYMBOL_GPL(rt2x00lib_get_ring);
- /*
-  * Link tuning handlers
-  */
--static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
-+void rt2x00lib_reset_link_tuner(struct rt2x00_dev *rt2x00dev)
- {
-+	if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
-+		return;
+diff -up linux-2.6.24.noarch/drivers/net/wireless/p54common.h.orig linux-2.6.24.noarch/drivers/net/wireless/p54common.h
+--- linux-2.6.24.noarch/drivers/net/wireless/p54common.h.orig	2008-01-24 17:58:37.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/p54common.h	2008-03-04 19:30:56.000000000 -0500
+@@ -53,10 +53,10 @@ struct pda_entry {
+ } __attribute__ ((packed));
+ 
+ struct eeprom_pda_wrap {
+-	u32 magic;
+-	u16 pad;
+-	u16 len;
+-	u32 arm_opcode;
++	__le32 magic;
++	__le16 pad;
++	__le16 len;
++	__le32 arm_opcode;
+ 	u8 data[0];
+ } __attribute__ ((packed));
+ 
+diff -up linux-2.6.24.noarch/drivers/net/wireless/p54common.c.orig linux-2.6.24.noarch/drivers/net/wireless/p54common.c
+--- linux-2.6.24.noarch/drivers/net/wireless/p54common.c.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/p54common.c	2008-03-04 19:30:56.000000000 -0500
+@@ -166,18 +166,23 @@ int p54_parse_eeprom(struct ieee80211_hw
+ 	struct p54_common *priv = dev->priv;
+ 	struct eeprom_pda_wrap *wrap = NULL;
+ 	struct pda_entry *entry;
+-	int i = 0;
+ 	unsigned int data_len, entry_len;
+ 	void *tmp;
+ 	int err;
++	u8 *end = (u8 *)eeprom + len;
+ 
+ 	wrap = (struct eeprom_pda_wrap *) eeprom;
+-	entry = (void *)wrap->data + wrap->len;
+-	i += 2;
+-	i += le16_to_cpu(entry->len)*2;
+-	while (i < len) {
++	entry = (void *)wrap->data + le16_to_cpu(wrap->len);
 +
-+	/*
-+	 * Reset link information.
-+	 * Both the currently active vgc level as well as
-+	 * the link tuner counter should be reset. Resetting
-+	 * the counter is important for devices where the
-+	 * device should only perform link tuning during the
-+	 * first minute after being enabled.
-+	 */
- 	rt2x00dev->link.count = 0;
- 	rt2x00dev->link.vgc_level = 0;
- 
-+	/*
-+	 * Reset the link tuner.
-+	 */
-+	rt2x00dev->ops->lib->reset_tuner(rt2x00dev);
-+}
++	/* verify that at least the entry length/code fits */
++	while ((u8 *)entry <= end - sizeof(*entry)) {
+ 		entry_len = le16_to_cpu(entry->len);
+ 		data_len = ((entry_len - 1) << 1);
 +
-+static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
-+{
-+	/*
-+	 * Clear all (possibly) pre-existing quality statistics.
-+	 */
- 	memset(&rt2x00dev->link.qual, 0, sizeof(rt2x00dev->link.qual));
- 
- 	/*
-@@ -79,10 +101,7 @@ static void rt2x00lib_start_link_tuner(s
- 	rt2x00dev->link.qual.rx_percentage = 50;
- 	rt2x00dev->link.qual.tx_percentage = 50;
- 
--	/*
--	 * Reset the link tuner.
--	 */
--	rt2x00dev->ops->lib->reset_tuner(rt2x00dev);
-+	rt2x00lib_reset_link_tuner(rt2x00dev);
- 
- 	queue_delayed_work(rt2x00dev->hw->workqueue,
- 			   &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
-@@ -93,15 +112,6 @@ static void rt2x00lib_stop_link_tuner(st
- 	cancel_delayed_work_sync(&rt2x00dev->link.work);
- }
- 
--void rt2x00lib_reset_link_tuner(struct rt2x00_dev *rt2x00dev)
--{
--	if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
--		return;
--
--	rt2x00lib_stop_link_tuner(rt2x00dev);
--	rt2x00lib_start_link_tuner(rt2x00dev);
--}
--
- /*
-  * Ring initialization
-  */
-@@ -260,19 +270,11 @@ static void rt2x00lib_evaluate_antenna_s
- 	if (sample_a == sample_b)
- 		return;
- 
--	if (rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY) {
--		if (sample_a > sample_b && rx == ANTENNA_B)
--			rx = ANTENNA_A;
--		else if (rx == ANTENNA_A)
--			rx = ANTENNA_B;
--	}
-+	if (rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY)
-+		rx = (sample_a > sample_b) ? ANTENNA_A : ANTENNA_B;
++		/* abort if entry exceeds whole structure */
++		if ((u8 *)entry + sizeof(*entry) + data_len > end)
++			break;
++
+ 		switch (le16_to_cpu(entry->code)) {
+ 		case PDR_MAC_ADDRESS:
+ 			SET_IEEE80211_PERM_ADDR(dev, entry->data);
+@@ -249,13 +254,12 @@ int p54_parse_eeprom(struct ieee80211_hw
+ 			priv->version = *(u8 *)(entry->data + 1);
+ 			break;
+ 		case PDR_END:
+-			i = len;
++			/* make it overrun */
++			entry_len = len;
+ 			break;
+ 		}
+ 
+ 		entry = (void *)entry + (entry_len + 1)*2;
+-		i += 2;
+-		i += entry_len*2;
+ 	}
  
--	if (rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY) {
--		if (sample_a > sample_b && tx == ANTENNA_B)
--			tx = ANTENNA_A;
--		else if (tx == ANTENNA_A)
--			tx = ANTENNA_B;
--	}
-+	if (rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY)
-+		tx = (sample_a > sample_b) ? ANTENNA_A : ANTENNA_B;
+ 	if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) {
+diff -up linux-2.6.24.noarch/drivers/net/wireless/b43legacy/main.c.orig linux-2.6.24.noarch/drivers/net/wireless/b43legacy/main.c
+--- linux-2.6.24.noarch/drivers/net/wireless/b43legacy/main.c.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/b43legacy/main.c	2008-03-04 19:30:56.000000000 -0500
+@@ -3829,7 +3829,7 @@ static void b43legacy_print_driverinfo(v
+ #ifdef CONFIG_B43LEGACY_DMA
+ 	feat_dma = "D";
+ #endif
+-	printk(KERN_INFO "Broadcom 43xx driver loaded "
++	printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
+ 	       "[ Features: %s%s%s%s%s, Firmware-ID: "
+ 	       B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
+ 	       feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
+diff -up linux-2.6.24.noarch/drivers/net/wireless/rndis_wlan.c.orig linux-2.6.24.noarch/drivers/net/wireless/rndis_wlan.c
+--- linux-2.6.24.noarch/drivers/net/wireless/rndis_wlan.c.orig	2008-03-04 19:28:37.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/rndis_wlan.c	2008-03-04 19:30:56.000000000 -0500
+@@ -260,7 +260,7 @@ struct NDIS_802_11_KEY {
+ 	__le32 KeyLength;
+ 	u8 Bssid[6];
+ 	u8 Padding[6];
+-	__le64 KeyRSC;
++	u8 KeyRSC[8];
+ 	u8 KeyMaterial[32];
+ } __attribute__((packed));
  
- 	rt2x00lib_config_antenna(rt2x00dev, rx, tx);
- }
-@@ -293,7 +295,7 @@ static void rt2x00lib_evaluate_antenna_e
- 	 * sample the rssi from the other antenna to make a valid
- 	 * comparison between the 2 antennas.
- 	 */
--	if ((rssi_curr - rssi_old) > -5 || (rssi_curr - rssi_old) < 5)
-+	if (abs(rssi_curr - rssi_old) < 5)
- 		return;
- 
- 	rt2x00dev->link.ant.flags |= ANTENNA_MODE_SAMPLE;
-@@ -319,15 +321,15 @@ static void rt2x00lib_evaluate_antenna(s
- 	rt2x00dev->link.ant.flags &= ~ANTENNA_TX_DIVERSITY;
- 
- 	if (rt2x00dev->hw->conf.antenna_sel_rx == 0 &&
--	    rt2x00dev->default_ant.rx != ANTENNA_SW_DIVERSITY)
-+	    rt2x00dev->default_ant.rx == ANTENNA_SW_DIVERSITY)
- 		rt2x00dev->link.ant.flags |= ANTENNA_RX_DIVERSITY;
- 	if (rt2x00dev->hw->conf.antenna_sel_tx == 0 &&
--	    rt2x00dev->default_ant.tx != ANTENNA_SW_DIVERSITY)
-+	    rt2x00dev->default_ant.tx == ANTENNA_SW_DIVERSITY)
- 		rt2x00dev->link.ant.flags |= ANTENNA_TX_DIVERSITY;
- 
- 	if (!(rt2x00dev->link.ant.flags & ANTENNA_RX_DIVERSITY) &&
- 	    !(rt2x00dev->link.ant.flags & ANTENNA_TX_DIVERSITY)) {
--		rt2x00dev->link.ant.flags &= ~ANTENNA_MODE_SAMPLE;
-+		rt2x00dev->link.ant.flags = 0;
- 		return;
+@@ -1508,7 +1508,7 @@ static int rndis_iw_set_encode_ext(struc
+ 	struct usbnet *usbdev = dev->priv;
+ 	struct rndis_wext_private *priv = get_rndis_wext_priv(usbdev);
+ 	struct NDIS_802_11_KEY ndis_key;
+-	int i, keyidx, ret;
++	int keyidx, ret;
+ 	u8 *addr;
+ 
+ 	keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX;
+@@ -1543,9 +1543,7 @@ static int rndis_iw_set_encode_ext(struc
+ 	ndis_key.KeyIndex = cpu_to_le32(keyidx);
+ 
+ 	if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
+-		for (i = 0; i < 6; i++)
+-			ndis_key.KeyRSC |=
+-				cpu_to_le64(ext->rx_seq[i] << (i * 8));
++		memcpy(ndis_key.KeyRSC, ext->rx_seq, 6);
+ 		ndis_key.KeyIndex |= cpu_to_le32(1 << 29);
  	}
  
-@@ -441,17 +443,18 @@ static void rt2x00lib_link_tuner(struct 
- 		rt2x00dev->ops->lib->link_tuner(rt2x00dev);
+diff -up linux-2.6.24.noarch/drivers/net/wireless/libertas/cmdresp.c.orig linux-2.6.24.noarch/drivers/net/wireless/libertas/cmdresp.c
+--- linux-2.6.24.noarch/drivers/net/wireless/libertas/cmdresp.c.orig	2008-03-04 19:28:31.000000000 -0500
++++ linux-2.6.24.noarch/drivers/net/wireless/libertas/cmdresp.c	2008-03-04 19:30:56.000000000 -0500
+@@ -562,9 +562,7 @@ int lbs_process_rx_command(struct lbs_pr
+ 	}
  
- 	/*
--	 * Evaluate antenna setup.
--	 */
--	rt2x00lib_evaluate_antenna(rt2x00dev);
+ 	resp = (void *)priv->upld_buf;
 -
--	/*
- 	 * Precalculate a portion of the link signal which is
- 	 * in based on the tx/rx success/failure counters.
- 	 */
- 	rt2x00lib_precalculate_link_signal(&rt2x00dev->link.qual);
- 
- 	/*
-+	 * Evaluate antenna setup, make this the last step since this could
-+	 * possibly reset some statistics.
-+	 */
-+	rt2x00lib_evaluate_antenna(rt2x00dev);
-+
-+	/*
- 	 * Increase tuner counter, and reschedule the next link tuner run.
- 	 */
- 	rt2x00dev->link.count++;
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2400pci.c.orig linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2400pci.c
---- linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2400pci.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2400pci.c	2008-02-27 20:47:51.000000000 -0500
-@@ -960,8 +960,12 @@ static int rt2400pci_set_device_state(st
- 		rt2400pci_disable_radio(rt2x00dev);
- 		break;
- 	case STATE_RADIO_RX_ON:
-+	case STATE_RADIO_RX_ON_LINK:
-+		rt2400pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
-+		break;
- 	case STATE_RADIO_RX_OFF:
--		rt2400pci_toggle_rx(rt2x00dev, state);
-+	case STATE_RADIO_RX_OFF_LINK:
-+		rt2400pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
- 		break;
- 	case STATE_DEEP_SLEEP:
- 	case STATE_SLEEP:
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2500usb.c.orig linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2500usb.c
---- linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2500usb.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2500usb.c	2008-02-27 20:47:51.000000000 -0500
-@@ -1001,8 +1001,12 @@ static int rt2500usb_set_device_state(st
- 		rt2500usb_disable_radio(rt2x00dev);
- 		break;
- 	case STATE_RADIO_RX_ON:
-+	case STATE_RADIO_RX_ON_LINK:
-+		rt2500usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
-+		break;
- 	case STATE_RADIO_RX_OFF:
--		rt2500usb_toggle_rx(rt2x00dev, state);
-+	case STATE_RADIO_RX_OFF_LINK:
-+		rt2500usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
- 		break;
- 	case STATE_DEEP_SLEEP:
- 	case STATE_SLEEP:
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00reg.h.orig linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00reg.h
---- linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00reg.h.orig	2008-01-24 17:58:37.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00reg.h	2008-02-27 20:47:51.000000000 -0500
-@@ -85,6 +85,8 @@ enum dev_state {
- 	STATE_RADIO_OFF,
- 	STATE_RADIO_RX_ON,
- 	STATE_RADIO_RX_OFF,
-+	STATE_RADIO_RX_ON_LINK,
-+	STATE_RADIO_RX_OFF_LINK,
- 	STATE_RADIO_IRQ_ON,
- 	STATE_RADIO_IRQ_OFF,
- };
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00config.c.orig linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00config.c
---- linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00config.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2x00config.c	2008-02-27 20:47:51.000000000 -0500
-@@ -97,12 +97,16 @@ void rt2x00lib_config_antenna(struct rt2
- 	libconf.ant.rx = rx;
- 	libconf.ant.tx = tx;
- 
-+	if (rx == rt2x00dev->link.ant.active.rx &&
-+	    tx == rt2x00dev->link.ant.active.tx)
+-	curcmd = le16_to_cpu(resp->command);
+-
++	curcmd = le16_to_cpu(priv->cur_cmd->cmdbuf->command);
+ 	respcmd = le16_to_cpu(resp->command);
+ 	result = le16_to_cpu(resp->result);
+ 
+@@ -572,9 +570,9 @@ int lbs_process_rx_command(struct lbs_pr
+ 		     respcmd, le16_to_cpu(resp->seqnum), priv->upld_len, jiffies);
+ 	lbs_deb_hex(LBS_DEB_HOST, "CMD_RESP", (void *) resp, priv->upld_len);
+ 
+-	if (resp->seqnum != resp->seqnum) {
++	if (resp->seqnum != priv->cur_cmd->cmdbuf->seqnum) {
+ 		lbs_pr_info("Received CMD_RESP with invalid sequence %d (expected %d)\n",
+-			    le16_to_cpu(resp->seqnum), le16_to_cpu(resp->seqnum));
++			    le16_to_cpu(resp->seqnum), le16_to_cpu(priv->cur_cmd->cmdbuf->seqnum));
+ 		spin_unlock_irqrestore(&priv->driver_lock, flags);
+ 		ret = -1;
+ 		goto done;
+diff -up linux-2.6.24.noarch/drivers/ssb/driver_pcicore.c.orig linux-2.6.24.noarch/drivers/ssb/driver_pcicore.c
+--- linux-2.6.24.noarch/drivers/ssb/driver_pcicore.c.orig	2008-03-04 19:28:37.000000000 -0500
++++ linux-2.6.24.noarch/drivers/ssb/driver_pcicore.c	2008-03-04 19:30:56.000000000 -0500
+@@ -111,7 +111,10 @@ static void __init ssb_fixup_pcibridge(s
+ 
+ 	/* Enable PCI bridge bus mastering and memory space */
+ 	pci_set_master(dev);
+-	pcibios_enable_device(dev, ~0);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		ssb_printk(KERN_ERR "PCI: SSB bridge enable failed\n");
 +		return;
-+
- 	/*
- 	 * Antenna setup changes require the RX to be disabled,
- 	 * else the changes will be ignored by the device.
- 	 */
- 	if (test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
--		rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
-+		rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF_LINK);
- 
- 	/*
- 	 * Write new antenna setup to device and reset the link tuner.
-@@ -116,7 +120,7 @@ void rt2x00lib_config_antenna(struct rt2
- 	rt2x00dev->link.ant.active.tx = libconf.ant.tx;
- 
- 	if (test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
--		rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
-+		rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON_LINK);
- }
++	}
  
- void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2500pci.c.orig linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2500pci.c
---- linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2500pci.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt2500pci.c	2008-02-27 20:47:51.000000000 -0500
-@@ -1112,8 +1112,12 @@ static int rt2500pci_set_device_state(st
- 		rt2500pci_disable_radio(rt2x00dev);
- 		break;
- 	case STATE_RADIO_RX_ON:
-+	case STATE_RADIO_RX_ON_LINK:
-+		rt2500pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
-+		break;
- 	case STATE_RADIO_RX_OFF:
--		rt2500pci_toggle_rx(rt2x00dev, state);
-+	case STATE_RADIO_RX_OFF_LINK:
-+		rt2500pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
- 		break;
- 	case STATE_DEEP_SLEEP:
- 	case STATE_SLEEP:
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt61pci.c.orig linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt61pci.c
---- linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt61pci.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt61pci.c	2008-02-27 20:47:51.000000000 -0500
-@@ -1482,8 +1482,12 @@ static int rt61pci_set_device_state(stru
- 		rt61pci_disable_radio(rt2x00dev);
- 		break;
- 	case STATE_RADIO_RX_ON:
-+	case STATE_RADIO_RX_ON_LINK:
-+		rt61pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
-+		break;
- 	case STATE_RADIO_RX_OFF:
--		rt61pci_toggle_rx(rt2x00dev, state);
-+	case STATE_RADIO_RX_OFF_LINK:
-+		rt61pci_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
- 		break;
- 	case STATE_DEEP_SLEEP:
- 	case STATE_SLEEP:
-diff -up linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt73usb.c.orig linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt73usb.c
---- linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt73usb.c.orig	2008-02-27 20:46:34.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/net/wireless/rt2x00/rt73usb.c	2008-02-27 20:47:51.000000000 -0500
-@@ -1208,8 +1208,12 @@ static int rt73usb_set_device_state(stru
- 		rt73usb_disable_radio(rt2x00dev);
- 		break;
- 	case STATE_RADIO_RX_ON:
-+	case STATE_RADIO_RX_ON_LINK:
-+		rt73usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
-+		break;
- 	case STATE_RADIO_RX_OFF:
--		rt73usb_toggle_rx(rt2x00dev, state);
-+	case STATE_RADIO_RX_OFF_LINK:
-+		rt73usb_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
- 		break;
- 	case STATE_DEEP_SLEEP:
- 	case STATE_SLEEP:
-diff -up linux-2.6.24.noarch/drivers/ssb/Makefile.orig linux-2.6.24.noarch/drivers/ssb/Makefile
---- linux-2.6.24.noarch/drivers/ssb/Makefile.orig	2008-02-27 20:46:35.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/ssb/Makefile	2008-02-27 20:47:51.000000000 -0500
-@@ -14,6 +14,6 @@ ssb-$(CONFIG_SSB_DRIVER_PCICORE)	+= driv
- 
- # b43 pci-ssb-bridge driver
- # Not strictly a part of SSB, but kept here for convenience
--ssb-$(CONFIG_SSB_PCIHOST)		+= b43_pci_bridge.o
-+ssb-$(CONFIG_SSB_B43_PCI_BRIDGE)	+= b43_pci_bridge.o
- 
- obj-$(CONFIG_SSB)			+= ssb.o
-diff -up linux-2.6.24.noarch/drivers/ssb/ssb_private.h.orig linux-2.6.24.noarch/drivers/ssb/ssb_private.h
---- linux-2.6.24.noarch/drivers/ssb/ssb_private.h.orig	2008-01-24 17:58:37.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/ssb/ssb_private.h	2008-02-27 20:47:51.000000000 -0500
-@@ -120,10 +120,10 @@ extern int ssb_devices_thaw(struct ssb_b
- extern struct ssb_bus *ssb_pci_dev_to_bus(struct pci_dev *pdev);
- 
- /* b43_pci_bridge.c */
--#ifdef CONFIG_SSB_PCIHOST
-+#ifdef CONFIG_SSB_B43_PCI_BRIDGE
- extern int __init b43_pci_ssb_bridge_init(void);
- extern void __exit b43_pci_ssb_bridge_exit(void);
--#else /* CONFIG_SSB_PCIHOST */
-+#else /* CONFIG_SSB_B43_PCI_BRIDGR */
- static inline int b43_pci_ssb_bridge_init(void)
- {
- 	return 0;
-diff -up linux-2.6.24.noarch/drivers/ssb/Kconfig.orig linux-2.6.24.noarch/drivers/ssb/Kconfig
---- linux-2.6.24.noarch/drivers/ssb/Kconfig.orig	2008-02-27 20:46:35.000000000 -0500
-+++ linux-2.6.24.noarch/drivers/ssb/Kconfig	2008-02-27 20:47:51.000000000 -0500
-@@ -35,6 +35,11 @@ config SSB_PCIHOST
- 
- 	  If unsure, say Y
- 
-+config SSB_B43_PCI_BRIDGE
-+	bool
-+	depends on SSB_PCIHOST
-+	default n
-+
- config SSB_PCMCIAHOST_POSSIBLE
- 	bool
- 	depends on SSB && (PCMCIA = y || PCMCIA = SSB) && EXPERIMENTAL
+ 	/* Enable PCI bridge BAR1 prefetch and burst */
+ 	pci_write_config_dword(dev, SSB_BAR1_CONTROL, 3);


Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/sources,v
retrieving revision 1.11.2.2
retrieving revision 1.11.2.3
diff -u -r1.11.2.2 -r1.11.2.3
--- sources	29 Feb 2008 18:58:24 -0000	1.11.2.2
+++ sources	5 Mar 2008 18:41:18 -0000	1.11.2.3
@@ -1,4 +1,3 @@
 3f23ad4b69d0a552042d1ed0f4399857  linux-2.6.24.tar.bz2
-01b1f6c7b35ba356129c121a81a77991  patch-2.6.25-rc3.bz2
-cefc333ff0422cdaa5e821ca58d06af4  patch-2.6.25-rc3-git1.bz2
+a4cc0fd5bda60e498246b6d69c873895  patch-2.6.25-rc4.bz2
 4aa57328d0802a063fa67dfc063da30e  xen-3.2.0.tar.gz


Index: upstream
===================================================================
RCS file: /cvs/pkgs/rpms/kernel-xen-2.6/devel/Attic/upstream,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -u -r1.1.2.2 -r1.1.2.3
--- upstream	29 Feb 2008 18:58:24 -0000	1.1.2.2
+++ upstream	5 Mar 2008 18:41:18 -0000	1.1.2.3
@@ -1,3 +1,2 @@
 linux-2.6.24.tar.bz2
-patch-2.6.25-rc3.bz2
-patch-2.6.25-rc3-git1.bz2
+patch-2.6.25-rc4.bz2


--- linux-2.6-xen-0001-Revert-linux-2.6-execshield.patch-from-kernel-2_6_25.patch DELETED ---


--- linux-2.6-xen-0002-x86-xen-Construct-e820-map-with-a-hole-between-640K.patch DELETED ---


--- linux-2.6-xen-0003-squashfs-Fix-build-without-CONFIG_SMP.patch DELETED ---


--- linux-2.6-xen-0004-xen-Make-hvc0-the-preferred-console-in-domU.patch DELETED ---


--- linux-2.6-xen-0005-xen-Make-xen-blkfront-write-its-protocol-ABI-to-xen.patch DELETED ---


--- linux-2.6-xen-0006-fbdev-Make-deferred-I-O-work-as-advertized.patch DELETED ---


--- linux-2.6-xen-0007-xen-pvfb-Para-virtual-framebuffer-keyboard-and-poi.patch DELETED ---


--- linux-2.6-xen-0008-xen-Module-autoprobing-support-for-frontend-drivers.patch DELETED ---


--- linux-2.6-xen-0009-xen-Add-compatibility-aliases-for-frontend-drivers.patch DELETED ---


--- linux-2.6-xen-0010-xen-dom0-Add-a-vmlinuz-target.patch DELETED ---


--- linux-2.6-xen-0011-xen-debug-Add-xprintk-to-log-directly-via-hypercall.patch DELETED ---


--- linux-2.6-xen-0012-xen-x86_64-Initial-x86_64-support-for-Xen-paravirt_.patch DELETED ---


--- patch-2.6.25-rc3-git1.bz2.sign DELETED ---


--- patch-2.6.25-rc3.bz2.sign DELETED ---




More information about the fedora-extras-commits mailing list