add the 'goldfish' target, useful for experimenting with virtual phone hardware (includes the emulator)

SVN-Revision: 16459

54 files changed, 16339 insertions, 0 deletions

diff --git a/target/linux/goldfish/Makefile b/target/linux/goldfish/Makefile
new file mode 100644
index 0000000000..08fdb6b579
--- /dev/null
+++ b/target/linux/goldfish/Makefile
@@ -0,0 +1,25 @@
+# 
+# Copyright (C) 2006-2009 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+
+ARCH:=arm
+BOARD:=goldfish
+BOARDNAME:=Goldfish (Android Emulator)
+FEATURES:=
+CFLAGS:=-O2 -pipe -march=armv5te -mtune=xscale -funit-at-a-time
+
+LINUX_VERSION:=2.6.30
+
+DEVICE_TYPE=phone
+
+define Target/Description
+	Android emulator virtual platform
+endef
+
+include $(INCLUDE_DIR)/target.mk
+
+$(eval $(call BuildTarget))
diff --git a/target/linux/goldfish/config-2.6.30 b/target/linux/goldfish/config-2.6.30
new file mode 100644
index 0000000000..251ab492ce
--- /dev/null
+++ b/target/linux/goldfish/config-2.6.30
@@ -0,0 +1,218 @@
+CONFIG_AEABI=y
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_ARCH_GOLDFISH=y
+# CONFIG_ARCH_HAS_HOLES_MEMORYMODEL is not set
+# CONFIG_ARCH_HAS_ILOG2_U32 is not set
+# CONFIG_ARCH_HAS_ILOG2_U64 is not set
+# CONFIG_ARCH_SELECT_MEMORY_MODEL is not set
+# CONFIG_ARCH_SPARSEMEM_DEFAULT is not set
+# CONFIG_ARCH_SUPPORTS_MSI is not set
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_THUMB=y
+# CONFIG_BACKTRACE_SELF_TEST is not set
+CONFIG_BASE_SMALL=0
+# CONFIG_BATTERY_DS2760 is not set
+CONFIG_BATTERY_GOLDFISH=y
+# CONFIG_BINARY_PRINTF is not set
+CONFIG_BITREVERSE=y
+# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
+# CONFIG_BOOT_PRINTK_DELAY is not set
+CONFIG_CMDLINE="console=/dev/ttyS0 root=mtdblock0 rootdelay=1 rootfstype=yaffs2"
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CPU_32=y
+CONFIG_CPU_32v5=y
+CONFIG_CPU_ABRT_EV5TJ=y
+CONFIG_CPU_ARM926T=y
+# CONFIG_CPU_CACHE_ROUND_ROBIN is not set
+CONFIG_CPU_CACHE_VIVT=y
+CONFIG_CPU_COPY_V4WB=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
+# CONFIG_CPU_ICACHE_DISABLE is not set
+CONFIG_CPU_PABRT_NOIFAR=y
+CONFIG_CPU_TLB_V4WBI=y
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_WORKQUEUE=y
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+CONFIG_DEBUG_BUGVERBOSE=y
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_ERRORS is not set
+# CONFIG_DEBUG_INFO is not set
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_LL is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_SHIRQ is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_DEBUG_USER is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
+# CONFIG_DETECT_HUNG_TASK is not set
+CONFIG_DETECT_SOFTLOCKUP=y
+CONFIG_DEVKMEM=y
+# CONFIG_DM9000 is not set
+CONFIG_DUMMY_CONSOLE=y
+# CONFIG_FAULT_INJECTION is not set
+CONFIG_FB=y
+# CONFIG_FB_BACKLIGHT is not set
+# CONFIG_FB_BOOT_VESA_SUPPORT is not set
+# CONFIG_FB_BROADSHEET is not set
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
+# CONFIG_FB_DDC is not set
+# CONFIG_FB_FOREIGN_ENDIAN is not set
+CONFIG_FB_GOLDFISH=y
+# CONFIG_FB_MACMODES is not set
+# CONFIG_FB_MB862XX is not set
+# CONFIG_FB_METRONOME is not set
+CONFIG_FB_MODE_HELPERS=y
+# CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_SVGALIB is not set
+# CONFIG_FB_SYS_COPYAREA is not set
+# CONFIG_FB_SYS_FILLRECT is not set
+# CONFIG_FB_SYS_FOPS is not set
+# CONFIG_FB_SYS_IMAGEBLIT is not set
+CONFIG_FB_TILEBLITTING=y
+# CONFIG_FB_VIRTUAL is not set
+# CONFIG_FIRMWARE_EDID is not set
+# CONFIG_FONTS is not set
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+CONFIG_FRAME_POINTER=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
+# CONFIG_GENERIC_GPIO is not set
+CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
+CONFIG_GOLDFISH_TTY=y
+# CONFIG_HAMRADIO is not set
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAVE_AOUT=y
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
+CONFIG_HAVE_IDE=y
+CONFIG_HAVE_KPROBES=y
+CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_LATENCYTOP_SUPPORT=y
+CONFIG_HAVE_MLOCK=y
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HID=y
+CONFIG_HID_SUPPORT=y
+CONFIG_HW_CONSOLE=y
+# CONFIG_HW_RANDOM is not set
+# CONFIG_I2C is not set
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_GPIO=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INPUT_KEYRESET=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_INPUT_TOUCHSCREEN=y
+# CONFIG_ISDN is not set
+# CONFIG_JFFS2_CMODE_PRIORITY is not set
+CONFIG_JFFS2_CMODE_SIZE=y
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GOLDFISH_EVENTS=y
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+# CONFIG_KGDB is not set
+# CONFIG_LOCK_STAT is not set
+# CONFIG_LOGO is not set
+CONFIG_MACH_GOLDFISH=y
+# CONFIG_MTD_CFI is not set
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_CONCAT=y
+CONFIG_MTD_GOLDFISH_NAND=y
+CONFIG_MTD_NAND=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_BEB_RESERVE=1
+# CONFIG_MTD_UBI_DEBUG is not set
+CONFIG_MTD_UBI_GLUEBI=y
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+# CONFIG_NETDEV_1000 is not set
+# CONFIG_NO_IOPORT is not set
+# CONFIG_OABI_COMPAT is not set
+# CONFIG_OUTER_CACHE is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_PAGE_OFFSET=0xC0000000
+# CONFIG_PAGE_POISONING is not set
+# CONFIG_PCI_SYSCALL is not set
+# CONFIG_PDA_POWER is not set
+CONFIG_POWER_SUPPLY=y
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+# CONFIG_PROVE_LOCKING is not set
+CONFIG_QEMU_TRACE=y
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_SCHEDSTATS is not set
+CONFIG_SCHED_DEBUG=y
+# CONFIG_SCSI_DMA is not set
+# CONFIG_SERIAL_8250 is not set
+# CONFIG_SLOW_WORK is not set
+CONFIG_SMC91X=y
+CONFIG_SPLIT_PTLOCK_CPUS=4096
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_TICK_ONESHOT=y
+# CONFIG_TIMER_STATS is not set
+# CONFIG_TOUCHSCREEN_AD7879 is not set
+# CONFIG_TOUCHSCREEN_ELO is not set
+# CONFIG_TOUCHSCREEN_FUJITSU is not set
+# CONFIG_TOUCHSCREEN_GUNZE is not set
+# CONFIG_TOUCHSCREEN_INEXIO is not set
+# CONFIG_TOUCHSCREEN_MK712 is not set
+# CONFIG_TOUCHSCREEN_MTOUCH is not set
+# CONFIG_TOUCHSCREEN_PENMOUNT is not set
+# CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
+# CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set
+# CONFIG_TOUCHSCREEN_TOUCHWIN is not set
+# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
+CONFIG_TRACING_SUPPORT=y
+# CONFIG_UBIFS_FS is not set
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_UID16=y
+CONFIG_VECTORS_BASE=0xffff0000
+CONFIG_VFP=y
+# CONFIG_VGA_CONSOLE is not set
+CONFIG_VIDEO_OUTPUT_CONTROL=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+# CONFIG_WATCHDOG is not set
+CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_TEXT=0
+CONFIG_ZONE_DMA_FLAG=0
diff --git a/target/linux/goldfish/image/Makefile b/target/linux/goldfish/image/Makefile
new file mode 100644
index 0000000000..bf871fb2ae
--- /dev/null
+++ b/target/linux/goldfish/image/Makefile
@@ -0,0 +1,43 @@
+# 
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+JFFS2_BLOCKSIZE=124k
+JFFS2OPTS += -n -s 2048
+
+_PREFIX=openwrt-goldfish-
+
+define Image/BuildKernel
+	$(TARGET_CROSS)objcopy -O binary -R .note -R .comment -S \
+		$(LINUX_DIR)/arch/arm/boot/compressed/vmlinux $(BIN_DIR)/$(_PREFIX)kernel.bin
+	$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS), \
+		$(CP) $(LINUX_DIR)/usr/initramfs_data.cpio.gz, \
+		gzip -c < $(LINUX_DIR)/usr/initramfs_data.cpio > \
+	) $(BIN_DIR)/$(_PREFIX)ramdisk.bin
+	$(CP) ./run-emulator.sh $(BIN_DIR)/
+endef
+
+define Image/Build/jffs2-124k
+	$(CP) ./ubinize.cfg $(KDIR)/
+	(cd $(KDIR); \
+		ubinize \
+			-o $(BIN_DIR)/$(_PREFIX)$(1).img \
+			-p 128KiB -m 2KiB -s 2KiB ubinize.cfg; \
+	)
+	nand_ecc \
+		$(BIN_DIR)/$(_PREFIX)$(1).img \
+		$(BIN_DIR)/$(_PREFIX)system.bin
+endef
+
+define Image/Build
+	$(call Image/Build/$(1),$(1))
+endef
+
+
+$(eval $(call BuildImage))
diff --git a/target/linux/goldfish/image/run-emulator.sh b/target/linux/goldfish/image/run-emulator.sh
new file mode 100644
index 0000000000..652ec5ed78
--- /dev/null
+++ b/target/linux/goldfish/image/run-emulator.sh
@@ -0,0 +1,3 @@
+PREFIX=openwrt-goldfish-
+touch ${PREFIX}data.bin
+./goldfish-qemu/emulator -sysdir . -ramdisk ${PREFIX}ramdisk.bin -kernel ${PREFIX}kernel.bin -system ${PREFIX}system.bin -data ${PREFIX}data.bin -show-kernel -partition-size 100 -qemu -append "console=ttyS0 ubi.mtd=0 root=/dev/mtdblock3 rootfstype=jffs2 bootdelay=1 init=/etc/preinit" -net nic,vlan=0,model=smc91c111 -net user,vlan=0,hostname=OpenWrt
diff --git a/target/linux/goldfish/image/ubinize.cfg b/target/linux/goldfish/image/ubinize.cfg
new file mode 100644
index 0000000000..d8d1fde012
--- /dev/null
+++ b/target/linux/goldfish/image/ubinize.cfg
@@ -0,0 +1,14 @@
+[rootfs]
+# Volume mode (other option is static)
+mode=ubi
+# Source image
+image=root.jffs2-124k
+# Volume ID in UBI image
+vol_id=0
+# Allow for dynamic resize
+vol_type=dynamic
+# Volume name
+vol_name=rootfs
+# Autoresize volume at first mount
+vol_flags=autoresize
+
diff --git a/target/linux/goldfish/patches-2.6.30/0042-ARM-Make-low-level-printk-work.patch b/target/linux/goldfish/patches-2.6.30/0042-ARM-Make-low-level-printk-work.patch
new file mode 100644
index 0000000000..6a74a3bf6c
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0042-ARM-Make-low-level-printk-work.patch
@@ -0,0 +1,36 @@
+From 0c61b75f9da1a0889959a0f9bd0b8b63f936ddf3 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 9 May 2005 14:10:26 -0700
+Subject: [PATCH 042/134] ARM: Make low-level printk work
+
+Makes low-level printk work.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+---
+ kernel/printk.c |    8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -45,6 +45,10 @@ void asmlinkage __attribute__((weak)) ea
+ 
+ #define __LOG_BUF_LEN	(1 << CONFIG_LOG_BUF_SHIFT)
+ 
++#ifdef        CONFIG_DEBUG_LL
++extern void printascii(char *);
++#endif
++
+ /* printk's without a loglevel use this.. */
+ #define DEFAULT_MESSAGE_LOGLEVEL 4 /* KERN_WARNING */
+ 
+@@ -687,6 +691,10 @@ asmlinkage int vprintk(const char *fmt, 
+ 				  sizeof(printk_buf) - printed_len, fmt, args);
+ 
+ 
++#ifdef	CONFIG_DEBUG_LL
++	printascii(printk_buf);
++#endif
++
+ 	/*
+ 	 * Copy the output into log_buf.  If the caller didn't provide
+ 	 * appropriate log level tags, we insert them here
diff --git a/target/linux/goldfish/patches-2.6.30/0052-lowmemorykiller-Only-iterate-over-process-list-when.patch b/target/linux/goldfish/patches-2.6.30/0052-lowmemorykiller-Only-iterate-over-process-list-when.patch
new file mode 100644
index 0000000000..aeab05e86c
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0052-lowmemorykiller-Only-iterate-over-process-list-when.patch
@@ -0,0 +1,71 @@
+From 3742e6638bdb7325c6432e2a145ad985ee47d052 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Mon, 26 Jan 2009 19:13:47 -0800
+Subject: [PATCH 052/134] lowmemorykiller: Only iterate over process list when needed.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Use NR_ACTIVE plus NR_INACTIVE as a size estimate for our fake cache
+instead the sum of rss. Neither method is accurate.
+
+Also skip the process scan, if the amount of memory available is above
+the largest threshold set.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/staging/android/lowmemorykiller.c |   35 +++++++++++++++++-----------
+ 1 files changed, 21 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/staging/android/lowmemorykiller.c b/drivers/staging/android/lowmemorykiller.c
+index 3715d56..b9a2e84 100644
+--- a/drivers/staging/android/lowmemorykiller.c
++++ b/drivers/staging/android/lowmemorykiller.c
+@@ -71,23 +71,30 @@ static int lowmem_shrink(int nr_to_scan, gfp_t gfp_mask)
+ 	}
+ 	if(nr_to_scan > 0)
+ 		lowmem_print(3, "lowmem_shrink %d, %x, ofree %d, ma %d\n", nr_to_scan, gfp_mask, other_free, min_adj);
++	rem = global_page_state(NR_ACTIVE) + global_page_state(NR_INACTIVE);
++	if (nr_to_scan <= 0 || min_adj == OOM_ADJUST_MAX + 1) {
++		lowmem_print(5, "lowmem_shrink %d, %x, return %d\n", nr_to_scan, gfp_mask, rem);
++		return rem;
++	}
++
+ 	read_lock(&tasklist_lock);
+ 	for_each_process(p) {
+-		if(p->oomkilladj >= 0 && p->mm) {
+-			tasksize = get_mm_rss(p->mm);
+-			if(nr_to_scan > 0 && tasksize > 0 && p->oomkilladj >= min_adj) {
+-				if(selected == NULL ||
+-				   p->oomkilladj > selected->oomkilladj ||
+-				   (p->oomkilladj == selected->oomkilladj &&
+-				    tasksize > selected_tasksize)) {
+-					selected = p;
+-					selected_tasksize = tasksize;
+-					lowmem_print(2, "select %d (%s), adj %d, size %d, to kill\n",
+-					             p->pid, p->comm, p->oomkilladj, tasksize);
+-				}
+-			}
+-			rem += tasksize;
++		if (p->oomkilladj < min_adj || !p->mm)
++			continue;
++		tasksize = get_mm_rss(p->mm);
++		if (tasksize <= 0)
++			continue;
++		if (selected) {
++			if (p->oomkilladj < selected->oomkilladj)
++				continue;
++			if (p->oomkilladj == selected->oomkilladj &&
++			    tasksize <= selected_tasksize)
++				continue;
+ 		}
++		selected = p;
++		selected_tasksize = tasksize;
++		lowmem_print(2, "select %d (%s), adj %d, size %d, to kill\n",
++		             p->pid, p->comm, p->oomkilladj, tasksize);
+ 	}
+ 	if(selected != NULL) {
+ 		lowmem_print(1, "send sigkill to %d (%s), adj %d, size %d\n",
+-- 
+1.6.2
+
diff --git a/target/linux/goldfish/patches-2.6.30/0053-lowmemorykiller-Don-t-count-free-space-unless-it-me.patch b/target/linux/goldfish/patches-2.6.30/0053-lowmemorykiller-Don-t-count-free-space-unless-it-me.patch
new file mode 100644
index 0000000000..0a8e83a828
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0053-lowmemorykiller-Don-t-count-free-space-unless-it-me.patch
@@ -0,0 +1,53 @@
+From f82da10dcae73652a6f0355e4398b4be1af17e6b Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Mon, 26 Jan 2009 19:22:19 -0800
+Subject: [PATCH 053/134] lowmemorykiller: Don't count free space unless it meets the specified limit by itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+This allows processes to be killed when the kernel evict cache pages in
+an attempt to get more contiguous free memory.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/staging/android/lowmemorykiller.c |   13 +++++++++----
+ 1 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/android/lowmemorykiller.c b/drivers/staging/android/lowmemorykiller.c
+index b9a2e84..b2ab7fa 100644
+--- a/drivers/staging/android/lowmemorykiller.c
++++ b/drivers/staging/android/lowmemorykiller.c
+@@ -58,20 +58,25 @@ static int lowmem_shrink(int nr_to_scan, gfp_t gfp_mask)
+ 	int min_adj = OOM_ADJUST_MAX + 1;
+ 	int selected_tasksize = 0;
+ 	int array_size = ARRAY_SIZE(lowmem_adj);
+-	int other_free = global_page_state(NR_FREE_PAGES) + global_page_state(NR_FILE_PAGES);
++	int other_free = global_page_state(NR_FREE_PAGES);
++	int other_file = global_page_state(NR_FILE_PAGES);
+ 	if(lowmem_adj_size < array_size)
+ 		array_size = lowmem_adj_size;
+ 	if(lowmem_minfree_size < array_size)
+ 		array_size = lowmem_minfree_size;
+ 	for(i = 0; i < array_size; i++) {
+-		if(other_free < lowmem_minfree[i]) {
++		if (other_free < lowmem_minfree[i] &&
++		    other_file < lowmem_minfree[i]) {
+ 			min_adj = lowmem_adj[i];
+ 			break;
+ 		}
+ 	}
+ 	if(nr_to_scan > 0)
+-		lowmem_print(3, "lowmem_shrink %d, %x, ofree %d, ma %d\n", nr_to_scan, gfp_mask, other_free, min_adj);
+-	rem = global_page_state(NR_ACTIVE) + global_page_state(NR_INACTIVE);
++		lowmem_print(3, "lowmem_shrink %d, %x, ofree %d %d, ma %d\n", nr_to_scan, gfp_mask, other_free, other_file, min_adj);
++	rem = global_page_state(NR_ACTIVE_ANON) +
++		global_page_state(NR_ACTIVE_FILE) +
++		global_page_state(NR_INACTIVE_ANON) +
++		global_page_state(NR_INACTIVE_FILE);
+ 	if (nr_to_scan <= 0 || min_adj == OOM_ADJUST_MAX + 1) {
+ 		lowmem_print(5, "lowmem_shrink %d, %x, return %d\n", nr_to_scan, gfp_mask, rem);
+ 		return rem;
+-- 
+1.6.2
+
diff --git a/target/linux/goldfish/patches-2.6.30/0054-timed_gpio-Separate-timed_output-class-into-a-separ.patch b/target/linux/goldfish/patches-2.6.30/0054-timed_gpio-Separate-timed_output-class-into-a-separ.patch
new file mode 100644
index 0000000000..fac656e0cb
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0054-timed_gpio-Separate-timed_output-class-into-a-separ.patch
@@ -0,0 +1,432 @@
+From e4c9c5d7d6d5deb124083678fe5d839d3133f60a Mon Sep 17 00:00:00 2001
+From: Mike Lockwood <lockwood@android.com>
+Date: Mon, 12 Jan 2009 13:25:05 -0500
+Subject: [PATCH 054/134] timed_gpio: Separate timed_output class into a separate driver.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Mike Lockwood <lockwood@android.com>
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/staging/android/Kconfig        |    6 ++-
+ drivers/staging/android/Makefile       |    1 +
+ drivers/staging/android/timed_gpio.c   |   98 +++++++++++--------------
+ drivers/staging/android/timed_gpio.h   |    4 +-
+ drivers/staging/android/timed_output.c |  121 ++++++++++++++++++++++++++++++++
+ drivers/staging/android/timed_output.h |   37 ++++++++++
+ 6 files changed, 210 insertions(+), 57 deletions(-)
+ create mode 100644 drivers/staging/android/timed_output.c
+ create mode 100644 drivers/staging/android/timed_output.h
+
+diff --git a/drivers/staging/android/Kconfig b/drivers/staging/android/Kconfig
+index 604bd1e..1784508 100644
+--- a/drivers/staging/android/Kconfig
++++ b/drivers/staging/android/Kconfig
+@@ -73,9 +73,13 @@ config ANDROID_RAM_CONSOLE_EARLY_SIZE
+ 	default 0
+ 	depends on ANDROID_RAM_CONSOLE_EARLY_INIT
+ 
++config ANDROID_TIMED_OUTPUT
++	bool "Timed output class driver"
++	default y
++
+ config ANDROID_TIMED_GPIO
+ 	tristate "Android timed gpio driver"
+-	depends on GENERIC_GPIO
++	depends on GENERIC_GPIO && ANDROID_TIMED_OUTPUT
+ 	default n
+ 
+ config ANDROID_LOW_MEMORY_KILLER
+diff --git a/drivers/staging/android/Makefile b/drivers/staging/android/Makefile
+index 95209d6..8e057e6 100644
+--- a/drivers/staging/android/Makefile
++++ b/drivers/staging/android/Makefile
+@@ -1,5 +1,6 @@
+ obj-$(CONFIG_ANDROID_BINDER_IPC)	+= binder.o
+ obj-$(CONFIG_ANDROID_LOGGER)		+= logger.o
+ obj-$(CONFIG_ANDROID_RAM_CONSOLE)	+= ram_console.o
++obj-$(CONFIG_ANDROID_TIMED_OUTPUT)	+= timed_output.o
+ obj-$(CONFIG_ANDROID_TIMED_GPIO)	+= timed_gpio.o
+ obj-$(CONFIG_ANDROID_LOW_MEMORY_KILLER)	+= lowmemorykiller.o
+diff --git a/drivers/staging/android/timed_gpio.c b/drivers/staging/android/timed_gpio.c
+index 33daff0..be7cdaa 100644
+--- a/drivers/staging/android/timed_gpio.c
++++ b/drivers/staging/android/timed_gpio.c
+@@ -20,13 +20,12 @@
+ #include <linux/err.h>
+ #include <linux/gpio.h>
+ 
++#include "timed_output.h"
+ #include "timed_gpio.h"
+ 
+ 
+-static struct class *timed_gpio_class;
+-
+ struct timed_gpio_data {
+-	struct device *dev;
++	struct timed_output_dev dev;
+ 	struct hrtimer timer;
+ 	spinlock_t lock;
+ 	unsigned 	gpio;
+@@ -36,70 +35,62 @@ struct timed_gpio_data {
+ 
+ static enum hrtimer_restart gpio_timer_func(struct hrtimer *timer)
+ {
+-	struct timed_gpio_data *gpio_data = container_of(timer, struct timed_gpio_data, timer);
++	struct timed_gpio_data *data =
++		container_of(timer, struct timed_gpio_data, timer);
+ 
+-	gpio_direction_output(gpio_data->gpio, gpio_data->active_low ? 1 : 0);
++	gpio_direction_output(data->gpio, data->active_low ? 1 : 0);
+ 	return HRTIMER_NORESTART;
+ }
+ 
+-static ssize_t gpio_enable_show(struct device *dev, struct device_attribute *attr, char *buf)
++static int gpio_get_time(struct timed_output_dev *dev)
+ {
+-	struct timed_gpio_data *gpio_data = dev_get_drvdata(dev);
+-	int remaining;
++	struct timed_gpio_data	*data =
++		container_of(dev, struct timed_gpio_data, dev);
+ 
+-	if (hrtimer_active(&gpio_data->timer)) {
+-		ktime_t r = hrtimer_get_remaining(&gpio_data->timer);
++	if (hrtimer_active(&data->timer)) {
++		ktime_t r = hrtimer_get_remaining(&data->timer);
+ 		struct timeval t = ktime_to_timeval(r);
+-		remaining = t.tv_sec * 1000 + t.tv_usec / 1000;
++		return t.tv_sec * 1000 + t.tv_usec / 1000;
+ 	} else
+-		remaining = 0;
+-
+-	return sprintf(buf, "%d\n", remaining);
++		return 0;
+ }
+ 
+-static ssize_t gpio_enable_store(
+-		struct device *dev, struct device_attribute *attr,
+-		const char *buf, size_t size)
++static void gpio_enable(struct timed_output_dev *dev, int value)
+ {
+-	struct timed_gpio_data *gpio_data = dev_get_drvdata(dev);
+-	int value;
++	struct timed_gpio_data	*data =
++		container_of(dev, struct timed_gpio_data, dev);
+ 	unsigned long	flags;
+ 
+-	sscanf(buf, "%d", &value);
+-
+-	spin_lock_irqsave(&gpio_data->lock, flags);
++	spin_lock_irqsave(&data->lock, flags);
+ 
+ 	/* cancel previous timer and set GPIO according to value */
+-	hrtimer_cancel(&gpio_data->timer);
+-	gpio_direction_output(gpio_data->gpio, gpio_data->active_low ? !value : !!value);
++	hrtimer_cancel(&data->timer);
++	gpio_direction_output(data->gpio, data->active_low ? !value : !!value);
+ 
+ 	if (value > 0) {
+-		if (value > gpio_data->max_timeout)
+-			value = gpio_data->max_timeout;
++		if (value > data->max_timeout)
++			value = data->max_timeout;
+ 
+-		hrtimer_start(&gpio_data->timer,
+-						ktime_set(value / 1000, (value % 1000) * 1000000),
+-						HRTIMER_MODE_REL);
++		hrtimer_start(&data->timer,
++			ktime_set(value / 1000, (value % 1000) * 1000000),
++			HRTIMER_MODE_REL);
+ 	}
+ 
+-	spin_unlock_irqrestore(&gpio_data->lock, flags);
+-
+-	return size;
++	spin_unlock_irqrestore(&data->lock, flags);
+ }
+ 
+-static DEVICE_ATTR(enable, S_IRUGO | S_IWUSR, gpio_enable_show, gpio_enable_store);
+-
+ static int timed_gpio_probe(struct platform_device *pdev)
+ {
+ 	struct timed_gpio_platform_data *pdata = pdev->dev.platform_data;
+ 	struct timed_gpio *cur_gpio;
+ 	struct timed_gpio_data *gpio_data, *gpio_dat;
+-	int i, ret = 0;
++	int i, j, ret = 0;
+ 
+ 	if (!pdata)
+ 		return -EBUSY;
+ 
+-	gpio_data = kzalloc(sizeof(struct timed_gpio_data) * pdata->num_gpios, GFP_KERNEL);
++	gpio_data = kzalloc(sizeof(struct timed_gpio_data) * pdata->num_gpios,
++			GFP_KERNEL);
+ 	if (!gpio_data)
+ 		return -ENOMEM;
+ 
+@@ -107,23 +98,26 @@ static int timed_gpio_probe(struct platform_device *pdev)
+ 		cur_gpio = &pdata->gpios[i];
+ 		gpio_dat = &gpio_data[i];
+ 
+-		hrtimer_init(&gpio_dat->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++		hrtimer_init(&gpio_dat->timer, CLOCK_MONOTONIC,
++				HRTIMER_MODE_REL);
+ 		gpio_dat->timer.function = gpio_timer_func;
+ 		spin_lock_init(&gpio_dat->lock);
+ 
++		gpio_dat->dev.name = cur_gpio->name;
++		gpio_dat->dev.get_time = gpio_get_time;
++		gpio_dat->dev.enable = gpio_enable;
++		ret = timed_output_dev_register(&gpio_dat->dev);
++		if (ret < 0) {
++			for (j = 0; j < i; j++)
++				timed_output_dev_unregister(&gpio_data[i].dev);
++			kfree(gpio_data);
++			return ret;
++		}
++
+ 		gpio_dat->gpio = cur_gpio->gpio;
+ 		gpio_dat->max_timeout = cur_gpio->max_timeout;
+ 		gpio_dat->active_low = cur_gpio->active_low;
+ 		gpio_direction_output(gpio_dat->gpio, gpio_dat->active_low);
+-
+-		gpio_dat->dev = device_create(timed_gpio_class, &pdev->dev, 0, "%s", cur_gpio->name);
+-		if (unlikely(IS_ERR(gpio_dat->dev)))
+-			return PTR_ERR(gpio_dat->dev);
+-
+-		dev_set_drvdata(gpio_dat->dev, gpio_dat);
+-		ret = device_create_file(gpio_dat->dev, &dev_attr_enable);
+-		if (ret)
+-			return ret;
+ 	}
+ 
+ 	platform_set_drvdata(pdev, gpio_data);
+@@ -137,10 +131,8 @@ static int timed_gpio_remove(struct platform_device *pdev)
+ 	struct timed_gpio_data *gpio_data = platform_get_drvdata(pdev);
+ 	int i;
+ 
+-	for (i = 0; i < pdata->num_gpios; i++) {
+-		device_remove_file(gpio_data[i].dev, &dev_attr_enable);
+-		device_unregister(gpio_data[i].dev);
+-	}
++	for (i = 0; i < pdata->num_gpios; i++)
++		timed_output_dev_unregister(&gpio_data[i].dev);
+ 
+ 	kfree(gpio_data);
+ 
+@@ -151,22 +143,18 @@ static struct platform_driver timed_gpio_driver = {
+ 	.probe		= timed_gpio_probe,
+ 	.remove		= timed_gpio_remove,
+ 	.driver		= {
+-		.name		= "timed-gpio",
++		.name		= TIMED_GPIO_NAME,
+ 		.owner		= THIS_MODULE,
+ 	},
+ };
+ 
+ static int __init timed_gpio_init(void)
+ {
+-	timed_gpio_class = class_create(THIS_MODULE, "timed_output");
+-	if (IS_ERR(timed_gpio_class))
+-		return PTR_ERR(timed_gpio_class);
+ 	return platform_driver_register(&timed_gpio_driver);
+ }
+ 
+ static void __exit timed_gpio_exit(void)
+ {
+-	class_destroy(timed_gpio_class);
+ 	platform_driver_unregister(&timed_gpio_driver);
+ }
+ 
+diff --git a/drivers/staging/android/timed_gpio.h b/drivers/staging/android/timed_gpio.h
+index 78449b2..a0e15f8 100644
+--- a/drivers/staging/android/timed_gpio.h
++++ b/drivers/staging/android/timed_gpio.h
+@@ -16,10 +16,12 @@
+ #ifndef _LINUX_TIMED_GPIO_H
+ #define _LINUX_TIMED_GPIO_H
+ 
++#define TIMED_GPIO_NAME "timed-gpio"
++
+ struct timed_gpio {
+ 	const char *name;
+ 	unsigned 	gpio;
+-	int     max_timeout;
++	int		max_timeout;
+ 	u8 		active_low;
+ };
+ 
+diff --git a/drivers/staging/android/timed_output.c b/drivers/staging/android/timed_output.c
+new file mode 100644
+index 0000000..62e7918
+--- /dev/null
++++ b/drivers/staging/android/timed_output.c
+@@ -0,0 +1,121 @@
++/* drivers/misc/timed_output.c
++ *
++ * Copyright (C) 2009 Google, Inc.
++ * Author: Mike Lockwood <lockwood@android.com>
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/device.h>
++#include <linux/fs.h>
++#include <linux/err.h>
++
++#include "timed_output.h"
++
++static struct class *timed_output_class;
++static atomic_t device_count;
++
++static ssize_t enable_show(struct device *dev, struct device_attribute *attr,
++		char *buf)
++{
++	struct timed_output_dev *tdev = dev_get_drvdata(dev);
++	int remaining = tdev->get_time(tdev);
++
++	return sprintf(buf, "%d\n", remaining);
++}
++
++static ssize_t enable_store(
++		struct device *dev, struct device_attribute *attr,
++		const char *buf, size_t size)
++{
++	struct timed_output_dev *tdev = dev_get_drvdata(dev);
++	int value;
++
++	sscanf(buf, "%d", &value);
++	tdev->enable(tdev, value);
++
++	return size;
++}
++
++static DEVICE_ATTR(enable, S_IRUGO | S_IWUSR, enable_show, enable_store);
++
++static int create_timed_output_class(void)
++{
++	if (!timed_output_class) {
++		timed_output_class = class_create(THIS_MODULE, "timed_output");
++		if (IS_ERR(timed_output_class))
++			return PTR_ERR(timed_output_class);
++		atomic_set(&device_count, 0);
++	}
++
++	return 0;
++}
++
++int timed_output_dev_register(struct timed_output_dev *tdev)
++{
++	int ret;
++
++	if (!tdev || !tdev->name || !tdev->enable || !tdev->get_time)
++		return -EINVAL;
++
++	ret = create_timed_output_class();
++	if (ret < 0)
++		return ret;
++
++	tdev->index = atomic_inc_return(&device_count);
++	tdev->dev = device_create(timed_output_class, NULL,
++		MKDEV(0, tdev->index), NULL, tdev->name);
++	if (IS_ERR(tdev->dev))
++		return PTR_ERR(tdev->dev);
++
++	ret = device_create_file(tdev->dev, &dev_attr_enable);
++	if (ret < 0)
++		goto err_create_file;
++
++	dev_set_drvdata(tdev->dev, tdev);
++	tdev->state = 0;
++	return 0;
++
++err_create_file:
++	device_destroy(timed_output_class, MKDEV(0, tdev->index));
++	printk(KERN_ERR "timed_output: Failed to register driver %s\n",
++			tdev->name);
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(timed_output_dev_register);
++
++void timed_output_dev_unregister(struct timed_output_dev *tdev)
++{
++	device_remove_file(tdev->dev, &dev_attr_enable);
++	device_destroy(timed_output_class, MKDEV(0, tdev->index));
++	dev_set_drvdata(tdev->dev, NULL);
++}
++EXPORT_SYMBOL_GPL(timed_output_dev_unregister);
++
++static int __init timed_output_init(void)
++{
++	return create_timed_output_class();
++}
++
++static void __exit timed_output_exit(void)
++{
++	class_destroy(timed_output_class);
++}
++
++module_init(timed_output_init);
++module_exit(timed_output_exit);
++
++MODULE_AUTHOR("Mike Lockwood <lockwood@android.com>");
++MODULE_DESCRIPTION("timed output class driver");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/staging/android/timed_output.h b/drivers/staging/android/timed_output.h
+new file mode 100644
+index 0000000..ec907ab
+--- /dev/null
++++ b/drivers/staging/android/timed_output.h
+@@ -0,0 +1,37 @@
++/* include/linux/timed_output.h
++ *
++ * Copyright (C) 2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++*/
++
++#ifndef _LINUX_TIMED_OUTPUT_H
++#define _LINUX_TIMED_OUTPUT_H
++
++struct timed_output_dev {
++	const char	*name;
++
++	/* enable the output and set the timer */
++	void	(*enable)(struct timed_output_dev *sdev, int timeout);
++
++	/* returns the current number of milliseconds remaining on the timer */
++	int		(*get_time)(struct timed_output_dev *sdev);
++
++	/* private data */
++	struct device	*dev;
++	int		index;
++	int		state;
++};
++
++extern int timed_output_dev_register(struct timed_output_dev *dev);
++extern void timed_output_dev_unregister(struct timed_output_dev *dev);
++
++#endif
+-- 
+1.6.2
+
diff --git a/target/linux/goldfish/patches-2.6.30/0055-mm-Add-min_free_order_shift-tunable.patch b/target/linux/goldfish/patches-2.6.30/0055-mm-Add-min_free_order_shift-tunable.patch
new file mode 100644
index 0000000000..2c6e329527
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0055-mm-Add-min_free_order_shift-tunable.patch
@@ -0,0 +1,62 @@
+From d620f695290e4ffb1586420ba1dbbb5b2c8c075d Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Tue, 17 Feb 2009 14:51:02 -0800
+Subject: [PATCH 055/134] mm: Add min_free_order_shift tunable.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+By default the kernel tries to keep half as much memory free at each
+order as it does for one order below. This can be too agressive when
+running without swap.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ kernel/sysctl.c |    9 +++++++++
+ mm/page_alloc.c |    3 ++-
+ 2 files changed, 11 insertions(+), 1 deletions(-)
+
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -77,6 +77,7 @@ extern int suid_dumpable;
+ extern char core_pattern[];
+ extern int pid_max;
+ extern int min_free_kbytes;
++extern int min_free_order_shift;
+ extern int pid_max_min, pid_max_max;
+ extern int sysctl_drop_caches;
+ extern int percpu_pagelist_fraction;
+@@ -1109,6 +1110,14 @@ static struct ctl_table vm_table[] = {
+ 		.extra1		= &zero,
+ 	},
+ 	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "min_free_order_shift",
++		.data		= &min_free_order_shift,
++		.maxlen		= sizeof(min_free_order_shift),
++		.mode		= 0644,
++		.proc_handler	= &proc_dointvec
++	},
++	{
+ 		.ctl_name	= VM_PERCPU_PAGELIST_FRACTION,
+ 		.procname	= "percpu_pagelist_fraction",
+ 		.data		= &percpu_pagelist_fraction,
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -119,6 +119,7 @@ static char * const zone_names[MAX_NR_ZO
+ };
+ 
+ int min_free_kbytes = 1024;
++int min_free_order_shift = 1;
+ 
+ unsigned long __meminitdata nr_kernel_pages;
+ unsigned long __meminitdata nr_all_pages;
+@@ -1253,7 +1254,7 @@ int zone_watermark_ok(struct zone *z, in
+ 		free_pages -= z->free_area[o].nr_free << o;
+ 
+ 		/* Require fewer higher order pages to be free */
+-		min >>= 1;
++		min >>= min_free_order_shift;
+ 
+ 		if (free_pages <= min)
+ 			return 0;
diff --git a/target/linux/goldfish/patches-2.6.30/0056-mm-Check-if-any-page-in-a-pageblock-is-reserved-bef.patch b/target/linux/goldfish/patches-2.6.30/0056-mm-Check-if-any-page-in-a-pageblock-is-reserved-bef.patch
new file mode 100644
index 0000000000..63a9bcd492
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0056-mm-Check-if-any-page-in-a-pageblock-is-reserved-bef.patch
@@ -0,0 +1,45 @@
+From a4eb204a8029320c2dd748daf4f51fd48d337c3d Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Wed, 18 Mar 2009 17:27:31 -0700
+Subject: [PATCH 056/134] mm: Check if any page in a pageblock is reserved before marking it MIGRATE_RESERVE
+
+This fixes a problem where the first pageblock got marked MIGRATE_RESERVE even
+though it only had a few free pages. This in turn caused no contiguous memory
+to be reserved and frequent kswapd wakeups that emptied the caches to get more
+contiguous memory.
+---
+ mm/page_alloc.c |   16 +++++++++++++++-
+ 1 files changed, 15 insertions(+), 1 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2545,6 +2545,20 @@ static inline unsigned long wait_table_b
+ #define LONG_ALIGN(x) (((x)+(sizeof(long))-1)&~((sizeof(long))-1))
+ 
+ /*
++ * Check if a pageblock contains reserved pages
++ */
++static int pageblock_is_reserved(unsigned long start_pfn)
++{
++	unsigned long end_pfn = start_pfn + pageblock_nr_pages;
++	unsigned long pfn;
++
++	for (pfn = start_pfn; pfn < end_pfn; pfn++)
++		if (PageReserved(pfn_to_page(pfn)))
++			return 1;
++	return 0;
++}
++
++/*
+  * Mark a number of pageblocks as MIGRATE_RESERVE. The number
+  * of blocks reserved is based on zone->pages_min. The memory within the
+  * reserve will tend to store contiguous free pages. Setting min_free_kbytes
+@@ -2573,7 +2587,7 @@ static void setup_zone_migrate_reserve(s
+ 			continue;
+ 
+ 		/* Blocks with reserved pages will never free, skip them. */
+-		if (PageReserved(page))
++		if (pageblock_is_reserved(pfn))
+ 			continue;
+ 
+ 		block_migratetype = get_pageblock_migratetype(page);
diff --git a/target/linux/goldfish/patches-2.6.30/0058-sched-Enable-might_sleep-before-initializing-driver.patch b/target/linux/goldfish/patches-2.6.30/0058-sched-Enable-might_sleep-before-initializing-driver.patch
new file mode 100644
index 0000000000..126cac0188
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0058-sched-Enable-might_sleep-before-initializing-driver.patch
@@ -0,0 +1,43 @@
+From 10276fd993c6e4c92d8086a6ccd0c9e0ff53b053 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Wed, 10 Dec 2008 20:06:28 -0800
+Subject: [PATCH 058/134] sched: Enable might_sleep before initializing drivers.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+This allows detection of init bugs in built-in drivers.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ kernel/sched.c |   14 ++++++++++++--
+ 1 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -9064,13 +9064,23 @@ void __init sched_init(void)
+ }
+ 
+ #ifdef CONFIG_DEBUG_SPINLOCK_SLEEP
++static int __might_sleep_init_called;
++int __init __might_sleep_init(void)
++{
++	__might_sleep_init_called = 1;
++	return 0;
++}
++early_initcall(__might_sleep_init);
++
+ void __might_sleep(char *file, int line)
+ {
+ #ifdef in_atomic
+ 	static unsigned long prev_jiffy;	/* ratelimiting */
+ 
+-	if ((!in_atomic() && !irqs_disabled()) ||
+-		    system_state != SYSTEM_RUNNING || oops_in_progress)
++	if ((!in_atomic() && !irqs_disabled()) || oops_in_progress)
++		return;
++	if (system_state != SYSTEM_RUNNING &&
++	    (!__might_sleep_init_called || system_state != SYSTEM_BOOTING))
+ 		return;
+ 	if (time_before(jiffies, prev_jiffy + HZ) && prev_jiffy)
+ 		return;
diff --git a/target/linux/goldfish/patches-2.6.30/0060--ARM-Add-code-to-prevent-system-calls-from-being-re.patch b/target/linux/goldfish/patches-2.6.30/0060--ARM-Add-code-to-prevent-system-calls-from-being-re.patch
new file mode 100644
index 0000000000..f0d33ed211
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0060--ARM-Add-code-to-prevent-system-calls-from-being-re.patch
@@ -0,0 +1,35 @@
+From d52bcb0a807dde87057f330dbe95aa6d221a4b85 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Mon, 9 Apr 2007 17:13:02 +0700
+Subject: [PATCH 060/134] [ARM] Add code to prevent system calls from being restarted muliple times before returning from the kernel.
+
+Fixes crashes with thumb syscalls.
+---
+ arch/arm/kernel/signal.c |    9 +++++++++
+ 1 files changed, 9 insertions(+), 0 deletions(-)
+
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -534,6 +534,14 @@ setup_rt_frame(int usig, struct k_sigact
+ 
+ static inline void restart_syscall(struct pt_regs *regs)
+ {
++	if (regs->ARM_ORIG_r0 == -ERESTARTNOHAND ||
++	    regs->ARM_ORIG_r0 == -ERESTARTSYS ||
++	    regs->ARM_ORIG_r0 == -ERESTARTNOINTR ||
++	    regs->ARM_ORIG_r0 == -ERESTART_RESTARTBLOCK) {
++		/* the syscall cannot be safely restarted, return -EINTR instead */
++		regs->ARM_r0 = -EINTR;
++		return;
++	}
+ 	regs->ARM_r0 = regs->ARM_ORIG_r0;
+ 	regs->ARM_pc -= thumb_mode(regs) ? 2 : 4;
+ }
+@@ -650,6 +658,7 @@ static int do_signal(sigset_t *oldset, s
+ 	 */
+ 	if (syscall) {
+ 		if (regs->ARM_r0 == -ERESTART_RESTARTBLOCK) {
++			regs->ARM_r0 = -EAGAIN; /* prevent multiple restarts */
+ 			if (thumb_mode(regs)) {
+ 				regs->ARM_r7 = __NR_restart_syscall - __NR_SYSCALL_BASE;
+ 				regs->ARM_pc -= 2;
diff --git a/target/linux/goldfish/patches-2.6.30/0061--ARM-Save-thread-registers-in-coredumps.patch b/target/linux/goldfish/patches-2.6.30/0061--ARM-Save-thread-registers-in-coredumps.patch
new file mode 100644
index 0000000000..44f78b6385
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0061--ARM-Save-thread-registers-in-coredumps.patch
@@ -0,0 +1,50 @@
+From 784b170a69906c48a688a9ffa7512fc858f8836c Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Sun, 30 Mar 2008 21:36:29 -0700
+Subject: [PATCH 061/134] [ARM] Save thread registers in coredumps
+
+Signed-off-by: Brian Swetland <swetland@google.com>
+---
+ arch/arm/include/asm/elf.h |    6 ++++++
+ arch/arm/kernel/process.c  |   10 ++++++++++
+ 2 files changed, 16 insertions(+), 0 deletions(-)
+
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -86,6 +86,10 @@ extern char elf_platform[];
+ 
+ struct elf32_hdr;
+ 
++struct task_struct;
++
++extern int dump_task_regs (struct task_struct *, elf_gregset_t *);
++
+ /*
+  * This is used to ensure we don't load something for the wrong architecture.
+  */
+@@ -113,4 +117,6 @@ extern int arm_elf_read_implies_exec(con
+ extern void elf_set_personality(const struct elf32_hdr *);
+ #define SET_PERSONALITY(ex)	elf_set_personality(&(ex))
+ 
++#define ELF_CORE_COPY_TASK_REGS(tsk, elf_regs) dump_task_regs(tsk, elf_regs)
++
+ #endif
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -337,6 +337,16 @@ int dump_fpu (struct pt_regs *regs, stru
+ EXPORT_SYMBOL(dump_fpu);
+ 
+ /*
++ * Capture the user space registers if the task is not running (in user space)
++ */
++int dump_task_regs(struct task_struct *tsk, elf_gregset_t *regs)
++{
++	struct pt_regs ptregs = *task_pt_regs(tsk);
++	elf_core_copy_regs(regs, &ptregs);
++	return 1;
++}
++
++/*
+  * Shuffle the argument into the correct register before calling the
+  * thread function.  r1 is the thread argument, r2 is the pointer to
+  * the thread function, and r3 points to the exit function.
diff --git a/target/linux/goldfish/patches-2.6.30/0064-PM-Add-wake-lock-api.patch b/target/linux/goldfish/patches-2.6.30/0064-PM-Add-wake-lock-api.patch
new file mode 100644
index 0000000000..bd4d364adc
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0064-PM-Add-wake-lock-api.patch
@@ -0,0 +1,104 @@
+From e93bd714c424d9fe907cb1d8ec5ce784767a3b16 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Fri, 26 Sep 2008 22:10:56 -0700
+Subject: [PATCH 064/134] PM: Add wake lock api.
+
+---
+ include/linux/wakelock.h |   91 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 files changed, 91 insertions(+), 0 deletions(-)
+ create mode 100755 include/linux/wakelock.h
+
+--- /dev/null
++++ b/include/linux/wakelock.h
+@@ -0,0 +1,91 @@
++/* include/linux/wakelock.h
++ *
++ * Copyright (C) 2007-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#ifndef _LINUX_WAKELOCK_H
++#define _LINUX_WAKELOCK_H
++
++#include <linux/list.h>
++#include <linux/ktime.h>
++
++/* A wake_lock prevents the system from entering suspend or other low power
++ * states when active. If the type is set to WAKE_LOCK_SUSPEND, the wake_lock
++ * prevents a full system suspend. If the type is WAKE_LOCK_IDLE, low power
++ * states that cause large interrupt latencies or that disable a set of
++ * interrupts will not entered from idle until the wake_locks are released.
++ */
++
++enum {
++	WAKE_LOCK_SUSPEND, /* Prevent suspend */
++	WAKE_LOCK_IDLE,    /* Prevent low power idle */
++	WAKE_LOCK_TYPE_COUNT
++};
++
++struct wake_lock {
++#ifdef CONFIG_HAS_WAKELOCK
++	struct list_head    link;
++	int                 flags;
++	const char         *name;
++	unsigned long       expires;
++#ifdef CONFIG_WAKELOCK_STAT
++	struct {
++		int             count;
++		int             expire_count;
++		int             wakeup_count;
++		ktime_t         total_time;
++		ktime_t         prevent_suspend_time;
++		ktime_t         max_time;
++		ktime_t         last_time;
++	} stat;
++#endif
++#endif
++};
++
++#ifdef CONFIG_HAS_WAKELOCK
++
++void wake_lock_init(struct wake_lock *lock, int type, const char *name);
++void wake_lock_destroy(struct wake_lock *lock);
++void wake_lock(struct wake_lock *lock);
++void wake_lock_timeout(struct wake_lock *lock, long timeout);
++void wake_unlock(struct wake_lock *lock);
++
++/* wake_lock_active returns a non-zero value if the wake_lock is currently
++ * locked. If the wake_lock has a timeout, it does not check the timeout
++ * but if the timeout had aready been checked it will return 0.
++ */
++int wake_lock_active(struct wake_lock *lock);
++
++/* has_wake_lock returns 0 if no wake locks of the specified type are active,
++ * and non-zero if one or more wake locks are held. Specifically it returns
++ * -1 if one or more wake locks with no timeout are active or the
++ * number of jiffies until all active wake locks time out.
++ */
++long has_wake_lock(int type);
++
++#else
++
++static inline void wake_lock_init(struct wake_lock *lock, int type,
++					const char *name) {}
++static inline void wake_lock_destroy(struct wake_lock *lock) {}
++static inline void wake_lock(struct wake_lock *lock) {}
++static inline void wake_lock_timeout(struct wake_lock *lock, long timeout) {}
++static inline void wake_unlock(struct wake_lock *lock) {}
++
++static inline int wake_lock_active(struct wake_lock *lock) { return 0; }
++static inline long has_wake_lock(int type) { return 0; }
++
++#endif
++
++#endif
++
diff --git a/target/linux/goldfish/patches-2.6.30/0065-PM-Add-early-suspend-api.patch b/target/linux/goldfish/patches-2.6.30/0065-PM-Add-early-suspend-api.patch
new file mode 100644
index 0000000000..02adef68a4
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0065-PM-Add-early-suspend-api.patch
@@ -0,0 +1,69 @@
+From 4f76252afe98fd017894e61c296bc61836e67a4a Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Fri, 26 Sep 2008 22:10:56 -0700
+Subject: [PATCH 065/134] PM: Add early suspend api.
+
+---
+ include/linux/earlysuspend.h |   56 ++++++++++++++++++++++++++++++++++++++++++
+ 1 files changed, 56 insertions(+), 0 deletions(-)
+ create mode 100755 include/linux/earlysuspend.h
+
+--- /dev/null
++++ b/include/linux/earlysuspend.h
+@@ -0,0 +1,56 @@
++/* include/linux/earlysuspend.h
++ *
++ * Copyright (C) 2007-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#ifndef _LINUX_EARLYSUSPEND_H
++#define _LINUX_EARLYSUSPEND_H
++
++#ifdef CONFIG_HAS_EARLYSUSPEND
++#include <linux/list.h>
++#endif
++
++/* The early_suspend structure defines suspend and resume hooks to be called
++ * when the user visible sleep state of the system changes, and a level to
++ * control the order. They can be used to turn off the screen and input
++ * devices that are not used for wakeup.
++ * Suspend handlers are called in low to high level order, resume handlers are
++ * called in the opposite order. If, when calling register_early_suspend,
++ * the suspend handlers have already been called without a matching call to the
++ * resume handlers, the suspend handler will be called directly from
++ * register_early_suspend. This direct call can violate the normal level order.
++ */
++enum {
++	EARLY_SUSPEND_LEVEL_BLANK_SCREEN = 50,
++	EARLY_SUSPEND_LEVEL_STOP_DRAWING = 100,
++	EARLY_SUSPEND_LEVEL_DISABLE_FB = 150,
++};
++struct early_suspend {
++#ifdef CONFIG_HAS_EARLYSUSPEND
++	struct list_head link;
++	int level;
++	void (*suspend)(struct early_suspend *h);
++	void (*resume)(struct early_suspend *h);
++#endif
++};
++
++#ifdef CONFIG_HAS_EARLYSUSPEND
++void register_early_suspend(struct early_suspend *handler);
++void unregister_early_suspend(struct early_suspend *handler);
++#else
++#define register_early_suspend(handler) do { } while (0)
++#define unregister_early_suspend(handler) do { } while (0)
++#endif
++
++#endif
++
diff --git a/target/linux/goldfish/patches-2.6.30/0066-PM-Implement-wakelock-api.patch b/target/linux/goldfish/patches-2.6.30/0066-PM-Implement-wakelock-api.patch
new file mode 100644
index 0000000000..610bc1f518
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0066-PM-Implement-wakelock-api.patch
@@ -0,0 +1,673 @@
+From eef7f012d480142a3eccff91e0ae73ecb13220b3 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Tue, 9 Sep 2008 22:14:34 -0700
+Subject: [PATCH 066/134] PM: Implement wakelock api.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+PM: wakelock: Replace expire work with a timer
+
+The expire work function did not work in the normal case.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ kernel/power/Kconfig    |   19 ++
+ kernel/power/Makefile   |    1 +
+ kernel/power/power.h    |    7 +
+ kernel/power/wakelock.c |  598 +++++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 625 insertions(+), 0 deletions(-)
+ create mode 100644 kernel/power/wakelock.c
+
+--- a/kernel/power/Kconfig
++++ b/kernel/power/Kconfig
+@@ -116,6 +116,25 @@ config SUSPEND_FREEZER
+ 
+ 	  Turning OFF this setting is NOT recommended! If in doubt, say Y.
+ 
++config HAS_WAKELOCK
++	bool
++
++config WAKELOCK
++	bool "Wake lock"
++	depends on PM && RTC_CLASS
++	default n
++	select HAS_WAKELOCK
++	---help---
++	  Enable wakelocks. When user space request a sleep state the
++	  sleep request will be delayed until no wake locks are held.
++
++config WAKELOCK_STAT
++	bool "Wake lock stats"
++	depends on WAKELOCK
++	default y
++	---help---
++	  Report wake lock stats in /proc/wakelocks
++
+ config HIBERNATION
+ 	bool "Hibernation (aka 'suspend to disk')"
+ 	depends on PM && SWAP && ARCH_HIBERNATION_POSSIBLE
+--- a/kernel/power/Makefile
++++ b/kernel/power/Makefile
+@@ -6,6 +6,7 @@ endif
+ obj-$(CONFIG_PM)		+= main.o
+ obj-$(CONFIG_PM_SLEEP)		+= console.o
+ obj-$(CONFIG_FREEZER)		+= process.o
++obj-$(CONFIG_WAKELOCK)		+= wakelock.o
+ obj-$(CONFIG_HIBERNATION)	+= swsusp.o disk.o snapshot.o swap.o user.o
+ 
+ obj-$(CONFIG_MAGIC_SYSRQ)	+= poweroff.o
+--- a/kernel/power/power.h
++++ b/kernel/power/power.h
+@@ -223,3 +223,10 @@ static inline void suspend_thaw_processe
+ {
+ }
+ #endif
++
++#ifdef CONFIG_WAKELOCK
++/* kernel/power/wakelock.c */
++extern struct workqueue_struct *suspend_work_queue;
++extern struct wake_lock main_wake_lock;
++extern suspend_state_t requested_suspend_state;
++#endif
+--- /dev/null
++++ b/kernel/power/wakelock.c
+@@ -0,0 +1,598 @@
++/* kernel/power/wakelock.c
++ *
++ * Copyright (C) 2005-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/rtc.h>
++#include <linux/suspend.h>
++#include <linux/syscalls.h> /* sys_sync */
++#include <linux/wakelock.h>
++#ifdef CONFIG_WAKELOCK_STAT
++#include <linux/proc_fs.h>
++#endif
++#include "power.h"
++
++enum {
++	DEBUG_EXIT_SUSPEND = 1U << 0,
++	DEBUG_WAKEUP = 1U << 1,
++	DEBUG_SUSPEND = 1U << 2,
++	DEBUG_EXPIRE = 1U << 3,
++	DEBUG_WAKE_LOCK = 1U << 4,
++};
++static int debug_mask = DEBUG_EXIT_SUSPEND | DEBUG_WAKEUP;
++module_param_named(debug_mask, debug_mask, int, S_IRUGO | S_IWUSR | S_IWGRP);
++
++#define WAKE_LOCK_TYPE_MASK              (0x0f)
++#define WAKE_LOCK_INITIALIZED            (1U << 8)
++#define WAKE_LOCK_ACTIVE                 (1U << 9)
++#define WAKE_LOCK_AUTO_EXPIRE            (1U << 10)
++#define WAKE_LOCK_PREVENTING_SUSPEND     (1U << 11)
++
++static DEFINE_SPINLOCK(list_lock);
++static LIST_HEAD(inactive_locks);
++static struct list_head active_wake_locks[WAKE_LOCK_TYPE_COUNT];
++static int current_event_num;
++struct workqueue_struct *suspend_work_queue;
++struct wake_lock main_wake_lock;
++suspend_state_t requested_suspend_state = PM_SUSPEND_MEM;
++static struct wake_lock unknown_wakeup;
++
++#ifdef CONFIG_WAKELOCK_STAT
++static struct wake_lock deleted_wake_locks;
++static ktime_t last_sleep_time_update;
++static int wait_for_wakeup;
++
++int get_expired_time(struct wake_lock *lock, ktime_t *expire_time)
++{
++	struct timespec ts;
++	struct timespec kt;
++	struct timespec tomono;
++	struct timespec delta;
++	unsigned long seq;
++	long timeout;
++
++	if (!(lock->flags & WAKE_LOCK_AUTO_EXPIRE))
++		return 0;
++	do {
++		seq = read_seqbegin(&xtime_lock);
++		timeout = lock->expires - jiffies;
++		if (timeout > 0)
++			return 0;
++		kt = current_kernel_time();
++		tomono = wall_to_monotonic;
++	} while (read_seqretry(&xtime_lock, seq));
++	jiffies_to_timespec(-timeout, &delta);
++	set_normalized_timespec(&ts, kt.tv_sec + tomono.tv_sec - delta.tv_sec,
++				kt.tv_nsec + tomono.tv_nsec - delta.tv_nsec);
++	*expire_time = timespec_to_ktime(ts);
++	return 1;
++}
++
++
++static int print_lock_stat(char *buf, struct wake_lock *lock)
++{
++	int lock_count = lock->stat.count;
++	int expire_count = lock->stat.expire_count;
++	ktime_t active_time = ktime_set(0, 0);
++	ktime_t total_time = lock->stat.total_time;
++	ktime_t max_time = lock->stat.max_time;
++	ktime_t prevent_suspend_time = lock->stat.prevent_suspend_time;
++	if (lock->flags & WAKE_LOCK_ACTIVE) {
++		ktime_t now, add_time;
++		int expired = get_expired_time(lock, &now);
++		if (!expired)
++			now = ktime_get();
++		add_time = ktime_sub(now, lock->stat.last_time);
++		lock_count++;
++		if (!expired)
++			active_time = add_time;
++		else
++			expire_count++;
++		total_time = ktime_add(total_time, add_time);
++		if (lock->flags & WAKE_LOCK_PREVENTING_SUSPEND)
++			prevent_suspend_time = ktime_add(prevent_suspend_time,
++					ktime_sub(now, last_sleep_time_update));
++		if (add_time.tv64 > max_time.tv64)
++			max_time = add_time;
++	}
++
++	return sprintf(buf, "\"%s\"\t%d\t%d\t%d\t%lld\t%lld\t%lld\t%lld\t"
++		       "%lld\n", lock->name, lock_count, expire_count,
++		       lock->stat.wakeup_count, ktime_to_ns(active_time),
++		       ktime_to_ns(total_time),
++		       ktime_to_ns(prevent_suspend_time), ktime_to_ns(max_time),
++		       ktime_to_ns(lock->stat.last_time));
++}
++
++
++static int wakelocks_read_proc(char *page, char **start, off_t off,
++			       int count, int *eof, void *data)
++{
++	unsigned long irqflags;
++	struct wake_lock *lock;
++	int len = 0;
++	char *p = page;
++	int type;
++
++	spin_lock_irqsave(&list_lock, irqflags);
++
++	p += sprintf(p, "name\tcount\texpire_count\twake_count\tactive_since"
++		     "\ttotal_time\tsleep_time\tmax_time\tlast_change\n");
++	list_for_each_entry(lock, &inactive_locks, link) {
++		p += print_lock_stat(p, lock);
++	}
++	for (type = 0; type < WAKE_LOCK_TYPE_COUNT; type++) {
++		list_for_each_entry(lock, &active_wake_locks[type], link)
++			p += print_lock_stat(p, lock);
++	}
++	spin_unlock_irqrestore(&list_lock, irqflags);
++
++	*start = page + off;
++
++	len = p - page;
++	if (len > off)
++		len -= off;
++	else
++		len = 0;
++
++	return len < count ? len  : count;
++}
++
++static void wake_unlock_stat_locked(struct wake_lock *lock, int expired)
++{
++	ktime_t duration;
++	ktime_t now;
++	if (!(lock->flags & WAKE_LOCK_ACTIVE))
++		return;
++	if (get_expired_time(lock, &now))
++		expired = 1;
++	else
++		now = ktime_get();
++	lock->stat.count++;
++	if (expired)
++		lock->stat.expire_count++;
++	duration = ktime_sub(now, lock->stat.last_time);
++	lock->stat.total_time = ktime_add(lock->stat.total_time, duration);
++	if (ktime_to_ns(duration) > ktime_to_ns(lock->stat.max_time))
++		lock->stat.max_time = duration;
++	lock->stat.last_time = ktime_get();
++	if (lock->flags & WAKE_LOCK_PREVENTING_SUSPEND) {
++		duration = ktime_sub(now, last_sleep_time_update);
++		lock->stat.prevent_suspend_time = ktime_add(
++			lock->stat.prevent_suspend_time, duration);
++		lock->flags &= ~WAKE_LOCK_PREVENTING_SUSPEND;
++	}
++}
++
++static void update_sleep_wait_stats_locked(int done)
++{
++	struct wake_lock *lock;
++	ktime_t now, etime, elapsed, add;
++	int expired;
++
++	now = ktime_get();
++	elapsed = ktime_sub(now, last_sleep_time_update);
++	list_for_each_entry(lock, &active_wake_locks[WAKE_LOCK_SUSPEND], link) {
++		expired = get_expired_time(lock, &etime);
++		if (lock->flags & WAKE_LOCK_PREVENTING_SUSPEND) {
++			if (expired)
++				add = ktime_sub(etime, last_sleep_time_update);
++			else
++				add = elapsed;
++			lock->stat.prevent_suspend_time = ktime_add(
++				lock->stat.prevent_suspend_time, add);
++		}
++		if (done || expired)
++			lock->flags &= ~WAKE_LOCK_PREVENTING_SUSPEND;
++		else
++			lock->flags |= WAKE_LOCK_PREVENTING_SUSPEND;
++	}
++	last_sleep_time_update = now;
++}
++#endif
++
++
++static void expire_wake_lock(struct wake_lock *lock)
++{
++#ifdef CONFIG_WAKELOCK_STAT
++	wake_unlock_stat_locked(lock, 1);
++#endif
++	lock->flags &= ~(WAKE_LOCK_ACTIVE | WAKE_LOCK_AUTO_EXPIRE);
++	list_del(&lock->link);
++	list_add(&lock->link, &inactive_locks);
++	if (debug_mask & (DEBUG_WAKE_LOCK | DEBUG_EXPIRE))
++		pr_info("expired wake lock %s\n", lock->name);
++}
++
++static void print_active_locks(int type)
++{
++	unsigned long irqflags;
++	struct wake_lock *lock;
++
++	BUG_ON(type >= WAKE_LOCK_TYPE_COUNT);
++	spin_lock_irqsave(&list_lock, irqflags);
++	list_for_each_entry(lock, &active_wake_locks[type], link) {
++		if (lock->flags & WAKE_LOCK_AUTO_EXPIRE) {
++			long timeout = lock->expires - jiffies;
++			if (timeout <= 0)
++				pr_info("wake lock %s, expired\n", lock->name);
++			else
++				pr_info("active wake lock %s, time left %ld\n",
++					lock->name, timeout);
++		} else
++			pr_info("active wake lock %s\n", lock->name);
++	}
++	spin_unlock_irqrestore(&list_lock, irqflags);
++}
++
++static long has_wake_lock_locked(int type)
++{
++	struct wake_lock *lock, *n;
++	long max_timeout = 0;
++
++	BUG_ON(type >= WAKE_LOCK_TYPE_COUNT);
++	list_for_each_entry_safe(lock, n, &active_wake_locks[type], link) {
++		if (lock->flags & WAKE_LOCK_AUTO_EXPIRE) {
++			long timeout = lock->expires - jiffies;
++			if (timeout <= 0)
++				expire_wake_lock(lock);
++			else if (timeout > max_timeout)
++				max_timeout = timeout;
++		} else
++			return -1;
++	}
++	return max_timeout;
++}
++
++long has_wake_lock(int type)
++{
++	long ret;
++	unsigned long irqflags;
++	spin_lock_irqsave(&list_lock, irqflags);
++	ret = has_wake_lock_locked(type);
++	spin_unlock_irqrestore(&list_lock, irqflags);
++	return ret;
++}
++
++static void suspend(struct work_struct *work)
++{
++	int ret;
++	int entry_event_num;
++
++	if (has_wake_lock(WAKE_LOCK_SUSPEND)) {
++		if (debug_mask & DEBUG_SUSPEND)
++			pr_info("suspend: abort suspend\n");
++		return;
++	}
++
++	entry_event_num = current_event_num;
++	sys_sync();
++	if (debug_mask & DEBUG_SUSPEND)
++		pr_info("suspend: enter suspend\n");
++	ret = pm_suspend(requested_suspend_state);
++	if (debug_mask & DEBUG_EXIT_SUSPEND) {
++		struct timespec ts;
++		struct rtc_time tm;
++		getnstimeofday(&ts);
++		rtc_time_to_tm(ts.tv_sec, &tm);
++		pr_info("suspend: exit suspend, ret = %d "
++			"(%d-%02d-%02d %02d:%02d:%02d.%09lu UTC)\n", ret,
++			tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
++			tm.tm_hour, tm.tm_min, tm.tm_sec, ts.tv_nsec);
++	}
++	if (current_event_num == entry_event_num) {
++		if (debug_mask & DEBUG_SUSPEND)
++			pr_info("suspend: pm_suspend returned with no event\n");
++		wake_lock_timeout(&unknown_wakeup, HZ / 2);
++	}
++}
++static DECLARE_WORK(suspend_work, suspend);
++
++static void expire_wake_locks(unsigned long data)
++{
++	long has_lock;
++	unsigned long irqflags;
++	if (debug_mask & DEBUG_EXPIRE)
++		pr_info("expire_wake_locks: start\n");
++	if (debug_mask & DEBUG_SUSPEND)
++		print_active_locks(WAKE_LOCK_SUSPEND);
++	spin_lock_irqsave(&list_lock, irqflags);
++	has_lock = has_wake_lock_locked(WAKE_LOCK_SUSPEND);
++	if (debug_mask & DEBUG_EXPIRE)
++		pr_info("expire_wake_locks: done, has_lock %ld\n", has_lock);
++	if (has_lock == 0)
++		queue_work(suspend_work_queue, &suspend_work);
++	spin_unlock_irqrestore(&list_lock, irqflags);
++}
++static DEFINE_TIMER(expire_timer, expire_wake_locks, 0, 0);
++
++static int power_suspend_late(struct platform_device *pdev, pm_message_t state)
++{
++	int ret = has_wake_lock(WAKE_LOCK_SUSPEND) ? -EAGAIN : 0;
++#ifdef CONFIG_WAKELOCK_STAT
++	wait_for_wakeup = 1;
++#endif
++	if (debug_mask & DEBUG_SUSPEND)
++		pr_info("power_suspend_late return %d\n", ret);
++	return ret;
++}
++
++static struct platform_driver power_driver = {
++	.driver.name = "power",
++	.suspend_late = power_suspend_late,
++};
++static struct platform_device power_device = {
++	.name = "power",
++};
++
++void wake_lock_init(struct wake_lock *lock, int type, const char *name)
++{
++	unsigned long irqflags = 0;
++
++	if (name)
++		lock->name = name;
++	BUG_ON(!lock->name);
++
++	if (debug_mask & DEBUG_WAKE_LOCK)
++		pr_info("wake_lock_init name=%s\n", lock->name);
++#ifdef CONFIG_WAKELOCK_STAT
++	lock->stat.count = 0;
++	lock->stat.expire_count = 0;
++	lock->stat.wakeup_count = 0;
++	lock->stat.total_time = ktime_set(0, 0);
++	lock->stat.prevent_suspend_time = ktime_set(0, 0);
++	lock->stat.max_time = ktime_set(0, 0);
++	lock->stat.last_time = ktime_set(0, 0);
++#endif
++	lock->flags = (type & WAKE_LOCK_TYPE_MASK) | WAKE_LOCK_INITIALIZED;
++
++	INIT_LIST_HEAD(&lock->link);
++	spin_lock_irqsave(&list_lock, irqflags);
++	list_add(&lock->link, &inactive_locks);
++	spin_unlock_irqrestore(&list_lock, irqflags);
++}
++EXPORT_SYMBOL(wake_lock_init);
++
++void wake_lock_destroy(struct wake_lock *lock)
++{
++	unsigned long irqflags;
++	if (debug_mask & DEBUG_WAKE_LOCK)
++		pr_info("wake_lock_destroy name=%s\n", lock->name);
++	spin_lock_irqsave(&list_lock, irqflags);
++	lock->flags &= ~WAKE_LOCK_INITIALIZED;
++#ifdef CONFIG_WAKELOCK_STAT
++	if (lock->stat.count) {
++		deleted_wake_locks.stat.count += lock->stat.count;
++		deleted_wake_locks.stat.expire_count += lock->stat.expire_count;
++		deleted_wake_locks.stat.total_time =
++			ktime_add(deleted_wake_locks.stat.total_time,
++				  lock->stat.total_time);
++		deleted_wake_locks.stat.prevent_suspend_time =
++			ktime_add(deleted_wake_locks.stat.prevent_suspend_time,
++				  lock->stat.prevent_suspend_time);
++		deleted_wake_locks.stat.max_time =
++			ktime_add(deleted_wake_locks.stat.max_time,
++				  lock->stat.max_time);
++	}
++#endif
++	list_del(&lock->link);
++	spin_unlock_irqrestore(&list_lock, irqflags);
++}
++EXPORT_SYMBOL(wake_lock_destroy);
++
++static void wake_lock_internal(
++	struct wake_lock *lock, long timeout, int has_timeout)
++{
++	int type;
++	unsigned long irqflags;
++	long expire_in;
++
++	spin_lock_irqsave(&list_lock, irqflags);
++	type = lock->flags & WAKE_LOCK_TYPE_MASK;
++	BUG_ON(type >= WAKE_LOCK_TYPE_COUNT);
++	BUG_ON(!(lock->flags & WAKE_LOCK_INITIALIZED));
++#ifdef CONFIG_WAKELOCK_STAT
++	if (type == WAKE_LOCK_SUSPEND && wait_for_wakeup) {
++		if (debug_mask & DEBUG_WAKEUP)
++			pr_info("wakeup wake lock: %s\n", lock->name);
++		wait_for_wakeup = 0;
++		lock->stat.wakeup_count++;
++	}
++	if ((lock->flags & WAKE_LOCK_AUTO_EXPIRE) &&
++	    (long)(lock->expires - jiffies) <= 0) {
++		wake_unlock_stat_locked(lock, 0);
++		lock->stat.last_time = ktime_get();
++	}
++#endif
++	if (!(lock->flags & WAKE_LOCK_ACTIVE)) {
++		lock->flags |= WAKE_LOCK_ACTIVE;
++#ifdef CONFIG_WAKELOCK_STAT
++		lock->stat.last_time = ktime_get();
++#endif
++	}
++	list_del(&lock->link);
++	if (has_timeout) {
++		if (debug_mask & DEBUG_WAKE_LOCK)
++			pr_info("wake_lock: %s, type %d, timeout %ld.%03lu\n",
++				lock->name, type, timeout / HZ,
++				(timeout % HZ) * MSEC_PER_SEC / HZ);
++		lock->expires = jiffies + timeout;
++		lock->flags |= WAKE_LOCK_AUTO_EXPIRE;
++		list_add_tail(&lock->link, &active_wake_locks[type]);
++	} else {
++		if (debug_mask & DEBUG_WAKE_LOCK)
++			pr_info("wake_lock: %s, type %d\n", lock->name, type);
++		lock->expires = LONG_MAX;
++		lock->flags &= ~WAKE_LOCK_AUTO_EXPIRE;
++		list_add(&lock->link, &active_wake_locks[type]);
++	}
++	if (type == WAKE_LOCK_SUSPEND) {
++		current_event_num++;
++#ifdef CONFIG_WAKELOCK_STAT
++		if (lock == &main_wake_lock)
++			update_sleep_wait_stats_locked(1);
++		else if (!wake_lock_active(&main_wake_lock))
++			update_sleep_wait_stats_locked(0);
++#endif
++		if (has_timeout)
++			expire_in = has_wake_lock_locked(type);
++		else
++			expire_in = -1;
++		if (expire_in > 0) {
++			if (debug_mask & DEBUG_EXPIRE)
++				pr_info("wake_lock: %s, start expire timer, "
++					"%ld\n", lock->name, expire_in);
++			mod_timer(&expire_timer, jiffies + expire_in);
++		} else {
++			if (del_timer(&expire_timer))
++				if (debug_mask & DEBUG_EXPIRE)
++					pr_info("wake_lock: %s, stop expire timer\n",
++						lock->name);
++			if (expire_in == 0)
++				queue_work(suspend_work_queue, &suspend_work);
++		}
++	}
++	spin_unlock_irqrestore(&list_lock, irqflags);
++}
++
++void wake_lock(struct wake_lock *lock)
++{
++	wake_lock_internal(lock, 0, 0);
++}
++EXPORT_SYMBOL(wake_lock);
++
++void wake_lock_timeout(struct wake_lock *lock, long timeout)
++{
++	wake_lock_internal(lock, timeout, 1);
++}
++EXPORT_SYMBOL(wake_lock_timeout);
++
++void wake_unlock(struct wake_lock *lock)
++{
++	int type;
++	unsigned long irqflags;
++	spin_lock_irqsave(&list_lock, irqflags);
++	type = lock->flags & WAKE_LOCK_TYPE_MASK;
++#ifdef CONFIG_WAKELOCK_STAT
++	wake_unlock_stat_locked(lock, 0);
++#endif
++	if (debug_mask & DEBUG_WAKE_LOCK)
++		pr_info("wake_unlock: %s\n", lock->name);
++	lock->flags &= ~(WAKE_LOCK_ACTIVE | WAKE_LOCK_AUTO_EXPIRE);
++	list_del(&lock->link);
++	list_add(&lock->link, &inactive_locks);
++	if (type == WAKE_LOCK_SUSPEND) {
++		long has_lock = has_wake_lock_locked(type);
++		if (has_lock > 0) {
++			if (debug_mask & DEBUG_EXPIRE)
++				pr_info("wake_unlock: %s, start expire timer, "
++					"%ld\n", lock->name, has_lock);
++			mod_timer(&expire_timer, jiffies + has_lock);
++		} else {
++			if (del_timer(&expire_timer))
++				if (debug_mask & DEBUG_EXPIRE)
++					pr_info("wake_unlock: %s, stop expire "
++						"timer\n", lock->name);
++			if (has_lock == 0)
++				queue_work(suspend_work_queue, &suspend_work);
++		}
++		if (lock == &main_wake_lock) {
++			if (debug_mask & DEBUG_SUSPEND)
++				print_active_locks(WAKE_LOCK_SUSPEND);
++#ifdef CONFIG_WAKELOCK_STAT
++			update_sleep_wait_stats_locked(0);
++#endif
++		}
++	}
++	spin_unlock_irqrestore(&list_lock, irqflags);
++}
++EXPORT_SYMBOL(wake_unlock);
++
++int wake_lock_active(struct wake_lock *lock)
++{
++	return !!(lock->flags & WAKE_LOCK_ACTIVE);
++}
++EXPORT_SYMBOL(wake_lock_active);
++
++static int __init wakelocks_init(void)
++{
++	int ret;
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(active_wake_locks); i++)
++		INIT_LIST_HEAD(&active_wake_locks[i]);
++
++#ifdef CONFIG_WAKELOCK_STAT
++	wake_lock_init(&deleted_wake_locks, WAKE_LOCK_SUSPEND,
++			"deleted_wake_locks");
++#endif
++	wake_lock_init(&main_wake_lock, WAKE_LOCK_SUSPEND, "main");
++	wake_lock(&main_wake_lock);
++	wake_lock_init(&unknown_wakeup, WAKE_LOCK_SUSPEND, "unknown_wakeups");
++
++	ret = platform_device_register(&power_device);
++	if (ret) {
++		pr_err("wakelocks_init: platform_device_register failed\n");
++		goto err_platform_device_register;
++	}
++	ret = platform_driver_register(&power_driver);
++	if (ret) {
++		pr_err("wakelocks_init: platform_driver_register failed\n");
++		goto err_platform_driver_register;
++	}
++
++	suspend_work_queue = create_singlethread_workqueue("suspend");
++	if (suspend_work_queue == NULL) {
++		ret = -ENOMEM;
++		goto err_suspend_work_queue;
++	}
++
++#ifdef CONFIG_WAKELOCK_STAT
++	create_proc_read_entry("wakelocks", S_IRUGO, NULL,
++				wakelocks_read_proc, NULL);
++#endif
++
++	return 0;
++
++err_suspend_work_queue:
++	platform_driver_unregister(&power_driver);
++err_platform_driver_register:
++	platform_device_unregister(&power_device);
++err_platform_device_register:
++	wake_lock_destroy(&unknown_wakeup);
++	wake_lock_destroy(&main_wake_lock);
++#ifdef CONFIG_WAKELOCK_STAT
++	wake_lock_destroy(&deleted_wake_locks);
++#endif
++	return ret;
++}
++
++static void  __exit wakelocks_exit(void)
++{
++#ifdef CONFIG_WAKELOCK_STAT
++	remove_proc_entry("wakelocks", NULL);
++#endif
++	destroy_workqueue(suspend_work_queue);
++	platform_driver_unregister(&power_driver);
++	platform_device_unregister(&power_device);
++	wake_lock_destroy(&unknown_wakeup);
++	wake_lock_destroy(&main_wake_lock);
++#ifdef CONFIG_WAKELOCK_STAT
++	wake_lock_destroy(&deleted_wake_locks);
++#endif
++}
++
++core_initcall(wakelocks_init);
++module_exit(wakelocks_exit);
diff --git a/target/linux/goldfish/patches-2.6.30/0067-PM-Implement-early-suspend-api.patch b/target/linux/goldfish/patches-2.6.30/0067-PM-Implement-early-suspend-api.patch
new file mode 100644
index 0000000000..0fc0cc1bbf
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0067-PM-Implement-early-suspend-api.patch
@@ -0,0 +1,244 @@
+From 2d4a25785ad1aa51bad967543e1ab20e9ed4a046 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Tue, 7 Oct 2008 20:48:01 -0700
+Subject: [PATCH 067/134] PM: Implement early suspend api
+
+---
+ kernel/power/Kconfig        |   12 +++
+ kernel/power/Makefile       |    1 +
+ kernel/power/earlysuspend.c |  178 +++++++++++++++++++++++++++++++++++++++++++
+ kernel/power/power.h        |    6 ++
+ 4 files changed, 197 insertions(+), 0 deletions(-)
+ create mode 100644 kernel/power/earlysuspend.c
+
+--- a/kernel/power/Kconfig
++++ b/kernel/power/Kconfig
+@@ -119,6 +119,9 @@ config SUSPEND_FREEZER
+ config HAS_WAKELOCK
+ 	bool
+ 
++config HAS_EARLYSUSPEND
++	bool
++
+ config WAKELOCK
+ 	bool "Wake lock"
+ 	depends on PM && RTC_CLASS
+@@ -135,6 +138,15 @@ config WAKELOCK_STAT
+ 	---help---
+ 	  Report wake lock stats in /proc/wakelocks
+ 
++config EARLYSUSPEND
++	bool "Early suspend"
++	depends on WAKELOCK
++	default y
++	select HAS_EARLYSUSPEND
++	---help---
++	  Call early suspend handlers when the user requested sleep state
++	  changes.
++
+ config HIBERNATION
+ 	bool "Hibernation (aka 'suspend to disk')"
+ 	depends on PM && SWAP && ARCH_HIBERNATION_POSSIBLE
+--- a/kernel/power/Makefile
++++ b/kernel/power/Makefile
+@@ -7,6 +7,7 @@ obj-$(CONFIG_PM)		+= main.o
+ obj-$(CONFIG_PM_SLEEP)		+= console.o
+ obj-$(CONFIG_FREEZER)		+= process.o
+ obj-$(CONFIG_WAKELOCK)		+= wakelock.o
++obj-$(CONFIG_EARLYSUSPEND)	+= earlysuspend.o
+ obj-$(CONFIG_HIBERNATION)	+= swsusp.o disk.o snapshot.o swap.o user.o
+ 
+ obj-$(CONFIG_MAGIC_SYSRQ)	+= poweroff.o
+--- /dev/null
++++ b/kernel/power/earlysuspend.c
+@@ -0,0 +1,178 @@
++/* kernel/power/earlysuspend.c
++ *
++ * Copyright (C) 2005-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/earlysuspend.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/rtc.h>
++#include <linux/syscalls.h> /* sys_sync */
++#include <linux/wakelock.h>
++#include <linux/workqueue.h>
++
++#include "power.h"
++
++enum {
++	DEBUG_USER_STATE = 1U << 0,
++	DEBUG_SUSPEND = 1U << 2,
++};
++static int debug_mask = DEBUG_USER_STATE;
++module_param_named(debug_mask, debug_mask, int, S_IRUGO | S_IWUSR | S_IWGRP);
++
++static DEFINE_MUTEX(early_suspend_lock);
++static LIST_HEAD(early_suspend_handlers);
++static void early_suspend(struct work_struct *work);
++static void late_resume(struct work_struct *work);
++static DECLARE_WORK(early_suspend_work, early_suspend);
++static DECLARE_WORK(late_resume_work, late_resume);
++static DEFINE_SPINLOCK(state_lock);
++enum {
++	SUSPEND_REQUESTED = 0x1,
++	SUSPENDED = 0x2,
++	SUSPEND_REQUESTED_AND_SUSPENDED = SUSPEND_REQUESTED | SUSPENDED,
++};
++static int state;
++
++void register_early_suspend(struct early_suspend *handler)
++{
++	struct list_head *pos;
++
++	mutex_lock(&early_suspend_lock);
++	list_for_each(pos, &early_suspend_handlers) {
++		struct early_suspend *e;
++		e = list_entry(pos, struct early_suspend, link);
++		if (e->level > handler->level)
++			break;
++	}
++	list_add_tail(&handler->link, pos);
++	if ((state & SUSPENDED) && handler->suspend)
++		handler->suspend(handler);
++	mutex_unlock(&early_suspend_lock);
++}
++EXPORT_SYMBOL(register_early_suspend);
++
++void unregister_early_suspend(struct early_suspend *handler)
++{
++	mutex_lock(&early_suspend_lock);
++	list_del(&handler->link);
++	mutex_unlock(&early_suspend_lock);
++}
++EXPORT_SYMBOL(unregister_early_suspend);
++
++static void early_suspend(struct work_struct *work)
++{
++	struct early_suspend *pos;
++	unsigned long irqflags;
++	int abort = 0;
++
++	mutex_lock(&early_suspend_lock);
++	spin_lock_irqsave(&state_lock, irqflags);
++	if (state == SUSPEND_REQUESTED)
++		state |= SUSPENDED;
++	else
++		abort = 1;
++	spin_unlock_irqrestore(&state_lock, irqflags);
++
++	if (abort) {
++		if (debug_mask & DEBUG_SUSPEND)
++			pr_info("early_suspend: abort, state %d\n", state);
++		mutex_unlock(&early_suspend_lock);
++		goto abort;
++	}
++
++	if (debug_mask & DEBUG_SUSPEND)
++		pr_info("early_suspend: call handlers\n");
++	list_for_each_entry(pos, &early_suspend_handlers, link) {
++		if (pos->suspend != NULL)
++			pos->suspend(pos);
++	}
++	mutex_unlock(&early_suspend_lock);
++
++	if (debug_mask & DEBUG_SUSPEND)
++		pr_info("early_suspend: sync\n");
++
++	sys_sync();
++abort:
++	spin_lock_irqsave(&state_lock, irqflags);
++	if (state == SUSPEND_REQUESTED_AND_SUSPENDED)
++		wake_unlock(&main_wake_lock);
++	spin_unlock_irqrestore(&state_lock, irqflags);
++}
++
++static void late_resume(struct work_struct *work)
++{
++	struct early_suspend *pos;
++	unsigned long irqflags;
++	int abort = 0;
++
++	mutex_lock(&early_suspend_lock);
++	spin_lock_irqsave(&state_lock, irqflags);
++	if (state == SUSPENDED)
++		state &= ~SUSPENDED;
++	else
++		abort = 1;
++	spin_unlock_irqrestore(&state_lock, irqflags);
++
++	if (abort) {
++		if (debug_mask & DEBUG_SUSPEND)
++			pr_info("late_resume: abort, state %d\n", state);
++		goto abort;
++	}
++	if (debug_mask & DEBUG_SUSPEND)
++		pr_info("late_resume: call handlers\n");
++	list_for_each_entry_reverse(pos, &early_suspend_handlers, link)
++		if (pos->resume != NULL)
++			pos->resume(pos);
++	if (debug_mask & DEBUG_SUSPEND)
++		pr_info("late_resume: done\n");
++abort:
++	mutex_unlock(&early_suspend_lock);
++}
++
++void request_suspend_state(suspend_state_t new_state)
++{
++	unsigned long irqflags;
++	int old_sleep;
++
++	spin_lock_irqsave(&state_lock, irqflags);
++	old_sleep = state & SUSPEND_REQUESTED;
++	if (debug_mask & DEBUG_USER_STATE) {
++		struct timespec ts;
++		struct rtc_time tm;
++		getnstimeofday(&ts);
++		rtc_time_to_tm(ts.tv_sec, &tm);
++		pr_info("request_suspend_state: %s (%d->%d) at %lld "
++			"(%d-%02d-%02d %02d:%02d:%02d.%09lu UTC)\n",
++			new_state != PM_SUSPEND_ON ? "sleep" : "wakeup",
++			requested_suspend_state, new_state,
++			ktime_to_ns(ktime_get()),
++			tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
++			tm.tm_hour, tm.tm_min, tm.tm_sec, ts.tv_nsec);
++	}
++	if (!old_sleep && new_state != PM_SUSPEND_ON) {
++		state |= SUSPEND_REQUESTED;
++		queue_work(suspend_work_queue, &early_suspend_work);
++	} else if (old_sleep && new_state == PM_SUSPEND_ON) {
++		state &= ~SUSPEND_REQUESTED;
++		wake_lock(&main_wake_lock);
++		queue_work(suspend_work_queue, &late_resume_work);
++	}
++	requested_suspend_state = new_state;
++	spin_unlock_irqrestore(&state_lock, irqflags);
++}
++
++suspend_state_t get_suspend_state(void)
++{
++	return requested_suspend_state;
++}
+--- a/kernel/power/power.h
++++ b/kernel/power/power.h
+@@ -230,3 +230,9 @@ extern struct workqueue_struct *suspend_
+ extern struct wake_lock main_wake_lock;
+ extern suspend_state_t requested_suspend_state;
+ #endif
++
++#ifdef CONFIG_EARLYSUSPEND
++/* kernel/power/earlysuspend.c */
++void request_suspend_state(suspend_state_t state);
++suspend_state_t get_suspend_state(void);
++#endif
diff --git a/target/linux/goldfish/patches-2.6.30/0068-PM-Enable-early-suspend-through-sys-power-state.patch b/target/linux/goldfish/patches-2.6.30/0068-PM-Enable-early-suspend-through-sys-power-state.patch
new file mode 100644
index 0000000000..84a95dba9f
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0068-PM-Enable-early-suspend-through-sys-power-state.patch
@@ -0,0 +1,52 @@
+From 7b236e69bb4403f20fbdef81907d46b4d32d4af8 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Thu, 9 Oct 2008 19:17:11 -0700
+Subject: [PATCH 068/134] PM: Enable early suspend through /sys/power/state
+
+If EARLYSUSPEND is enabled then writes to /sys/power/state no longer
+blocks, and the kernel will try to enter the requested state every
+time no wakelocks are held. Write "on" to resume normal operation.
+---
+ kernel/power/main.c |   14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+--- a/kernel/power/main.c
++++ b/kernel/power/main.c
+@@ -408,6 +408,9 @@ static void suspend_finish(void)
+ 
+ 
+ static const char * const pm_states[PM_SUSPEND_MAX] = {
++#ifdef CONFIG_EARLYSUSPEND
++	[PM_SUSPEND_ON]		= "on",
++#endif
+ 	[PM_SUSPEND_STANDBY]	= "standby",
+ 	[PM_SUSPEND_MEM]	= "mem",
+ };
+@@ -525,7 +528,11 @@ static ssize_t state_store(struct kobjec
+ 			   const char *buf, size_t n)
+ {
+ #ifdef CONFIG_SUSPEND
++#ifdef CONFIG_EARLYSUSPEND
++	suspend_state_t state = PM_SUSPEND_ON;
++#else
+ 	suspend_state_t state = PM_SUSPEND_STANDBY;
++#endif
+ 	const char * const *s;
+ #endif
+ 	char *p;
+@@ -547,8 +554,15 @@ static ssize_t state_store(struct kobjec
+ 			break;
+ 	}
+ 	if (state < PM_SUSPEND_MAX && *s)
++#ifdef CONFIG_EARLYSUSPEND
++		if (state == PM_SUSPEND_ON || valid_state(state)) {
++			error = 0;
++			request_suspend_state(state);
++		}
++#else
+ 		error = enter_state(state);
+ #endif
++#endif
+ 
+  Exit:
+ 	return error ? error : n;
diff --git a/target/linux/goldfish/patches-2.6.30/0069-PM-Add-user-space-wake-lock-api.patch b/target/linux/goldfish/patches-2.6.30/0069-PM-Add-user-space-wake-lock-api.patch
new file mode 100644
index 0000000000..c1d0125f11
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0069-PM-Add-user-space-wake-lock-api.patch
@@ -0,0 +1,314 @@
+From 48e1af2bdd11204f11b3770a6c8d3eee64aee2e8 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Thu, 9 Oct 2008 21:01:46 -0700
+Subject: [PATCH 069/134] PM: Add user-space wake lock api.
+
+This adds /sys/power/wake_lock and /sys/power/wake_unlock.
+Writing a string to wake_lock creates a wake lock the
+first time is sees a string and locks it. Optionally, the
+string can be followed by a timeout.
+To unlock the wake lock, write the same string to wake_unlock.
+---
+ kernel/power/Kconfig        |   10 ++
+ kernel/power/Makefile       |    1 +
+ kernel/power/main.c         |    9 ++
+ kernel/power/power.h        |   11 ++
+ kernel/power/userwakelock.c |  218 +++++++++++++++++++++++++++++++++++++++++++
+ 5 files changed, 249 insertions(+), 0 deletions(-)
+ create mode 100644 kernel/power/userwakelock.c
+
+--- a/kernel/power/Kconfig
++++ b/kernel/power/Kconfig
+@@ -138,6 +138,16 @@ config WAKELOCK_STAT
+ 	---help---
+ 	  Report wake lock stats in /proc/wakelocks
+ 
++config USER_WAKELOCK
++	bool "Userspace wake locks"
++	depends on WAKELOCK
++	default y
++	---help---
++	  User-space wake lock api. Write "lockname" or "lockname timeout"
++	  to /sys/power/wake_lock lock and if needed create a wake lock.
++	  Write "lockname" to /sys/power/wake_unlock to unlock a user wake
++	  lock.
++
+ config EARLYSUSPEND
+ 	bool "Early suspend"
+ 	depends on WAKELOCK
+--- a/kernel/power/Makefile
++++ b/kernel/power/Makefile
+@@ -7,6 +7,7 @@ obj-$(CONFIG_PM)		+= main.o
+ obj-$(CONFIG_PM_SLEEP)		+= console.o
+ obj-$(CONFIG_FREEZER)		+= process.o
+ obj-$(CONFIG_WAKELOCK)		+= wakelock.o
++obj-$(CONFIG_USER_WAKELOCK)	+= userwakelock.o
+ obj-$(CONFIG_EARLYSUSPEND)	+= earlysuspend.o
+ obj-$(CONFIG_HIBERNATION)	+= swsusp.o disk.o snapshot.o swap.o user.o
+ 
+--- a/kernel/power/main.c
++++ b/kernel/power/main.c
+@@ -595,6 +595,11 @@ pm_trace_store(struct kobject *kobj, str
+ power_attr(pm_trace);
+ #endif /* CONFIG_PM_TRACE */
+ 
++#ifdef CONFIG_USER_WAKELOCK
++power_attr(wake_lock);
++power_attr(wake_unlock);
++#endif
++
+ static struct attribute * g[] = {
+ 	&state_attr.attr,
+ #ifdef CONFIG_PM_TRACE
+@@ -603,6 +608,10 @@ static struct attribute * g[] = {
+ #if defined(CONFIG_PM_SLEEP) && defined(CONFIG_PM_DEBUG)
+ 	&pm_test_attr.attr,
+ #endif
++#ifdef CONFIG_USER_WAKELOCK
++	&wake_lock_attr.attr,
++	&wake_unlock_attr.attr,
++#endif
+ 	NULL,
+ };
+ 
+--- a/kernel/power/power.h
++++ b/kernel/power/power.h
+@@ -231,6 +231,17 @@ extern struct wake_lock main_wake_lock;
+ extern suspend_state_t requested_suspend_state;
+ #endif
+ 
++#ifdef CONFIG_USER_WAKELOCK
++ssize_t wake_lock_show(struct kobject *kobj, struct kobj_attribute *attr,
++			char *buf);
++ssize_t wake_lock_store(struct kobject *kobj, struct kobj_attribute *attr,
++			const char *buf, size_t n);
++ssize_t wake_unlock_show(struct kobject *kobj, struct kobj_attribute *attr,
++			char *buf);
++ssize_t  wake_unlock_store(struct kobject *kobj, struct kobj_attribute *attr,
++			const char *buf, size_t n);
++#endif
++
+ #ifdef CONFIG_EARLYSUSPEND
+ /* kernel/power/earlysuspend.c */
+ void request_suspend_state(suspend_state_t state);
+--- /dev/null
++++ b/kernel/power/userwakelock.c
+@@ -0,0 +1,218 @@
++/* kernel/power/userwakelock.c
++ *
++ * Copyright (C) 2005-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/ctype.h>
++#include <linux/module.h>
++#include <linux/wakelock.h>
++
++#include "power.h"
++
++enum {
++	DEBUG_FAILURE	= BIT(0),
++	DEBUG_ERROR	= BIT(1),
++	DEBUG_NEW	= BIT(2),
++	DEBUG_ACCESS	= BIT(3),
++	DEBUG_LOOKUP	= BIT(4),
++};
++static int debug_mask = DEBUG_FAILURE;
++module_param_named(debug_mask, debug_mask, int, S_IRUGO | S_IWUSR | S_IWGRP);
++
++static DEFINE_MUTEX(tree_lock);
++
++struct user_wake_lock {
++	struct rb_node		node;
++	struct wake_lock	wake_lock;
++	char			name[0];
++};
++struct rb_root user_wake_locks;
++
++static struct user_wake_lock *lookup_wake_lock_name(
++	const char *buf, int allocate, long *timeoutptr)
++{
++	struct rb_node **p = &user_wake_locks.rb_node;
++	struct rb_node *parent = NULL;
++	struct user_wake_lock *l;
++	int diff;
++	u64 timeout;
++	int name_len;
++	const char *arg;
++
++	/* Find length of lock name and start of optional timeout string */
++	arg = buf;
++	while (*arg && !isspace(*arg))
++		arg++;
++	name_len = arg - buf;
++	if (!name_len)
++		goto bad_arg;
++	while (isspace(*arg))
++		arg++;
++
++	/* Process timeout string */
++	if (timeoutptr && *arg) {
++		timeout = simple_strtoull(arg, (char **)&arg, 0);
++		while (isspace(*arg))
++			arg++;
++		if (*arg)
++			goto bad_arg;
++		/* convert timeout from nanoseconds to jiffies > 0 */
++		timeout += (NSEC_PER_SEC / HZ) - 1;
++		do_div(timeout, (NSEC_PER_SEC / HZ));
++		if (timeout <= 0)
++			timeout = 1;
++		*timeoutptr = timeout;
++	} else if (*arg)
++		goto bad_arg;
++	else if (timeoutptr)
++		*timeoutptr = 0;
++
++	/* Lookup wake lock in rbtree */
++	while (*p) {
++		parent = *p;
++		l = rb_entry(parent, struct user_wake_lock, node);
++		diff = strncmp(buf, l->name, name_len);
++		if (!diff && l->name[name_len])
++			diff = -1;
++		if (debug_mask & DEBUG_ERROR)
++			pr_info("lookup_wake_lock_name: compare %.*s %s %d\n",
++				name_len, buf, l->name, diff);
++
++		if (diff < 0)
++			p = &(*p)->rb_left;
++		else if (diff > 0)
++			p = &(*p)->rb_right;
++		else
++			return l;
++	}
++
++	/* Allocate and add new wakelock to rbtree */
++	if (!allocate) {
++		if (debug_mask & DEBUG_ERROR)
++			pr_info("lookup_wake_lock_name: %.*s not found\n",
++				name_len, buf);
++		return ERR_PTR(-EINVAL);
++	}
++	l = kzalloc(sizeof(*l) + name_len + 1, GFP_KERNEL);
++	if (l == NULL) {
++		if (debug_mask & DEBUG_FAILURE)
++			pr_err("lookup_wake_lock_name: failed to allocate "
++				"memory for %.*s\n", name_len, buf);
++		return ERR_PTR(-ENOMEM);
++	}
++	memcpy(l->name, buf, name_len);
++	if (debug_mask & DEBUG_NEW)
++		pr_info("lookup_wake_lock_name: new wake lock %s\n", l->name);
++	wake_lock_init(&l->wake_lock, WAKE_LOCK_SUSPEND, l->name);
++	rb_link_node(&l->node, parent, p);
++	rb_insert_color(&l->node, &user_wake_locks);
++	return l;
++
++bad_arg:
++	if (debug_mask & DEBUG_ERROR)
++		pr_info("lookup_wake_lock_name: wake lock, %.*s, bad arg, %s\n",
++			name_len, buf, arg);
++	return ERR_PTR(-EINVAL);
++}
++
++ssize_t wake_lock_show(
++	struct kobject *kobj, struct kobj_attribute *attr, char *buf)
++{
++	char *s = buf;
++	char *end = buf + PAGE_SIZE;
++	struct rb_node *n;
++	struct user_wake_lock *l;
++
++	mutex_lock(&tree_lock);
++
++	for (n = rb_first(&user_wake_locks); n != NULL; n = rb_next(n)) {
++		l = rb_entry(n, struct user_wake_lock, node);
++		if (wake_lock_active(&l->wake_lock))
++			s += scnprintf(s, end - s, "%s ", l->name);
++	}
++	s += scnprintf(s, end - s, "\n");
++
++	mutex_unlock(&tree_lock);
++	return (s - buf);
++}
++
++ssize_t wake_lock_store(
++	struct kobject *kobj, struct kobj_attribute *attr,
++	const char *buf, size_t n)
++{
++	long timeout;
++	struct user_wake_lock *l;
++
++	mutex_lock(&tree_lock);
++	l = lookup_wake_lock_name(buf, 1, &timeout);
++	if (IS_ERR(l)) {
++		n = PTR_ERR(l);
++		goto bad_name;
++	}
++
++	if (debug_mask & DEBUG_ACCESS)
++		pr_info("wake_lock_store: %s, timeout %ld\n", l->name, timeout);
++
++	if (timeout)
++		wake_lock_timeout(&l->wake_lock, timeout);
++	else
++		wake_lock(&l->wake_lock);
++bad_name:
++	mutex_unlock(&tree_lock);
++	return n;
++}
++
++
++ssize_t wake_unlock_show(
++	struct kobject *kobj, struct kobj_attribute *attr, char *buf)
++{
++	char *s = buf;
++	char *end = buf + PAGE_SIZE;
++	struct rb_node *n;
++	struct user_wake_lock *l;
++
++	mutex_lock(&tree_lock);
++
++	for (n = rb_first(&user_wake_locks); n != NULL; n = rb_next(n)) {
++		l = rb_entry(n, struct user_wake_lock, node);
++		if (!wake_lock_active(&l->wake_lock))
++			s += scnprintf(s, end - s, "%s ", l->name);
++	}
++	s += scnprintf(s, end - s, "\n");
++
++	mutex_unlock(&tree_lock);
++	return (s - buf);
++}
++
++ssize_t wake_unlock_store(
++	struct kobject *kobj, struct kobj_attribute *attr,
++	const char *buf, size_t n)
++{
++	struct user_wake_lock *l;
++
++	mutex_lock(&tree_lock);
++	l = lookup_wake_lock_name(buf, 0, NULL);
++	if (IS_ERR(l)) {
++		n = PTR_ERR(l);
++		goto not_found;
++	}
++
++	if (debug_mask & DEBUG_ACCESS)
++		pr_info("wake_unlock_store: %s\n", l->name);
++
++	wake_unlock(&l->wake_lock);
++not_found:
++	mutex_unlock(&tree_lock);
++	return n;
++}
++
diff --git a/target/linux/goldfish/patches-2.6.30/0070-PM-wakelock-Abort-task-freezing-if-a-wake-lock-is.patch b/target/linux/goldfish/patches-2.6.30/0070-PM-wakelock-Abort-task-freezing-if-a-wake-lock-is.patch
new file mode 100644
index 0000000000..a93df9ad41
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0070-PM-wakelock-Abort-task-freezing-if-a-wake-lock-is.patch
@@ -0,0 +1,64 @@
+From 3f8e407c418205252f00615da4d0182e8c960344 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Tue, 14 Oct 2008 16:02:39 -0700
+Subject: [PATCH 070/134] PM: wakelock: Abort task freezing if a wake lock is held.
+
+Avoids a problem where the device sometimes hangs for 20 seconds
+before the screen is turned on.
+---
+ kernel/power/process.c |   23 ++++++++++++++++++-----
+ 1 files changed, 18 insertions(+), 5 deletions(-)
+
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -13,6 +13,7 @@
+ #include <linux/module.h>
+ #include <linux/syscalls.h>
+ #include <linux/freezer.h>
++#include <linux/wakelock.h>
+ 
+ /* 
+  * Timeout for stopping processes
+@@ -36,6 +37,7 @@ static int try_to_freeze_tasks(bool sig_
+ 	struct timeval start, end;
+ 	u64 elapsed_csecs64;
+ 	unsigned int elapsed_csecs;
++	unsigned int wakeup = 0;
+ 
+ 	do_gettimeofday(&start);
+ 
+@@ -62,6 +64,10 @@ static int try_to_freeze_tasks(bool sig_
+ 		} while_each_thread(g, p);
+ 		read_unlock(&tasklist_lock);
+ 		yield();			/* Yield is okay here */
++		if (todo && has_wake_lock(WAKE_LOCK_SUSPEND)) {
++			wakeup = 1;
++			break;
++		}
+ 		if (time_after(jiffies, end_time))
+ 			break;
+ 	} while (todo);
+@@ -77,11 +83,18 @@ static int try_to_freeze_tasks(bool sig_
+ 		 * and caller must call thaw_processes() if something fails),
+ 		 * but it cleans up leftover PF_FREEZE requests.
+ 		 */
+-		printk("\n");
+-		printk(KERN_ERR "Freezing of tasks failed after %d.%02d seconds "
+-				"(%d tasks refusing to freeze):\n",
+-				elapsed_csecs / 100, elapsed_csecs % 100, todo);
+-		show_state();
++		if(wakeup) {
++			printk("\n");
++			printk(KERN_ERR "Freezing of %s aborted\n",
++					sig_only ? "user space " : "tasks ");
++		}
++		else {
++			printk("\n");
++			printk(KERN_ERR "Freezing of tasks failed after %d.%02d seconds "
++					"(%d tasks refusing to freeze):\n",
++					elapsed_csecs / 100, elapsed_csecs % 100, todo);
++			show_state();
++		}
+ 		read_lock(&tasklist_lock);
+ 		do_each_thread(g, p) {
+ 			task_lock(p);
diff --git a/target/linux/goldfish/patches-2.6.30/0071-PM-earlysuspend-Add-console-switch-when-user-reque.patch b/target/linux/goldfish/patches-2.6.30/0071-PM-earlysuspend-Add-console-switch-when-user-reque.patch
new file mode 100644
index 0000000000..602b92425a
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0071-PM-earlysuspend-Add-console-switch-when-user-reque.patch
@@ -0,0 +1,133 @@
+From 0083b2afe89dea4a06bfd967b164318ad0bccd11 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Wed, 15 Oct 2008 17:52:20 -0700
+Subject: [PATCH 071/134] PM: earlysuspend: Add console switch when user requested sleep state changes.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ kernel/power/Kconfig               |   17 ++++++++
+ kernel/power/Makefile              |    1 +
+ kernel/power/consoleearlysuspend.c |   78 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 96 insertions(+), 0 deletions(-)
+ create mode 100644 kernel/power/consoleearlysuspend.c
+
+--- a/kernel/power/Kconfig
++++ b/kernel/power/Kconfig
+@@ -157,6 +157,23 @@ config EARLYSUSPEND
+ 	  Call early suspend handlers when the user requested sleep state
+ 	  changes.
+ 
++choice
++	prompt "User-space screen access"
++	default CONSOLE_EARLYSUSPEND
++	depends on HAS_EARLYSUSPEND
++
++	config NO_USER_SPACE_SCREEN_ACCESS_CONTROL
++		bool "None"
++
++	config CONSOLE_EARLYSUSPEND
++		bool "Console switch on early-suspend"
++		depends on HAS_EARLYSUSPEND && VT
++		---help---
++		  Register early suspend handler to perform a console switch to
++		  when user-space should stop drawing to the screen and a switch
++		  back when it should resume.
++endchoice
++
+ config HIBERNATION
+ 	bool "Hibernation (aka 'suspend to disk')"
+ 	depends on PM && SWAP && ARCH_HIBERNATION_POSSIBLE
+--- a/kernel/power/Makefile
++++ b/kernel/power/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_FREEZER)		+= process.o
+ obj-$(CONFIG_WAKELOCK)		+= wakelock.o
+ obj-$(CONFIG_USER_WAKELOCK)	+= userwakelock.o
+ obj-$(CONFIG_EARLYSUSPEND)	+= earlysuspend.o
++obj-$(CONFIG_CONSOLE_EARLYSUSPEND)	+= consoleearlysuspend.o
+ obj-$(CONFIG_HIBERNATION)	+= swsusp.o disk.o snapshot.o swap.o user.o
+ 
+ obj-$(CONFIG_MAGIC_SYSRQ)	+= poweroff.o
+--- /dev/null
++++ b/kernel/power/consoleearlysuspend.c
+@@ -0,0 +1,78 @@
++/* kernel/power/consoleearlysuspend.c
++ *
++ * Copyright (C) 2005-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/console.h>
++#include <linux/earlysuspend.h>
++#include <linux/kbd_kern.h>
++#include <linux/module.h>
++#include <linux/vt_kern.h>
++#include <linux/wait.h>
++
++#define EARLY_SUSPEND_CONSOLE	(MAX_NR_CONSOLES-1)
++
++static int orig_fgconsole;
++static void console_early_suspend(struct early_suspend *h)
++{
++	acquire_console_sem();
++	orig_fgconsole = fg_console;
++	if (vc_allocate(EARLY_SUSPEND_CONSOLE))
++		goto err;
++	if (set_console(EARLY_SUSPEND_CONSOLE))
++		goto err;
++	release_console_sem();
++
++	if (vt_waitactive(EARLY_SUSPEND_CONSOLE))
++		pr_warning("console_early_suspend: Can't switch VCs.\n");
++	return;
++err:
++	pr_warning("console_early_suspend: Can't set console\n");
++	release_console_sem();
++}
++
++static void console_late_resume(struct early_suspend *h)
++{
++	int ret;
++	acquire_console_sem();
++	ret = set_console(orig_fgconsole);
++	release_console_sem();
++	if (ret) {
++		pr_warning("console_late_resume: Can't set console.\n");
++		return;
++	}
++
++	if (vt_waitactive(orig_fgconsole))
++		pr_warning("console_late_resume: Can't switch VCs.\n");
++}
++
++static struct early_suspend console_early_suspend_desc = {
++	.level = EARLY_SUSPEND_LEVEL_STOP_DRAWING,
++	.suspend = console_early_suspend,
++	.resume = console_late_resume,
++};
++
++static int __init console_early_suspend_init(void)
++{
++	register_early_suspend(&console_early_suspend_desc);
++	return 0;
++}
++
++static void  __exit console_early_suspend_exit(void)
++{
++	unregister_early_suspend(&console_early_suspend_desc);
++}
++
++module_init(console_early_suspend_init);
++module_exit(console_early_suspend_exit);
++
diff --git a/target/linux/goldfish/patches-2.6.30/0072-PM-earlysuspend-Removing-dependence-on-console.patch b/target/linux/goldfish/patches-2.6.30/0072-PM-earlysuspend-Removing-dependence-on-console.patch
new file mode 100644
index 0000000000..489cfc0f48
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0072-PM-earlysuspend-Removing-dependence-on-console.patch
@@ -0,0 +1,217 @@
+From ba801aa66e869f1f9f9d3a1610a2165baa024e4b Mon Sep 17 00:00:00 2001
+From: Rebecca Schultz <rschultz@google.com>
+Date: Thu, 17 Jul 2008 18:14:55 -0700
+Subject: [PATCH 072/134] PM: earlysuspend: Removing dependence on console.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Rather than signaling a full update of the display from userspace via a
+console switch, this patch introduces 2 files int /sys/power,
+wait_for_fb_sleep and wait_for_fb_wake.  Reading these files will block
+until the requested state has been entered.  When a read from
+wait_for_fb_sleep returns userspace should stop drawing.  When
+wait_for_fb_wake returns, it should do a full update.  If either are called
+when the fb driver is already in the requested state, they will return
+immediately.
+
+Signed-off-by: Rebecca Schultz <rschultz@google.com>
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ kernel/power/Kconfig          |    9 +++
+ kernel/power/Makefile         |    1 +
+ kernel/power/fbearlysuspend.c |  153 +++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 163 insertions(+), 0 deletions(-)
+ create mode 100644 kernel/power/fbearlysuspend.c
+
+--- a/kernel/power/Kconfig
++++ b/kernel/power/Kconfig
+@@ -159,6 +159,7 @@ config EARLYSUSPEND
+ 
+ choice
+ 	prompt "User-space screen access"
++	default FB_EARLYSUSPEND if !FRAMEBUFFER_CONSOLE
+ 	default CONSOLE_EARLYSUSPEND
+ 	depends on HAS_EARLYSUSPEND
+ 
+@@ -172,6 +173,14 @@ choice
+ 		  Register early suspend handler to perform a console switch to
+ 		  when user-space should stop drawing to the screen and a switch
+ 		  back when it should resume.
++
++	config FB_EARLYSUSPEND
++		bool "Sysfs interface"
++		depends on HAS_EARLYSUSPEND
++		---help---
++		  Register early suspend handler that notifies and waits for
++		  user-space through sysfs when user-space should stop drawing
++		  to the screen and notifies user-space when it should resume.
+ endchoice
+ 
+ config HIBERNATION
+--- a/kernel/power/Makefile
++++ b/kernel/power/Makefile
+@@ -10,6 +10,7 @@ obj-$(CONFIG_WAKELOCK)		+= wakelock.o
+ obj-$(CONFIG_USER_WAKELOCK)	+= userwakelock.o
+ obj-$(CONFIG_EARLYSUSPEND)	+= earlysuspend.o
+ obj-$(CONFIG_CONSOLE_EARLYSUSPEND)	+= consoleearlysuspend.o
++obj-$(CONFIG_FB_EARLYSUSPEND)	+= fbearlysuspend.o
+ obj-$(CONFIG_HIBERNATION)	+= swsusp.o disk.o snapshot.o swap.o user.o
+ 
+ obj-$(CONFIG_MAGIC_SYSRQ)	+= poweroff.o
+--- /dev/null
++++ b/kernel/power/fbearlysuspend.c
+@@ -0,0 +1,153 @@
++/* kernel/power/fbearlysuspend.c
++ *
++ * Copyright (C) 2005-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/earlysuspend.h>
++#include <linux/module.h>
++#include <linux/wait.h>
++
++#include "power.h"
++
++static wait_queue_head_t fb_state_wq;
++static DEFINE_SPINLOCK(fb_state_lock);
++static enum {
++	FB_STATE_STOPPED_DRAWING,
++	FB_STATE_REQUEST_STOP_DRAWING,
++	FB_STATE_DRAWING_OK,
++} fb_state;
++
++/* tell userspace to stop drawing, wait for it to stop */
++static void stop_drawing_early_suspend(struct early_suspend *h)
++{
++	int ret;
++	unsigned long irq_flags;
++
++	spin_lock_irqsave(&fb_state_lock, irq_flags);
++	fb_state = FB_STATE_REQUEST_STOP_DRAWING;
++	spin_unlock_irqrestore(&fb_state_lock, irq_flags);
++
++	wake_up_all(&fb_state_wq);
++	ret = wait_event_timeout(fb_state_wq,
++				 fb_state == FB_STATE_STOPPED_DRAWING,
++				 HZ);
++	if (unlikely(fb_state != FB_STATE_STOPPED_DRAWING))
++		pr_warning("stop_drawing_early_suspend: timeout waiting for "
++			   "userspace to stop drawing\n");
++}
++
++/* tell userspace to start drawing */
++static void start_drawing_late_resume(struct early_suspend *h)
++{
++	unsigned long irq_flags;
++
++	spin_lock_irqsave(&fb_state_lock, irq_flags);
++	fb_state = FB_STATE_DRAWING_OK;
++	spin_unlock_irqrestore(&fb_state_lock, irq_flags);
++	wake_up(&fb_state_wq);
++}
++
++static struct early_suspend stop_drawing_early_suspend_desc = {
++	.level = EARLY_SUSPEND_LEVEL_STOP_DRAWING,
++	.suspend = stop_drawing_early_suspend,
++	.resume = start_drawing_late_resume,
++};
++
++static ssize_t wait_for_fb_sleep_show(struct kobject *kobj,
++				      struct kobj_attribute *attr, char *buf)
++{
++	char *s = buf;
++	int ret;
++
++	ret = wait_event_interruptible(fb_state_wq,
++				       fb_state != FB_STATE_DRAWING_OK);
++	if (ret && fb_state == FB_STATE_DRAWING_OK)
++		return ret;
++	else
++		s += sprintf(buf, "sleeping");
++	return s - buf;
++}
++
++static ssize_t wait_for_fb_wake_show(struct kobject *kobj,
++				     struct kobj_attribute *attr, char *buf)
++{
++	char *s = buf;
++	int ret;
++	unsigned long irq_flags;
++
++	spin_lock_irqsave(&fb_state_lock, irq_flags);
++	if (fb_state == FB_STATE_REQUEST_STOP_DRAWING) {
++		fb_state = FB_STATE_STOPPED_DRAWING;
++		wake_up(&fb_state_wq);
++	}
++	spin_unlock_irqrestore(&fb_state_lock, irq_flags);
++
++	ret = wait_event_interruptible(fb_state_wq,
++				       fb_state == FB_STATE_DRAWING_OK);
++	if (ret && fb_state != FB_STATE_DRAWING_OK)
++		return ret;
++	else
++		s += sprintf(buf, "awake");
++
++	return s - buf;
++}
++
++#define power_ro_attr(_name) \
++static struct kobj_attribute _name##_attr = {	\
++	.attr	= {				\
++		.name = __stringify(_name),	\
++		.mode = 0444,			\
++	},					\
++	.show	= _name##_show,			\
++	.store	= NULL,		\
++}
++
++power_ro_attr(wait_for_fb_sleep);
++power_ro_attr(wait_for_fb_wake);
++
++static struct attribute *g[] = {
++	&wait_for_fb_sleep_attr.attr,
++	&wait_for_fb_wake_attr.attr,
++	NULL,
++};
++
++static struct attribute_group attr_group = {
++	.attrs = g,
++};
++
++static int __init android_power_init(void)
++{
++	int ret;
++
++	init_waitqueue_head(&fb_state_wq);
++	fb_state = FB_STATE_DRAWING_OK;
++
++	ret = sysfs_create_group(power_kobj, &attr_group);
++	if (ret) {
++		pr_err("android_power_init: sysfs_create_group failed\n");
++		return ret;
++	}
++
++	register_early_suspend(&stop_drawing_early_suspend_desc);
++	return 0;
++}
++
++static void  __exit android_power_exit(void)
++{
++	unregister_early_suspend(&stop_drawing_early_suspend_desc);
++	sysfs_remove_group(power_kobj, &attr_group);
++}
++
++module_init(android_power_init);
++module_exit(android_power_exit);
++
diff --git a/target/linux/goldfish/patches-2.6.30/0081-net-socket-ioctl-to-reset-connections-matching-loca.patch b/target/linux/goldfish/patches-2.6.30/0081-net-socket-ioctl-to-reset-connections-matching-loca.patch
new file mode 100644
index 0000000000..fdffc507a0
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0081-net-socket-ioctl-to-reset-connections-matching-loca.patch
@@ -0,0 +1,132 @@
+From 2df5996350da51bcdee798c00ae1f2415fd9ad20 Mon Sep 17 00:00:00 2001
+From: Robert Love <rlove@google.com>
+Date: Mon, 12 May 2008 17:08:29 -0400
+Subject: [PATCH 081/134] net: socket ioctl to reset connections matching local address
+
+Introduce a new socket ioctl, SIOCKILLADDR, that nukes all sockets
+bound to the same local address. This is useful in situations with
+dynamic IPs, to kill stuck connections.
+
+Signed-off-by: Brian Swetland <swetland@google.com>
+
+net: fix tcp_v4_nuke_addr
+
+Signed-off-by: Dima Zavin <dima@android.com>
+---
+ include/linux/sockios.h |    1 +
+ include/net/tcp.h       |    2 ++
+ net/ipv4/af_inet.c      |    1 +
+ net/ipv4/devinet.c      |    9 ++++++++-
+ net/ipv4/tcp_ipv4.c     |   31 +++++++++++++++++++++++++++++++
+ 5 files changed, 43 insertions(+), 1 deletions(-)
+
+--- a/include/linux/sockios.h
++++ b/include/linux/sockios.h
+@@ -65,6 +65,7 @@
+ #define SIOCDIFADDR	0x8936		/* delete PA address		*/
+ #define	SIOCSIFHWBROADCAST	0x8937	/* set hardware broadcast addr	*/
+ #define SIOCGIFCOUNT	0x8938		/* get number of devices */
++#define SIOCKILLADDR	0x8939		/* kill sockets with this local addr */
+ 
+ #define SIOCGIFBR	0x8940		/* Bridging support		*/
+ #define SIOCSIFBR	0x8941		/* Set bridging options 	*/
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1381,6 +1381,8 @@ extern struct sk_buff **tcp4_gro_receive
+ extern int tcp_gro_complete(struct sk_buff *skb);
+ extern int tcp4_gro_complete(struct sk_buff *skb);
+ 
++extern void tcp_v4_nuke_addr(__u32 saddr);
++
+ #ifdef CONFIG_PROC_FS
+ extern int  tcp4_proc_init(void);
+ extern void tcp4_proc_exit(void);
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -825,6 +825,7 @@ int inet_ioctl(struct socket *sock, unsi
+ 		case SIOCSIFPFLAGS:
+ 		case SIOCGIFPFLAGS:
+ 		case SIOCSIFFLAGS:
++		case SIOCKILLADDR:
+ 			err = devinet_ioctl(net, cmd, (void __user *)arg);
+ 			break;
+ 		default:
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -57,6 +57,7 @@
+ 
+ #include <net/arp.h>
+ #include <net/ip.h>
++#include <net/tcp.h>
+ #include <net/route.h>
+ #include <net/ip_fib.h>
+ #include <net/rtnetlink.h>
+@@ -631,6 +632,7 @@ int devinet_ioctl(struct net *net, unsig
+ 	case SIOCSIFBRDADDR:	/* Set the broadcast address */
+ 	case SIOCSIFDSTADDR:	/* Set the destination address */
+ 	case SIOCSIFNETMASK: 	/* Set the netmask for the interface */
++	case SIOCKILLADDR:	/* Nuke all sockets on this address */
+ 		ret = -EACCES;
+ 		if (!capable(CAP_NET_ADMIN))
+ 			goto out;
+@@ -680,7 +682,8 @@ int devinet_ioctl(struct net *net, unsig
+ 	}
+ 
+ 	ret = -EADDRNOTAVAIL;
+-	if (!ifa && cmd != SIOCSIFADDR && cmd != SIOCSIFFLAGS)
++	if (!ifa && cmd != SIOCSIFADDR && cmd != SIOCSIFFLAGS
++	    && cmd != SIOCKILLADDR)
+ 		goto done;
+ 
+ 	switch (cmd) {
+@@ -804,6 +807,10 @@ int devinet_ioctl(struct net *net, unsig
+ 			inet_insert_ifa(ifa);
+ 		}
+ 		break;
++	case SIOCKILLADDR:	/* Nuke all connections on this address */
++		ret = 0;
++		tcp_v4_nuke_addr(sin->sin_addr.s_addr);
++		break;
+ 	}
+ done:
+ 	rtnl_unlock();
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1845,6 +1845,37 @@ void tcp_v4_destroy_sock(struct sock *sk
+ 
+ EXPORT_SYMBOL(tcp_v4_destroy_sock);
+ 
++/*
++ * tcp_v4_nuke_addr - destroy all sockets on the given local address
++ */
++void tcp_v4_nuke_addr(__u32 saddr)
++{
++	unsigned int bucket;
++
++	for (bucket = 0; bucket < tcp_hashinfo.ehash_size; bucket++) {
++		struct hlist_nulls_node *node;
++		struct sock *sk;
++		spinlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, bucket);
++
++		spin_lock_bh(lock);
++		sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[bucket].chain) {
++			struct inet_sock *inet = inet_sk(sk);
++
++			if (inet->rcv_saddr != saddr)
++				continue;
++			if (sysctl_ip_dynaddr && sk->sk_state == TCP_SYN_SENT)
++				continue;
++			if (sock_flag(sk, SOCK_DEAD))
++				continue;
++
++			sk->sk_err = ETIMEDOUT;
++			sk->sk_error_report(sk);
++			tcp_done(sk);
++		}
++		spin_unlock_bh(lock);
++	}
++}
++
+ #ifdef CONFIG_PROC_FS
+ /* Proc filesystem TCP sock list dumping. */
+ 
diff --git a/target/linux/goldfish/patches-2.6.30/0082-sysfs_net_ipv4-Add-sysfs-based-knobs-for-controllin.patch b/target/linux/goldfish/patches-2.6.30/0082-sysfs_net_ipv4-Add-sysfs-based-knobs-for-controllin.patch
new file mode 100644
index 0000000000..f1fce089c6
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0082-sysfs_net_ipv4-Add-sysfs-based-knobs-for-controllin.patch
@@ -0,0 +1,128 @@
+From 75090d40ffbd9b4863238e1d62b43f8598da5e5e Mon Sep 17 00:00:00 2001
+From: Robert Love <rlove@google.com>
+Date: Thu, 31 Jul 2008 11:12:44 -0400
+Subject: [PATCH 082/134] sysfs_net_ipv4: Add sysfs-based knobs for controlling TCP window size
+
+Add a family of knobs to /sys/kernel/ipv4 for controlling the TCP window size:
+
+	tcp_wmem_min
+	tcp_wmem_def
+	tcp_wmem_max
+	tcp_rmem_min
+	tcp_rmem_def
+	tcp_rmem_max
+
+This six values mirror the sysctl knobs in /proc/sys/net/ipv4/tcp_wmem and
+/proc/sys/net/ipv4/tcp_rmem.
+
+Sysfs, unlike sysctl, allows us to set and manage the files' permissions and
+owners.
+
+Signed-off-by: Robert Love <rlove@google.com>
+---
+ net/ipv4/Makefile         |    1 +
+ net/ipv4/sysfs_net_ipv4.c |   88 +++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 89 insertions(+), 0 deletions(-)
+ create mode 100644 net/ipv4/sysfs_net_ipv4.c
+
+--- a/net/ipv4/Makefile
++++ b/net/ipv4/Makefile
+@@ -14,6 +14,7 @@ obj-y     := route.o inetpeer.o protocol
+ 	     inet_fragment.o
+ 
+ obj-$(CONFIG_SYSCTL) += sysctl_net_ipv4.o
++obj-$(CONFIG_SYSFS) += sysfs_net_ipv4.o
+ obj-$(CONFIG_IP_FIB_HASH) += fib_hash.o
+ obj-$(CONFIG_IP_FIB_TRIE) += fib_trie.o
+ obj-$(CONFIG_PROC_FS) += proc.o
+--- /dev/null
++++ b/net/ipv4/sysfs_net_ipv4.c
+@@ -0,0 +1,88 @@
++/*
++ * net/ipv4/sysfs_net_ipv4.c
++ *
++ * sysfs-based networking knobs (so we can, unlike with sysctl, control perms)
++ *
++ * Copyright (C) 2008 Google, Inc.
++ *
++ * Robert Love <rlove@google.com>
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/kobject.h>
++#include <linux/string.h>
++#include <linux/sysfs.h>
++#include <linux/init.h>
++#include <net/tcp.h>
++
++#define CREATE_IPV4_FILE(_name, _var) \
++static ssize_t _name##_show(struct kobject *kobj, \
++			    struct kobj_attribute *attr, char *buf) \
++{ \
++	return sprintf(buf, "%d\n", _var); \
++} \
++static ssize_t _name##_store(struct kobject *kobj, \
++			     struct kobj_attribute *attr, \
++			     const char *buf, size_t count) \
++{ \
++	int val, ret; \
++	ret = sscanf(buf, "%d", &val); \
++	if (ret != 1) \
++		return -EINVAL; \
++	if (val < 0) \
++		return -EINVAL; \
++	_var = val; \
++	return count; \
++} \
++static struct kobj_attribute _name##_attr = \
++	__ATTR(_name, 0644, _name##_show, _name##_store)
++
++CREATE_IPV4_FILE(tcp_wmem_min, sysctl_tcp_wmem[0]);
++CREATE_IPV4_FILE(tcp_wmem_def, sysctl_tcp_wmem[1]);
++CREATE_IPV4_FILE(tcp_wmem_max, sysctl_tcp_wmem[2]);
++
++CREATE_IPV4_FILE(tcp_rmem_min, sysctl_tcp_rmem[0]);
++CREATE_IPV4_FILE(tcp_rmem_def, sysctl_tcp_rmem[1]);
++CREATE_IPV4_FILE(tcp_rmem_max, sysctl_tcp_rmem[2]);
++
++static struct attribute *ipv4_attrs[] = {
++	&tcp_wmem_min_attr.attr,
++	&tcp_wmem_def_attr.attr,
++	&tcp_wmem_max_attr.attr,
++	&tcp_rmem_min_attr.attr,
++	&tcp_rmem_def_attr.attr,
++	&tcp_rmem_max_attr.attr,
++	NULL
++};
++
++static struct attribute_group ipv4_attr_group = {
++	.attrs = ipv4_attrs,
++};
++
++static __init int sysfs_ipv4_init(void)
++{
++	struct kobject *ipv4_kobject;
++	int ret;
++
++	ipv4_kobject = kobject_create_and_add("ipv4", kernel_kobj);
++	if (!ipv4_kobject)
++		return -ENOMEM;
++
++	ret = sysfs_create_group(ipv4_kobject, &ipv4_attr_group);
++	if (ret) {
++		kobject_put(ipv4_kobject);
++		return ret;
++	}
++
++	return 0;
++}
++
++subsys_initcall(sysfs_ipv4_init);
diff --git a/target/linux/goldfish/patches-2.6.30/0086-Input-Generic-GPIO-Input-device.patch b/target/linux/goldfish/patches-2.6.30/0086-Input-Generic-GPIO-Input-device.patch
new file mode 100644
index 0000000000..1025633802
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0086-Input-Generic-GPIO-Input-device.patch
@@ -0,0 +1,1460 @@
+From 6730377482c05a1742abb92f1463701f5d084a27 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Wed, 15 Oct 2008 18:23:47 -0700
+Subject: [PATCH 086/134] Input: Generic GPIO Input device.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Supports keyboard matrixces, direct inputs, direct outputs and axes connected to gpios.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+Signed-off-by: Nick Pelly <npelly@google.com>
+---
+ drivers/input/misc/Kconfig       |    5 +
+ drivers/input/misc/Makefile      |    1 +
+ drivers/input/misc/gpio_axis.c   |  180 +++++++++++++++++
+ drivers/input/misc/gpio_event.c  |  224 +++++++++++++++++++++
+ drivers/input/misc/gpio_input.c  |  343 ++++++++++++++++++++++++++++++++
+ drivers/input/misc/gpio_matrix.c |  406 ++++++++++++++++++++++++++++++++++++++
+ drivers/input/misc/gpio_output.c |   84 ++++++++
+ include/linux/gpio_event.h       |  154 ++++++++++++++
+ 8 files changed, 1397 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/input/misc/gpio_axis.c
+ create mode 100644 drivers/input/misc/gpio_event.c
+ create mode 100644 drivers/input/misc/gpio_input.c
+ create mode 100644 drivers/input/misc/gpio_matrix.c
+ create mode 100644 drivers/input/misc/gpio_output.c
+ create mode 100644 include/linux/gpio_event.h
+
+--- a/drivers/input/misc/Kconfig
++++ b/drivers/input/misc/Kconfig
+@@ -212,6 +212,11 @@ config INPUT_SGI_BTNS
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called sgi_btns.
+ 
++config INPUT_GPIO
++	tristate "GPIO driver support"
++	help
++	  Say Y here if you want to support gpio based keys, wheels etc...
++
+ config HP_SDC_RTC
+ 	tristate "HP SDC Real Time Clock"
+ 	depends on (GSC || HP300) && SERIO
+--- a/drivers/input/misc/Makefile
++++ b/drivers/input/misc/Makefile
+@@ -25,3 +25,5 @@ obj-$(CONFIG_INPUT_UINPUT)		+= uinput.o
+ obj-$(CONFIG_INPUT_WISTRON_BTNS)	+= wistron_btns.o
+ obj-$(CONFIG_INPUT_YEALINK)		+= yealink.o
+ obj-$(CONFIG_INPUT_GPIO_BUTTONS)	+= gpio_buttons.o
++obj-$(CONFIG_INPUT_GPIO)		+= gpio_event.o gpio_matrix.o gpio_input.o gpio_output.o gpio_axis.o
++
+--- /dev/null
++++ b/drivers/input/misc/gpio_axis.c
+@@ -0,0 +1,180 @@
++/* drivers/input/misc/gpio_axis.c
++ *
++ * Copyright (C) 2007 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/gpio.h>
++#include <linux/gpio_event.h>
++#include <linux/interrupt.h>
++
++struct gpio_axis_state {
++	struct input_dev *input_dev;
++	struct gpio_event_axis_info *info;
++	uint32_t pos;
++};
++
++uint16_t gpio_axis_4bit_gray_map_table[] = {
++	[0x0] = 0x0, [0x1] = 0x1, /* 0000 0001 */
++	[0x3] = 0x2, [0x2] = 0x3, /* 0011 0010 */
++	[0x6] = 0x4, [0x7] = 0x5, /* 0110 0111 */
++	[0x5] = 0x6, [0x4] = 0x7, /* 0101 0100 */
++	[0xc] = 0x8, [0xd] = 0x9, /* 1100 1101 */
++	[0xf] = 0xa, [0xe] = 0xb, /* 1111 1110 */
++	[0xa] = 0xc, [0xb] = 0xd, /* 1010 1011 */
++	[0x9] = 0xe, [0x8] = 0xf, /* 1001 1000 */
++};
++uint16_t gpio_axis_4bit_gray_map(struct gpio_event_axis_info *info, uint16_t in)
++{
++	return gpio_axis_4bit_gray_map_table[in];
++}
++
++uint16_t gpio_axis_5bit_singletrack_map_table[] = {
++	[0x10] = 0x00, [0x14] = 0x01, [0x1c] = 0x02, /*     10000 10100 11100 */
++	[0x1e] = 0x03, [0x1a] = 0x04, [0x18] = 0x05, /*     11110 11010 11000 */
++	[0x08] = 0x06, [0x0a] = 0x07, [0x0e] = 0x08, /*    01000 01010 01110  */
++	[0x0f] = 0x09, [0x0d] = 0x0a, [0x0c] = 0x0b, /*    01111 01101 01100  */
++	[0x04] = 0x0c, [0x05] = 0x0d, [0x07] = 0x0e, /*   00100 00101 00111   */
++	[0x17] = 0x0f, [0x16] = 0x10, [0x06] = 0x11, /*   10111 10110 00110   */
++	[0x02] = 0x12, [0x12] = 0x13, [0x13] = 0x14, /*  00010 10010 10011    */
++	[0x1b] = 0x15, [0x0b] = 0x16, [0x03] = 0x17, /*  11011 01011 00011    */
++	[0x01] = 0x18, [0x09] = 0x19, [0x19] = 0x1a, /* 00001 01001 11001     */
++	[0x1d] = 0x1b, [0x15] = 0x1c, [0x11] = 0x1d, /* 11101 10101 10001     */
++};
++uint16_t gpio_axis_5bit_singletrack_map(
++	struct gpio_event_axis_info *info, uint16_t in)
++{
++	return gpio_axis_5bit_singletrack_map_table[in];
++}
++
++static void gpio_event_update_axis(struct gpio_axis_state *as, int report)
++{
++	struct gpio_event_axis_info *ai = as->info;
++	int i;
++	int change;
++	uint16_t state = 0;
++	uint16_t pos;
++	uint16_t old_pos = as->pos;
++	for (i = ai->count - 1; i >= 0; i--)
++		state = (state << 1) | gpio_get_value(ai->gpio[i]);
++	pos = ai->map(ai, state);
++	if (ai->flags & GPIOEAF_PRINT_RAW)
++		pr_info("axis %d-%d raw %x, pos %d -> %d\n",
++			ai->type, ai->code, state, old_pos, pos);
++	if (report && pos != old_pos) {
++		if (ai->type == EV_REL) {
++			change = (ai->decoded_size + pos - old_pos) %
++				  ai->decoded_size;
++			if (change > ai->decoded_size / 2)
++				change -= ai->decoded_size;
++			if (change == ai->decoded_size / 2) {
++				if (ai->flags & GPIOEAF_PRINT_EVENT)
++					pr_info("axis %d-%d unknown direction, "
++						"pos %d -> %d\n", ai->type,
++						ai->code, old_pos, pos);
++				change = 0; /* no closest direction */
++			}
++			if (ai->flags & GPIOEAF_PRINT_EVENT)
++				pr_info("axis %d-%d change %d\n",
++					ai->type, ai->code, change);
++			input_report_rel(as->input_dev, ai->code, change);
++		} else {
++			if (ai->flags & GPIOEAF_PRINT_EVENT)
++				pr_info("axis %d-%d now %d\n",
++					ai->type, ai->code, pos);
++			input_event(as->input_dev, ai->type, ai->code, pos);
++		}
++		input_sync(as->input_dev);
++	}
++	as->pos = pos;
++}
++
++static irqreturn_t gpio_axis_irq_handler(int irq, void *dev_id)
++{
++	struct gpio_axis_state *as = dev_id;
++	gpio_event_update_axis(as, 1);
++	return IRQ_HANDLED;
++}
++
++int gpio_event_axis_func(struct input_dev *input_dev,
++			 struct gpio_event_info *info, void **data, int func)
++{
++	int ret;
++	int i;
++	int irq;
++	struct gpio_event_axis_info *ai;
++	struct gpio_axis_state *as;
++
++	ai = container_of(info, struct gpio_event_axis_info, info);
++	if (func == GPIO_EVENT_FUNC_SUSPEND) {
++		for (i = 0; i < ai->count; i++)
++			disable_irq(gpio_to_irq(ai->gpio[i]));
++		return 0;
++	}
++	if (func == GPIO_EVENT_FUNC_RESUME) {
++		for (i = 0; i < ai->count; i++)
++			enable_irq(gpio_to_irq(ai->gpio[i]));
++		return 0;
++	}
++
++	if (func == GPIO_EVENT_FUNC_INIT) {
++		*data = as = kmalloc(sizeof(*as), GFP_KERNEL);
++		if (as == NULL) {
++			ret = -ENOMEM;
++			goto err_alloc_axis_state_failed;
++		}
++		as->input_dev = input_dev;
++		as->info = ai;
++
++		input_set_capability(input_dev, ai->type, ai->code);
++		if (ai->type == EV_ABS) {
++			input_set_abs_params(input_dev, ai->code, 0,
++					     ai->decoded_size - 1, 0, 0);
++		}
++		for (i = 0; i < ai->count; i++) {
++			ret = gpio_request(ai->gpio[i], "gpio_event_axis");
++			if (ret < 0)
++				goto err_request_gpio_failed;
++			ret = gpio_direction_input(ai->gpio[i]);
++			if (ret < 0)
++				goto err_gpio_direction_input_failed;
++			ret = irq = gpio_to_irq(ai->gpio[i]);
++			if (ret < 0)
++				goto err_get_irq_num_failed;
++			ret = request_irq(irq, gpio_axis_irq_handler,
++					  IRQF_TRIGGER_RISING |
++					  IRQF_TRIGGER_FALLING,
++					  "gpio_event_axis", as);
++			if (ret < 0)
++				goto err_request_irq_failed;
++		}
++		gpio_event_update_axis(as, 0);
++		return 0;
++	}
++
++	ret = 0;
++	as = *data;
++	for (i = ai->count - 1; i >= 0; i--) {
++		free_irq(gpio_to_irq(ai->gpio[i]), as);
++err_request_irq_failed:
++err_get_irq_num_failed:
++err_gpio_direction_input_failed:
++		gpio_free(ai->gpio[i]);
++err_request_gpio_failed:
++		;
++	}
++	kfree(as);
++	*data = NULL;
++err_alloc_axis_state_failed:
++	return ret;
++}
+--- /dev/null
++++ b/drivers/input/misc/gpio_event.c
+@@ -0,0 +1,224 @@
++/* drivers/input/misc/gpio_event.c
++ *
++ * Copyright (C) 2007 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/earlysuspend.h>
++#include <linux/module.h>
++#include <linux/input.h>
++#include <linux/gpio_event.h>
++#include <linux/hrtimer.h>
++#include <linux/platform_device.h>
++
++struct gpio_event {
++	struct input_dev *input_dev;
++	const struct gpio_event_platform_data *info;
++	struct early_suspend early_suspend;
++	void *state[0];
++};
++
++static int gpio_input_event(
++	struct input_dev *dev, unsigned int type, unsigned int code, int value)
++{
++	int i;
++	int ret = 0;
++	int tmp_ret;
++	struct gpio_event_info **ii;
++	struct gpio_event *ip = input_get_drvdata(dev);
++
++	for (i = 0, ii = ip->info->info; i < ip->info->info_count; i++, ii++) {
++		if ((*ii)->event) {
++			tmp_ret = (*ii)->event(ip->input_dev, *ii,
++					&ip->state[i], type, code, value);
++			if (tmp_ret)
++				ret = tmp_ret;
++		}
++	}
++	return ret;
++}
++
++static int gpio_event_call_all_func(struct gpio_event *ip, int func)
++{
++	int i;
++	int ret;
++	struct gpio_event_info **ii;
++
++	if (func == GPIO_EVENT_FUNC_INIT || func == GPIO_EVENT_FUNC_RESUME) {
++		ii = ip->info->info;
++		for (i = 0; i < ip->info->info_count; i++, ii++) {
++			if ((*ii)->func == NULL) {
++				ret = -ENODEV;
++				pr_err("gpio_event_probe: Incomplete pdata, "
++					"no function\n");
++				goto err_no_func;
++			}
++			ret = (*ii)->func(ip->input_dev, *ii, &ip->state[i],
++					  func);
++			if (ret) {
++				pr_err("gpio_event_probe: function failed\n");
++				goto err_func_failed;
++			}
++		}
++		return 0;
++	}
++
++	ret = 0;
++	i = ip->info->info_count;
++	ii = ip->info->info + i;
++	while (i > 0) {
++		i--;
++		ii--;
++		(*ii)->func(ip->input_dev, *ii, &ip->state[i], func & ~1);
++err_func_failed:
++err_no_func:
++		;
++	}
++	return ret;
++}
++
++#ifdef CONFIG_HAS_EARLYSUSPEND
++void gpio_event_suspend(struct early_suspend *h)
++{
++	struct gpio_event *ip;
++	ip = container_of(h, struct gpio_event, early_suspend);
++	gpio_event_call_all_func(ip, GPIO_EVENT_FUNC_SUSPEND);
++	ip->info->power(ip->info, 0);
++}
++
++void gpio_event_resume(struct early_suspend *h)
++{
++	struct gpio_event *ip;
++	ip = container_of(h, struct gpio_event, early_suspend);
++	ip->info->power(ip->info, 1);
++	gpio_event_call_all_func(ip, GPIO_EVENT_FUNC_RESUME);
++}
++#endif
++
++static int __init gpio_event_probe(struct platform_device *pdev)
++{
++	int err;
++	struct gpio_event *ip;
++	struct input_dev *input_dev;
++	struct gpio_event_platform_data *event_info;
++
++	event_info = pdev->dev.platform_data;
++	if (event_info == NULL) {
++		pr_err("gpio_event_probe: No pdata\n");
++		return -ENODEV;
++	}
++	if (event_info->name == NULL ||
++	   event_info->info == NULL ||
++	   event_info->info_count == 0) {
++		pr_err("gpio_event_probe: Incomplete pdata\n");
++		return -ENODEV;
++	}
++	ip = kzalloc(sizeof(*ip) +
++		     sizeof(ip->state[0]) * event_info->info_count, GFP_KERNEL);
++	if (ip == NULL) {
++		err = -ENOMEM;
++		pr_err("gpio_event_probe: Failed to allocate private data\n");
++		goto err_kp_alloc_failed;
++	}
++	platform_set_drvdata(pdev, ip);
++
++	input_dev = input_allocate_device();
++	if (input_dev == NULL) {
++		err = -ENOMEM;
++		pr_err("gpio_event_probe: Failed to allocate input device\n");
++		goto err_input_dev_alloc_failed;
++	}
++	input_set_drvdata(input_dev, ip);
++	ip->input_dev = input_dev;
++	ip->info = event_info;
++	if (event_info->power) {
++#ifdef CONFIG_HAS_EARLYSUSPEND
++		ip->early_suspend.level = EARLY_SUSPEND_LEVEL_BLANK_SCREEN + 1;
++		ip->early_suspend.suspend = gpio_event_suspend;
++		ip->early_suspend.resume = gpio_event_resume;
++		register_early_suspend(&ip->early_suspend);
++#endif
++		ip->info->power(ip->info, 1);
++	}
++
++	input_dev->name = ip->info->name;
++	input_dev->event = gpio_input_event;
++
++	err = gpio_event_call_all_func(ip, GPIO_EVENT_FUNC_INIT);
++	if (err)
++		goto err_call_all_func_failed;
++
++	err = input_register_device(input_dev);
++	if (err) {
++		pr_err("gpio_event_probe: Unable to register %s input device\n",
++			input_dev->name);
++		goto err_input_register_device_failed;
++	}
++
++	return 0;
++
++err_input_register_device_failed:
++	gpio_event_call_all_func(ip, GPIO_EVENT_FUNC_UNINIT);
++err_call_all_func_failed:
++	if (event_info->power) {
++#ifdef CONFIG_HAS_EARLYSUSPEND
++		unregister_early_suspend(&ip->early_suspend);
++#endif
++		ip->info->power(ip->info, 0);
++	}
++	input_free_device(input_dev);
++err_input_dev_alloc_failed:
++	kfree(ip);
++err_kp_alloc_failed:
++	return err;
++}
++
++static int gpio_event_remove(struct platform_device *pdev)
++{
++	struct gpio_event *ip = platform_get_drvdata(pdev);
++
++	gpio_event_call_all_func(ip, GPIO_EVENT_FUNC_UNINIT);
++	if (ip->info->power) {
++#ifdef CONFIG_HAS_EARLYSUSPEND
++		unregister_early_suspend(&ip->early_suspend);
++#endif
++		ip->info->power(ip->info, 0);
++	}
++	input_unregister_device(ip->input_dev);
++	kfree(ip);
++	return 0;
++}
++
++static struct platform_driver gpio_event_driver = {
++	.probe		= gpio_event_probe,
++	.remove		= gpio_event_remove,
++	.driver		= {
++		.name	= GPIO_EVENT_DEV_NAME,
++	},
++};
++
++static int __devinit gpio_event_init(void)
++{
++	return platform_driver_register(&gpio_event_driver);
++}
++
++static void __exit gpio_event_exit(void)
++{
++	platform_driver_unregister(&gpio_event_driver);
++}
++
++module_init(gpio_event_init);
++module_exit(gpio_event_exit);
++
++MODULE_DESCRIPTION("GPIO Event Driver");
++MODULE_LICENSE("GPL");
++
+--- /dev/null
++++ b/drivers/input/misc/gpio_input.c
+@@ -0,0 +1,343 @@
++/* drivers/input/misc/gpio_input.c
++ *
++ * Copyright (C) 2007 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/gpio.h>
++#include <linux/gpio_event.h>
++#include <linux/hrtimer.h>
++#include <linux/input.h>
++#include <linux/interrupt.h>
++#include <linux/wakelock.h>
++
++enum {
++	DEBOUNCE_UNSTABLE     = BIT(0),	/* Got irq, while debouncing */
++	DEBOUNCE_PRESSED      = BIT(1),
++	DEBOUNCE_NOTPRESSED   = BIT(2),
++	DEBOUNCE_WAIT_IRQ     = BIT(3),	/* Stable irq state */
++	DEBOUNCE_POLL         = BIT(4),	/* Stable polling state */
++
++	DEBOUNCE_UNKNOWN =
++		DEBOUNCE_PRESSED | DEBOUNCE_NOTPRESSED,
++};
++
++struct gpio_key_state {
++	struct gpio_input_state *ds;
++	uint8_t debounce;
++};
++
++struct gpio_input_state {
++	struct input_dev *input_dev;
++	const struct gpio_event_input_info *info;
++	struct hrtimer timer;
++	int use_irq;
++	int debounce_count;
++	spinlock_t irq_lock;
++	struct wake_lock wake_lock;
++	struct gpio_key_state key_state[0];
++};
++
++static enum hrtimer_restart gpio_event_input_timer_func(struct hrtimer *timer)
++{
++	int i;
++	int pressed;
++	struct gpio_input_state *ds =
++		container_of(timer, struct gpio_input_state, timer);
++	unsigned gpio_flags = ds->info->flags;
++	unsigned npolarity;
++	int nkeys = ds->info->keymap_size;
++	const struct gpio_event_direct_entry *key_entry;
++	struct gpio_key_state *key_state;
++	unsigned long irqflags;
++	uint8_t debounce;
++
++#if 0
++	key_entry = kp->keys_info->keymap;
++	key_state = kp->key_state;
++	for (i = 0; i < nkeys; i++, key_entry++, key_state++)
++		pr_info("gpio_read_detect_status %d %d\n", key_entry->gpio,
++			gpio_read_detect_status(key_entry->gpio));
++#endif
++	key_entry = ds->info->keymap;
++	key_state = ds->key_state;
++	spin_lock_irqsave(&ds->irq_lock, irqflags);
++	for (i = 0; i < nkeys; i++, key_entry++, key_state++) {
++		debounce = key_state->debounce;
++		if (debounce & DEBOUNCE_WAIT_IRQ)
++			continue;
++		if (key_state->debounce & DEBOUNCE_UNSTABLE) {
++			debounce = key_state->debounce = DEBOUNCE_UNKNOWN;
++			enable_irq(gpio_to_irq(key_entry->gpio));
++			pr_info("gpio_keys_scan_keys: key %x-%x, %d "
++				"(%d) continue debounce\n",
++				ds->info->type, key_entry->code,
++				i, key_entry->gpio);
++		}
++		npolarity = !(gpio_flags & GPIOEDF_ACTIVE_HIGH);
++		pressed = gpio_get_value(key_entry->gpio) ^ npolarity;
++		if (debounce & DEBOUNCE_POLL) {
++			if (pressed == !(debounce & DEBOUNCE_PRESSED)) {
++				ds->debounce_count++;
++				key_state->debounce = DEBOUNCE_UNKNOWN;
++				if (gpio_flags & GPIOEDF_PRINT_KEY_DEBOUNCE)
++					pr_info("gpio_keys_scan_keys: key %x-"
++						"%x, %d (%d) start debounce\n",
++						ds->info->type, key_entry->code,
++						i, key_entry->gpio);
++			}
++			continue;
++		}
++		if (pressed && (debounce & DEBOUNCE_NOTPRESSED)) {
++			if (gpio_flags & GPIOEDF_PRINT_KEY_DEBOUNCE)
++				pr_info("gpio_keys_scan_keys: key %x-%x, %d "
++					"(%d) debounce pressed 1\n",
++					ds->info->type, key_entry->code,
++					i, key_entry->gpio);
++			key_state->debounce = DEBOUNCE_PRESSED;
++			continue;
++		}
++		if (!pressed && (debounce & DEBOUNCE_PRESSED)) {
++			if (gpio_flags & GPIOEDF_PRINT_KEY_DEBOUNCE)
++				pr_info("gpio_keys_scan_keys: key %x-%x, %d "
++					"(%d) debounce pressed 0\n",
++					ds->info->type, key_entry->code,
++					i, key_entry->gpio);
++			key_state->debounce = DEBOUNCE_NOTPRESSED;
++			continue;
++		}
++		/* key is stable */
++		ds->debounce_count--;
++		if (ds->use_irq)
++			key_state->debounce |= DEBOUNCE_WAIT_IRQ;
++		else
++			key_state->debounce |= DEBOUNCE_POLL;
++		if (gpio_flags & GPIOEDF_PRINT_KEYS)
++			pr_info("gpio_keys_scan_keys: key %x-%x, %d (%d) "
++				"changed to %d\n", ds->info->type,
++				key_entry->code, i, key_entry->gpio, pressed);
++		input_event(ds->input_dev, ds->info->type,
++			    key_entry->code, pressed);
++	}
++
++#if 0
++	key_entry = kp->keys_info->keymap;
++	key_state = kp->key_state;
++	for (i = 0; i < nkeys; i++, key_entry++, key_state++) {
++		pr_info("gpio_read_detect_status %d %d\n", key_entry->gpio,
++			gpio_read_detect_status(key_entry->gpio));
++	}
++#endif
++
++	if (ds->debounce_count)
++		hrtimer_start(timer, ds->info->debounce_time, HRTIMER_MODE_REL);
++	else if (!ds->use_irq)
++		hrtimer_start(timer, ds->info->poll_time, HRTIMER_MODE_REL);
++	else
++		wake_unlock(&ds->wake_lock);
++
++	spin_unlock_irqrestore(&ds->irq_lock, irqflags);
++
++	return HRTIMER_NORESTART;
++}
++
++static irqreturn_t gpio_event_input_irq_handler(int irq, void *dev_id)
++{
++	struct gpio_key_state *ks = dev_id;
++	struct gpio_input_state *ds = ks->ds;
++	int keymap_index = ks - ds->key_state;
++	const struct gpio_event_direct_entry *key_entry;
++	unsigned long irqflags;
++	int pressed;
++
++	if (!ds->use_irq)
++		return IRQ_HANDLED;
++
++	key_entry = &ds->info->keymap[keymap_index];
++
++	if (ds->info->debounce_time.tv64) {
++		spin_lock_irqsave(&ds->irq_lock, irqflags);
++		if (ks->debounce & DEBOUNCE_WAIT_IRQ) {
++			ks->debounce = DEBOUNCE_UNKNOWN;
++			if (ds->debounce_count++ == 0) {
++				wake_lock(&ds->wake_lock);
++				hrtimer_start(
++					&ds->timer, ds->info->debounce_time,
++					HRTIMER_MODE_REL);
++			}
++			if (ds->info->flags & GPIOEDF_PRINT_KEY_DEBOUNCE)
++				pr_info("gpio_event_input_irq_handler: "
++					"key %x-%x, %d (%d) start debounce\n",
++					ds->info->type, key_entry->code,
++					keymap_index, key_entry->gpio);
++		} else {
++			disable_irq(irq);
++			ks->debounce = DEBOUNCE_UNSTABLE;
++		}
++		spin_unlock_irqrestore(&ds->irq_lock, irqflags);
++	} else {
++		pressed = gpio_get_value(key_entry->gpio) ^
++			!(ds->info->flags & GPIOEDF_ACTIVE_HIGH);
++		if (ds->info->flags & GPIOEDF_PRINT_KEYS)
++			pr_info("gpio_event_input_irq_handler: key %x-%x, %d "
++				"(%d) changed to %d\n",
++				ds->info->type, key_entry->code, keymap_index,
++				key_entry->gpio, pressed);
++		input_event(ds->input_dev, ds->info->type,
++			    key_entry->code, pressed);
++	}
++	return IRQ_HANDLED;
++}
++
++static int gpio_event_input_request_irqs(struct gpio_input_state *ds)
++{
++	int i;
++	int err;
++	unsigned int irq;
++	unsigned long req_flags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING;
++
++	for (i = 0; i < ds->info->keymap_size; i++) {
++		err = irq = gpio_to_irq(ds->info->keymap[i].gpio);
++		if (err < 0)
++			goto err_gpio_get_irq_num_failed;
++		err = request_irq(irq, gpio_event_input_irq_handler,
++				  req_flags, "gpio_keys", &ds->key_state[i]);
++		if (err) {
++			pr_err("gpio_event_input_request_irqs: request_irq "
++				"failed for input %d, irq %d\n",
++				ds->info->keymap[i].gpio, irq);
++			goto err_request_irq_failed;
++		}
++		enable_irq_wake(irq);
++	}
++	return 0;
++
++	for (i = ds->info->keymap_size - 1; i >= 0; i--) {
++		free_irq(gpio_to_irq(ds->info->keymap[i].gpio),
++			 &ds->key_state[i]);
++err_request_irq_failed:
++err_gpio_get_irq_num_failed:
++		;
++	}
++	return err;
++}
++
++int gpio_event_input_func(struct input_dev *input_dev,
++			struct gpio_event_info *info, void **data, int func)
++{
++	int ret;
++	int i;
++	unsigned long irqflags;
++	struct gpio_event_input_info *di;
++	struct gpio_input_state *ds = *data;
++
++	di = container_of(info, struct gpio_event_input_info, info);
++
++	if (func == GPIO_EVENT_FUNC_SUSPEND) {
++		spin_lock_irqsave(&ds->irq_lock, irqflags);
++		if (ds->use_irq)
++			for (i = 0; i < di->keymap_size; i++)
++				disable_irq(gpio_to_irq(di->keymap[i].gpio));
++		spin_unlock_irqrestore(&ds->irq_lock, irqflags);
++		hrtimer_cancel(&ds->timer);
++		return 0;
++	}
++	if (func == GPIO_EVENT_FUNC_RESUME) {
++		spin_lock_irqsave(&ds->irq_lock, irqflags);
++		if (ds->use_irq)
++			for (i = 0; i < di->keymap_size; i++)
++				enable_irq(gpio_to_irq(di->keymap[i].gpio));
++		hrtimer_start(&ds->timer, ktime_set(0, 0), HRTIMER_MODE_REL);
++		spin_unlock_irqrestore(&ds->irq_lock, irqflags);
++		return 0;
++	}
++
++	if (func == GPIO_EVENT_FUNC_INIT) {
++		if (ktime_to_ns(di->poll_time) <= 0)
++			di->poll_time = ktime_set(0, 20 * NSEC_PER_MSEC);
++
++		*data = ds = kzalloc(sizeof(*ds) + sizeof(ds->key_state[0]) *
++					di->keymap_size, GFP_KERNEL);
++		if (ds == NULL) {
++			ret = -ENOMEM;
++			pr_err("gpio_event_input_func: "
++				"Failed to allocate private data\n");
++			goto err_ds_alloc_failed;
++		}
++		ds->debounce_count = di->keymap_size;
++		ds->input_dev = input_dev;
++		ds->info = di;
++		wake_lock_init(&ds->wake_lock, WAKE_LOCK_SUSPEND, "gpio_input");
++		spin_lock_init(&ds->irq_lock);
++
++		for (i = 0; i < di->keymap_size; i++) {
++			input_set_capability(input_dev, di->type,
++					     di->keymap[i].code);
++			ds->key_state[i].ds = ds;
++			ds->key_state[i].debounce = DEBOUNCE_UNKNOWN;
++		}
++
++		for (i = 0; i < di->keymap_size; i++) {
++			ret = gpio_request(di->keymap[i].gpio, "gpio_kp_in");
++			if (ret) {
++				pr_err("gpio_event_input_func: gpio_request "
++					"failed for %d\n", di->keymap[i].gpio);
++				goto err_gpio_request_failed;
++			}
++			ret = gpio_direction_input(di->keymap[i].gpio);
++			if (ret) {
++				pr_err("gpio_event_input_func: "
++					"gpio_direction_input failed for %d\n",
++					di->keymap[i].gpio);
++				goto err_gpio_configure_failed;
++			}
++		}
++
++		ret = gpio_event_input_request_irqs(ds);
++
++		spin_lock_irqsave(&ds->irq_lock, irqflags);
++		ds->use_irq = ret == 0;
++
++		pr_info("GPIO Input Driver: Start gpio inputs for %s in %s "
++			"mode\n",
++			input_dev->name, ret == 0 ? "interrupt" : "polling");
++
++		hrtimer_init(&ds->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++		ds->timer.function = gpio_event_input_timer_func;
++		hrtimer_start(&ds->timer, ktime_set(0, 0), HRTIMER_MODE_REL);
++		spin_unlock_irqrestore(&ds->irq_lock, irqflags);
++		return 0;
++	}
++
++	ret = 0;
++	spin_lock_irqsave(&ds->irq_lock, irqflags);
++	hrtimer_cancel(&ds->timer);
++	if (ds->use_irq) {
++		for (i = di->keymap_size - 1; i >= 0; i--) {
++			free_irq(gpio_to_irq(di->keymap[i].gpio),
++				 &ds->key_state[i]);
++		}
++	}
++	spin_unlock_irqrestore(&ds->irq_lock, irqflags);
++
++	for (i = di->keymap_size - 1; i >= 0; i--) {
++err_gpio_configure_failed:
++		gpio_free(di->keymap[i].gpio);
++err_gpio_request_failed:
++		;
++	}
++	wake_lock_destroy(&ds->wake_lock);
++	kfree(ds);
++err_ds_alloc_failed:
++	return ret;
++}
+--- /dev/null
++++ b/drivers/input/misc/gpio_matrix.c
+@@ -0,0 +1,406 @@
++/* drivers/input/misc/gpio_matrix.c
++ *
++ * Copyright (C) 2007 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/gpio.h>
++#include <linux/gpio_event.h>
++#include <linux/hrtimer.h>
++#include <linux/interrupt.h>
++#include <linux/wakelock.h>
++
++struct gpio_kp {
++	struct input_dev *input_dev;
++	struct gpio_event_matrix_info *keypad_info;
++	struct hrtimer timer;
++	struct wake_lock wake_lock;
++	int current_output;
++	unsigned int use_irq:1;
++	unsigned int key_state_changed:1;
++	unsigned int last_key_state_changed:1;
++	unsigned int some_keys_pressed:2;
++	unsigned long keys_pressed[0];
++};
++
++static void clear_phantom_key(struct gpio_kp *kp, int out, int in)
++{
++	struct gpio_event_matrix_info *mi = kp->keypad_info;
++	int key_index = out * mi->ninputs + in;
++	unsigned short keycode = mi->keymap[key_index];;
++
++	if (!test_bit(keycode, kp->input_dev->key)) {
++		if (mi->flags & GPIOKPF_PRINT_PHANTOM_KEYS)
++			pr_info("gpiomatrix: phantom key %x, %d-%d (%d-%d) "
++				"cleared\n", keycode, out, in,
++				mi->output_gpios[out], mi->input_gpios[in]);
++		__clear_bit(key_index, kp->keys_pressed);
++	} else {
++		if (mi->flags & GPIOKPF_PRINT_PHANTOM_KEYS)
++			pr_info("gpiomatrix: phantom key %x, %d-%d (%d-%d) "
++				"not cleared\n", keycode, out, in,
++				mi->output_gpios[out], mi->input_gpios[in]);
++	}
++}
++
++static int restore_keys_for_input(struct gpio_kp *kp, int out, int in)
++{
++	int rv = 0;
++	int key_index;
++
++	key_index = out * kp->keypad_info->ninputs + in;
++	while (out < kp->keypad_info->noutputs) {
++		if (test_bit(key_index, kp->keys_pressed)) {
++			rv = 1;
++			clear_phantom_key(kp, out, in);
++		}
++		key_index += kp->keypad_info->ninputs;
++		out++;
++	}
++	return rv;
++}
++
++static void remove_phantom_keys(struct gpio_kp *kp)
++{
++	int out, in, inp;
++	int key_index;
++
++	if (kp->some_keys_pressed < 3)
++		return;
++
++	for (out = 0; out < kp->keypad_info->noutputs; out++) {
++		inp = -1;
++		key_index = out * kp->keypad_info->ninputs;
++		for (in = 0; in < kp->keypad_info->ninputs; in++, key_index++) {
++			if (test_bit(key_index, kp->keys_pressed)) {
++				if (inp == -1) {
++					inp = in;
++					continue;
++				}
++				if (inp >= 0) {
++					if (!restore_keys_for_input(kp, out + 1,
++									inp))
++						break;
++					clear_phantom_key(kp, out, inp);
++					inp = -2;
++				}
++				restore_keys_for_input(kp, out, in);
++			}
++		}
++	}
++}
++
++static void report_key(struct gpio_kp *kp, int key_index, int out, int in)
++{
++	struct gpio_event_matrix_info *mi = kp->keypad_info;
++	int pressed = test_bit(key_index, kp->keys_pressed);
++	unsigned short keycode = mi->keymap[key_index];
++	if (pressed != test_bit(keycode, kp->input_dev->key)) {
++		if (keycode == KEY_RESERVED) {
++			if (mi->flags & GPIOKPF_PRINT_UNMAPPED_KEYS)
++				pr_info("gpiomatrix: unmapped key, %d-%d "
++					"(%d-%d) changed to %d\n",
++					out, in, mi->output_gpios[out],
++					mi->input_gpios[in], pressed);
++		} else {
++			if (mi->flags & GPIOKPF_PRINT_MAPPED_KEYS)
++				pr_info("gpiomatrix: key %x, %d-%d (%d-%d) "
++					"changed to %d\n", keycode,
++					out, in, mi->output_gpios[out],
++					mi->input_gpios[in], pressed);
++			input_report_key(kp->input_dev, keycode, pressed);
++		}
++	}
++}
++
++static enum hrtimer_restart gpio_keypad_timer_func(struct hrtimer *timer)
++{
++	int out, in;
++	int key_index;
++	int gpio;
++	struct gpio_kp *kp = container_of(timer, struct gpio_kp, timer);
++	struct gpio_event_matrix_info *mi = kp->keypad_info;
++	unsigned gpio_keypad_flags = mi->flags;
++	unsigned polarity = !!(gpio_keypad_flags & GPIOKPF_ACTIVE_HIGH);
++
++	out = kp->current_output;
++	if (out == mi->noutputs) {
++		out = 0;
++		kp->last_key_state_changed = kp->key_state_changed;
++		kp->key_state_changed = 0;
++		kp->some_keys_pressed = 0;
++	} else {
++		key_index = out * mi->ninputs;
++		for (in = 0; in < mi->ninputs; in++, key_index++) {
++			gpio = mi->input_gpios[in];
++			if (gpio_get_value(gpio) ^ !polarity) {
++				if (kp->some_keys_pressed < 3)
++					kp->some_keys_pressed++;
++				kp->key_state_changed |= !__test_and_set_bit(
++						key_index, kp->keys_pressed);
++			} else
++				kp->key_state_changed |= __test_and_clear_bit(
++						key_index, kp->keys_pressed);
++		}
++		gpio = mi->output_gpios[out];
++		if (gpio_keypad_flags & GPIOKPF_DRIVE_INACTIVE)
++			gpio_set_value(gpio, !polarity);
++		else
++			gpio_direction_input(gpio);
++		out++;
++	}
++	kp->current_output = out;
++	if (out < mi->noutputs) {
++		gpio = mi->output_gpios[out];
++		if (gpio_keypad_flags & GPIOKPF_DRIVE_INACTIVE)
++			gpio_set_value(gpio, polarity);
++		else
++			gpio_direction_output(gpio, polarity);
++		hrtimer_start(timer, mi->settle_time, HRTIMER_MODE_REL);
++		return HRTIMER_NORESTART;
++	}
++	if (gpio_keypad_flags & GPIOKPF_DEBOUNCE) {
++		if (kp->key_state_changed) {
++			hrtimer_start(&kp->timer, mi->debounce_delay,
++				      HRTIMER_MODE_REL);
++			return HRTIMER_NORESTART;
++		}
++		kp->key_state_changed = kp->last_key_state_changed;
++	}
++	if (kp->key_state_changed) {
++		if (gpio_keypad_flags & GPIOKPF_REMOVE_SOME_PHANTOM_KEYS)
++			remove_phantom_keys(kp);
++		key_index = 0;
++		for (out = 0; out < mi->noutputs; out++)
++			for (in = 0; in < mi->ninputs; in++, key_index++)
++				report_key(kp, key_index, out, in);
++	}
++	if (!kp->use_irq || kp->some_keys_pressed) {
++		hrtimer_start(timer, mi->poll_time, HRTIMER_MODE_REL);
++		return HRTIMER_NORESTART;
++	}
++
++	/* No keys are pressed, reenable interrupt */
++	for (out = 0; out < mi->noutputs; out++) {
++		if (gpio_keypad_flags & GPIOKPF_DRIVE_INACTIVE)
++			gpio_set_value(mi->output_gpios[out], polarity);
++		else
++			gpio_direction_output(mi->output_gpios[out], polarity);
++	}
++	for (in = 0; in < mi->ninputs; in++)
++		enable_irq(gpio_to_irq(mi->input_gpios[in]));
++	wake_unlock(&kp->wake_lock);
++	return HRTIMER_NORESTART;
++}
++
++static irqreturn_t gpio_keypad_irq_handler(int irq_in, void *dev_id)
++{
++	int i;
++	struct gpio_kp *kp = dev_id;
++	struct gpio_event_matrix_info *mi = kp->keypad_info;
++	unsigned gpio_keypad_flags = mi->flags;
++
++	if (!kp->use_irq) /* ignore interrupt while registering the handler */
++		return IRQ_HANDLED;
++
++	for (i = 0; i < mi->ninputs; i++)
++		disable_irq(gpio_to_irq(mi->input_gpios[i]));
++	for (i = 0; i < mi->noutputs; i++) {
++		if (gpio_keypad_flags & GPIOKPF_DRIVE_INACTIVE)
++			gpio_set_value(mi->output_gpios[i],
++				!(gpio_keypad_flags & GPIOKPF_ACTIVE_HIGH));
++		else
++			gpio_direction_input(mi->output_gpios[i]);
++	}
++	wake_lock(&kp->wake_lock);
++	hrtimer_start(&kp->timer, ktime_set(0, 0), HRTIMER_MODE_REL);
++	return IRQ_HANDLED;
++}
++
++static int gpio_keypad_request_irqs(struct gpio_kp *kp)
++{
++	int i;
++	int err;
++	unsigned int irq;
++	unsigned long request_flags;
++	struct gpio_event_matrix_info *mi = kp->keypad_info;
++
++	switch (mi->flags & (GPIOKPF_ACTIVE_HIGH|GPIOKPF_LEVEL_TRIGGERED_IRQ)) {
++	default:
++		request_flags = IRQF_TRIGGER_FALLING;
++		break;
++	case GPIOKPF_ACTIVE_HIGH:
++		request_flags = IRQF_TRIGGER_RISING;
++		break;
++	case GPIOKPF_LEVEL_TRIGGERED_IRQ:
++		request_flags = IRQF_TRIGGER_LOW;
++		break;
++	case GPIOKPF_LEVEL_TRIGGERED_IRQ | GPIOKPF_ACTIVE_HIGH:
++		request_flags = IRQF_TRIGGER_HIGH;
++		break;
++	}
++
++	for (i = 0; i < mi->ninputs; i++) {
++		err = irq = gpio_to_irq(mi->input_gpios[i]);
++		if (err < 0)
++			goto err_gpio_get_irq_num_failed;
++		err = request_irq(irq, gpio_keypad_irq_handler, request_flags,
++				  "gpio_kp", kp);
++		if (err) {
++			pr_err("gpiomatrix: request_irq failed for input %d, "
++				"irq %d\n", mi->input_gpios[i], irq);
++			goto err_request_irq_failed;
++		}
++		err = set_irq_wake(irq, 1);
++		if (err) {
++			pr_err("gpiomatrix: set_irq_wake failed for input %d, "
++				"irq %d\n", mi->input_gpios[i], irq);
++		}
++		disable_irq(irq);
++	}
++	return 0;
++
++	for (i = mi->noutputs - 1; i >= 0; i--) {
++		free_irq(gpio_to_irq(mi->input_gpios[i]), kp);
++err_request_irq_failed:
++err_gpio_get_irq_num_failed:
++		;
++	}
++	return err;
++}
++
++int gpio_event_matrix_func(struct input_dev *input_dev,
++	struct gpio_event_info *info, void **data, int func)
++{
++	int i;
++	int err;
++	int key_count;
++	struct gpio_kp *kp;
++	struct gpio_event_matrix_info *mi;
++
++	mi = container_of(info, struct gpio_event_matrix_info, info);
++	if (func == GPIO_EVENT_FUNC_SUSPEND || func == GPIO_EVENT_FUNC_RESUME) {
++		/* TODO: disable scanning */
++		return 0;
++	}
++
++	if (func == GPIO_EVENT_FUNC_INIT) {
++		if (mi->keymap == NULL ||
++		   mi->input_gpios == NULL ||
++		   mi->output_gpios == NULL) {
++			err = -ENODEV;
++			pr_err("gpiomatrix: Incomplete pdata\n");
++			goto err_invalid_platform_data;
++		}
++		key_count = mi->ninputs * mi->noutputs;
++
++		*data = kp = kzalloc(sizeof(*kp) + sizeof(kp->keys_pressed[0]) *
++				     BITS_TO_LONGS(key_count), GFP_KERNEL);
++		if (kp == NULL) {
++			err = -ENOMEM;
++			pr_err("gpiomatrix: Failed to allocate private data\n");
++			goto err_kp_alloc_failed;
++		}
++		kp->input_dev = input_dev;
++		kp->keypad_info = mi;
++		set_bit(EV_KEY, input_dev->evbit);
++		for (i = 0; i < key_count; i++) {
++			if (mi->keymap[i])
++				set_bit(mi->keymap[i] & KEY_MAX,
++					input_dev->keybit);
++		}
++
++		for (i = 0; i < mi->noutputs; i++) {
++			if (gpio_cansleep(mi->output_gpios[i])) {
++				pr_err("gpiomatrix: unsupported output gpio %d,"
++					" can sleep\n", mi->output_gpios[i]);
++				err = -EINVAL;
++				goto err_request_output_gpio_failed;
++			}
++			err = gpio_request(mi->output_gpios[i], "gpio_kp_out");
++			if (err) {
++				pr_err("gpiomatrix: gpio_request failed for "
++					"output %d\n", mi->output_gpios[i]);
++				goto err_request_output_gpio_failed;
++			}
++			if (mi->flags & GPIOKPF_DRIVE_INACTIVE)
++				err = gpio_direction_output(mi->output_gpios[i],
++					!(mi->flags & GPIOKPF_ACTIVE_HIGH));
++			else
++				err = gpio_direction_input(mi->output_gpios[i]);
++			if (err) {
++				pr_err("gpiomatrix: gpio_configure failed for "
++					"output %d\n", mi->output_gpios[i]);
++				goto err_output_gpio_configure_failed;
++			}
++		}
++		for (i = 0; i < mi->ninputs; i++) {
++			err = gpio_request(mi->input_gpios[i], "gpio_kp_in");
++			if (err) {
++				pr_err("gpiomatrix: gpio_request failed for "
++					"input %d\n", mi->input_gpios[i]);
++				goto err_request_input_gpio_failed;
++			}
++			err = gpio_direction_input(mi->input_gpios[i]);
++			if (err) {
++				pr_err("gpiomatrix: gpio_direction_input failed"
++					" for input %d\n", mi->input_gpios[i]);
++				goto err_gpio_direction_input_failed;
++			}
++		}
++		kp->current_output = mi->noutputs;
++		kp->key_state_changed = 1;
++
++		hrtimer_init(&kp->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++		kp->timer.function = gpio_keypad_timer_func;
++		wake_lock_init(&kp->wake_lock, WAKE_LOCK_SUSPEND, "gpio_kp");
++		err = gpio_keypad_request_irqs(kp);
++		kp->use_irq = err == 0;
++
++		pr_info("GPIO Matrix Keypad Driver: Start keypad matrix for %s "
++			"in %s mode\n", input_dev->name,
++			kp->use_irq ? "interrupt" : "polling");
++
++		if (kp->use_irq)
++			wake_lock(&kp->wake_lock);
++		hrtimer_start(&kp->timer, ktime_set(0, 0), HRTIMER_MODE_REL);
++
++		return 0;
++	}
++
++	err = 0;
++	kp = *data;
++
++	if (kp->use_irq)
++		for (i = mi->noutputs - 1; i >= 0; i--)
++			free_irq(gpio_to_irq(mi->input_gpios[i]), kp);
++
++	hrtimer_cancel(&kp->timer);
++	wake_lock_destroy(&kp->wake_lock);
++	for (i = mi->noutputs - 1; i >= 0; i--) {
++err_gpio_direction_input_failed:
++		gpio_free(mi->input_gpios[i]);
++err_request_input_gpio_failed:
++		;
++	}
++	for (i = mi->noutputs - 1; i >= 0; i--) {
++err_output_gpio_configure_failed:
++		gpio_free(mi->output_gpios[i]);
++err_request_output_gpio_failed:
++		;
++	}
++	kfree(kp);
++err_kp_alloc_failed:
++err_invalid_platform_data:
++	return err;
++}
+--- /dev/null
++++ b/drivers/input/misc/gpio_output.c
+@@ -0,0 +1,84 @@
++/* drivers/input/misc/gpio_output.c
++ *
++ * Copyright (C) 2007 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/gpio.h>
++#include <linux/gpio_event.h>
++
++int gpio_event_output_event(
++	struct input_dev *input_dev, struct gpio_event_info *info, void **data,
++	unsigned int type, unsigned int code, int value)
++{
++	int i;
++	struct gpio_event_output_info *oi;
++	oi = container_of(info, struct gpio_event_output_info, info);
++	if (type != oi->type)
++		return 0;
++	if (!(oi->flags & GPIOEDF_ACTIVE_HIGH))
++		value = !value;
++	for (i = 0; i < oi->keymap_size; i++)
++		if (code == oi->keymap[i].code)
++			gpio_set_value(oi->keymap[i].gpio, value);
++	return 0;
++}
++
++int gpio_event_output_func(
++	struct input_dev *input_dev, struct gpio_event_info *info, void **data,
++	int func)
++{
++	int ret;
++	int i;
++	struct gpio_event_output_info *oi;
++	oi = container_of(info, struct gpio_event_output_info, info);
++
++	if (func == GPIO_EVENT_FUNC_SUSPEND || func == GPIO_EVENT_FUNC_RESUME)
++		return 0;
++
++	if (func == GPIO_EVENT_FUNC_INIT) {
++		int output_level = !(oi->flags & GPIOEDF_ACTIVE_HIGH);
++		for (i = 0; i < oi->keymap_size; i++)
++			input_set_capability(input_dev, oi->type,
++					     oi->keymap[i].code);
++
++		for (i = 0; i < oi->keymap_size; i++) {
++			ret = gpio_request(oi->keymap[i].gpio,
++					   "gpio_event_output");
++			if (ret) {
++				pr_err("gpio_event_output_func: gpio_request "
++					"failed for %d\n", oi->keymap[i].gpio);
++				goto err_gpio_request_failed;
++			}
++			ret = gpio_direction_output(oi->keymap[i].gpio,
++						    output_level);
++			if (ret) {
++				pr_err("gpio_event_output_func: "
++					"gpio_direction_output failed for %d\n",
++					oi->keymap[i].gpio);
++				goto err_gpio_direction_output_failed;
++			}
++		}
++		return 0;
++	}
++
++	ret = 0;
++	for (i = oi->keymap_size - 1; i >= 0; i--) {
++err_gpio_direction_output_failed:
++		gpio_free(oi->keymap[i].gpio);
++err_gpio_request_failed:
++		;
++	}
++	return ret;
++}
++
+--- /dev/null
++++ b/include/linux/gpio_event.h
+@@ -0,0 +1,154 @@
++/* include/linux/gpio_event.h
++ *
++ * Copyright (C) 2007 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#ifndef _LINUX_GPIO_EVENT_H
++#define _LINUX_GPIO_EVENT_H
++
++#include <linux/input.h>
++
++enum {
++	GPIO_EVENT_FUNC_UNINIT  = 0x0,
++	GPIO_EVENT_FUNC_INIT    = 0x1,
++	GPIO_EVENT_FUNC_SUSPEND = 0x2,
++	GPIO_EVENT_FUNC_RESUME  = 0x3,
++};
++struct gpio_event_info {
++	int (*func)(struct input_dev *input_dev,
++		    struct gpio_event_info *info,
++		    void **data, int func);
++	int (*event)(struct input_dev *input_dev,
++		     struct gpio_event_info *info,
++		     void **data, unsigned int type,
++		     unsigned int code, int value); /* out events */
++};
++
++struct gpio_event_platform_data {
++	const char *name;
++	struct gpio_event_info **info;
++	size_t info_count;
++	int (*power)(const struct gpio_event_platform_data *pdata, bool on);
++};
++
++#define GPIO_EVENT_DEV_NAME "gpio-event"
++
++/* Key matrix */
++
++enum gpio_event_matrix_flags {
++	/* unset: drive active output low, set: drive active output high */
++	GPIOKPF_ACTIVE_HIGH              = 1U << 0,
++	GPIOKPF_DEBOUNCE                 = 1U << 1,
++	GPIOKPF_REMOVE_SOME_PHANTOM_KEYS = 1U << 2,
++	GPIOKPF_REMOVE_PHANTOM_KEYS      = GPIOKPF_REMOVE_SOME_PHANTOM_KEYS |
++					   GPIOKPF_DEBOUNCE,
++	GPIOKPF_DRIVE_INACTIVE           = 1U << 3,
++	GPIOKPF_LEVEL_TRIGGERED_IRQ      = 1U << 4,
++	GPIOKPF_PRINT_UNMAPPED_KEYS      = 1U << 16,
++	GPIOKPF_PRINT_MAPPED_KEYS        = 1U << 17,
++	GPIOKPF_PRINT_PHANTOM_KEYS       = 1U << 18,
++};
++
++extern int gpio_event_matrix_func(struct input_dev *input_dev,
++			struct gpio_event_info *info, void **data, int func);
++struct gpio_event_matrix_info {
++	/* initialize to gpio_event_matrix_func */
++	struct gpio_event_info info;
++	/* size must be ninputs * noutputs */
++	const unsigned short *keymap;
++	unsigned int *input_gpios;
++	unsigned int *output_gpios;
++	unsigned int ninputs;
++	unsigned int noutputs;
++	/* time to wait before reading inputs after driving each output */
++	ktime_t settle_time;
++	/* time to wait before scanning the keypad a second time */
++	ktime_t debounce_delay;
++	ktime_t poll_time;
++	unsigned flags;
++};
++
++/* Directly connected inputs and outputs */
++
++enum gpio_event_direct_flags {
++	GPIOEDF_ACTIVE_HIGH         = 1U << 0,
++/*	GPIOEDF_USE_DOWN_IRQ        = 1U << 1, */
++/*	GPIOEDF_USE_IRQ             = (1U << 2) | GPIOIDF_USE_DOWN_IRQ, */
++	GPIOEDF_PRINT_KEYS          = 1U << 8,
++	GPIOEDF_PRINT_KEY_DEBOUNCE  = 1U << 9,
++};
++
++struct gpio_event_direct_entry {
++	uint32_t gpio:23;
++	uint32_t code:9;
++};
++
++/* inputs */
++extern int gpio_event_input_func(struct input_dev *input_dev,
++			struct gpio_event_info *info, void **data, int func);
++struct gpio_event_input_info {
++	/* initialize to gpio_event_input_func */
++	struct gpio_event_info info;
++	ktime_t debounce_time;
++	ktime_t poll_time;
++	uint16_t flags;
++	uint16_t type;
++	const struct gpio_event_direct_entry *keymap;
++	size_t keymap_size;
++};
++
++/* outputs */
++extern int gpio_event_output_func(struct input_dev *input_dev,
++			struct gpio_event_info *info, void **data, int func);
++extern int gpio_event_output_event(struct input_dev *input_dev,
++			struct gpio_event_info *info, void **data,
++			unsigned int type, unsigned int code, int value);
++struct gpio_event_output_info {
++	/* initialize to gpio_event_output_func and gpio_event_output_event */
++	struct gpio_event_info info;
++	uint16_t flags;
++	uint16_t type;
++	const struct gpio_event_direct_entry *keymap;
++	size_t keymap_size;
++};
++
++
++/* axes */
++
++enum gpio_event_axis_flags {
++	GPIOEAF_PRINT_UNKNOWN_DIRECTION  = 1U << 16,
++	GPIOEAF_PRINT_RAW                = 1U << 17,
++	GPIOEAF_PRINT_EVENT              = 1U << 18,
++};
++
++extern int gpio_event_axis_func(struct input_dev *input_dev,
++			struct gpio_event_info *info, void **data, int func);
++struct gpio_event_axis_info {
++	/* initialize to gpio_event_axis_func */
++	struct gpio_event_info info;
++	uint8_t  count;
++	uint8_t  type; /* EV_REL or EV_ABS */
++	uint16_t code;
++	uint16_t decoded_size;
++	uint16_t (*map)(struct gpio_event_axis_info *info, uint16_t in);
++	uint32_t *gpio;
++	uint32_t flags;
++};
++#define gpio_axis_2bit_gray_map gpio_axis_4bit_gray_map
++#define gpio_axis_3bit_gray_map gpio_axis_4bit_gray_map
++uint16_t gpio_axis_4bit_gray_map(
++			struct gpio_event_axis_info *info, uint16_t in);
++uint16_t gpio_axis_5bit_singletrack_map(
++			struct gpio_event_axis_info *info, uint16_t in);
++
++#endif
diff --git a/target/linux/goldfish/patches-2.6.30/0087-Input-Hold-wake-lock-while-event-queue-is-not-empty.patch b/target/linux/goldfish/patches-2.6.30/0087-Input-Hold-wake-lock-while-event-queue-is-not-empty.patch
new file mode 100644
index 0000000000..e85f7a3db6
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0087-Input-Hold-wake-lock-while-event-queue-is-not-empty.patch
@@ -0,0 +1,67 @@
+From 0d1077627288e51b5604f270eae6cf9f5ccd3871 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Fri, 17 Oct 2008 15:20:55 -0700
+Subject: [PATCH 087/134] Input: Hold wake lock while event queue is not empty.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Allows userspace code to process input events while
+the device appears to be asleep.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/input/evdev.c |    7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -19,6 +19,7 @@
+ #include <linux/input.h>
+ #include <linux/major.h>
+ #include <linux/device.h>
++#include <linux/wakelock.h>
+ #include "input-compat.h"
+ 
+ struct evdev {
+@@ -43,6 +44,7 @@ struct evdev_client {
+ 	struct fasync_struct *fasync;
+ 	struct evdev *evdev;
+ 	struct list_head node;
++	struct wake_lock wake_lock;
+ };
+ 
+ static struct evdev *evdev_table[EVDEV_MINORS];
+@@ -55,6 +57,7 @@ static void evdev_pass_event(struct evde
+ 	 * Interrupts are disabled, just acquire the lock
+ 	 */
+ 	spin_lock(&client->buffer_lock);
++	wake_lock_timeout(&client->wake_lock, 5 * HZ);
+ 	client->buffer[client->head++] = *event;
+ 	client->head &= EVDEV_BUFFER_SIZE - 1;
+ 	spin_unlock(&client->buffer_lock);
+@@ -233,6 +236,7 @@ static int evdev_release(struct inode *i
+ 	mutex_unlock(&evdev->mutex);
+ 
+ 	evdev_detach_client(evdev, client);
++	wake_lock_destroy(&client->wake_lock);
+ 	kfree(client);
+ 
+ 	evdev_close_device(evdev);
+@@ -269,6 +273,7 @@ static int evdev_open(struct inode *inod
+ 	}
+ 
+ 	spin_lock_init(&client->buffer_lock);
++	wake_lock_init(&client->wake_lock, WAKE_LOCK_SUSPEND, "evdev");
+ 	client->evdev = evdev;
+ 	evdev_attach_client(evdev, client);
+ 
+@@ -332,6 +337,8 @@ static int evdev_fetch_next_event(struct
+ 	if (have_event) {
+ 		*event = client->buffer[client->tail++];
+ 		client->tail &= EVDEV_BUFFER_SIZE - 1;
++		if (client->head == client->tail)
++			wake_unlock(&client->wake_lock);
+ 	}
+ 
+ 	spin_unlock_irq(&client->buffer_lock);
diff --git a/target/linux/goldfish/patches-2.6.30/0088-Input-Use-monotonic-time-for-event-time-stamps.patch b/target/linux/goldfish/patches-2.6.30/0088-Input-Use-monotonic-time-for-event-time-stamps.patch
new file mode 100644
index 0000000000..6ca183ca71
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0088-Input-Use-monotonic-time-for-event-time-stamps.patch
@@ -0,0 +1,31 @@
+From 474db0e1425f8da03a7d49ebba1602efa503c73f Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Fri, 17 Oct 2008 15:28:08 -0700
+Subject: [PATCH 088/134] Input: Use monotonic time for event time stamps.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Since wall time can jump backwards, it cannot be used to determine if one
+event occured before another or for how long a key was pressed.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/input/evdev.c |    5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -74,8 +74,11 @@ static void evdev_event(struct input_han
+ 	struct evdev *evdev = handle->private;
+ 	struct evdev_client *client;
+ 	struct input_event event;
++	struct timespec ts;
+ 
+-	do_gettimeofday(&event.time);
++	ktime_get_ts(&ts);
++	event.time.tv_sec = ts.tv_sec;
++	event.time.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+ 	event.type = type;
+ 	event.code = code;
+ 	event.value = value;
diff --git a/target/linux/goldfish/patches-2.6.30/0090-input-Add-keyreset-driver.patch b/target/linux/goldfish/patches-2.6.30/0090-input-Add-keyreset-driver.patch
new file mode 100644
index 0000000000..0af1c5617d
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0090-input-Add-keyreset-driver.patch
@@ -0,0 +1,313 @@
+From eb92150c047e76960ecf8989b9037fd34b43a4af Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Fri, 21 Nov 2008 21:47:23 -0800
+Subject: [PATCH 090/134] input: Add keyreset driver.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Add a platform device in the board file to specify a reset key-combo.
+The first time the key-combo is detected a work function that syncs
+the filesystems is scheduled. If all the keys are released and then
+pressed again, it calls panic. Reboot on panic should be set for
+this to work.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/input/Kconfig    |    9 ++
+ drivers/input/Makefile   |    1 +
+ drivers/input/keyreset.c |  229 ++++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/keyreset.h |   27 ++++++
+ 4 files changed, 266 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/input/keyreset.c
+ create mode 100644 include/linux/keyreset.h
+
+--- a/drivers/input/Kconfig
++++ b/drivers/input/Kconfig
+@@ -149,6 +149,15 @@ config INPUT_APMPOWER
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called apm-power.
+ 
++config INPUT_KEYRESET
++	tristate "Reset key"
++	depends on INPUT
++	---help---
++	  Say Y here if you want to reboot when some keys are pressed;
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called keyreset.
++
+ config XEN_KBDDEV_FRONTEND
+ 	tristate "Xen virtual keyboard and mouse support"
+ 	depends on XEN_FBDEV_FRONTEND
+--- a/drivers/input/Makefile
++++ b/drivers/input/Makefile
+@@ -23,5 +23,6 @@ obj-$(CONFIG_INPUT_TOUCHSCREEN)	+= touch
+ obj-$(CONFIG_INPUT_MISC)	+= misc/
+ 
+ obj-$(CONFIG_INPUT_APMPOWER)	+= apm-power.o
++obj-$(CONFIG_INPUT_KEYRESET)	+= keyreset.o
+ 
+ obj-$(CONFIG_XEN_KBDDEV_FRONTEND)	+= xen-kbdfront.o
+--- /dev/null
++++ b/drivers/input/keyreset.c
+@@ -0,0 +1,229 @@
++/* drivers/input/keyreset.c
++ *
++ * Copyright (C) 2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/input.h>
++#include <linux/keyreset.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/reboot.h>
++#include <linux/sched.h>
++#include <linux/syscalls.h>
++
++
++struct keyreset_state {
++	struct input_handler input_handler;
++	unsigned long keybit[BITS_TO_LONGS(KEY_CNT)];
++	unsigned long upbit[BITS_TO_LONGS(KEY_CNT)];
++	unsigned long key[BITS_TO_LONGS(KEY_CNT)];
++	spinlock_t lock;
++	int key_down_target;
++	int key_down;
++	int key_up;
++	int restart_disabled;
++};
++
++int restart_requested;
++static void deferred_restart(struct work_struct *dummy)
++{
++	restart_requested = 2;
++	sys_sync();
++	restart_requested = 3;
++	kernel_restart(NULL);
++}
++static DECLARE_WORK(restart_work, deferred_restart);
++
++static void keyreset_event(struct input_handle *handle, unsigned int type,
++			   unsigned int code, int value)
++{
++	unsigned long flags;
++	struct keyreset_state *state = handle->private;
++
++	if (type != EV_KEY)
++		return;
++
++	if (code >= KEY_MAX)
++		return;
++
++	if (!test_bit(code, state->keybit))
++		return;
++
++	spin_lock_irqsave(&state->lock, flags);
++	if (!test_bit(code, state->key) == !value)
++		goto done;
++	__change_bit(code, state->key);
++	if (test_bit(code, state->upbit)) {
++		if (value) {
++			state->restart_disabled = 1;
++			state->key_up++;
++		} else
++			state->key_up--;
++	} else {
++		if (value)
++			state->key_down++;
++		else
++			state->key_down--;
++	}
++	if (state->key_down == 0 && state->key_up == 0)
++		state->restart_disabled = 0;
++
++	pr_debug("reset key changed %d %d new state %d-%d-%d\n", code, value,
++		 state->key_down, state->key_up, state->restart_disabled);
++
++	if (value && !state->restart_disabled &&
++	    state->key_down == state->key_down_target) {
++		state->restart_disabled = 1;
++		if (restart_requested)
++			panic("keyboard reset failed, %d", restart_requested);
++		pr_info("keyboard reset\n");
++		schedule_work(&restart_work);
++		restart_requested = 1;
++	}
++done:
++	spin_unlock_irqrestore(&state->lock, flags);
++}
++
++static int keyreset_connect(struct input_handler *handler,
++					  struct input_dev *dev,
++					  const struct input_device_id *id)
++{
++	int i;
++	int ret;
++	struct input_handle *handle;
++	struct keyreset_state *state =
++		container_of(handler, struct keyreset_state, input_handler);
++
++	for (i = 0; i < KEY_MAX; i++) {
++		if (test_bit(i, state->keybit) && test_bit(i, dev->keybit))
++			break;
++	}
++	if (i == KEY_MAX)
++		return -ENODEV;
++
++	handle = kzalloc(sizeof(*handle), GFP_KERNEL);
++	if (!handle)
++		return -ENOMEM;
++
++	handle->dev = dev;
++	handle->handler = handler;
++	handle->name = "keyreset";
++	handle->private = state;
++
++	ret = input_register_handle(handle);
++	if (ret)
++		goto err_input_register_handle;
++
++	ret = input_open_device(handle);
++	if (ret)
++		goto err_input_open_device;
++
++	pr_info("using input dev %s for key reset\n", dev->name);
++
++	return 0;
++
++err_input_open_device:
++	input_unregister_handle(handle);
++err_input_register_handle:
++	kfree(handle);
++	return ret;
++}
++
++static void keyreset_disconnect(struct input_handle *handle)
++{
++	input_close_device(handle);
++	input_unregister_handle(handle);
++	kfree(handle);
++}
++
++static const struct input_device_id keyreset_ids[] = {
++	{
++		.flags = INPUT_DEVICE_ID_MATCH_EVBIT,
++		.evbit = { BIT_MASK(EV_KEY) },
++	},
++	{ },
++};
++MODULE_DEVICE_TABLE(input, keyreset_ids);
++
++static int keyreset_probe(struct platform_device *pdev)
++{
++	int ret;
++	int key, *keyp;
++	struct keyreset_state *state;
++	struct keyreset_platform_data *pdata = pdev->dev.platform_data;
++
++	if (!pdata)
++		return -EINVAL;
++
++	state = kzalloc(sizeof(*state), GFP_KERNEL);
++	if (!state)
++		return -ENOMEM;
++
++	spin_lock_init(&state->lock);
++	keyp = pdata->keys_down;
++	while ((key = *keyp++)) {
++		if (key >= KEY_MAX)
++			continue;
++		state->key_down_target++;
++		__set_bit(key, state->keybit);
++	}
++	if (pdata->keys_up) {
++		keyp = pdata->keys_up;
++		while ((key = *keyp++)) {
++			if (key >= KEY_MAX)
++				continue;
++			__set_bit(key, state->keybit);
++			__set_bit(key, state->upbit);
++		}
++	}
++	state->input_handler.event = keyreset_event;
++	state->input_handler.connect = keyreset_connect;
++	state->input_handler.disconnect = keyreset_disconnect;
++	state->input_handler.name = KEYRESET_NAME;
++	state->input_handler.id_table = keyreset_ids;
++	ret = input_register_handler(&state->input_handler);
++	if (ret) {
++		kfree(state);
++		return ret;
++	}
++	platform_set_drvdata(pdev, state);
++	return 0;
++}
++
++int keyreset_remove(struct platform_device *pdev)
++{
++	struct keyreset_state *state = platform_get_drvdata(pdev);
++	input_unregister_handler(&state->input_handler);
++	kfree(state);
++	return 0;
++}
++
++
++struct platform_driver keyreset_driver = {
++	.driver.name = KEYRESET_NAME,
++	.probe = keyreset_probe,
++	.remove = keyreset_remove,
++};
++
++static int __init keyreset_init(void)
++{
++	return platform_driver_register(&keyreset_driver);
++}
++
++static void __exit keyreset_exit(void)
++{
++	return platform_driver_unregister(&keyreset_driver);
++}
++
++module_init(keyreset_init);
++module_exit(keyreset_exit);
+--- /dev/null
++++ b/include/linux/keyreset.h
+@@ -0,0 +1,27 @@
++/*
++ * include/linux/keyreset.h - platform data structure for resetkeys driver
++ *
++ * Copyright (C) 2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#ifndef _LINUX_KEYRESET_H
++#define _LINUX_KEYRESET_H
++
++#define KEYRESET_NAME "keyreset"
++
++struct keyreset_platform_data {
++	int *keys_up;
++	int keys_down[]; /* 0 terminated */
++};
++
++#endif /* _LINUX_KEYRESET_H */
diff --git a/target/linux/goldfish/patches-2.6.30/0093-mmc-Add-status-IRQ-and-status-callback-function-to.patch b/target/linux/goldfish/patches-2.6.30/0093-mmc-Add-status-IRQ-and-status-callback-function-to.patch
new file mode 100644
index 0000000000..8fb7ade2d5
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0093-mmc-Add-status-IRQ-and-status-callback-function-to.patch
@@ -0,0 +1,21 @@
+From 2cae40a6a76e9e440f146ce0402aed40a7c127ca Mon Sep 17 00:00:00 2001
+From: San Mehat <san@google.com>
+Date: Mon, 10 Nov 2008 16:29:50 -0800
+Subject: [PATCH 093/134] mmc: Add status IRQ and status callback function to mmc platform data
+
+Signed-off-by: San Mehat <san@google.com>
+---
+ arch/arm/include/asm/mach/mmc.h |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+--- a/arch/arm/include/asm/mach/mmc.h
++++ b/arch/arm/include/asm/mach/mmc.h
+@@ -10,6 +10,8 @@ struct mmc_platform_data {
+ 	unsigned int ocr_mask;			/* available voltages */
+ 	u32 (*translate_vdd)(struct device *, unsigned int);
+ 	unsigned int (*status)(struct device *);
++	unsigned int status_irq;
++	int (*register_status_notify)(void (*callback)(int card_present, void *dev_id), void *dev_id);
+ };
+ 
+ #endif
diff --git a/target/linux/goldfish/patches-2.6.30/0094-mmc-sd-Add-new-CONFIG_MMC_PARANOID_SD_INIT-for-ena.patch b/target/linux/goldfish/patches-2.6.30/0094-mmc-sd-Add-new-CONFIG_MMC_PARANOID_SD_INIT-for-ena.patch
new file mode 100644
index 0000000000..275504b358
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0094-mmc-sd-Add-new-CONFIG_MMC_PARANOID_SD_INIT-for-ena.patch
@@ -0,0 +1,69 @@
+From 66983857a54479d76ce6dbd8399e1276698bd3c5 Mon Sep 17 00:00:00 2001
+From: San Mehat <san@google.com>
+Date: Tue, 11 Nov 2008 09:35:36 -0800
+Subject: [PATCH 094/134] mmc: sd: Add new CONFIG_MMC_PARANOID_SD_INIT for enabling retries during SD detection
+
+Signed-off-by: San Mehat <san@google.com>
+---
+ drivers/mmc/core/Kconfig |    8 ++++++++
+ drivers/mmc/core/sd.c    |   24 ++++++++++++++++++++++--
+ 2 files changed, 30 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/core/Kconfig
++++ b/drivers/mmc/core/Kconfig
+@@ -14,3 +14,11 @@ config MMC_UNSAFE_RESUME
+ 	  This option is usually just for embedded systems which use
+ 	  a MMC/SD card for rootfs. Most people should say N here.
+ 
++config MMC_PARANOID_SD_INIT
++	bool "Enable paranoid SD card initialization (EXPERIMENTAL)"
++	help
++	  If you say Y here, the MMC layer will be extra paranoid
++	  about re-trying SD init requests. This can be a useful
++	  work-around for buggy controllers and hardware. Enable
++	  if you are experiencing issues with SD detection.
++
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -336,7 +336,9 @@ static int mmc_sd_init_card(struct mmc_h
+ 	int err;
+ 	u32 cid[4];
+ 	unsigned int max_dtr;
+-
++#ifdef CONFIG_MMC_PARANOID_SD_INIT
++	int retries;
++#endif
+ 	BUG_ON(!host);
+ 	WARN_ON(!host->claimed);
+ 
+@@ -439,11 +441,29 @@ static int mmc_sd_init_card(struct mmc_h
+ 		err = mmc_decode_scr(card);
+ 		if (err < 0)
+ 			goto free_card;
+-
+ 		/*
+ 		 * Fetch switch information from card.
+ 		 */
++#ifdef CONFIG_MMC_PARANOID_SD_INIT
++		for (retries = 1; retries <= 3; retries++) {
++			err = mmc_read_switch(card);
++			if (!err) {
++				if (retries > 1) {
++					printk(KERN_WARNING
++					       "%s: recovered\n", 
++					       mmc_hostname(host));
++				}
++				break;
++			} else {
++				printk(KERN_WARNING
++				       "%s: read switch failed (attempt %d)\n",
++				       mmc_hostname(host), retries);
++			}
++		}
++#else
+ 		err = mmc_read_switch(card);
++#endif
++
+ 		if (err)
+ 			goto free_card;
+ 	}
diff --git a/target/linux/goldfish/patches-2.6.30/0095-mmc-Add-concept-of-an-embedded-SDIO-device.patch b/target/linux/goldfish/patches-2.6.30/0095-mmc-Add-concept-of-an-embedded-SDIO-device.patch
new file mode 100644
index 0000000000..e3f0eb4811
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0095-mmc-Add-concept-of-an-embedded-SDIO-device.patch
@@ -0,0 +1,274 @@
+From 62d51f0d0d0b3c758b4505c3855b61288b8e90aa Mon Sep 17 00:00:00 2001
+From: San Mehat <san@android.com>
+Date: Mon, 14 Apr 2008 15:22:49 -0700
+Subject: [PATCH 095/134] mmc: Add concept of an 'embedded' SDIO device.
+
+This is required to support chips which use SDIO for signaling/
+communication but do not implement the various card enumeration registers
+as required for full SD / SDIO cards.
+
+mmc: sdio: Fix bug where we're freeing the CIS tables we never allocated when using EMBEDDED_SDIO
+mmc: Add max_blksize to embedded SDIO data
+
+Signed-off-by: San Mehat <san@google.com>
+---
+ arch/arm/include/asm/mach/mmc.h |   10 ++++++
+ drivers/mmc/core/Kconfig        |   10 +++++-
+ drivers/mmc/core/core.c         |   16 +++++++++
+ drivers/mmc/core/sdio.c         |   67 ++++++++++++++++++++++++++++++++-------
+ drivers/mmc/core/sdio_bus.c     |   13 +++++++-
+ include/linux/mmc/host.h        |   17 ++++++++++
+ include/linux/mmc/sdio_func.h   |    8 +++++
+ 7 files changed, 127 insertions(+), 14 deletions(-)
+
+--- a/arch/arm/include/asm/mach/mmc.h
++++ b/arch/arm/include/asm/mach/mmc.h
+@@ -5,12 +5,22 @@
+ #define ASMARM_MACH_MMC_H
+ 
+ #include <linux/mmc/host.h>
++#include <linux/mmc/card.h>
++#include <linux/mmc/sdio_func.h>
++
++struct embedded_sdio_data {
++        struct sdio_cis cis;
++        struct sdio_cccr cccr;
++        struct sdio_embedded_func *funcs;
++        int num_funcs;
++};
+ 
+ struct mmc_platform_data {
+ 	unsigned int ocr_mask;			/* available voltages */
+ 	u32 (*translate_vdd)(struct device *, unsigned int);
+ 	unsigned int (*status)(struct device *);
+ 	unsigned int status_irq;
++	struct embedded_sdio_data *embedded_sdio;
+ 	int (*register_status_notify)(void (*callback)(int card_present, void *dev_id), void *dev_id);
+ };
+ 
+--- a/drivers/mmc/core/Kconfig
++++ b/drivers/mmc/core/Kconfig
+@@ -14,11 +14,19 @@ config MMC_UNSAFE_RESUME
+ 	  This option is usually just for embedded systems which use
+ 	  a MMC/SD card for rootfs. Most people should say N here.
+ 
++config MMC_EMBEDDED_SDIO
++	boolean "MMC embedded SDIO device support (EXPERIMENTAL)"
++	depends on EXPERIMENTAL
++	help
++	  If you say Y here, support will be added for embedded SDIO
++	  devices which do not contain the necessary enumeration
++	  support in hardware to be properly detected.
++
+ config MMC_PARANOID_SD_INIT
+ 	bool "Enable paranoid SD card initialization (EXPERIMENTAL)"
++	depends on EXPERIMENTAL
+ 	help
+ 	  If you say Y here, the MMC layer will be extra paranoid
+ 	  about re-trying SD init requests. This can be a useful
+ 	  work-around for buggy controllers and hardware. Enable
+ 	  if you are experiencing issues with SD detection.
+-
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1011,6 +1011,22 @@ EXPORT_SYMBOL(mmc_resume_host);
+ 
+ #endif
+ 
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++void mmc_set_embedded_sdio_data(struct mmc_host *host,
++				struct sdio_cis *cis,
++				struct sdio_cccr *cccr,
++				struct sdio_embedded_func *funcs,
++				int num_funcs)
++{
++	host->embedded_sdio_data.cis = cis;
++	host->embedded_sdio_data.cccr = cccr;
++	host->embedded_sdio_data.funcs = funcs;
++	host->embedded_sdio_data.num_funcs = num_funcs;
++}
++
++EXPORT_SYMBOL(mmc_set_embedded_sdio_data);
++#endif
++
+ static int __init mmc_init(void)
+ {
+ 	int ret;
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -24,6 +24,10 @@
+ #include "sdio_ops.h"
+ #include "sdio_cis.h"
+ 
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++#include <linux/mmc/sdio_ids.h>
++#endif
++
+ static int sdio_read_fbr(struct sdio_func *func)
+ {
+ 	int ret;
+@@ -314,6 +318,11 @@ int mmc_attach_sdio(struct mmc_host *hos
+ 	 */
+ 	funcs = (ocr & 0x70000000) >> 28;
+ 
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++	if (host->embedded_sdio_data.funcs)
++		funcs = host->embedded_sdio_data.num_funcs;
++#endif
++
+ 	/*
+ 	 * Allocate card structure.
+ 	 */
+@@ -351,17 +360,33 @@ int mmc_attach_sdio(struct mmc_host *hos
+ 	/*
+ 	 * Read the common registers.
+ 	 */
+-	err = sdio_read_cccr(card);
+-	if (err)
+-		goto remove;
+ 
+-	/*
+-	 * Read the common CIS tuples.
+-	 */
+-	err = sdio_read_common_cis(card);
+-	if (err)
+-		goto remove;
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++	if (host->embedded_sdio_data.cccr)
++		memcpy(&card->cccr, host->embedded_sdio_data.cccr, sizeof(struct sdio_cccr));
++	else {
++#endif
++		err = sdio_read_cccr(card);
++		if (err)
++			goto remove;
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++	}
++#endif
+ 
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++	if (host->embedded_sdio_data.cis)
++		memcpy(&card->cis, host->embedded_sdio_data.cis, sizeof(struct sdio_cis));
++	else {
++#endif
++		/*
++		 * Read the common CIS tuples.
++		 */
++		err = sdio_read_common_cis(card);
++		if (err)
++			goto remove;
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++	}
++#endif
+ 	/*
+ 	 * Switch to high-speed (if supported).
+ 	 */
+@@ -395,9 +420,27 @@ int mmc_attach_sdio(struct mmc_host *hos
+ 	 * Initialize (but don't add) all present functions.
+ 	 */
+ 	for (i = 0;i < funcs;i++) {
+-		err = sdio_init_func(host->card, i + 1);
+-		if (err)
+-			goto remove;
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++		if (host->embedded_sdio_data.funcs) {
++			struct sdio_func *tmp;
++
++			tmp = sdio_alloc_func(host->card);
++			if (IS_ERR(tmp))
++				goto remove;
++			tmp->num = (i + 1);
++			card->sdio_func[i] = tmp;
++			tmp->class = host->embedded_sdio_data.funcs[i].f_class;
++			tmp->max_blksize = host->embedded_sdio_data.funcs[i].f_maxblksize;
++			tmp->vendor = card->cis.vendor;
++			tmp->device = card->cis.device;
++		} else {
++#endif
++			err = sdio_init_func(host->card, i + 1);
++			if (err)
++				goto remove;
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++		}
++#endif
+ 	}
+ 
+ 	mmc_release_host(host);
+--- a/drivers/mmc/core/sdio_bus.c
++++ b/drivers/mmc/core/sdio_bus.c
+@@ -20,6 +20,10 @@
+ #include "sdio_cis.h"
+ #include "sdio_bus.h"
+ 
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++#include <linux/mmc/host.h>
++#endif
++
+ #define dev_to_sdio_func(d)	container_of(d, struct sdio_func, dev)
+ #define to_sdio_driver(d)      container_of(d, struct sdio_driver, drv)
+ 
+@@ -202,7 +206,14 @@ static void sdio_release_func(struct dev
+ {
+ 	struct sdio_func *func = dev_to_sdio_func(dev);
+ 
+-	sdio_free_func_cis(func);
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++	/*
++	 * If this device is embedded then we never allocated
++	 * cis tables for this func
++	 */
++	if (!func->card->host->embedded_sdio_data.funcs)
++#endif
++		sdio_free_func_cis(func);
+ 
+ 	if (func->info)
+ 		kfree(func->info);
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -161,6 +161,15 @@ struct mmc_host {
+ 
+ 	struct dentry		*debugfs_root;
+ 
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++	struct {
++		struct sdio_cis			*cis;
++		struct sdio_cccr		*cccr;
++		struct sdio_embedded_func	*funcs;
++		int				num_funcs;
++	} embedded_sdio_data;
++#endif
++
+ 	unsigned long		private[0] ____cacheline_aligned;
+ };
+ 
+@@ -169,6 +178,14 @@ extern int mmc_add_host(struct mmc_host 
+ extern void mmc_remove_host(struct mmc_host *);
+ extern void mmc_free_host(struct mmc_host *);
+ 
++#ifdef CONFIG_MMC_EMBEDDED_SDIO
++extern void mmc_set_embedded_sdio_data(struct mmc_host *host,
++				       struct sdio_cis *cis,
++				       struct sdio_cccr *cccr,
++				       struct sdio_embedded_func *funcs,
++				       int num_funcs);
++#endif
++
+ static inline void *mmc_priv(struct mmc_host *host)
+ {
+ 	return (void *)host->private;
+--- a/include/linux/mmc/sdio_func.h
++++ b/include/linux/mmc/sdio_func.h
+@@ -21,6 +21,14 @@ struct sdio_func;
+ typedef void (sdio_irq_handler_t)(struct sdio_func *);
+ 
+ /*
++ * Structure used to hold embedded SDIO device data from platform layer
++ */
++struct sdio_embedded_func {
++	uint8_t f_class;
++	uint32_t f_maxblksize;
++};
++
++/*
+  * SDIO function CIS tuple (unknown to the core)
+  */
+ struct sdio_func_tuple {
diff --git a/target/linux/goldfish/patches-2.6.30/0097-mmc-Add-new-API-call-sdio_reset_comm-for-resettin.patch b/target/linux/goldfish/patches-2.6.30/0097-mmc-Add-new-API-call-sdio_reset_comm-for-resettin.patch
new file mode 100644
index 0000000000..59cd702b56
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0097-mmc-Add-new-API-call-sdio_reset_comm-for-resettin.patch
@@ -0,0 +1,74 @@
+From 0b9879757f15d4ac99e032647cb3ee26393031b0 Mon Sep 17 00:00:00 2001
+From: San Mehat <san@android.com>
+Date: Thu, 15 May 2008 09:15:37 -0700
+Subject: [PATCH 097/134] mmc: Add new API call 'sdio_reset_comm' for resetting communication with an SDIO device
+
+Signed-off-by: San Mehat <san@android.com>
+---
+ drivers/mmc/core/sdio.c |   58 +++++++++++++++++++++++++++++++++++++++++++++++
+ 1 files changed, 58 insertions(+), 0 deletions(-)
+
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -482,3 +482,61 @@ err:
+ 	return err;
+ }
+ 
++int sdio_reset_comm(struct mmc_card *card)
++{
++	struct mmc_host *host = card->host;
++	u32 ocr;
++	int err;
++
++	printk("%s():\n", __func__);
++	mmc_go_idle(host);
++
++	mmc_set_clock(host, host->f_min);
++
++	err = mmc_send_io_op_cond(host, 0, &ocr);
++	if (err)
++		goto err;
++
++	host->ocr = mmc_select_voltage(host, ocr);
++	if (!host->ocr) {
++		err = -EINVAL;
++		goto err;
++	}
++
++	err = mmc_send_io_op_cond(host, host->ocr, &ocr);
++	if (err)
++		goto err;
++
++	if (mmc_host_is_spi(host)) {
++		err = mmc_spi_set_crc(host, use_spi_crc);
++		if (err)
++		goto err;
++	}
++
++	if (!mmc_host_is_spi(host)) {
++		err = mmc_send_relative_addr(host, &card->rca);
++		if (err)
++			goto err;
++		mmc_set_bus_mode(host, MMC_BUSMODE_PUSHPULL);
++	}
++	if (!mmc_host_is_spi(host)) {
++		err = mmc_select_card(card);
++		if (err)
++			goto err;
++	}
++
++	mmc_set_clock(host, card->cis.max_dtr);
++	err = sdio_enable_wide(card);
++	if (err)
++		goto err;
++
++	return 0;
++ err:
++	printk("%s: Error resetting SDIO communications (%d)\n",
++	       mmc_hostname(host), err);
++	mmc_release_host(host);
++	return err;
++}
++EXPORT_SYMBOL(sdio_reset_comm);
++
++
diff --git a/target/linux/goldfish/patches-2.6.30/0098-mmc-sd-When-resuming-try-a-little-harder-to-init.patch b/target/linux/goldfish/patches-2.6.30/0098-mmc-sd-When-resuming-try-a-little-harder-to-init.patch
new file mode 100644
index 0000000000..4e525b6176
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0098-mmc-sd-When-resuming-try-a-little-harder-to-init.patch
@@ -0,0 +1,44 @@
+From bd8df907ee8e95143d1bb7ec01ee0e4b6f7e1b79 Mon Sep 17 00:00:00 2001
+From: San Mehat <san@android.com>
+Date: Mon, 1 Dec 2008 08:52:34 -0800
+Subject: [PATCH 098/134] mmc: sd: When resuming, try a little harder to init the card
+
+Signed-off-by: San Mehat <san@android.com>
+---
+ drivers/mmc/core/sd.c |   19 +++++++++++++++++++
+ 1 files changed, 19 insertions(+), 0 deletions(-)
+
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -607,12 +607,31 @@ static void mmc_sd_suspend(struct mmc_ho
+ static void mmc_sd_resume(struct mmc_host *host)
+ {
+ 	int err;
++#ifdef CONFIG_MMC_PARANOID_SD_INIT
++	int retries;
++#endif
+ 
+ 	BUG_ON(!host);
+ 	BUG_ON(!host->card);
+ 
+ 	mmc_claim_host(host);
++#ifdef CONFIG_MMC_PARANOID_SD_INIT
++	retries = 5;
++	while (retries) {
++		err = mmc_sd_init_card(host, host->ocr, host->card);
++
++		if (err) {
++			printk(KERN_ERR "%s: Re-init card rc = %d (retries = %d)\n",
++			       mmc_hostname(host), err, retries);
++			mdelay(5);
++			retries--;
++			continue;
++		}
++		break;
++	}
++#else
+ 	err = mmc_sd_init_card(host, host->ocr, host->card);
++#endif
+ 	mmc_release_host(host);
+ 
+ 	if (err) {
diff --git a/target/linux/goldfish/patches-2.6.30/0099-mmc-mmcblk-Add-new-feature-CONFIG_MMC_BLOCK_PARAN.patch b/target/linux/goldfish/patches-2.6.30/0099-mmc-mmcblk-Add-new-feature-CONFIG_MMC_BLOCK_PARAN.patch
new file mode 100644
index 0000000000..78e23780ff
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0099-mmc-mmcblk-Add-new-feature-CONFIG_MMC_BLOCK_PARAN.patch
@@ -0,0 +1,104 @@
+From 5ca694dfd981a371e9b18cdd4a89c002ffaccbc5 Mon Sep 17 00:00:00 2001
+From: San Mehat <san@android.com>
+Date: Wed, 3 Dec 2008 10:22:59 -0800
+Subject: [PATCH 099/134] mmc: mmcblk: Add new feature 'CONFIG_MMC_BLOCK_PARANOID_RESUME'
+
+  With this feature enabled, mmcblk will check the card-status before issuing
+a transaction *only* after being resumed. This protectes us from issuing
+transactions before the sdcard is ready (which can occur if the host driver
+deferrs mmc_resume_host() to reduce resume latency)
+
+Signed-off-by: San Mehat <san@android.com>
+---
+ drivers/mmc/card/Kconfig |    7 +++++++
+ drivers/mmc/card/block.c |    3 +++
+ drivers/mmc/card/queue.c |   28 ++++++++++++++++++++++++++++
+ drivers/mmc/card/queue.h |    3 +++
+ 4 files changed, 41 insertions(+), 0 deletions(-)
+
+--- a/drivers/mmc/card/Kconfig
++++ b/drivers/mmc/card/Kconfig
+@@ -32,6 +32,13 @@ config MMC_BLOCK_BOUNCE
+ 
+ 	  If unsure, say Y here.
+ 
++config MMC_BLOCK_PARANOID_RESUME
++	bool "Check card status on resume"
++        depends on MMC_BLOCK
++        default y
++        help
++          Nohelp
++
+ config SDIO_UART
+ 	tristate "SDIO UART/GPS class support"
+ 	help
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -643,6 +643,9 @@ static int mmc_blk_resume(struct mmc_car
+ 
+ 	if (md) {
+ 		mmc_blk_set_blksize(md, card);
++#ifdef CONFIG_MMC_BLOCK_PARANOID_RESUME
++		md->queue.check_status = 1;
++#endif
+ 		mmc_queue_resume(&md->queue);
+ 	}
+ 	return 0;
+--- a/drivers/mmc/card/queue.c
++++ b/drivers/mmc/card/queue.c
+@@ -14,7 +14,9 @@
+ #include <linux/freezer.h>
+ #include <linux/kthread.h>
+ #include <linux/scatterlist.h>
++#include <linux/delay.h>
+ 
++#include <linux/mmc/mmc.h>
+ #include <linux/mmc/card.h>
+ #include <linux/mmc/host.h>
+ #include "queue.h"
+@@ -70,7 +72,33 @@ static int mmc_queue_thread(void *d)
+ 			continue;
+ 		}
+ 		set_current_state(TASK_RUNNING);
++#ifdef CONFIG_MMC_BLOCK_PARANOID_RESUME
++		if (mq->check_status) {
++			struct mmc_command cmd;
+ 
++			do {
++				int err;
++
++				cmd.opcode = MMC_SEND_STATUS;
++				cmd.arg = mq->card->rca << 16;
++				cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
++
++				mmc_claim_host(mq->card->host);
++				err = mmc_wait_for_cmd(mq->card->host, &cmd, 5);
++				mmc_release_host(mq->card->host);
++
++				if (err) {
++					printk(KERN_ERR "%s: failed to get status (%d)\n",
++					       __func__, err);
++					msleep(5);
++					continue;
++				}
++				printk(KERN_DEBUG "%s: status 0x%.8x\n", __func__, cmd.resp[0]);
++			} while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
++				(R1_CURRENT_STATE(cmd.resp[0]) == 7));
++			mq->check_status = 0;
++                }
++#endif
+ 		mq->issue_fn(mq, req);
+ 	} while (1);
+ 	up(&mq->thread_sem);
+--- a/drivers/mmc/card/queue.h
++++ b/drivers/mmc/card/queue.h
+@@ -17,6 +17,9 @@ struct mmc_queue {
+ 	char			*bounce_buf;
+ 	struct scatterlist	*bounce_sg;
+ 	unsigned int		bounce_sg_len;
++#ifdef CONFIG_MMC_BLOCK_PARANOID_RESUME
++	int			check_status;
++#endif
+ };
+ 
+ extern int mmc_init_queue(struct mmc_queue *, struct mmc_card *, spinlock_t *);
diff --git a/target/linux/goldfish/patches-2.6.30/0100-mmc-sd-Add-retries-in-re-detection.patch b/target/linux/goldfish/patches-2.6.30/0100-mmc-sd-Add-retries-in-re-detection.patch
new file mode 100644
index 0000000000..090e9e6913
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0100-mmc-sd-Add-retries-in-re-detection.patch
@@ -0,0 +1,91 @@
+From 39e3d37b1f7194277b8a3ea3536a67ec2d24491e Mon Sep 17 00:00:00 2001
+From: San Mehat <san@android.com>
+Date: Thu, 4 Dec 2008 11:18:00 -0800
+Subject: [PATCH 100/134] mmc: sd: Add retries in re-detection
+
+Signed-off-by: San Mehat <san@android.com>
+---
+ drivers/mmc/core/sd.c |   46 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 files changed, 43 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -558,18 +558,37 @@ static void mmc_sd_remove(struct mmc_hos
+  */
+ static void mmc_sd_detect(struct mmc_host *host)
+ {
+-	int err;
++	int err = 0;
++#ifdef CONFIG_MMC_PARANOID_SD_INIT
++        int retries = 5;
++#endif
+ 
+ 	BUG_ON(!host);
+ 	BUG_ON(!host->card);
+-
++       
+ 	mmc_claim_host(host);
+ 
+ 	/*
+ 	 * Just check if our card has been removed.
+ 	 */
++#ifdef CONFIG_MMC_PARANOID_SD_INIT
++	while(retries) {
++		err = mmc_send_status(host->card, NULL);
++		printk("%s(%s): err = %d\n", __func__, mmc_hostname(host), err);
++		if (err) {
++			retries--;
++			udelay(5);
++			continue;
++		}
++		break;
++	}
++	if (!retries) {
++		printk(KERN_ERR "%s(%s): Unable to re-detect card (%d)\n",
++		       __func__, mmc_hostname(host), err);
++	}
++#else
+ 	err = mmc_send_status(host->card, NULL);
+-
++#endif
+ 	mmc_release_host(host);
+ 
+ 	if (err) {
+@@ -664,6 +683,9 @@ static const struct mmc_bus_ops mmc_sd_o
+ int mmc_attach_sd(struct mmc_host *host, u32 ocr)
+ {
+ 	int err;
++#ifdef CONFIG_MMC_PARANOID_SD_INIT
++	int retries;
++#endif
+ 
+ 	BUG_ON(!host);
+ 	WARN_ON(!host->claimed);
+@@ -712,9 +734,27 @@ int mmc_attach_sd(struct mmc_host *host,
+ 	/*
+ 	 * Detect and init the card.
+ 	 */
++#ifdef CONFIG_MMC_PARANOID_SD_INIT
++	retries = 5;
++	while (retries) {
++		err = mmc_sd_init_card(host, host->ocr, NULL);
++		if (err) {
++			retries--;
++			continue;
++		}
++		break;
++	}
++
++	if (!retries) {
++		printk(KERN_ERR "%s: mmc_sd_init_card() failure (err = %d)\n",
++		       mmc_hostname(host), err);
++		goto err;
++	}
++#else
+ 	err = mmc_sd_init_card(host, host->ocr, NULL);
+ 	if (err)
+ 		goto err;
++#endif
+ 
+ 	mmc_release_host(host);
+ 
diff --git a/target/linux/goldfish/patches-2.6.30/0101-android_usb-Composite-USB-gadget-driver-for-android.patch b/target/linux/goldfish/patches-2.6.30/0101-android_usb-Composite-USB-gadget-driver-for-android.patch
new file mode 100644
index 0000000000..4638449ce1
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0101-android_usb-Composite-USB-gadget-driver-for-android.patch
@@ -0,0 +1,4127 @@
+From 03e39e8f663c896dac11e87d96e8cb0292520e36 Mon Sep 17 00:00:00 2001
+From: Mike Lockwood <lockwood@android.com>
+Date: Tue, 2 Dec 2008 22:01:33 -0500
+Subject: [PATCH 101/134] android_usb: Composite USB gadget driver for android.
+
+Signed-off-by: Mike Lockwood <lockwood@android.com>
+
+USB: android gadget: add remote wakeup attribute to android function
+
+Add remote wakeup attribute to configuration descriptor of android
+function to advertise remote wakeup capability to host
+
+Acked-by: Allam, Suresh Reddy <sallam@qualcomm.com>
+
+Signed-off-by: Mike Lockwood <lockwood@android.com>
+
+usb gadget: link fixes for android composite gadget
+
+Signed-off-by: Mike Lockwood <lockwood@android.com>
+
+usb gadget: Fix null pointer errors in android composite driver
+
+Signed-off-by: Mike Lockwood <lockwood@android.com>
+---
+ drivers/usb/gadget/Kconfig          |    8 +
+ drivers/usb/gadget/Makefile         |    2 +
+ drivers/usb/gadget/android.c        |  345 +++++
+ drivers/usb/gadget/f_adb.c          |  668 ++++++++
+ drivers/usb/gadget/f_adb.h          |   25 +
+ drivers/usb/gadget/f_mass_storage.c | 2906 +++++++++++++++++++++++++++++++++++
+ drivers/usb/gadget/f_mass_storage.h |   52 +
+ include/linux/usb/android.h         |   40 +
+ 8 files changed, 4046 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/usb/gadget/android.c
+ create mode 100644 drivers/usb/gadget/f_adb.c
+ create mode 100644 drivers/usb/gadget/f_adb.h
+ create mode 100644 drivers/usb/gadget/f_mass_storage.c
+ create mode 100644 drivers/usb/gadget/f_mass_storage.h
+ create mode 100644 include/linux/usb/android.h
+
+--- a/drivers/usb/gadget/Kconfig
++++ b/drivers/usb/gadget/Kconfig
+@@ -700,6 +700,14 @@ config USB_G_PRINTER
+ 	  For more information, see Documentation/usb/gadget_printer.txt
+ 	  which includes sample code for accessing the device file.
+ 
++config USB_ANDROID
++	tristate "Android Gadget"
++	help
++	  The Android gadget provides mass storage and adb transport.
++
++	  Say "y" to link the driver statically, or "m" to build a
++	  dynamically linked module called "g_android".
++
+ config USB_CDC_COMPOSITE
+ 	tristate "CDC Composite Device (Ethernet and ACM)"
+ 	depends on NET
+--- a/drivers/usb/gadget/Makefile
++++ b/drivers/usb/gadget/Makefile
+@@ -33,6 +33,7 @@ gadgetfs-objs			:= inode.o
+ g_file_storage-objs		:= file_storage.o
+ g_printer-objs			:= printer.o
+ g_cdc-objs			:= cdc2.o
++g_android-objs			:= android.o f_adb.o f_mass_storage.o
+ 
+ obj-$(CONFIG_USB_ZERO)		+= g_zero.o
+ obj-$(CONFIG_USB_ETH)		+= g_ether.o
+@@ -42,4 +43,5 @@ obj-$(CONFIG_USB_G_SERIAL)	+= g_serial.o
+ obj-$(CONFIG_USB_G_PRINTER)	+= g_printer.o
+ obj-$(CONFIG_USB_MIDI_GADGET)	+= g_midi.o
+ obj-$(CONFIG_USB_CDC_COMPOSITE) += g_cdc.o
++obj-$(CONFIG_USB_ANDROID)	+= g_android.o
+ 
+--- /dev/null
++++ b/drivers/usb/gadget/android.c
+@@ -0,0 +1,345 @@
++/*
++ * Gadget Driver for Android
++ *
++ * Copyright (C) 2008 Google, Inc.
++ * Author: Mike Lockwood <lockwood@android.com>
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++/* #define DEBUG */
++/* #define VERBOSE_DEBUG */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/fs.h>
++
++#include <linux/delay.h>
++#include <linux/kernel.h>
++#include <linux/utsname.h>
++#include <linux/miscdevice.h>
++#include <linux/platform_device.h>
++
++#include <linux/usb/android.h>
++#include <linux/usb/ch9.h>
++#include <linux/usb/composite.h>
++#include <linux/usb/gadget.h>
++
++#include "f_mass_storage.h"
++#include "f_adb.h"
++
++#include "gadget_chips.h"
++
++/*
++ * Kbuild is not very cooperative with respect to linking separately
++ * compiled library objects into one module.  So for now we won't use
++ * separate compilation ... ensuring init/exit sections work to shrink
++ * the runtime footprint, and giving us at least some parts of what
++ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
++ */
++#include "usbstring.c"
++#include "config.c"
++#include "epautoconf.c"
++#include "composite.c"
++
++MODULE_AUTHOR("Mike Lockwood");
++MODULE_DESCRIPTION("Android Composite USB Driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION("1.0");
++
++static const char longname[] = "Gadget Android";
++
++/* Default vendor and product IDs, overridden by platform data */
++#define VENDOR_ID		0x18D1
++#define PRODUCT_ID		0x0001
++#define ADB_PRODUCT_ID	0x0002
++
++struct android_dev {
++	struct usb_gadget *gadget;
++	struct usb_composite_dev *cdev;
++
++	int product_id;
++	int adb_product_id;
++	int version;
++
++	int adb_enabled;
++	int nluns;
++};
++
++static atomic_t adb_enable_excl;
++static struct android_dev *_android_dev;
++
++/* string IDs are assigned dynamically */
++
++#define STRING_MANUFACTURER_IDX		0
++#define STRING_PRODUCT_IDX		1
++#define STRING_SERIAL_IDX		2
++
++/* String Table */
++static struct usb_string strings_dev[] = {
++	/* These dummy values should be overridden by platform data */
++	[STRING_MANUFACTURER_IDX].s = "Android",
++	[STRING_PRODUCT_IDX].s = "Android",
++	[STRING_SERIAL_IDX].s = "0123456789ABCDEF",
++	{  }			/* end of list */
++};
++
++static struct usb_gadget_strings stringtab_dev = {
++	.language	= 0x0409,	/* en-us */
++	.strings	= strings_dev,
++};
++
++static struct usb_gadget_strings *dev_strings[] = {
++	&stringtab_dev,
++	NULL,
++};
++
++static struct usb_device_descriptor device_desc = {
++	.bLength              = sizeof(device_desc),
++	.bDescriptorType      = USB_DT_DEVICE,
++	.bcdUSB               = __constant_cpu_to_le16(0x0200),
++	.bDeviceClass         = USB_CLASS_PER_INTERFACE,
++	.idVendor             = __constant_cpu_to_le16(VENDOR_ID),
++	.idProduct            = __constant_cpu_to_le16(PRODUCT_ID),
++	.bcdDevice            = __constant_cpu_to_le16(0xffff),
++	.bNumConfigurations   = 1,
++};
++
++static int __init android_bind_config(struct usb_configuration *c)
++{
++	struct android_dev *dev = _android_dev;
++	int ret;
++	printk(KERN_DEBUG "android_bind_config\n");
++
++	ret = mass_storage_function_add(dev->cdev, c, dev->nluns);
++	if (ret)
++		return ret;
++	return adb_function_add(dev->cdev, c);
++}
++
++static struct usb_configuration android_config_driver = {
++	.label		= "android",
++	.bind		= android_bind_config,
++	.bConfigurationValue = 1,
++	.bmAttributes	= USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
++	.bMaxPower	= 0x80, /* 250ma */
++};
++
++static int __init android_bind(struct usb_composite_dev *cdev)
++{
++	struct android_dev *dev = _android_dev;
++	struct usb_gadget	*gadget = cdev->gadget;
++	int			gcnum;
++	int			id;
++	int			ret;
++
++	printk(KERN_INFO "android_bind\n");
++
++	/* Allocate string descriptor numbers ... note that string
++	 * contents can be overridden by the composite_dev glue.
++	 */
++	id = usb_string_id(cdev);
++	if (id < 0)
++		return id;
++	strings_dev[STRING_MANUFACTURER_IDX].id = id;
++	device_desc.iManufacturer = id;
++
++	id = usb_string_id(cdev);
++	if (id < 0)
++		return id;
++	strings_dev[STRING_PRODUCT_IDX].id = id;
++	device_desc.iProduct = id;
++
++	id = usb_string_id(cdev);
++	if (id < 0)
++		return id;
++	strings_dev[STRING_SERIAL_IDX].id = id;
++	device_desc.iSerialNumber = id;
++
++	if (gadget->ops->wakeup)
++		android_config_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
++
++	/* register our configuration */
++	ret = usb_add_config(cdev, &android_config_driver);
++	if (ret) {
++		printk(KERN_ERR "usb_add_config failed\n");
++		return ret;
++	}
++
++	gcnum = usb_gadget_controller_number(gadget);
++	if (gcnum >= 0)
++		device_desc.bcdDevice = cpu_to_le16(0x0200 + gcnum);
++	else {
++		/* gadget zero is so simple (for now, no altsettings) that
++		 * it SHOULD NOT have problems with bulk-capable hardware.
++		 * so just warn about unrcognized controllers -- don't panic.
++		 *
++		 * things like configuration and altsetting numbering
++		 * can need hardware-specific attention though.
++		 */
++		pr_warning("%s: controller '%s' not recognized\n",
++			longname, gadget->name);
++		device_desc.bcdDevice = __constant_cpu_to_le16(0x9999);
++	}
++
++	usb_gadget_set_selfpowered(gadget);
++	dev->cdev = cdev;
++
++	return 0;
++}
++
++static struct usb_composite_driver android_usb_driver = {
++	.name		= "android_usb",
++	.dev		= &device_desc,
++	.strings	= dev_strings,
++	.bind		= android_bind,
++};
++
++static void enable_adb(struct android_dev *dev, int enable)
++{
++	if (enable != dev->adb_enabled) {
++		dev->adb_enabled = enable;
++		adb_function_enable(enable);
++
++		/* set product ID to the appropriate value */
++		if (enable)
++			device_desc.idProduct =
++				__constant_cpu_to_le16(dev->adb_product_id);
++		else
++			device_desc.idProduct =
++				__constant_cpu_to_le16(dev->product_id);
++		if (dev->cdev)
++			dev->cdev->desc.idProduct = device_desc.idProduct;
++
++		/* force reenumeration */
++		if (dev->cdev && dev->cdev->gadget &&
++				dev->cdev->gadget->speed != USB_SPEED_UNKNOWN) {
++			usb_gadget_disconnect(dev->cdev->gadget);
++			msleep(10);
++			usb_gadget_connect(dev->cdev->gadget);
++		}
++	}
++}
++
++static int adb_enable_open(struct inode *ip, struct file *fp)
++{
++	if (atomic_inc_return(&adb_enable_excl) != 1) {
++		atomic_dec(&adb_enable_excl);
++		return -EBUSY;
++	}
++
++	printk(KERN_INFO "enabling adb\n");
++	enable_adb(_android_dev, 1);
++
++	return 0;
++}
++
++static int adb_enable_release(struct inode *ip, struct file *fp)
++{
++	printk(KERN_INFO "disabling adb\n");
++	enable_adb(_android_dev, 0);
++	atomic_dec(&adb_enable_excl);
++	return 0;
++}
++
++static struct file_operations adb_enable_fops = {
++	.owner =   THIS_MODULE,
++	.open =    adb_enable_open,
++	.release = adb_enable_release,
++};
++
++static struct miscdevice adb_enable_device = {
++	.minor = MISC_DYNAMIC_MINOR,
++	.name = "android_adb_enable",
++	.fops = &adb_enable_fops,
++};
++
++static int __init android_probe(struct platform_device *pdev)
++{
++	struct android_usb_platform_data *pdata = pdev->dev.platform_data;
++	struct android_dev *dev = _android_dev;
++
++	printk(KERN_INFO "android_probe pdata: %p\n", pdata);
++
++	if (pdata) {
++		if (pdata->vendor_id)
++			device_desc.idVendor =
++				__constant_cpu_to_le16(pdata->vendor_id);
++		if (pdata->product_id) {
++			dev->product_id = pdata->product_id;
++			device_desc.idProduct =
++				__constant_cpu_to_le16(pdata->product_id);
++		}
++		if (pdata->adb_product_id)
++			dev->adb_product_id = pdata->adb_product_id;
++		if (pdata->version)
++			dev->version = pdata->version;
++
++		if (pdata->product_name)
++			strings_dev[STRING_PRODUCT_IDX].s = pdata->product_name;
++		if (pdata->manufacturer_name)
++			strings_dev[STRING_MANUFACTURER_IDX].s =
++					pdata->manufacturer_name;
++		if (pdata->serial_number)
++			strings_dev[STRING_SERIAL_IDX].s = pdata->serial_number;
++		dev->nluns = pdata->nluns;
++	}
++
++	return 0;
++}
++
++static struct platform_driver android_platform_driver = {
++	.driver = { .name = "android_usb", },
++	.probe = android_probe,
++};
++
++static int __init init(void)
++{
++	struct android_dev *dev;
++	int ret;
++
++	printk(KERN_INFO "android init\n");
++
++	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++
++	/* set default values, which should be overridden by platform data */
++	dev->product_id = PRODUCT_ID;
++	dev->adb_product_id = ADB_PRODUCT_ID;
++	_android_dev = dev;
++
++	ret = platform_driver_register(&android_platform_driver);
++	if (ret)
++		return ret;
++	ret = misc_register(&adb_enable_device);
++	if (ret) {
++		platform_driver_unregister(&android_platform_driver);
++		return ret;
++	}
++	ret = usb_composite_register(&android_usb_driver);
++	if (ret) {
++		misc_deregister(&adb_enable_device);
++		platform_driver_unregister(&android_platform_driver);
++	}
++	return ret;
++}
++module_init(init);
++
++static void __exit cleanup(void)
++{
++	usb_composite_unregister(&android_usb_driver);
++	misc_deregister(&adb_enable_device);
++	platform_driver_unregister(&android_platform_driver);
++	kfree(_android_dev);
++	_android_dev = NULL;
++}
++module_exit(cleanup);
+--- /dev/null
++++ b/drivers/usb/gadget/f_adb.c
+@@ -0,0 +1,668 @@
++/*
++ * Gadget Driver for Android ADB
++ *
++ * Copyright (C) 2008 Google, Inc.
++ * Author: Mike Lockwood <lockwood@android.com>
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++/* #define DEBUG */
++/* #define VERBOSE_DEBUG */
++
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/poll.h>
++#include <linux/delay.h>
++#include <linux/wait.h>
++#include <linux/err.h>
++#include <linux/interrupt.h>
++
++#include <linux/types.h>
++#include <linux/device.h>
++#include <linux/miscdevice.h>
++
++#include <linux/usb/ch9.h>
++#include <linux/usb/composite.h>
++#include <linux/usb/gadget.h>
++
++#include "f_adb.h"
++
++#define BULK_BUFFER_SIZE           4096
++
++/* number of rx and tx requests to allocate */
++#define RX_REQ_MAX 4
++#define TX_REQ_MAX 4
++
++static const char shortname[] = "android_adb";
++
++struct adb_dev {
++	struct usb_function function;
++	struct usb_composite_dev *cdev;
++	spinlock_t lock;
++
++	struct usb_ep *ep_in;
++	struct usb_ep *ep_out;
++
++	int online;
++	int error;
++
++	atomic_t read_excl;
++	atomic_t write_excl;
++	atomic_t open_excl;
++
++	struct list_head tx_idle;
++	struct list_head rx_idle;
++	struct list_head rx_done;
++
++	wait_queue_head_t read_wq;
++	wait_queue_head_t write_wq;
++
++	/* the request we're currently reading from */
++	struct usb_request *read_req;
++	unsigned char *read_buf;
++	unsigned read_count;
++};
++
++static struct usb_interface_descriptor adb_interface_desc = {
++	.bLength                = USB_DT_INTERFACE_SIZE,
++	.bDescriptorType        = USB_DT_INTERFACE,
++	.bInterfaceNumber       = 0,
++	.bNumEndpoints          = 2,
++	.bInterfaceClass        = 0xFF,
++	.bInterfaceSubClass     = 0x42,
++	.bInterfaceProtocol     = 1,
++};
++
++static struct usb_endpoint_descriptor adb_highspeed_in_desc = {
++	.bLength                = USB_DT_ENDPOINT_SIZE,
++	.bDescriptorType        = USB_DT_ENDPOINT,
++	.bEndpointAddress       = USB_DIR_IN,
++	.bmAttributes           = USB_ENDPOINT_XFER_BULK,
++	.wMaxPacketSize         = __constant_cpu_to_le16(512),
++};
++
++static struct usb_endpoint_descriptor adb_highspeed_out_desc = {
++	.bLength                = USB_DT_ENDPOINT_SIZE,
++	.bDescriptorType        = USB_DT_ENDPOINT,
++	.bEndpointAddress       = USB_DIR_OUT,
++	.bmAttributes           = USB_ENDPOINT_XFER_BULK,
++	.wMaxPacketSize         = __constant_cpu_to_le16(512),
++};
++
++static struct usb_endpoint_descriptor adb_fullspeed_in_desc = {
++	.bLength                = USB_DT_ENDPOINT_SIZE,
++	.bDescriptorType        = USB_DT_ENDPOINT,
++	.bEndpointAddress       = USB_DIR_IN,
++	.bmAttributes           = USB_ENDPOINT_XFER_BULK,
++};
++
++static struct usb_endpoint_descriptor adb_fullspeed_out_desc = {
++	.bLength                = USB_DT_ENDPOINT_SIZE,
++	.bDescriptorType        = USB_DT_ENDPOINT,
++	.bEndpointAddress       = USB_DIR_OUT,
++	.bmAttributes           = USB_ENDPOINT_XFER_BULK,
++};
++
++static struct usb_descriptor_header *fs_adb_descs[] = {
++	(struct usb_descriptor_header *) &adb_interface_desc,
++	(struct usb_descriptor_header *) &adb_fullspeed_in_desc,
++	(struct usb_descriptor_header *) &adb_fullspeed_out_desc,
++	NULL,
++};
++
++static struct usb_descriptor_header *hs_adb_descs[] = {
++	(struct usb_descriptor_header *) &adb_interface_desc,
++	(struct usb_descriptor_header *) &adb_highspeed_in_desc,
++	(struct usb_descriptor_header *) &adb_highspeed_out_desc,
++	NULL,
++};
++
++/* used when adb function is disabled */
++static struct usb_descriptor_header *null_adb_descs[] = {
++	NULL,
++};
++
++
++/* temporary variable used between adb_open() and adb_gadget_bind() */
++static struct adb_dev *_adb_dev;
++
++static inline struct adb_dev *func_to_dev(struct usb_function *f)
++{
++	return container_of(f, struct adb_dev, function);
++}
++
++
++static struct usb_request *adb_request_new(struct usb_ep *ep, int buffer_size)
++{
++	struct usb_request *req = usb_ep_alloc_request(ep, GFP_KERNEL);
++	if (!req)
++		return NULL;
++
++	/* now allocate buffers for the requests */
++	req->buf = kmalloc(buffer_size, GFP_KERNEL);
++	if (!req->buf) {
++		usb_ep_free_request(ep, req);
++		return NULL;
++	}
++
++	return req;
++}
++
++static void adb_request_free(struct usb_request *req, struct usb_ep *ep)
++{
++	if (req) {
++		kfree(req->buf);
++		usb_ep_free_request(ep, req);
++	}
++}
++
++static inline int _lock(atomic_t *excl)
++{
++	if (atomic_inc_return(excl) == 1) {
++		return 0;
++	} else {
++		atomic_dec(excl);
++		return -1;
++	}
++}
++
++static inline void _unlock(atomic_t *excl)
++{
++	atomic_dec(excl);
++}
++
++/* add a request to the tail of a list */
++void req_put(struct adb_dev *dev, struct list_head *head,
++		struct usb_request *req)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&dev->lock, flags);
++	list_add_tail(&req->list, head);
++	spin_unlock_irqrestore(&dev->lock, flags);
++}
++
++/* remove a request from the head of a list */
++struct usb_request *req_get(struct adb_dev *dev, struct list_head *head)
++{
++	unsigned long flags;
++	struct usb_request *req;
++
++	spin_lock_irqsave(&dev->lock, flags);
++	if (list_empty(head)) {
++		req = 0;
++	} else {
++		req = list_first_entry(head, struct usb_request, list);
++		list_del(&req->list);
++	}
++	spin_unlock_irqrestore(&dev->lock, flags);
++	return req;
++}
++
++static void adb_complete_in(struct usb_ep *ep, struct usb_request *req)
++{
++	struct adb_dev *dev = _adb_dev;
++
++	if (req->status != 0)
++		dev->error = 1;
++
++	req_put(dev, &dev->tx_idle, req);
++
++	wake_up(&dev->write_wq);
++}
++
++static void adb_complete_out(struct usb_ep *ep, struct usb_request *req)
++{
++	struct adb_dev *dev = _adb_dev;
++
++	if (req->status != 0) {
++		dev->error = 1;
++		req_put(dev, &dev->rx_idle, req);
++	} else {
++		req_put(dev, &dev->rx_done, req);
++	}
++
++	wake_up(&dev->read_wq);
++}
++
++static int __init create_bulk_endpoints(struct adb_dev *dev,
++				struct usb_endpoint_descriptor *in_desc,
++				struct usb_endpoint_descriptor *out_desc)
++{
++	struct usb_composite_dev *cdev = dev->cdev;
++	struct usb_request *req;
++	struct usb_ep *ep;
++	int i;
++
++	DBG(cdev, "create_bulk_endpoints dev: %p\n", dev);
++
++	ep = usb_ep_autoconfig(cdev->gadget, in_desc);
++	if (!ep) {
++		DBG(cdev, "usb_ep_autoconfig for ep_in failed\n");
++		return -ENODEV;
++	}
++	DBG(cdev, "usb_ep_autoconfig for ep_in got %s\n", ep->name);
++	dev->ep_in = ep;
++
++	ep = usb_ep_autoconfig(cdev->gadget, out_desc);
++	if (!ep) {
++		DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
++		return -ENODEV;
++	}
++	DBG(cdev, "usb_ep_autoconfig for adb ep_out got %s\n", ep->name);
++	dev->ep_out = ep;
++
++	/* now allocate requests for our endpoints */
++	for (i = 0; i < RX_REQ_MAX; i++) {
++		req = adb_request_new(dev->ep_out, BULK_BUFFER_SIZE);
++		if (!req)
++			goto fail;
++		req->complete = adb_complete_out;
++		req_put(dev, &dev->rx_idle, req);
++	}
++
++	for (i = 0; i < TX_REQ_MAX; i++) {
++		req = adb_request_new(dev->ep_in, BULK_BUFFER_SIZE);
++		if (!req)
++			goto fail;
++		req->complete = adb_complete_in;
++		req_put(dev, &dev->tx_idle, req);
++	}
++
++	return 0;
++
++fail:
++	printk(KERN_ERR "adb_bind() could not allocate requests\n");
++	return -1;
++}
++
++static ssize_t adb_read(struct file *fp, char __user *buf,
++				size_t count, loff_t *pos)
++{
++	struct adb_dev *dev = fp->private_data;
++	struct usb_composite_dev *cdev = dev->cdev;
++	struct usb_request *req;
++	int r = count, xfer;
++	int ret;
++
++	DBG(cdev, "adb_read(%d)\n", count);
++
++	if (_lock(&dev->read_excl))
++		return -EBUSY;
++
++	/* we will block until we're online */
++	while (!(dev->online || dev->error)) {
++		DBG(cdev, "adb_read: waiting for online state\n");
++		ret = wait_event_interruptible(dev->read_wq,
++				(dev->online || dev->error));
++		if (ret < 0) {
++			_unlock(&dev->read_excl);
++			return ret;
++		}
++	}
++
++	while (count > 0) {
++		if (dev->error) {
++			DBG(cdev, "adb_read dev->error\n");
++			r = -EIO;
++			break;
++		}
++
++		/* if we have idle read requests, get them queued */
++		while ((req = req_get(dev, &dev->rx_idle))) {
++requeue_req:
++			req->length = BULK_BUFFER_SIZE;
++			ret = usb_ep_queue(dev->ep_out, req, GFP_ATOMIC);
++
++			if (ret < 0) {
++				r = -EIO;
++				dev->error = 1;
++				req_put(dev, &dev->rx_idle, req);
++				goto fail;
++			} else {
++				DBG(cdev, "rx %p queue\n", req);
++			}
++		}
++
++		/* if we have data pending, give it to userspace */
++		if (dev->read_count > 0) {
++			if (dev->read_count < count)
++				xfer = dev->read_count;
++			else
++				xfer = count;
++
++			if (copy_to_user(buf, dev->read_buf, xfer)) {
++				r = -EFAULT;
++				break;
++			}
++			dev->read_buf += xfer;
++			dev->read_count -= xfer;
++			buf += xfer;
++			count -= xfer;
++
++			/* if we've emptied the buffer, release the request */
++			if (dev->read_count == 0) {
++				req_put(dev, &dev->rx_idle, dev->read_req);
++				dev->read_req = 0;
++			}
++			continue;
++		}
++
++		/* wait for a request to complete */
++		req = 0;
++		ret = wait_event_interruptible(dev->read_wq,
++			((req = req_get(dev, &dev->rx_done)) || dev->error));
++		if (req != 0) {
++			/* if we got a 0-len one we need to put it back into
++			** service.  if we made it the current read req we'd
++			** be stuck forever
++			*/
++			if (req->actual == 0)
++				goto requeue_req;
++
++			dev->read_req = req;
++			dev->read_count = req->actual;
++			dev->read_buf = req->buf;
++			DBG(cdev, "rx %p %d\n", req, req->actual);
++		}
++
++		if (ret < 0) {
++			r = ret;
++			break;
++		}
++	}
++
++fail:
++	_unlock(&dev->read_excl);
++	DBG(cdev, "adb_read returning %d\n", r);
++	return r;
++}
++
++static ssize_t adb_write(struct file *fp, const char __user *buf,
++				 size_t count, loff_t *pos)
++{
++	struct adb_dev *dev = fp->private_data;
++	struct usb_composite_dev *cdev = dev->cdev;
++	struct usb_request *req = 0;
++	int r = count, xfer;
++	int ret;
++
++	DBG(cdev, "adb_write(%d)\n", count);
++
++	if (_lock(&dev->write_excl))
++		return -EBUSY;
++
++	while (count > 0) {
++		if (dev->error) {
++			DBG(cdev, "adb_write dev->error\n");
++			r = -EIO;
++			break;
++		}
++
++		/* get an idle tx request to use */
++		req = 0;
++		ret = wait_event_interruptible(dev->write_wq,
++			((req = req_get(dev, &dev->tx_idle)) || dev->error));
++
++		if (ret < 0) {
++			r = ret;
++			break;
++		}
++
++		if (req != 0) {
++			if (count > BULK_BUFFER_SIZE)
++				xfer = BULK_BUFFER_SIZE;
++			else
++				xfer = count;
++			if (copy_from_user(req->buf, buf, xfer)) {
++				r = -EFAULT;
++				break;
++			}
++
++			req->length = xfer;
++			ret = usb_ep_queue(dev->ep_in, req, GFP_ATOMIC);
++			if (ret < 0) {
++				DBG(cdev, "adb_write: xfer error %d\n", ret);
++				dev->error = 1;
++				r = -EIO;
++				break;
++			}
++
++			buf += xfer;
++			count -= xfer;
++
++			/* zero this so we don't try to free it on error exit */
++			req = 0;
++		}
++	}
++
++	if (req)
++		req_put(dev, &dev->tx_idle, req);
++
++	_unlock(&dev->write_excl);
++	DBG(cdev, "adb_write returning %d\n", r);
++	return r;
++}
++
++static int adb_open(struct inode *ip, struct file *fp)
++{
++	printk(KERN_INFO "adb_open\n");
++	if (_lock(&_adb_dev->open_excl))
++		return -EBUSY;
++
++	fp->private_data = _adb_dev;
++
++	/* clear the error latch */
++	_adb_dev->error = 0;
++
++	return 0;
++}
++
++static int adb_release(struct inode *ip, struct file *fp)
++{
++	printk(KERN_INFO "adb_release\n");
++	_unlock(&_adb_dev->open_excl);
++	return 0;
++}
++
++/* file operations for ADB device /dev/android_adb */
++static struct file_operations adb_fops = {
++	.owner = THIS_MODULE,
++	.read = adb_read,
++	.write = adb_write,
++	.open = adb_open,
++	.release = adb_release,
++};
++
++static struct miscdevice adb_device = {
++	.minor = MISC_DYNAMIC_MINOR,
++	.name = shortname,
++	.fops = &adb_fops,
++};
++
++static int __init
++adb_function_bind(struct usb_configuration *c, struct usb_function *f)
++{
++	struct usb_composite_dev *cdev = c->cdev;
++	struct adb_dev	*dev = func_to_dev(f);
++	int			id;
++	int			ret;
++
++	dev->cdev = cdev;
++	DBG(cdev, "adb_function_bind dev: %p\n", dev);
++
++	/* allocate interface ID(s) */
++	id = usb_interface_id(c, f);
++	if (id < 0)
++		return id;
++	adb_interface_desc.bInterfaceNumber = id;
++
++	/* allocate endpoints */
++	ret = create_bulk_endpoints(dev, &adb_fullspeed_in_desc,
++			&adb_fullspeed_out_desc);
++	if (ret)
++		return ret;
++
++	/* support high speed hardware */
++	if (gadget_is_dualspeed(c->cdev->gadget)) {
++		adb_highspeed_in_desc.bEndpointAddress =
++			adb_fullspeed_in_desc.bEndpointAddress;
++		adb_highspeed_out_desc.bEndpointAddress =
++			adb_fullspeed_out_desc.bEndpointAddress;
++	}
++
++	DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
++			gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
++			f->name, dev->ep_in->name, dev->ep_out->name);
++	return 0;
++}
++
++static void
++adb_function_unbind(struct usb_configuration *c, struct usb_function *f)
++{
++	struct adb_dev	*dev = func_to_dev(f);
++	struct usb_request *req;
++
++	spin_lock_irq(&dev->lock);
++
++	while ((req = req_get(dev, &dev->rx_idle)))
++		adb_request_free(req, dev->ep_out);
++	while ((req = req_get(dev, &dev->tx_idle)))
++		adb_request_free(req, dev->ep_in);
++
++	dev->online = 0;
++	dev->error = 1;
++	spin_unlock_irq(&dev->lock);
++
++	misc_deregister(&adb_device);
++	kfree(_adb_dev);
++	_adb_dev = NULL;
++}
++
++static int adb_function_set_alt(struct usb_function *f,
++		unsigned intf, unsigned alt)
++{
++	struct adb_dev	*dev = func_to_dev(f);
++	struct usb_composite_dev *cdev = f->config->cdev;
++	int ret;
++
++	DBG(cdev, "adb_function_set_alt intf: %d alt: %d\n", intf, alt);
++	ret = usb_ep_enable(dev->ep_in,
++			ep_choose(cdev->gadget,
++				&adb_highspeed_in_desc,
++				&adb_fullspeed_in_desc));
++	if (ret)
++		return ret;
++	ret = usb_ep_enable(dev->ep_out,
++			ep_choose(cdev->gadget,
++				&adb_highspeed_out_desc,
++				&adb_fullspeed_out_desc));
++	if (ret) {
++		usb_ep_disable(dev->ep_in);
++		return ret;
++	}
++	dev->online = 1;
++
++	/* readers may be blocked waiting for us to go online */
++	wake_up(&dev->read_wq);
++	return 0;
++}
++
++static void adb_function_disable(struct usb_function *f)
++{
++	struct adb_dev	*dev = func_to_dev(f);
++	struct usb_composite_dev	*cdev = dev->cdev;
++
++	DBG(cdev, "adb_function_disable\n");
++	dev->online = 0;
++	dev->error = 1;
++	usb_ep_disable(dev->ep_in);
++	usb_ep_disable(dev->ep_out);
++
++	/* readers may be blocked waiting for us to go online */
++	wake_up(&dev->read_wq);
++
++	VDBG(cdev, "%s disabled\n", dev->function.name);
++}
++
++int __init adb_function_add(struct usb_composite_dev *cdev,
++	struct usb_configuration *c)
++{
++	struct adb_dev *dev;
++	int ret;
++
++	printk(KERN_INFO "adb_function_add\n");
++
++	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return -ENOMEM;
++
++	spin_lock_init(&dev->lock);
++
++	init_waitqueue_head(&dev->read_wq);
++	init_waitqueue_head(&dev->write_wq);
++
++	atomic_set(&dev->open_excl, 0);
++	atomic_set(&dev->read_excl, 0);
++	atomic_set(&dev->write_excl, 0);
++
++	INIT_LIST_HEAD(&dev->rx_idle);
++	INIT_LIST_HEAD(&dev->rx_done);
++	INIT_LIST_HEAD(&dev->tx_idle);
++
++	dev->cdev = cdev;
++	dev->function.name = "adb";
++	dev->function.descriptors = null_adb_descs;
++	dev->function.hs_descriptors = null_adb_descs;
++	dev->function.bind = adb_function_bind;
++	dev->function.unbind = adb_function_unbind;
++	dev->function.set_alt = adb_function_set_alt;
++	dev->function.disable = adb_function_disable;
++
++	/* _adb_dev must be set before calling usb_gadget_register_driver */
++	_adb_dev = dev;
++
++	ret = misc_register(&adb_device);
++	if (ret)
++		goto err1;
++	ret = usb_add_function(c, &dev->function);
++	if (ret)
++		goto err2;
++
++	return 0;
++
++err2:
++	misc_deregister(&adb_device);
++err1:
++	kfree(dev);
++	printk(KERN_ERR "adb gadget driver failed to initialize\n");
++	return ret;
++}
++
++void adb_function_enable(int enable)
++{
++	struct adb_dev *dev = _adb_dev;
++
++	if (dev) {
++		DBG(dev->cdev, "adb_function_enable(%s)\n",
++			enable ? "true" : "false");
++
++		if (enable) {
++			dev->function.descriptors = fs_adb_descs;
++			dev->function.hs_descriptors = hs_adb_descs;
++		} else {
++			dev->function.descriptors = null_adb_descs;
++			dev->function.hs_descriptors = null_adb_descs;
++		}
++	}
++}
++
+--- /dev/null
++++ b/drivers/usb/gadget/f_adb.h
+@@ -0,0 +1,25 @@
++/*
++ * Gadget Driver for Android ADB
++ *
++ * Copyright (C) 2008 Google, Inc.
++ * Author: Mike Lockwood <lockwood@android.com>
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#ifndef __F_ADB_H
++#define __F_ADB_H
++
++int adb_function_add(struct usb_composite_dev *cdev,
++	struct usb_configuration *c);
++void adb_function_enable(int enable);
++
++#endif /* __F_ADB_H */
+--- /dev/null
++++ b/drivers/usb/gadget/f_mass_storage.c
+@@ -0,0 +1,2906 @@
++/*
++ * drivers/usb/gadget/f_mass_storage.c
++ *
++ * Function Driver for USB Mass Storage
++ *
++ * Copyright (C) 2008 Google, Inc.
++ * Author: Mike Lockwood <lockwood@android.com>
++ *
++ * Based heavily on the file_storage gadget driver in
++ * drivers/usb/gadget/file_storage.c and licensed under the same terms:
++ *
++ * Copyright (C) 2003-2007 Alan Stern
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") as published by the Free Software
++ * Foundation, either version 2 of that License or (at your option) any
++ * later version.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++/* #define DEBUG */
++/* #define VERBOSE_DEBUG */
++/* #define DUMP_MSGS */
++
++
++#include <linux/blkdev.h>
++#include <linux/completion.h>
++#include <linux/dcache.h>
++#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/fcntl.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/kref.h>
++#include <linux/kthread.h>
++#include <linux/limits.h>
++#include <linux/rwsem.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++#include <linux/string.h>
++#include <linux/switch.h>
++#include <linux/freezer.h>
++#include <linux/utsname.h>
++#include <linux/wakelock.h>
++
++#include <linux/usb_usual.h>
++#include <linux/usb/ch9.h>
++#include <linux/usb/composite.h>
++#include <linux/usb/gadget.h>
++
++#include "f_mass_storage.h"
++#include "gadget_chips.h"
++
++
++#define BULK_BUFFER_SIZE           4096
++
++/*-------------------------------------------------------------------------*/
++
++#define DRIVER_NAME		"usb_mass_storage"
++#define MAX_LUNS		8
++
++static const char shortname[] = DRIVER_NAME;
++
++#ifdef DEBUG
++#define LDBG(lun, fmt, args...) \
++	dev_dbg(&(lun)->dev , fmt , ## args)
++#define MDBG(fmt,args...) \
++	printk(KERN_DEBUG DRIVER_NAME ": " fmt , ## args)
++#else
++#define LDBG(lun, fmt, args...) \
++	do { } while (0)
++#define MDBG(fmt,args...) \
++	do { } while (0)
++#undef VERBOSE_DEBUG
++#undef DUMP_MSGS
++#endif /* DEBUG */
++
++#ifdef VERBOSE_DEBUG
++#define VLDBG	LDBG
++#else
++#define VLDBG(lun, fmt, args...) \
++	do { } while (0)
++#endif /* VERBOSE_DEBUG */
++
++#define LERROR(lun, fmt, args...) \
++	dev_err(&(lun)->dev , fmt , ## args)
++#define LWARN(lun, fmt, args...) \
++	dev_warn(&(lun)->dev , fmt , ## args)
++#define LINFO(lun, fmt, args...) \
++	dev_info(&(lun)->dev , fmt , ## args)
++
++#define MINFO(fmt,args...) \
++	printk(KERN_INFO DRIVER_NAME ": " fmt , ## args)
++
++#undef DBG
++#undef VDBG
++#undef ERROR
++#undef WARNING
++#undef INFO
++#define DBG(d, fmt, args...) \
++	dev_dbg(&(d)->cdev->gadget->dev , fmt , ## args)
++#define VDBG(d, fmt, args...) \
++	dev_vdbg(&(d)->cdev->gadget->dev , fmt , ## args)
++#define ERROR(d, fmt, args...) \
++	dev_err(&(d)->cdev->gadget->dev , fmt , ## args)
++#define WARNING(d, fmt, args...) \
++	dev_warn(&(d)->cdev->gadget->dev , fmt , ## args)
++#define INFO(d, fmt, args...) \
++	dev_info(&(d)->cdev->gadget->dev , fmt , ## args)
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Bulk-only data structures */
++
++/* Command Block Wrapper */
++struct bulk_cb_wrap {
++	__le32	Signature;		/* Contains 'USBC' */
++	u32	Tag;			/* Unique per command id */
++	__le32	DataTransferLength;	/* Size of the data */
++	u8	Flags;			/* Direction in bit 7 */
++	u8	Lun;			/* LUN (normally 0) */
++	u8	Length;			/* Of the CDB, <= MAX_COMMAND_SIZE */
++	u8	CDB[16];		/* Command Data Block */
++};
++
++#define USB_BULK_CB_WRAP_LEN	31
++#define USB_BULK_CB_SIG		0x43425355	/* Spells out USBC */
++#define USB_BULK_IN_FLAG	0x80
++
++/* Command Status Wrapper */
++struct bulk_cs_wrap {
++	__le32	Signature;		/* Should = 'USBS' */
++	u32	Tag;			/* Same as original command */
++	__le32	Residue;		/* Amount not transferred */
++	u8	Status;			/* See below */
++};
++
++#define USB_BULK_CS_WRAP_LEN	13
++#define USB_BULK_CS_SIG		0x53425355	/* Spells out 'USBS' */
++#define USB_STATUS_PASS		0
++#define USB_STATUS_FAIL		1
++#define USB_STATUS_PHASE_ERROR	2
++
++/* Bulk-only class specific requests */
++#define USB_BULK_RESET_REQUEST		0xff
++#define USB_BULK_GET_MAX_LUN_REQUEST	0xfe
++
++/* Length of a SCSI Command Data Block */
++#define MAX_COMMAND_SIZE	16
++
++/* SCSI commands that we recognize */
++#define SC_FORMAT_UNIT			0x04
++#define SC_INQUIRY			0x12
++#define SC_MODE_SELECT_6		0x15
++#define SC_MODE_SELECT_10		0x55
++#define SC_MODE_SENSE_6			0x1a
++#define SC_MODE_SENSE_10		0x5a
++#define SC_PREVENT_ALLOW_MEDIUM_REMOVAL	0x1e
++#define SC_READ_6			0x08
++#define SC_READ_10			0x28
++#define SC_READ_12			0xa8
++#define SC_READ_CAPACITY		0x25
++#define SC_READ_FORMAT_CAPACITIES	0x23
++#define SC_RELEASE			0x17
++#define SC_REQUEST_SENSE		0x03
++#define SC_RESERVE			0x16
++#define SC_SEND_DIAGNOSTIC		0x1d
++#define SC_START_STOP_UNIT		0x1b
++#define SC_SYNCHRONIZE_CACHE		0x35
++#define SC_TEST_UNIT_READY		0x00
++#define SC_VERIFY			0x2f
++#define SC_WRITE_6			0x0a
++#define SC_WRITE_10			0x2a
++#define SC_WRITE_12			0xaa
++
++/* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
++#define SS_NO_SENSE				0
++#define SS_COMMUNICATION_FAILURE		0x040800
++#define SS_INVALID_COMMAND			0x052000
++#define SS_INVALID_FIELD_IN_CDB			0x052400
++#define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE	0x052100
++#define SS_LOGICAL_UNIT_NOT_SUPPORTED		0x052500
++#define SS_MEDIUM_NOT_PRESENT			0x023a00
++#define SS_MEDIUM_REMOVAL_PREVENTED		0x055302
++#define SS_NOT_READY_TO_READY_TRANSITION	0x062800
++#define SS_RESET_OCCURRED			0x062900
++#define SS_SAVING_PARAMETERS_NOT_SUPPORTED	0x053900
++#define SS_UNRECOVERED_READ_ERROR		0x031100
++#define SS_WRITE_ERROR				0x030c02
++#define SS_WRITE_PROTECTED			0x072700
++
++#define SK(x)		((u8) ((x) >> 16))	/* Sense Key byte, etc. */
++#define ASC(x)		((u8) ((x) >> 8))
++#define ASCQ(x)		((u8) (x))
++
++
++/*-------------------------------------------------------------------------*/
++
++struct lun {
++	struct file	*filp;
++	loff_t		file_length;
++	loff_t		num_sectors;
++
++	unsigned int	ro : 1;
++	unsigned int	prevent_medium_removal : 1;
++	unsigned int	registered : 1;
++	unsigned int	info_valid : 1;
++
++	u32		sense_data;
++	u32		sense_data_info;
++	u32		unit_attention_data;
++
++	struct device	dev;
++};
++
++#define backing_file_is_open(curlun)	((curlun)->filp != NULL)
++
++
++static struct lun *dev_to_lun(struct device *dev)
++{
++	return container_of(dev, struct lun, dev);
++}
++
++/* Big enough to hold our biggest descriptor */
++#define EP0_BUFSIZE	256
++#define DELAYED_STATUS	(EP0_BUFSIZE + 999)	/* An impossibly large value */
++
++/* Number of buffers we will use.  2 is enough for double-buffering */
++#define NUM_BUFFERS	2
++
++enum fsg_buffer_state {
++	BUF_STATE_EMPTY = 0,
++	BUF_STATE_FULL,
++	BUF_STATE_BUSY
++};
++
++struct fsg_buffhd {
++	void				*buf;
++	enum fsg_buffer_state		state;
++	struct fsg_buffhd		*next;
++
++	/* The NetChip 2280 is faster, and handles some protocol faults
++	 * better, if we don't submit any short bulk-out read requests.
++	 * So we will record the intended request length here. */
++	unsigned int			bulk_out_intended_length;
++
++	struct usb_request		*inreq;
++	int				inreq_busy;
++	struct usb_request		*outreq;
++	int				outreq_busy;
++};
++
++enum fsg_state {
++	/* This one isn't used anywhere */
++	FSG_STATE_COMMAND_PHASE = -10,
++
++	FSG_STATE_DATA_PHASE,
++	FSG_STATE_STATUS_PHASE,
++
++	FSG_STATE_IDLE = 0,
++	FSG_STATE_ABORT_BULK_OUT,
++	FSG_STATE_RESET,
++	FSG_STATE_CONFIG_CHANGE,
++	FSG_STATE_EXIT,
++	FSG_STATE_TERMINATED
++};
++
++enum data_direction {
++	DATA_DIR_UNKNOWN = 0,
++	DATA_DIR_FROM_HOST,
++	DATA_DIR_TO_HOST,
++	DATA_DIR_NONE
++};
++
++struct fsg_dev {
++	struct usb_function function;
++	struct usb_composite_dev *cdev;
++
++	/* lock protects: state and all the req_busy's */
++	spinlock_t		lock;
++
++	/* filesem protects: backing files in use */
++	struct rw_semaphore	filesem;
++
++	/* reference counting: wait until all LUNs are released */
++	struct kref		ref;
++
++	unsigned int		bulk_out_maxpacket;
++	enum fsg_state		state;		/* For exception handling */
++
++	u8			config, new_config;
++
++	unsigned int		running : 1;
++	unsigned int		bulk_in_enabled : 1;
++	unsigned int		bulk_out_enabled : 1;
++	unsigned int		phase_error : 1;
++	unsigned int		short_packet_received : 1;
++	unsigned int		bad_lun_okay : 1;
++
++	unsigned long		atomic_bitflags;
++#define REGISTERED		0
++#define CLEAR_BULK_HALTS	1
++#define SUSPENDED		2
++
++	struct usb_ep		*bulk_in;
++	struct usb_ep		*bulk_out;
++
++	struct fsg_buffhd	*next_buffhd_to_fill;
++	struct fsg_buffhd	*next_buffhd_to_drain;
++	struct fsg_buffhd	buffhds[NUM_BUFFERS];
++
++	int			thread_wakeup_needed;
++	struct completion	thread_notifier;
++	struct task_struct	*thread_task;
++
++	int			cmnd_size;
++	u8			cmnd[MAX_COMMAND_SIZE];
++	enum data_direction	data_dir;
++	u32			data_size;
++	u32			data_size_from_cmnd;
++	u32			tag;
++	unsigned int		lun;
++	u32			residue;
++	u32			usb_amount_left;
++
++	unsigned int		nluns;
++	struct lun		*luns;
++	struct lun		*curlun;
++
++	u32				buf_size;
++	const char		*vendor;
++	const char		*product;
++	int				release;
++
++	struct switch_dev sdev;
++
++	struct wake_lock wake_lock;
++};
++
++static inline struct fsg_dev *func_to_dev(struct usb_function *f)
++{
++	return container_of(f, struct fsg_dev, function);
++}
++
++static int exception_in_progress(struct fsg_dev *fsg)
++{
++	return (fsg->state > FSG_STATE_IDLE);
++}
++
++/* Make bulk-out requests be divisible by the maxpacket size */
++static void set_bulk_out_req_length(struct fsg_dev *fsg,
++		struct fsg_buffhd *bh, unsigned int length)
++{
++	unsigned int	rem;
++
++	bh->bulk_out_intended_length = length;
++	rem = length % fsg->bulk_out_maxpacket;
++	if (rem > 0)
++		length += fsg->bulk_out_maxpacket - rem;
++	bh->outreq->length = length;
++}
++
++static struct fsg_dev			*the_fsg;
++
++static void	close_backing_file(struct fsg_dev *fsg, struct lun *curlun);
++static void	close_all_backing_files(struct fsg_dev *fsg);
++
++
++/*-------------------------------------------------------------------------*/
++
++#ifdef DUMP_MSGS
++
++static void dump_msg(struct fsg_dev *fsg, const char *label,
++		const u8 *buf, unsigned int length)
++{
++	if (length < 512) {
++		DBG(fsg, "%s, length %u:\n", label, length);
++		print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET,
++				16, 1, buf, length, 0);
++	}
++}
++
++static void dump_cdb(struct fsg_dev *fsg)
++{}
++
++#else
++
++static void dump_msg(struct fsg_dev *fsg, const char *label,
++		const u8 *buf, unsigned int length)
++{}
++
++#ifdef VERBOSE_DEBUG
++
++static void dump_cdb(struct fsg_dev *fsg)
++{
++	print_hex_dump(KERN_DEBUG, "SCSI CDB: ", DUMP_PREFIX_NONE,
++			16, 1, fsg->cmnd, fsg->cmnd_size, 0);
++}
++
++#else
++
++static void dump_cdb(struct fsg_dev *fsg)
++{}
++
++#endif /* VERBOSE_DEBUG */
++#endif /* DUMP_MSGS */
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Routines for unaligned data access */
++
++static u16 get_be16(u8 *buf)
++{
++	return ((u16) buf[0] << 8) | ((u16) buf[1]);
++}
++
++static u32 get_be32(u8 *buf)
++{
++	return ((u32) buf[0] << 24) | ((u32) buf[1] << 16) |
++			((u32) buf[2] << 8) | ((u32) buf[3]);
++}
++
++static void put_be16(u8 *buf, u16 val)
++{
++	buf[0] = val >> 8;
++	buf[1] = val;
++}
++
++static void put_be32(u8 *buf, u32 val)
++{
++	buf[0] = val >> 24;
++	buf[1] = val >> 16;
++	buf[2] = val >> 8;
++	buf[3] = val & 0xff;
++}
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * DESCRIPTORS ... most are static, but strings and (full) configuration
++ * descriptors are built on demand.  Also the (static) config and interface
++ * descriptors are adjusted during fsg_bind().
++ */
++
++/* There is only one interface. */
++
++static struct usb_interface_descriptor
++intf_desc = {
++	.bLength =		sizeof intf_desc,
++	.bDescriptorType =	USB_DT_INTERFACE,
++
++	.bNumEndpoints =	2,		/* Adjusted during fsg_bind() */
++	.bInterfaceClass =	USB_CLASS_MASS_STORAGE,
++	.bInterfaceSubClass =	US_SC_SCSI,
++	.bInterfaceProtocol =	US_PR_BULK,
++};
++
++/* Three full-speed endpoint descriptors: bulk-in, bulk-out,
++ * and interrupt-in. */
++
++static struct usb_endpoint_descriptor
++fs_bulk_in_desc = {
++	.bLength =		USB_DT_ENDPOINT_SIZE,
++	.bDescriptorType =	USB_DT_ENDPOINT,
++
++	.bEndpointAddress =	USB_DIR_IN,
++	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
++	/* wMaxPacketSize set by autoconfiguration */
++};
++
++static struct usb_endpoint_descriptor
++fs_bulk_out_desc = {
++	.bLength =		USB_DT_ENDPOINT_SIZE,
++	.bDescriptorType =	USB_DT_ENDPOINT,
++
++	.bEndpointAddress =	USB_DIR_OUT,
++	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
++	/* wMaxPacketSize set by autoconfiguration */
++};
++
++static struct usb_descriptor_header *fs_function[] = {
++	(struct usb_descriptor_header *) &intf_desc,
++	(struct usb_descriptor_header *) &fs_bulk_in_desc,
++	(struct usb_descriptor_header *) &fs_bulk_out_desc,
++	NULL,
++};
++#define FS_FUNCTION_PRE_EP_ENTRIES	2
++
++
++static struct usb_endpoint_descriptor
++hs_bulk_in_desc = {
++	.bLength =		USB_DT_ENDPOINT_SIZE,
++	.bDescriptorType =	USB_DT_ENDPOINT,
++
++	/* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
++	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
++	.wMaxPacketSize =	__constant_cpu_to_le16(512),
++};
++
++static struct usb_endpoint_descriptor
++hs_bulk_out_desc = {
++	.bLength =		USB_DT_ENDPOINT_SIZE,
++	.bDescriptorType =	USB_DT_ENDPOINT,
++
++	/* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
++	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
++	.wMaxPacketSize =	__constant_cpu_to_le16(512),
++	.bInterval =		1,	/* NAK every 1 uframe */
++};
++
++
++static struct usb_descriptor_header *hs_function[] = {
++	(struct usb_descriptor_header *) &intf_desc,
++	(struct usb_descriptor_header *) &hs_bulk_in_desc,
++	(struct usb_descriptor_header *) &hs_bulk_out_desc,
++	NULL,
++};
++
++/* Maxpacket and other transfer characteristics vary by speed. */
++static struct usb_endpoint_descriptor *
++ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
++		struct usb_endpoint_descriptor *hs)
++{
++	if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
++		return hs;
++	return fs;
++}
++
++/*-------------------------------------------------------------------------*/
++
++/* These routines may be called in process context or in_irq */
++
++/* Caller must hold fsg->lock */
++static void wakeup_thread(struct fsg_dev *fsg)
++{
++	/* Tell the main thread that something has happened */
++	fsg->thread_wakeup_needed = 1;
++	if (fsg->thread_task)
++		wake_up_process(fsg->thread_task);
++}
++
++
++static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
++{
++	unsigned long		flags;
++
++	DBG(fsg, "raise_exception %d\n", (int)new_state);
++	/* Do nothing if a higher-priority exception is already in progress.
++	 * If a lower-or-equal priority exception is in progress, preempt it
++	 * and notify the main thread by sending it a signal. */
++	spin_lock_irqsave(&fsg->lock, flags);
++	if (fsg->state <= new_state) {
++		fsg->state = new_state;
++		if (fsg->thread_task)
++			send_sig_info(SIGUSR1, SEND_SIG_FORCED,
++					fsg->thread_task);
++	}
++	spin_unlock_irqrestore(&fsg->lock, flags);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Bulk and interrupt endpoint completion handlers.
++ * These always run in_irq. */
++
++static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++	struct fsg_buffhd	*bh = req->context;
++
++	if (req->status || req->actual != req->length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual, req->length);
++
++	/* Hold the lock while we update the request and buffer states */
++	smp_wmb();
++	spin_lock(&fsg->lock);
++	bh->inreq_busy = 0;
++	bh->state = BUF_STATE_EMPTY;
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
++{
++	struct fsg_dev		*fsg = ep->driver_data;
++	struct fsg_buffhd	*bh = req->context;
++
++	dump_msg(fsg, "bulk-out", req->buf, req->actual);
++	if (req->status || req->actual != bh->bulk_out_intended_length)
++		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
++				req->status, req->actual,
++				bh->bulk_out_intended_length);
++
++	/* Hold the lock while we update the request and buffer states */
++	smp_wmb();
++	spin_lock(&fsg->lock);
++	bh->outreq_busy = 0;
++	bh->state = BUF_STATE_FULL;
++	wakeup_thread(fsg);
++	spin_unlock(&fsg->lock);
++}
++
++static int fsg_function_setup(struct usb_function *f,
++					const struct usb_ctrlrequest *ctrl)
++{
++	struct fsg_dev	*fsg = func_to_dev(f);
++	struct usb_composite_dev *cdev = fsg->cdev;
++	int			value = -EOPNOTSUPP;
++	u16			w_index = le16_to_cpu(ctrl->wIndex);
++	u16			w_value = le16_to_cpu(ctrl->wValue);
++	u16			w_length = le16_to_cpu(ctrl->wLength);
++
++	DBG(fsg, "fsg_function_setup\n");
++	/* Handle Bulk-only class-specific requests */
++	if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS) {
++	DBG(fsg, "USB_TYPE_CLASS\n");
++		switch (ctrl->bRequest) {
++		case USB_BULK_RESET_REQUEST:
++			if (ctrl->bRequestType != (USB_DIR_OUT |
++					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
++				break;
++			if (w_index != 0 || w_value != 0) {
++				value = -EDOM;
++				break;
++			}
++
++			/* Raise an exception to stop the current operation
++			 * and reinitialize our state. */
++			DBG(fsg, "bulk reset request\n");
++			raise_exception(fsg, FSG_STATE_RESET);
++			value = DELAYED_STATUS;
++			break;
++
++		case USB_BULK_GET_MAX_LUN_REQUEST:
++			if (ctrl->bRequestType != (USB_DIR_IN |
++					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
++				break;
++			if (w_index != 0 || w_value != 0) {
++				value = -EDOM;
++				break;
++			}
++			VDBG(fsg, "get max LUN\n");
++			*(u8 *)cdev->req->buf = fsg->nluns - 1;
++			value = 1;
++			break;
++		}
++	}
++
++	if (value == -EOPNOTSUPP)
++		VDBG(fsg,
++			"unknown class-specific control req "
++			"%02x.%02x v%04x i%04x l%u\n",
++			ctrl->bRequestType, ctrl->bRequest,
++			le16_to_cpu(ctrl->wValue), w_index, w_length);
++	return value;
++}
++
++/*-------------------------------------------------------------------------*/
++
++/* All the following routines run in process context */
++
++
++/* Use this for bulk or interrupt transfers, not ep0 */
++static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
++		struct usb_request *req, int *pbusy,
++		enum fsg_buffer_state *state)
++{
++	int	rc;
++
++	DBG(fsg, "start_transfer req: %p, req->buf: %p\n", req, req->buf);
++	if (ep == fsg->bulk_in)
++		dump_msg(fsg, "bulk-in", req->buf, req->length);
++
++	spin_lock_irq(&fsg->lock);
++	*pbusy = 1;
++	*state = BUF_STATE_BUSY;
++	spin_unlock_irq(&fsg->lock);
++	rc = usb_ep_queue(ep, req, GFP_KERNEL);
++	if (rc != 0) {
++		*pbusy = 0;
++		*state = BUF_STATE_EMPTY;
++
++		/* We can't do much more than wait for a reset */
++
++		/* Note: currently the net2280 driver fails zero-length
++		 * submissions if DMA is enabled. */
++		if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
++						req->length == 0))
++			WARN(fsg, "error in submission: %s --> %d\n",
++				(ep == fsg->bulk_in ? "bulk-in" : "bulk-out"),
++				rc);
++	}
++}
++
++
++static int sleep_thread(struct fsg_dev *fsg)
++{
++	int	rc = 0;
++
++	/* Wait until a signal arrives or we are woken up */
++	for (;;) {
++		try_to_freeze();
++		set_current_state(TASK_INTERRUPTIBLE);
++		if (signal_pending(current)) {
++			rc = -EINTR;
++			break;
++		}
++		if (fsg->thread_wakeup_needed)
++			break;
++		schedule();
++	}
++	__set_current_state(TASK_RUNNING);
++	fsg->thread_wakeup_needed = 0;
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_read(struct fsg_dev *fsg)
++{
++	struct lun		*curlun = fsg->curlun;
++	u32			lba;
++	struct fsg_buffhd	*bh;
++	int			rc;
++	u32			amount_left;
++	loff_t			file_offset, file_offset_tmp;
++	unsigned int		amount;
++	unsigned int		partial_page;
++	ssize_t			nread;
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	if (fsg->cmnd[0] == SC_READ_6)
++		lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
++	else {
++		lba = get_be32(&fsg->cmnd[2]);
++
++		/* We allow DPO (Disable Page Out = don't save data in the
++		 * cache) and FUA (Force Unit Access = don't read from the
++		 * cache), but we don't implement them. */
++		if ((fsg->cmnd[1] & ~0x18) != 0) {
++			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			return -EINVAL;
++		}
++	}
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++	file_offset = ((loff_t) lba) << 9;
++
++	/* Carry out the file reads */
++	amount_left = fsg->data_size_from_cmnd;
++	if (unlikely(amount_left == 0))
++		return -EIO;		/* No default reply */
++
++	for (;;) {
++
++		/* Figure out how much we need to read:
++		 * Try to read the remaining amount.
++		 * But don't read more than the buffer size.
++		 * And don't try to read past the end of the file.
++		 * Finally, if we're not at a page boundary, don't read past
++		 *	the next page.
++		 * If this means reading 0 then we were asked to read past
++		 *	the end of file. */
++		amount = min((unsigned int) amount_left,
++				(unsigned int)fsg->buf_size);
++		amount = min((loff_t) amount,
++				curlun->file_length - file_offset);
++		partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
++		if (partial_page > 0)
++			amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
++					partial_page);
++
++		/* Wait for the next buffer to become available */
++		bh = fsg->next_buffhd_to_fill;
++		while (bh->state != BUF_STATE_EMPTY) {
++			rc = sleep_thread(fsg);
++			if (rc)
++				return rc;
++		}
++
++		/* If we were asked to read past the end of file,
++		 * end with an empty buffer. */
++		if (amount == 0) {
++			curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++			curlun->sense_data_info = file_offset >> 9;
++			curlun->info_valid = 1;
++			bh->inreq->length = 0;
++			bh->state = BUF_STATE_FULL;
++			break;
++		}
++
++		/* Perform the read */
++		file_offset_tmp = file_offset;
++		nread = vfs_read(curlun->filp,
++				(char __user *) bh->buf,
++				amount, &file_offset_tmp);
++		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
++				(unsigned long long) file_offset,
++				(int) nread);
++		if (signal_pending(current))
++			return -EINTR;
++
++		if (nread < 0) {
++			LDBG(curlun, "error in file read: %d\n",
++					(int) nread);
++			nread = 0;
++		} else if (nread < amount) {
++			LDBG(curlun, "partial file read: %d/%u\n",
++					(int) nread, amount);
++			nread -= (nread & 511);	/* Round down to a block */
++		}
++		file_offset  += nread;
++		amount_left  -= nread;
++		fsg->residue -= nread;
++		bh->inreq->length = nread;
++		bh->state = BUF_STATE_FULL;
++
++		/* If an error occurred, report it and its position */
++		if (nread < amount) {
++			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
++			curlun->sense_data_info = file_offset >> 9;
++			curlun->info_valid = 1;
++			break;
++		}
++
++		if (amount_left == 0)
++			break;		/* No more left to read */
++
++		/* Send this buffer and go read some more */
++		start_transfer(fsg, fsg->bulk_in, bh->inreq,
++				&bh->inreq_busy, &bh->state);
++		fsg->next_buffhd_to_fill = bh->next;
++	}
++
++	return -EIO;		/* No default reply */
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_write(struct fsg_dev *fsg)
++{
++	struct lun		*curlun = fsg->curlun;
++	u32			lba;
++	struct fsg_buffhd	*bh;
++	int			get_some_more;
++	u32			amount_left_to_req, amount_left_to_write;
++	loff_t			usb_offset, file_offset, file_offset_tmp;
++	unsigned int		amount;
++	unsigned int		partial_page;
++	ssize_t			nwritten;
++	int			rc;
++
++	if (curlun->ro) {
++		curlun->sense_data = SS_WRITE_PROTECTED;
++		return -EINVAL;
++	}
++	curlun->filp->f_flags &= ~O_SYNC;	/* Default is not to wait */
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	if (fsg->cmnd[0] == SC_WRITE_6)
++		lba = (fsg->cmnd[1] << 16) | get_be16(&fsg->cmnd[2]);
++	else {
++		lba = get_be32(&fsg->cmnd[2]);
++
++		/* We allow DPO (Disable Page Out = don't save data in the
++		 * cache) and FUA (Force Unit Access = write directly to the
++		 * medium).  We don't implement DPO; we implement FUA by
++		 * performing synchronous output. */
++		if ((fsg->cmnd[1] & ~0x18) != 0) {
++			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			return -EINVAL;
++		}
++		if (fsg->cmnd[1] & 0x08)	/* FUA */
++			curlun->filp->f_flags |= O_SYNC;
++	}
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++
++	/* Carry out the file writes */
++	get_some_more = 1;
++	file_offset = usb_offset = ((loff_t) lba) << 9;
++	amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
++
++	while (amount_left_to_write > 0) {
++
++		/* Queue a request for more data from the host */
++		bh = fsg->next_buffhd_to_fill;
++		if (bh->state == BUF_STATE_EMPTY && get_some_more) {
++
++			/* Figure out how much we want to get:
++			 * Try to get the remaining amount.
++			 * But don't get more than the buffer size.
++			 * And don't try to go past the end of the file.
++			 * If we're not at a page boundary,
++			 *	don't go past the next page.
++			 * If this means getting 0, then we were asked
++			 *	to write past the end of file.
++			 * Finally, round down to a block boundary. */
++			amount = min(amount_left_to_req, (u32)fsg->buf_size);
++			amount = min((loff_t) amount, curlun->file_length -
++					usb_offset);
++			partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
++			if (partial_page > 0)
++				amount = min(amount,
++	(unsigned int) PAGE_CACHE_SIZE - partial_page);
++
++			if (amount == 0) {
++				get_some_more = 0;
++				curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++				curlun->sense_data_info = usb_offset >> 9;
++				curlun->info_valid = 1;
++				continue;
++			}
++			amount -= (amount & 511);
++			if (amount == 0) {
++
++				/* Why were we were asked to transfer a
++				 * partial block? */
++				get_some_more = 0;
++				continue;
++			}
++
++			/* Get the next buffer */
++			usb_offset += amount;
++			fsg->usb_amount_left -= amount;
++			amount_left_to_req -= amount;
++			if (amount_left_to_req == 0)
++				get_some_more = 0;
++
++			/* amount is always divisible by 512, hence by
++			 * the bulk-out maxpacket size */
++			bh->outreq->length = bh->bulk_out_intended_length =
++					amount;
++			start_transfer(fsg, fsg->bulk_out, bh->outreq,
++					&bh->outreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++			continue;
++		}
++
++		/* Write the received data to the backing file */
++		bh = fsg->next_buffhd_to_drain;
++		if (bh->state == BUF_STATE_EMPTY && !get_some_more)
++			break;			/* We stopped early */
++		if (bh->state == BUF_STATE_FULL) {
++			smp_rmb();
++			fsg->next_buffhd_to_drain = bh->next;
++			bh->state = BUF_STATE_EMPTY;
++
++			/* Did something go wrong with the transfer? */
++			if (bh->outreq->status != 0) {
++				curlun->sense_data = SS_COMMUNICATION_FAILURE;
++				curlun->sense_data_info = file_offset >> 9;
++				curlun->info_valid = 1;
++				break;
++			}
++
++			amount = bh->outreq->actual;
++			if (curlun->file_length - file_offset < amount) {
++				LERROR(curlun,
++	"write %u @ %llu beyond end %llu\n",
++	amount, (unsigned long long) file_offset,
++	(unsigned long long) curlun->file_length);
++				amount = curlun->file_length - file_offset;
++			}
++
++			/* Perform the write */
++			file_offset_tmp = file_offset;
++			nwritten = vfs_write(curlun->filp,
++					(char __user *) bh->buf,
++					amount, &file_offset_tmp);
++			VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
++					(unsigned long long) file_offset,
++					(int) nwritten);
++			if (signal_pending(current))
++				return -EINTR;		/* Interrupted! */
++
++			if (nwritten < 0) {
++				LDBG(curlun, "error in file write: %d\n",
++						(int) nwritten);
++				nwritten = 0;
++			} else if (nwritten < amount) {
++				LDBG(curlun, "partial file write: %d/%u\n",
++						(int) nwritten, amount);
++				nwritten -= (nwritten & 511);
++						/* Round down to a block */
++			}
++			file_offset += nwritten;
++			amount_left_to_write -= nwritten;
++			fsg->residue -= nwritten;
++
++			/* If an error occurred, report it and its position */
++			if (nwritten < amount) {
++				curlun->sense_data = SS_WRITE_ERROR;
++				curlun->sense_data_info = file_offset >> 9;
++				curlun->info_valid = 1;
++				break;
++			}
++
++			/* Did the host decide to stop early? */
++			if (bh->outreq->actual != bh->outreq->length) {
++				fsg->short_packet_received = 1;
++				break;
++			}
++			continue;
++		}
++
++		/* Wait for something to happen */
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++
++	return -EIO;		/* No default reply */
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Sync the file data, don't bother with the metadata.
++ * The caller must own fsg->filesem.
++ * This code was copied from fs/buffer.c:sys_fdatasync(). */
++static int fsync_sub(struct lun *curlun)
++{
++	struct file	*filp = curlun->filp;
++	struct inode	*inode;
++	int		rc, err;
++
++	if (curlun->ro || !filp)
++		return 0;
++	if (!filp->f_op->fsync)
++		return -EINVAL;
++
++	inode = filp->f_path.dentry->d_inode;
++	mutex_lock(&inode->i_mutex);
++	rc = filemap_fdatawrite(inode->i_mapping);
++	err = filp->f_op->fsync(filp, filp->f_path.dentry, 1);
++	if (!rc)
++		rc = err;
++	err = filemap_fdatawait(inode->i_mapping);
++	if (!rc)
++		rc = err;
++	mutex_unlock(&inode->i_mutex);
++	VLDBG(curlun, "fdatasync -> %d\n", rc);
++	return rc;
++}
++
++static void fsync_all(struct fsg_dev *fsg)
++{
++	int	i;
++
++	for (i = 0; i < fsg->nluns; ++i)
++		fsync_sub(&fsg->luns[i]);
++}
++
++static int do_synchronize_cache(struct fsg_dev *fsg)
++{
++	struct lun	*curlun = fsg->curlun;
++	int		rc;
++
++	/* We ignore the requested LBA and write out all file's
++	 * dirty data buffers. */
++	rc = fsync_sub(curlun);
++	if (rc)
++		curlun->sense_data = SS_WRITE_ERROR;
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static void invalidate_sub(struct lun *curlun)
++{
++	struct file	*filp = curlun->filp;
++	struct inode	*inode = filp->f_path.dentry->d_inode;
++	unsigned long	rc;
++
++	rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
++	VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
++}
++
++static int do_verify(struct fsg_dev *fsg)
++{
++	struct lun		*curlun = fsg->curlun;
++	u32			lba;
++	u32			verification_length;
++	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
++	loff_t			file_offset, file_offset_tmp;
++	u32			amount_left;
++	unsigned int		amount;
++	ssize_t			nread;
++
++	/* Get the starting Logical Block Address and check that it's
++	 * not too big */
++	lba = get_be32(&fsg->cmnd[2]);
++	if (lba >= curlun->num_sectors) {
++		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++		return -EINVAL;
++	}
++
++	/* We allow DPO (Disable Page Out = don't save data in the
++	 * cache) but we don't implement it. */
++	if ((fsg->cmnd[1] & ~0x10) != 0) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	verification_length = get_be16(&fsg->cmnd[7]);
++	if (unlikely(verification_length == 0))
++		return -EIO;		/* No default reply */
++
++	/* Prepare to carry out the file verify */
++	amount_left = verification_length << 9;
++	file_offset = ((loff_t) lba) << 9;
++
++	/* Write out all the dirty buffers before invalidating them */
++	fsync_sub(curlun);
++	if (signal_pending(current))
++		return -EINTR;
++
++	invalidate_sub(curlun);
++	if (signal_pending(current))
++		return -EINTR;
++
++	/* Just try to read the requested blocks */
++	while (amount_left > 0) {
++
++		/* Figure out how much we need to read:
++		 * Try to read the remaining amount, but not more than
++		 * the buffer size.
++		 * And don't try to read past the end of the file.
++		 * If this means reading 0 then we were asked to read
++		 * past the end of file. */
++		amount = min((unsigned int) amount_left,
++				(unsigned int)fsg->buf_size);
++		amount = min((loff_t) amount,
++				curlun->file_length - file_offset);
++		if (amount == 0) {
++			curlun->sense_data =
++					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
++			curlun->sense_data_info = file_offset >> 9;
++			curlun->info_valid = 1;
++			break;
++		}
++
++		/* Perform the read */
++		file_offset_tmp = file_offset;
++		nread = vfs_read(curlun->filp,
++				(char __user *) bh->buf,
++				amount, &file_offset_tmp);
++		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
++				(unsigned long long) file_offset,
++				(int) nread);
++		if (signal_pending(current))
++			return -EINTR;
++
++		if (nread < 0) {
++			LDBG(curlun, "error in file verify: %d\n",
++					(int) nread);
++			nread = 0;
++		} else if (nread < amount) {
++			LDBG(curlun, "partial file verify: %d/%u\n",
++					(int) nread, amount);
++			nread -= (nread & 511);	/* Round down to a sector */
++		}
++		if (nread == 0) {
++			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
++			curlun->sense_data_info = file_offset >> 9;
++			curlun->info_valid = 1;
++			break;
++		}
++		file_offset += nread;
++		amount_left -= nread;
++	}
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	u8	*buf = (u8 *) bh->buf;
++
++	if (!fsg->curlun) {		/* Unsupported LUNs are okay */
++		fsg->bad_lun_okay = 1;
++		memset(buf, 0, 36);
++		buf[0] = 0x7f;		/* Unsupported, no device-type */
++		return 36;
++	}
++
++	memset(buf, 0, 8);	/* Non-removable, direct-access device */
++
++	buf[1] = 0x80;	/* set removable bit */
++	buf[2] = 2;		/* ANSI SCSI level 2 */
++	buf[3] = 2;		/* SCSI-2 INQUIRY data format */
++	buf[4] = 31;		/* Additional length */
++				/* No special options */
++	sprintf(buf + 8, "%-8s%-16s%04x", fsg->vendor,
++			fsg->product, fsg->release);
++	return 36;
++}
++
++
++static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct lun	*curlun = fsg->curlun;
++	u8		*buf = (u8 *) bh->buf;
++	u32		sd, sdinfo;
++	int		valid;
++
++	/*
++	 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
++	 *
++	 * If a REQUEST SENSE command is received from an initiator
++	 * with a pending unit attention condition (before the target
++	 * generates the contingent allegiance condition), then the
++	 * target shall either:
++	 *   a) report any pending sense data and preserve the unit
++	 *	attention condition on the logical unit, or,
++	 *   b) report the unit attention condition, may discard any
++	 *	pending sense data, and clear the unit attention
++	 *	condition on the logical unit for that initiator.
++	 *
++	 * FSG normally uses option a); enable this code to use option b).
++	 */
++#if 0
++	if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
++		curlun->sense_data = curlun->unit_attention_data;
++		curlun->unit_attention_data = SS_NO_SENSE;
++	}
++#endif
++
++	if (!curlun) {		/* Unsupported LUNs are okay */
++		fsg->bad_lun_okay = 1;
++		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
++		sdinfo = 0;
++		valid = 0;
++	} else {
++		sd = curlun->sense_data;
++		sdinfo = curlun->sense_data_info;
++		valid = curlun->info_valid << 7;
++		curlun->sense_data = SS_NO_SENSE;
++		curlun->sense_data_info = 0;
++		curlun->info_valid = 0;
++	}
++
++	memset(buf, 0, 18);
++	buf[0] = valid | 0x70;			/* Valid, current error */
++	buf[2] = SK(sd);
++	put_be32(&buf[3], sdinfo);		/* Sense information */
++	buf[7] = 18 - 8;			/* Additional sense length */
++	buf[12] = ASC(sd);
++	buf[13] = ASCQ(sd);
++	return 18;
++}
++
++
++static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct lun	*curlun = fsg->curlun;
++	u32		lba = get_be32(&fsg->cmnd[2]);
++	int		pmi = fsg->cmnd[8];
++	u8		*buf = (u8 *) bh->buf;
++
++	/* Check the PMI and LBA fields */
++	if (pmi > 1 || (pmi == 0 && lba != 0)) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	put_be32(&buf[0], curlun->num_sectors - 1);	/* Max logical block */
++	put_be32(&buf[4], 512);				/* Block length */
++	return 8;
++}
++
++
++static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct lun	*curlun = fsg->curlun;
++	int		mscmnd = fsg->cmnd[0];
++	u8		*buf = (u8 *) bh->buf;
++	u8		*buf0 = buf;
++	int		pc, page_code;
++	int		changeable_values, all_pages;
++	int		valid_page = 0;
++	int		len, limit;
++
++	if ((fsg->cmnd[1] & ~0x08) != 0) {		/* Mask away DBD */
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++	pc = fsg->cmnd[2] >> 6;
++	page_code = fsg->cmnd[2] & 0x3f;
++	if (pc == 3) {
++		curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
++		return -EINVAL;
++	}
++	changeable_values = (pc == 1);
++	all_pages = (page_code == 0x3f);
++
++	/* Write the mode parameter header.  Fixed values are: default
++	 * medium type, no cache control (DPOFUA), and no block descriptors.
++	 * The only variable value is the WriteProtect bit.  We will fill in
++	 * the mode data length later. */
++	memset(buf, 0, 8);
++	if (mscmnd == SC_MODE_SENSE_6) {
++		buf[2] = (curlun->ro ? 0x80 : 0x00);		/* WP, DPOFUA */
++		buf += 4;
++		limit = 255;
++	} else {			/* SC_MODE_SENSE_10 */
++		buf[3] = (curlun->ro ? 0x80 : 0x00);		/* WP, DPOFUA */
++		buf += 8;
++		limit = 65535;
++	}
++
++	/* No block descriptors */
++
++	/* Disabled to workaround USB reset problems with a Vista host.
++	 */
++#if 0
++	/* The mode pages, in numerical order.  The only page we support
++	 * is the Caching page. */
++	if (page_code == 0x08 || all_pages) {
++		valid_page = 1;
++		buf[0] = 0x08;		/* Page code */
++		buf[1] = 10;		/* Page length */
++		memset(buf+2, 0, 10);	/* None of the fields are changeable */
++
++		if (!changeable_values) {
++			buf[2] = 0x04;	/* Write cache enable, */
++					/* Read cache not disabled */
++					/* No cache retention priorities */
++			put_be16(&buf[4], 0xffff);  /* Don't disable prefetch */
++					/* Minimum prefetch = 0 */
++			put_be16(&buf[8], 0xffff);  /* Maximum prefetch */
++			/* Maximum prefetch ceiling */
++			put_be16(&buf[10], 0xffff);
++		}
++		buf += 12;
++	}
++#else
++	valid_page = 1;
++#endif
++
++	/* Check that a valid page was requested and the mode data length
++	 * isn't too long. */
++	len = buf - buf0;
++	if (!valid_page || len > limit) {
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	/*  Store the mode data length */
++	if (mscmnd == SC_MODE_SENSE_6)
++		buf0[0] = len - 1;
++	else
++		put_be16(buf0, len - 2);
++	return len;
++}
++
++static int do_start_stop(struct fsg_dev *fsg)
++{
++	struct lun	*curlun = fsg->curlun;
++	int		loej, start;
++
++	/* int immed = fsg->cmnd[1] & 0x01; */
++	loej = fsg->cmnd[4] & 0x02;
++	start = fsg->cmnd[4] & 0x01;
++
++	if (loej) {
++		/* eject request from the host */
++		if (backing_file_is_open(curlun)) {
++			close_backing_file(fsg, curlun);
++			curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
++		}
++	}
++
++	return 0;
++}
++
++static int do_prevent_allow(struct fsg_dev *fsg)
++{
++	struct lun	*curlun = fsg->curlun;
++	int		prevent;
++
++	prevent = fsg->cmnd[4] & 0x01;
++	if ((fsg->cmnd[4] & ~0x01) != 0) {		/* Mask away Prevent */
++		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++		return -EINVAL;
++	}
++
++	if (curlun->prevent_medium_removal && !prevent)
++		fsync_sub(curlun);
++	curlun->prevent_medium_removal = prevent;
++	return 0;
++}
++
++
++static int do_read_format_capacities(struct fsg_dev *fsg,
++			struct fsg_buffhd *bh)
++{
++	struct lun	*curlun = fsg->curlun;
++	u8		*buf = (u8 *) bh->buf;
++
++	buf[0] = buf[1] = buf[2] = 0;
++	buf[3] = 8;	/* Only the Current/Maximum Capacity Descriptor */
++	buf += 4;
++
++	put_be32(&buf[0], curlun->num_sectors);	/* Number of blocks */
++	put_be32(&buf[4], 512);				/* Block length */
++	buf[4] = 0x02;					/* Current capacity */
++	return 12;
++}
++
++
++static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct lun	*curlun = fsg->curlun;
++
++	/* We don't support MODE SELECT */
++	curlun->sense_data = SS_INVALID_COMMAND;
++	return -EINVAL;
++}
++
++
++/*-------------------------------------------------------------------------*/
++#if 0
++static int write_zero(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	int			rc;
++
++	DBG(fsg, "write_zero\n");
++	/* Wait for the next buffer to become available */
++	bh = fsg->next_buffhd_to_fill;
++	while (bh->state != BUF_STATE_EMPTY) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++
++	bh->inreq->length = 0;
++	start_transfer(fsg, fsg->bulk_in, bh->inreq,
++			&bh->inreq_busy, &bh->state);
++
++	fsg->next_buffhd_to_fill = bh->next;
++	return 0;
++}
++#endif
++
++static int throw_away_data(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	u32			amount;
++	int			rc;
++
++	DBG(fsg, "throw_away_data\n");
++	while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
++			fsg->usb_amount_left > 0) {
++
++		/* Throw away the data in a filled buffer */
++		if (bh->state == BUF_STATE_FULL) {
++			smp_rmb();
++			bh->state = BUF_STATE_EMPTY;
++			fsg->next_buffhd_to_drain = bh->next;
++
++			/* A short packet or an error ends everything */
++			if (bh->outreq->actual != bh->outreq->length ||
++					bh->outreq->status != 0) {
++				raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++				return -EINTR;
++			}
++			continue;
++		}
++
++		/* Try to submit another request if we need one */
++		bh = fsg->next_buffhd_to_fill;
++		if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
++			amount = min(fsg->usb_amount_left, (u32) fsg->buf_size);
++
++			/* amount is always divisible by 512, hence by
++			 * the bulk-out maxpacket size */
++			bh->outreq->length = bh->bulk_out_intended_length =
++					amount;
++			start_transfer(fsg, fsg->bulk_out, bh->outreq,
++					&bh->outreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++			fsg->usb_amount_left -= amount;
++			continue;
++		}
++
++		/* Otherwise wait for something to happen */
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++	return 0;
++}
++
++
++static int finish_reply(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
++	int			rc = 0;
++
++	switch (fsg->data_dir) {
++	case DATA_DIR_NONE:
++		break;			/* Nothing to send */
++
++	case DATA_DIR_UNKNOWN:
++		rc = -EINVAL;
++		break;
++
++	/* All but the last buffer of data must have already been sent */
++	case DATA_DIR_TO_HOST:
++		if (fsg->data_size == 0)
++			;		/* Nothing to send */
++
++		/* If there's no residue, simply send the last buffer */
++		else if (fsg->residue == 0) {
++			start_transfer(fsg, fsg->bulk_in, bh->inreq,
++					&bh->inreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++		} else {
++			start_transfer(fsg, fsg->bulk_in, bh->inreq,
++					&bh->inreq_busy, &bh->state);
++			fsg->next_buffhd_to_fill = bh->next;
++#if 0
++			/* this is unnecessary, and was causing problems with MacOS */
++			if (bh->inreq->length > 0)
++				write_zero(fsg);
++#endif
++		}
++		break;
++
++	/* We have processed all we want from the data the host has sent.
++	 * There may still be outstanding bulk-out requests. */
++	case DATA_DIR_FROM_HOST:
++		if (fsg->residue == 0)
++			;		/* Nothing to receive */
++
++		/* Did the host stop sending unexpectedly early? */
++		else if (fsg->short_packet_received) {
++			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++			rc = -EINTR;
++		}
++
++		/* We haven't processed all the incoming data.  Even though
++		 * we may be allowed to stall, doing so would cause a race.
++		 * The controller may already have ACK'ed all the remaining
++		 * bulk-out packets, in which case the host wouldn't see a
++		 * STALL.  Not realizing the endpoint was halted, it wouldn't
++		 * clear the halt -- leading to problems later on. */
++#if 0
++		fsg_set_halt(fsg, fsg->bulk_out);
++		raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
++		rc = -EINTR;
++#endif
++
++		/* We can't stall.  Read in the excess data and throw it
++		 * all away. */
++		else
++			rc = throw_away_data(fsg);
++		break;
++	}
++	return rc;
++}
++
++
++static int send_status(struct fsg_dev *fsg)
++{
++	struct lun		*curlun = fsg->curlun;
++	struct fsg_buffhd	*bh;
++	int			rc;
++	u8			status = USB_STATUS_PASS;
++	u32			sd, sdinfo = 0;
++	struct bulk_cs_wrap	*csw;
++
++	DBG(fsg, "send_status\n");
++	/* Wait for the next buffer to become available */
++	bh = fsg->next_buffhd_to_fill;
++	while (bh->state != BUF_STATE_EMPTY) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++
++	if (curlun) {
++		sd = curlun->sense_data;
++		sdinfo = curlun->sense_data_info;
++	} else if (fsg->bad_lun_okay)
++		sd = SS_NO_SENSE;
++	else
++		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
++
++	if (fsg->phase_error) {
++		DBG(fsg, "sending phase-error status\n");
++		status = USB_STATUS_PHASE_ERROR;
++		sd = SS_INVALID_COMMAND;
++	} else if (sd != SS_NO_SENSE) {
++		DBG(fsg, "sending command-failure status\n");
++		status = USB_STATUS_FAIL;
++		VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
++				"  info x%x\n",
++				SK(sd), ASC(sd), ASCQ(sd), sdinfo);
++	}
++
++	csw = bh->buf;
++
++	/* Store and send the Bulk-only CSW */
++	csw->Signature = __constant_cpu_to_le32(USB_BULK_CS_SIG);
++	csw->Tag = fsg->tag;
++	csw->Residue = cpu_to_le32(fsg->residue);
++	csw->Status = status;
++
++	bh->inreq->length = USB_BULK_CS_WRAP_LEN;
++	start_transfer(fsg, fsg->bulk_in, bh->inreq,
++			&bh->inreq_busy, &bh->state);
++
++	fsg->next_buffhd_to_fill = bh->next;
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* Check whether the command is properly formed and whether its data size
++ * and direction agree with the values we already have. */
++static int check_command(struct fsg_dev *fsg, int cmnd_size,
++		enum data_direction data_dir, unsigned int mask,
++		int needs_medium, const char *name)
++{
++	int			i;
++	int			lun = fsg->cmnd[1] >> 5;
++	static const char	dirletter[4] = {'u', 'o', 'i', 'n'};
++	char			hdlen[20];
++	struct lun		*curlun;
++
++	hdlen[0] = 0;
++	if (fsg->data_dir != DATA_DIR_UNKNOWN)
++		sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
++				fsg->data_size);
++	VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
++			name, cmnd_size, dirletter[(int) data_dir],
++			fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
++
++	/* We can't reply at all until we know the correct data direction
++	 * and size. */
++	if (fsg->data_size_from_cmnd == 0)
++		data_dir = DATA_DIR_NONE;
++	if (fsg->data_dir == DATA_DIR_UNKNOWN) {	/* CB or CBI */
++		fsg->data_dir = data_dir;
++		fsg->data_size = fsg->data_size_from_cmnd;
++
++	} else {					/* Bulk-only */
++		if (fsg->data_size < fsg->data_size_from_cmnd) {
++
++			/* Host data size < Device data size is a phase error.
++			 * Carry out the command, but only transfer as much
++			 * as we are allowed. */
++			DBG(fsg, "phase error 1\n");
++			fsg->data_size_from_cmnd = fsg->data_size;
++			fsg->phase_error = 1;
++		}
++	}
++	fsg->residue = fsg->usb_amount_left = fsg->data_size;
++
++	/* Conflicting data directions is a phase error */
++	if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
++		fsg->phase_error = 1;
++		DBG(fsg, "phase error 2\n");
++		return -EINVAL;
++	}
++
++	/* Verify the length of the command itself */
++	if (cmnd_size != fsg->cmnd_size) {
++
++		/* Special case workaround: MS-Windows issues REQUEST SENSE
++		 * with cbw->Length == 12 (it should be 6). */
++		if (fsg->cmnd[0] == SC_REQUEST_SENSE && fsg->cmnd_size == 12)
++			cmnd_size = fsg->cmnd_size;
++		else {
++			fsg->phase_error = 1;
++			return -EINVAL;
++		}
++	}
++
++	/* Check that the LUN values are consistent */
++	if (fsg->lun != lun)
++		DBG(fsg, "using LUN %d from CBW, "
++				"not LUN %d from CDB\n",
++				fsg->lun, lun);
++
++	/* Check the LUN */
++	if (fsg->lun >= 0 && fsg->lun < fsg->nluns) {
++		fsg->curlun = curlun = &fsg->luns[fsg->lun];
++		if (fsg->cmnd[0] != SC_REQUEST_SENSE) {
++			curlun->sense_data = SS_NO_SENSE;
++			curlun->sense_data_info = 0;
++			curlun->info_valid = 0;
++		}
++	} else {
++		fsg->curlun = curlun = NULL;
++		fsg->bad_lun_okay = 0;
++
++		/* INQUIRY and REQUEST SENSE commands are explicitly allowed
++		 * to use unsupported LUNs; all others may not. */
++		if (fsg->cmnd[0] != SC_INQUIRY &&
++				fsg->cmnd[0] != SC_REQUEST_SENSE) {
++			DBG(fsg, "unsupported LUN %d\n", fsg->lun);
++			return -EINVAL;
++		}
++	}
++
++	/* If a unit attention condition exists, only INQUIRY and
++	 * REQUEST SENSE commands are allowed; anything else must fail. */
++	if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
++			fsg->cmnd[0] != SC_INQUIRY &&
++			fsg->cmnd[0] != SC_REQUEST_SENSE) {
++		curlun->sense_data = curlun->unit_attention_data;
++		curlun->unit_attention_data = SS_NO_SENSE;
++		return -EINVAL;
++	}
++
++	/* Check that only command bytes listed in the mask are non-zero */
++	fsg->cmnd[1] &= 0x1f;			/* Mask away the LUN */
++	for (i = 1; i < cmnd_size; ++i) {
++		if (fsg->cmnd[i] && !(mask & (1 << i))) {
++			if (curlun)
++				curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
++			DBG(fsg, "SS_INVALID_FIELD_IN_CDB\n");
++			return -EINVAL;
++		}
++	}
++
++	/* If the medium isn't mounted and the command needs to access
++	 * it, return an error. */
++	if (curlun && !backing_file_is_open(curlun) && needs_medium) {
++		curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
++		DBG(fsg, "SS_MEDIUM_NOT_PRESENT\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++
++static int do_scsi_command(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	int			rc;
++	int			reply = -EINVAL;
++	int			i;
++	static char		unknown[16];
++
++	dump_cdb(fsg);
++
++	/* Wait for the next buffer to become available for data or status */
++	bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
++	while (bh->state != BUF_STATE_EMPTY) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++	fsg->phase_error = 0;
++	fsg->short_packet_received = 0;
++
++	down_read(&fsg->filesem);	/* We're using the backing file */
++	switch (fsg->cmnd[0]) {
++
++	case SC_INQUIRY:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<4), 0,
++				"INQUIRY")) == 0)
++			reply = do_inquiry(fsg, bh);
++		break;
++
++	case SC_MODE_SELECT_6:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
++				(1<<1) | (1<<4), 0,
++				"MODE SELECT(6)")) == 0)
++			reply = do_mode_select(fsg, bh);
++		break;
++
++	case SC_MODE_SELECT_10:
++		fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
++				(1<<1) | (3<<7), 0,
++				"MODE SELECT(10)")) == 0)
++			reply = do_mode_select(fsg, bh);
++		break;
++
++	case SC_MODE_SENSE_6:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<1) | (1<<2) | (1<<4), 0,
++				"MODE SENSE(6)")) == 0)
++			reply = do_mode_sense(fsg, bh);
++		break;
++
++	case SC_MODE_SENSE_10:
++		fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(1<<1) | (1<<2) | (3<<7), 0,
++				"MODE SENSE(10)")) == 0)
++			reply = do_mode_sense(fsg, bh);
++		break;
++
++	case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
++				(1<<4), 0,
++				"PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
++			reply = do_prevent_allow(fsg);
++		break;
++
++	case SC_READ_6:
++		i = fsg->cmnd[4];
++		fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(7<<1) | (1<<4), 1,
++				"READ(6)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case SC_READ_10:
++		fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"READ(10)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case SC_READ_12:
++		fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
++		if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
++				(1<<1) | (0xf<<2) | (0xf<<6), 1,
++				"READ(12)")) == 0)
++			reply = do_read(fsg);
++		break;
++
++	case SC_READ_CAPACITY:
++		fsg->data_size_from_cmnd = 8;
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(0xf<<2) | (1<<8), 1,
++				"READ CAPACITY")) == 0)
++			reply = do_read_capacity(fsg, bh);
++		break;
++
++	case SC_READ_FORMAT_CAPACITIES:
++		fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]);
++		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
++				(3<<7), 1,
++				"READ FORMAT CAPACITIES")) == 0)
++			reply = do_read_format_capacities(fsg, bh);
++		break;
++
++	case SC_REQUEST_SENSE:
++		fsg->data_size_from_cmnd = fsg->cmnd[4];
++		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
++				(1<<4), 0,
++				"REQUEST SENSE")) == 0)
++			reply = do_request_sense(fsg, bh);
++		break;
++
++	case SC_START_STOP_UNIT:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
++				(1<<1) | (1<<4), 0,
++				"START-STOP UNIT")) == 0)
++			reply = do_start_stop(fsg);
++		break;
++
++	case SC_SYNCHRONIZE_CACHE:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
++				(0xf<<2) | (3<<7), 1,
++				"SYNCHRONIZE CACHE")) == 0)
++			reply = do_synchronize_cache(fsg);
++		break;
++
++	case SC_TEST_UNIT_READY:
++		fsg->data_size_from_cmnd = 0;
++		reply = check_command(fsg, 6, DATA_DIR_NONE,
++				0, 1,
++				"TEST UNIT READY");
++		break;
++
++	/* Although optional, this command is used by MS-Windows.  We
++	 * support a minimal version: BytChk must be 0. */
++	case SC_VERIFY:
++		fsg->data_size_from_cmnd = 0;
++		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"VERIFY")) == 0)
++			reply = do_verify(fsg);
++		break;
++
++	case SC_WRITE_6:
++		i = fsg->cmnd[4];
++		fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
++		if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
++				(7<<1) | (1<<4), 1,
++				"WRITE(6)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	case SC_WRITE_10:
++		fsg->data_size_from_cmnd = get_be16(&fsg->cmnd[7]) << 9;
++		if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
++				(1<<1) | (0xf<<2) | (3<<7), 1,
++				"WRITE(10)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	case SC_WRITE_12:
++		fsg->data_size_from_cmnd = get_be32(&fsg->cmnd[6]) << 9;
++		if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
++				(1<<1) | (0xf<<2) | (0xf<<6), 1,
++				"WRITE(12)")) == 0)
++			reply = do_write(fsg);
++		break;
++
++	/* Some mandatory commands that we recognize but don't implement.
++	 * They don't mean much in this setting.  It's left as an exercise
++	 * for anyone interested to implement RESERVE and RELEASE in terms
++	 * of Posix locks. */
++	case SC_FORMAT_UNIT:
++	case SC_RELEASE:
++	case SC_RESERVE:
++	case SC_SEND_DIAGNOSTIC:
++		/* Fall through */
++
++	default:
++		fsg->data_size_from_cmnd = 0;
++		sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
++		if ((reply = check_command(fsg, fsg->cmnd_size,
++				DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
++			fsg->curlun->sense_data = SS_INVALID_COMMAND;
++			reply = -EINVAL;
++		}
++		break;
++	}
++	up_read(&fsg->filesem);
++
++	VDBG(fsg, "reply: %d, fsg->data_size_from_cmnd: %d\n",
++			reply, fsg->data_size_from_cmnd);
++	if (reply == -EINTR || signal_pending(current))
++		return -EINTR;
++
++	/* Set up the single reply buffer for finish_reply() */
++	if (reply == -EINVAL)
++		reply = 0;		/* Error reply length */
++	if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
++		reply = min((u32) reply, fsg->data_size_from_cmnd);
++		bh->inreq->length = reply;
++		bh->state = BUF_STATE_FULL;
++		fsg->residue -= reply;
++	}				/* Otherwise it's already set */
++
++	return 0;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
++{
++	struct usb_request	*req = bh->outreq;
++	struct bulk_cb_wrap	*cbw = req->buf;
++
++	/* Was this a real packet? */
++	if (req->status)
++		return -EINVAL;
++
++	/* Is the CBW valid? */
++	if (req->actual != USB_BULK_CB_WRAP_LEN ||
++			cbw->Signature != __constant_cpu_to_le32(
++				USB_BULK_CB_SIG)) {
++		DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
++				req->actual,
++				le32_to_cpu(cbw->Signature));
++		return -EINVAL;
++	}
++
++	/* Is the CBW meaningful? */
++	if (cbw->Lun >= MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
++			cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
++		DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
++				"cmdlen %u\n",
++				cbw->Lun, cbw->Flags, cbw->Length);
++		return -EINVAL;
++	}
++
++	/* Save the command for later */
++	fsg->cmnd_size = cbw->Length;
++	memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
++	if (cbw->Flags & USB_BULK_IN_FLAG)
++		fsg->data_dir = DATA_DIR_TO_HOST;
++	else
++		fsg->data_dir = DATA_DIR_FROM_HOST;
++	fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
++	if (fsg->data_size == 0)
++		fsg->data_dir = DATA_DIR_NONE;
++	fsg->lun = cbw->Lun;
++	fsg->tag = cbw->Tag;
++	return 0;
++}
++
++
++static int get_next_command(struct fsg_dev *fsg)
++{
++	struct fsg_buffhd	*bh;
++	int			rc = 0;
++
++	/* Wait for the next buffer to become available */
++	bh = fsg->next_buffhd_to_fill;
++	while (bh->state != BUF_STATE_EMPTY) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++
++	/* Queue a request to read a Bulk-only CBW */
++	set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
++	start_transfer(fsg, fsg->bulk_out, bh->outreq,
++			&bh->outreq_busy, &bh->state);
++
++	/* We will drain the buffer in software, which means we
++	 * can reuse it for the next filling.  No need to advance
++	 * next_buffhd_to_fill. */
++
++	/* Wait for the CBW to arrive */
++	while (bh->state != BUF_STATE_FULL) {
++		rc = sleep_thread(fsg);
++		if (rc)
++			return rc;
++	}
++	smp_rmb();
++	rc = received_cbw(fsg, bh);
++	bh->state = BUF_STATE_EMPTY;
++
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
++		const struct usb_endpoint_descriptor *d)
++{
++	int	rc;
++
++	DBG(fsg, "usb_ep_enable %s\n", ep->name);
++	ep->driver_data = fsg;
++	rc = usb_ep_enable(ep, d);
++	if (rc)
++		ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
++	return rc;
++}
++
++static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
++		struct usb_request **preq)
++{
++	*preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
++	if (*preq)
++		return 0;
++	ERROR(fsg, "can't allocate request for %s\n", ep->name);
++	return -ENOMEM;
++}
++
++/*
++ * Reset interface setting and re-init endpoint state (toggle etc).
++ * Call with altsetting < 0 to disable the interface.  The only other
++ * available altsetting is 0, which enables the interface.
++ */
++static int do_set_interface(struct fsg_dev *fsg, int altsetting)
++{
++	struct usb_composite_dev *cdev = fsg->cdev;
++	int	rc = 0;
++	int	i;
++	const struct usb_endpoint_descriptor	*d;
++
++	if (fsg->running)
++		DBG(fsg, "reset interface\n");
++
++reset:
++	/* Deallocate the requests */
++	for (i = 0; i < NUM_BUFFERS; ++i) {
++		struct fsg_buffhd *bh = &fsg->buffhds[i];
++
++		if (bh->inreq) {
++			usb_ep_free_request(fsg->bulk_in, bh->inreq);
++			bh->inreq = NULL;
++		}
++		if (bh->outreq) {
++			usb_ep_free_request(fsg->bulk_out, bh->outreq);
++			bh->outreq = NULL;
++		}
++	}
++
++	/* Disable the endpoints */
++	if (fsg->bulk_in_enabled) {
++		DBG(fsg, "usb_ep_disable %s\n", fsg->bulk_in->name);
++		usb_ep_disable(fsg->bulk_in);
++		fsg->bulk_in_enabled = 0;
++	}
++	if (fsg->bulk_out_enabled) {
++		DBG(fsg, "usb_ep_disable %s\n", fsg->bulk_out->name);
++		usb_ep_disable(fsg->bulk_out);
++		fsg->bulk_out_enabled = 0;
++	}
++
++	fsg->running = 0;
++	if (altsetting < 0 || rc != 0)
++		return rc;
++
++	DBG(fsg, "set interface %d\n", altsetting);
++
++	/* Enable the endpoints */
++	d = ep_desc(cdev->gadget, &fs_bulk_in_desc, &hs_bulk_in_desc);
++	if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
++		goto reset;
++	fsg->bulk_in_enabled = 1;
++
++	d = ep_desc(cdev->gadget, &fs_bulk_out_desc, &hs_bulk_out_desc);
++	if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
++		goto reset;
++	fsg->bulk_out_enabled = 1;
++	fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
++
++	/* Allocate the requests */
++	for (i = 0; i < NUM_BUFFERS; ++i) {
++		struct fsg_buffhd	*bh = &fsg->buffhds[i];
++
++		rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq);
++		if (rc != 0)
++			goto reset;
++		rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq);
++		if (rc != 0)
++			goto reset;
++		bh->inreq->buf = bh->outreq->buf = bh->buf;
++		bh->inreq->context = bh->outreq->context = bh;
++		bh->inreq->complete = bulk_in_complete;
++		bh->outreq->complete = bulk_out_complete;
++	}
++
++	fsg->running = 1;
++	for (i = 0; i < fsg->nluns; ++i)
++		fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
++
++	return rc;
++}
++
++static void adjust_wake_lock(struct fsg_dev *fsg)
++{
++	int ums_active = 0;
++	int i;
++
++	spin_lock_irq(&fsg->lock);
++
++	if (fsg->config) {
++		for (i = 0; i < fsg->nluns; ++i) {
++			if (backing_file_is_open(&fsg->luns[i]))
++				ums_active = 1;
++		}
++	}
++
++	if (ums_active)
++		wake_lock(&fsg->wake_lock);
++	else
++		wake_unlock(&fsg->wake_lock);
++
++	spin_unlock_irq(&fsg->lock);
++}
++
++/*
++ * Change our operational configuration.  This code must agree with the code
++ * that returns config descriptors, and with interface altsetting code.
++ *
++ * It's also responsible for power management interactions.  Some
++ * configurations might not work with our current power sources.
++ * For now we just assume the gadget is always self-powered.
++ */
++static int do_set_config(struct fsg_dev *fsg, u8 new_config)
++{
++	int	rc = 0;
++
++	if (new_config == fsg->config)
++		return rc;
++
++	/* Disable the single interface */
++	if (fsg->config != 0) {
++		DBG(fsg, "reset config\n");
++		fsg->config = 0;
++		rc = do_set_interface(fsg, -1);
++	}
++
++	/* Enable the interface */
++	if (new_config != 0) {
++		fsg->config = new_config;
++		rc = do_set_interface(fsg, 0);
++		if (rc != 0)
++			fsg->config = 0;	/* Reset on errors */
++		else
++			INFO(fsg, "config #%d\n", fsg->config);
++	}
++
++	switch_set_state(&fsg->sdev, new_config);
++	adjust_wake_lock(fsg);
++	return rc;
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static void handle_exception(struct fsg_dev *fsg)
++{
++	siginfo_t		info;
++	int			sig;
++	int			i;
++	struct fsg_buffhd	*bh;
++	enum fsg_state		old_state;
++	u8			new_config;
++	struct lun		*curlun;
++	int			rc;
++
++	DBG(fsg, "handle_exception state: %d\n", (int)fsg->state);
++	/* Clear the existing signals.  Anything but SIGUSR1 is converted
++	 * into a high-priority EXIT exception. */
++	for (;;) {
++		sig = dequeue_signal_lock(current, &current->blocked, &info);
++		if (!sig)
++			break;
++		if (sig != SIGUSR1) {
++			if (fsg->state < FSG_STATE_EXIT)
++				DBG(fsg, "Main thread exiting on signal\n");
++			raise_exception(fsg, FSG_STATE_EXIT);
++		}
++	}
++
++	/* Clear out the controller's fifos */
++	if (fsg->bulk_in_enabled)
++		usb_ep_fifo_flush(fsg->bulk_in);
++	if (fsg->bulk_out_enabled)
++		usb_ep_fifo_flush(fsg->bulk_out);
++
++	/* Reset the I/O buffer states and pointers, the SCSI
++	 * state, and the exception.  Then invoke the handler. */
++	spin_lock_irq(&fsg->lock);
++
++	for (i = 0; i < NUM_BUFFERS; ++i) {
++		bh = &fsg->buffhds[i];
++		bh->state = BUF_STATE_EMPTY;
++	}
++	fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
++			&fsg->buffhds[0];
++
++	new_config = fsg->new_config;
++	old_state = fsg->state;
++
++	if (old_state == FSG_STATE_ABORT_BULK_OUT)
++		fsg->state = FSG_STATE_STATUS_PHASE;
++	else {
++		for (i = 0; i < fsg->nluns; ++i) {
++			curlun = &fsg->luns[i];
++			curlun->prevent_medium_removal = 0;
++			curlun->sense_data = curlun->unit_attention_data =
++					SS_NO_SENSE;
++			curlun->sense_data_info = 0;
++			curlun->info_valid = 0;
++		}
++		fsg->state = FSG_STATE_IDLE;
++	}
++	spin_unlock_irq(&fsg->lock);
++
++	/* Carry out any extra actions required for the exception */
++	switch (old_state) {
++	default:
++		break;
++
++	case FSG_STATE_ABORT_BULK_OUT:
++		DBG(fsg, "FSG_STATE_ABORT_BULK_OUT\n");
++		spin_lock_irq(&fsg->lock);
++		if (fsg->state == FSG_STATE_STATUS_PHASE)
++			fsg->state = FSG_STATE_IDLE;
++		spin_unlock_irq(&fsg->lock);
++		break;
++
++	case FSG_STATE_RESET:
++		/* really not much to do here */
++		break;
++
++	case FSG_STATE_CONFIG_CHANGE:
++		rc = do_set_config(fsg, new_config);
++		if (new_config == 0) {
++			/* We're using the backing file */
++			down_read(&fsg->filesem);
++			fsync_all(fsg);
++			up_read(&fsg->filesem);
++		}
++		break;
++
++	case FSG_STATE_EXIT:
++	case FSG_STATE_TERMINATED:
++		do_set_config(fsg, 0);			/* Free resources */
++		spin_lock_irq(&fsg->lock);
++		fsg->state = FSG_STATE_TERMINATED;	/* Stop the thread */
++		spin_unlock_irq(&fsg->lock);
++		break;
++	}
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int fsg_main_thread(void *fsg_)
++{
++	struct fsg_dev		*fsg = fsg_;
++
++	/* Allow the thread to be killed by a signal, but set the signal mask
++	 * to block everything but INT, TERM, KILL, and USR1. */
++	allow_signal(SIGINT);
++	allow_signal(SIGTERM);
++	allow_signal(SIGKILL);
++	allow_signal(SIGUSR1);
++
++	/* Allow the thread to be frozen */
++	set_freezable();
++
++	/* Arrange for userspace references to be interpreted as kernel
++	 * pointers.  That way we can pass a kernel pointer to a routine
++	 * that expects a __user pointer and it will work okay. */
++	set_fs(get_ds());
++
++	/* The main loop */
++	while (fsg->state != FSG_STATE_TERMINATED) {
++		if (exception_in_progress(fsg) || signal_pending(current)) {
++			handle_exception(fsg);
++			continue;
++		}
++
++		if (!fsg->running) {
++			sleep_thread(fsg);
++			continue;
++		}
++
++		if (get_next_command(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_DATA_PHASE;
++		spin_unlock_irq(&fsg->lock);
++
++		if (do_scsi_command(fsg) || finish_reply(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_STATUS_PHASE;
++		spin_unlock_irq(&fsg->lock);
++
++		if (send_status(fsg))
++			continue;
++
++		spin_lock_irq(&fsg->lock);
++		if (!exception_in_progress(fsg))
++			fsg->state = FSG_STATE_IDLE;
++		spin_unlock_irq(&fsg->lock);
++		}
++
++	spin_lock_irq(&fsg->lock);
++	fsg->thread_task = NULL;
++	spin_unlock_irq(&fsg->lock);
++
++	/* In case we are exiting because of a signal, unregister the
++	 * gadget driver and close the backing file. */
++	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
++		close_all_backing_files(fsg);
++
++	/* Let the unbind and cleanup routines know the thread has exited */
++	complete_and_exit(&fsg->thread_notifier, 0);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++/* If the next two routines are called while the gadget is registered,
++ * the caller must own fsg->filesem for writing. */
++
++static int open_backing_file(struct fsg_dev *fsg, struct lun *curlun,
++	const char *filename)
++{
++	int				ro;
++	struct file			*filp = NULL;
++	int				rc = -EINVAL;
++	struct inode			*inode = NULL;
++	loff_t				size;
++	loff_t				num_sectors;
++
++	/* R/W if we can, R/O if we must */
++	ro = curlun->ro;
++	if (!ro) {
++		filp = filp_open(filename, O_RDWR | O_LARGEFILE, 0);
++		if (-EROFS == PTR_ERR(filp))
++			ro = 1;
++	}
++	if (ro)
++		filp = filp_open(filename, O_RDONLY | O_LARGEFILE, 0);
++	if (IS_ERR(filp)) {
++		LINFO(curlun, "unable to open backing file: %s\n", filename);
++		return PTR_ERR(filp);
++	}
++
++	if (!(filp->f_mode & FMODE_WRITE))
++		ro = 1;
++
++	if (filp->f_path.dentry)
++		inode = filp->f_path.dentry->d_inode;
++	if (inode && S_ISBLK(inode->i_mode)) {
++		if (bdev_read_only(inode->i_bdev))
++			ro = 1;
++	} else if (!inode || !S_ISREG(inode->i_mode)) {
++		LINFO(curlun, "invalid file type: %s\n", filename);
++		goto out;
++	}
++
++	/* If we can't read the file, it's no good.
++	 * If we can't write the file, use it read-only. */
++	if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
++		LINFO(curlun, "file not readable: %s\n", filename);
++		goto out;
++	}
++	if (!(filp->f_op->write || filp->f_op->aio_write))
++		ro = 1;
++
++	size = i_size_read(inode->i_mapping->host);
++	if (size < 0) {
++		LINFO(curlun, "unable to find file size: %s\n", filename);
++		rc = (int) size;
++		goto out;
++	}
++	num_sectors = size >> 9;	/* File size in 512-byte sectors */
++	if (num_sectors == 0) {
++		LINFO(curlun, "file too small: %s\n", filename);
++		rc = -ETOOSMALL;
++		goto out;
++	}
++
++	get_file(filp);
++	curlun->ro = ro;
++	curlun->filp = filp;
++	curlun->file_length = size;
++	curlun->num_sectors = num_sectors;
++	LDBG(curlun, "open backing file: %s size: %lld num_sectors: %lld\n",
++			filename, size, num_sectors);
++	rc = 0;
++	adjust_wake_lock(fsg);
++
++out:
++	filp_close(filp, current->files);
++	return rc;
++}
++
++
++static void close_backing_file(struct fsg_dev *fsg, struct lun *curlun)
++{
++	if (curlun->filp) {
++		int rc;
++
++		/*
++		 * XXX: San: Ugly hack here added to ensure that
++		 * our pages get synced to disk.
++		 * Also drop caches here just to be extra-safe
++		 */
++		rc = vfs_fsync(curlun->filp, curlun->filp->f_path.dentry, 1);
++		if (rc < 0)
++			printk(KERN_ERR "ums: Error syncing data (%d)\n", rc);
++		/* drop_pagecache and drop_slab are no longer available */
++		/* drop_pagecache(); */
++		/* drop_slab(); */
++
++		LDBG(curlun, "close backing file\n");
++		fput(curlun->filp);
++		curlun->filp = NULL;
++		adjust_wake_lock(fsg);
++	}
++}
++
++static void close_all_backing_files(struct fsg_dev *fsg)
++{
++	int	i;
++
++	for (i = 0; i < fsg->nluns; ++i)
++		close_backing_file(fsg, &fsg->luns[i]);
++}
++
++static ssize_t show_file(struct device *dev, struct device_attribute *attr,
++		char *buf)
++{
++	struct lun	*curlun = dev_to_lun(dev);
++	struct fsg_dev	*fsg = dev_get_drvdata(dev);
++	char		*p;
++	ssize_t		rc;
++
++	down_read(&fsg->filesem);
++	if (backing_file_is_open(curlun)) {	/* Get the complete pathname */
++		p = d_path(&curlun->filp->f_path, buf, PAGE_SIZE - 1);
++		if (IS_ERR(p))
++			rc = PTR_ERR(p);
++		else {
++			rc = strlen(p);
++			memmove(buf, p, rc);
++			buf[rc] = '\n';		/* Add a newline */
++			buf[++rc] = 0;
++		}
++	} else {				/* No file, return 0 bytes */
++		*buf = 0;
++		rc = 0;
++	}
++	up_read(&fsg->filesem);
++	return rc;
++}
++
++static ssize_t store_file(struct device *dev, struct device_attribute *attr,
++		const char *buf, size_t count)
++{
++	struct lun	*curlun = dev_to_lun(dev);
++	struct fsg_dev	*fsg = dev_get_drvdata(dev);
++	int		rc = 0;
++
++	DBG(fsg, "store_file: \"%s\"\n", buf);
++#if 0
++	/* disabled because we need to allow closing the backing file if the media was removed */
++	if (curlun->prevent_medium_removal && backing_file_is_open(curlun)) {
++		LDBG(curlun, "eject attempt prevented\n");
++		return -EBUSY;				/* "Door is locked" */
++	}
++#endif
++
++	/* Remove a trailing newline */
++	if (count > 0 && buf[count-1] == '\n')
++		((char *) buf)[count-1] = 0;
++
++	/* Eject current medium */
++	down_write(&fsg->filesem);
++	if (backing_file_is_open(curlun)) {
++		close_backing_file(fsg, curlun);
++		curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
++	}
++
++	/* Load new medium */
++	if (count > 0 && buf[0]) {
++		rc = open_backing_file(fsg, curlun, buf);
++		if (rc == 0)
++			curlun->unit_attention_data =
++					SS_NOT_READY_TO_READY_TRANSITION;
++	}
++	up_write(&fsg->filesem);
++	return (rc < 0 ? rc : count);
++}
++
++
++static DEVICE_ATTR(file, 0444, show_file, store_file);
++
++/*-------------------------------------------------------------------------*/
++
++static void fsg_release(struct kref *ref)
++{
++	struct fsg_dev	*fsg = container_of(ref, struct fsg_dev, ref);
++
++	kfree(fsg->luns);
++	kfree(fsg);
++}
++
++static void lun_release(struct device *dev)
++{
++	struct fsg_dev	*fsg = dev_get_drvdata(dev);
++
++	kref_put(&fsg->ref, fsg_release);
++}
++
++
++/*-------------------------------------------------------------------------*/
++
++static int __init fsg_alloc(void)
++{
++	struct fsg_dev		*fsg;
++
++	fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
++	if (!fsg)
++		return -ENOMEM;
++	spin_lock_init(&fsg->lock);
++	init_rwsem(&fsg->filesem);
++	kref_init(&fsg->ref);
++	init_completion(&fsg->thread_notifier);
++
++	the_fsg = fsg;
++	return 0;
++}
++
++static ssize_t print_switch_name(struct switch_dev *sdev, char *buf)
++{
++	return sprintf(buf, "%s\n", DRIVER_NAME);
++}
++
++static ssize_t print_switch_state(struct switch_dev *sdev, char *buf)
++{
++	struct fsg_dev	*fsg = container_of(sdev, struct fsg_dev, sdev);
++	return sprintf(buf, "%s\n", (fsg->config ? "online" : "offline"));
++}
++
++static void
++fsg_function_unbind(struct usb_configuration *c, struct usb_function *f)
++{
++	struct fsg_dev	*fsg = func_to_dev(f);
++	int			i;
++	struct lun		*curlun;
++
++	DBG(fsg, "fsg_function_unbind\n");
++	clear_bit(REGISTERED, &fsg->atomic_bitflags);
++
++	/* Unregister the sysfs attribute files and the LUNs */
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		if (curlun->registered) {
++			device_remove_file(&curlun->dev, &dev_attr_file);
++			device_unregister(&curlun->dev);
++			curlun->registered = 0;
++		}
++	}
++
++	/* If the thread isn't already dead, tell it to exit now */
++	if (fsg->state != FSG_STATE_TERMINATED) {
++		raise_exception(fsg, FSG_STATE_EXIT);
++		wait_for_completion(&fsg->thread_notifier);
++
++		/* The cleanup routine waits for this completion also */
++		complete(&fsg->thread_notifier);
++	}
++
++	/* Free the data buffers */
++	for (i = 0; i < NUM_BUFFERS; ++i)
++		kfree(fsg->buffhds[i].buf);
++}
++
++static int __init
++fsg_function_bind(struct usb_configuration *c, struct usb_function *f)
++{
++	struct usb_composite_dev *cdev = c->cdev;
++	struct fsg_dev	*fsg = func_to_dev(f);
++	int			rc;
++	int			i;
++	int			id;
++	struct lun		*curlun;
++	struct usb_ep		*ep;
++	char			*pathbuf, *p;
++
++	fsg->cdev = cdev;
++	DBG(fsg, "fsg_function_bind\n");
++
++	dev_attr_file.attr.mode = 0644;
++
++	/* Find out how many LUNs there should be */
++	i = fsg->nluns;
++	if (i == 0)
++		i = 1;
++	if (i > MAX_LUNS) {
++		ERROR(fsg, "invalid number of LUNs: %d\n", i);
++		rc = -EINVAL;
++		goto out;
++	}
++
++	/* Create the LUNs, open their backing files, and register the
++	 * LUN devices in sysfs. */
++	fsg->luns = kzalloc(i * sizeof(struct lun), GFP_KERNEL);
++	if (!fsg->luns) {
++		rc = -ENOMEM;
++		goto out;
++	}
++	fsg->nluns = i;
++
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		curlun->ro = 0;
++		curlun->dev.release = lun_release;
++		curlun->dev.parent = &cdev->gadget->dev;
++		dev_set_drvdata(&curlun->dev, fsg);
++		snprintf(curlun->dev.bus_id, BUS_ID_SIZE,
++				"lun%d", i);
++
++		rc = device_register(&curlun->dev);
++		if (rc != 0) {
++			INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
++			goto out;
++		}
++		rc = device_create_file(&curlun->dev, &dev_attr_file);
++		if (rc != 0) {
++			ERROR(fsg, "device_create_file failed: %d\n", rc);
++			device_unregister(&curlun->dev);
++			goto out;
++		}
++		curlun->registered = 1;
++		kref_get(&fsg->ref);
++	}
++
++	/* allocate interface ID(s) */
++	id = usb_interface_id(c, f);
++	if (id < 0)
++		return id;
++	intf_desc.bInterfaceNumber = id;
++
++	ep = usb_ep_autoconfig(cdev->gadget, &fs_bulk_in_desc);
++	if (!ep)
++		goto autoconf_fail;
++	ep->driver_data = fsg;		/* claim the endpoint */
++	fsg->bulk_in = ep;
++
++	ep = usb_ep_autoconfig(cdev->gadget, &fs_bulk_out_desc);
++	if (!ep)
++		goto autoconf_fail;
++	ep->driver_data = fsg;		/* claim the endpoint */
++	fsg->bulk_out = ep;
++
++	rc = -ENOMEM;
++
++	if (gadget_is_dualspeed(cdev->gadget)) {
++		/* Assume endpoint addresses are the same for both speeds */
++		hs_bulk_in_desc.bEndpointAddress =
++				fs_bulk_in_desc.bEndpointAddress;
++		hs_bulk_out_desc.bEndpointAddress =
++				fs_bulk_out_desc.bEndpointAddress;
++
++		f->hs_descriptors = hs_function;
++	}
++
++	/* Allocate the data buffers */
++	for (i = 0; i < NUM_BUFFERS; ++i) {
++		struct fsg_buffhd	*bh = &fsg->buffhds[i];
++
++		/* Allocate for the bulk-in endpoint.  We assume that
++		 * the buffer will also work with the bulk-out (and
++		 * interrupt-in) endpoint. */
++		bh->buf = kmalloc(fsg->buf_size, GFP_KERNEL);
++		if (!bh->buf)
++			goto out;
++		bh->next = bh + 1;
++	}
++	fsg->buffhds[NUM_BUFFERS - 1].next = &fsg->buffhds[0];
++
++	fsg->thread_task = kthread_create(fsg_main_thread, fsg,
++			shortname);
++	if (IS_ERR(fsg->thread_task)) {
++		rc = PTR_ERR(fsg->thread_task);
++		ERROR(fsg, "kthread_create failed: %d\n", rc);
++		goto out;
++	}
++
++	INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
++
++	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
++	for (i = 0; i < fsg->nluns; ++i) {
++		curlun = &fsg->luns[i];
++		if (backing_file_is_open(curlun)) {
++			p = NULL;
++			if (pathbuf) {
++				p = d_path(&curlun->filp->f_path,
++					   pathbuf, PATH_MAX);
++				if (IS_ERR(p))
++					p = NULL;
++			}
++			LINFO(curlun, "ro=%d, file: %s\n",
++					curlun->ro, (p ? p : "(error)"));
++		}
++	}
++	kfree(pathbuf);
++
++	set_bit(REGISTERED, &fsg->atomic_bitflags);
++
++	/* Tell the thread to start working */
++	wake_up_process(fsg->thread_task);
++	return 0;
++
++autoconf_fail:
++	ERROR(fsg, "unable to autoconfigure all endpoints\n");
++	rc = -ENOTSUPP;
++
++out:
++	DBG(fsg, "fsg_function_bind failed: %d\n", rc);
++	fsg->state = FSG_STATE_TERMINATED;	/* The thread is dead */
++	fsg_function_unbind(c, f);
++	close_all_backing_files(fsg);
++	return rc;
++}
++
++static int fsg_function_set_alt(struct usb_function *f,
++		unsigned intf, unsigned alt)
++{
++	struct fsg_dev	*fsg = func_to_dev(f);
++	DBG(fsg, "fsg_function_set_alt intf: %d alt: %d\n", intf, alt);
++	fsg->new_config = 1;
++	raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
++	return 0;
++}
++
++static void fsg_function_disable(struct usb_function *f)
++{
++	struct fsg_dev	*fsg = func_to_dev(f);
++	DBG(fsg, "fsg_function_disable\n");
++	fsg->new_config = 0;
++	raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
++}
++
++int __init mass_storage_function_add(struct usb_composite_dev *cdev,
++	struct usb_configuration *c, int nluns)
++{
++	int		rc;
++	struct fsg_dev	*fsg;
++
++	printk(KERN_INFO "mass_storage_function_add\n");
++	rc = fsg_alloc();
++	if (rc)
++		return rc;
++	fsg = the_fsg;
++	fsg->nluns = nluns;
++
++	spin_lock_init(&fsg->lock);
++	init_rwsem(&fsg->filesem);
++	kref_init(&fsg->ref);
++	init_completion(&fsg->thread_notifier);
++
++	the_fsg->buf_size = BULK_BUFFER_SIZE;
++	the_fsg->sdev.name = DRIVER_NAME;
++	the_fsg->sdev.print_name = print_switch_name;
++	the_fsg->sdev.print_state = print_switch_state;
++	rc = switch_dev_register(&the_fsg->sdev);
++	if (rc < 0)
++		goto err_switch_dev_register;
++
++	wake_lock_init(&the_fsg->wake_lock, WAKE_LOCK_SUSPEND,
++		       "usb_mass_storage");
++
++	fsg->cdev = cdev;
++	fsg->function.name = shortname;
++	fsg->function.descriptors = fs_function;
++	fsg->function.bind = fsg_function_bind;
++	fsg->function.unbind = fsg_function_unbind;
++	fsg->function.setup = fsg_function_setup;
++	fsg->function.set_alt = fsg_function_set_alt;
++	fsg->function.disable = fsg_function_disable;
++
++	rc = usb_add_function(c, &fsg->function);
++	if (rc != 0)
++		goto err_usb_add_function;
++
++	return 0;
++
++err_usb_add_function:
++	switch_dev_unregister(&the_fsg->sdev);
++err_switch_dev_register:
++	kref_put(&the_fsg->ref, fsg_release);
++
++	return rc;
++}
+--- /dev/null
++++ b/drivers/usb/gadget/f_mass_storage.h
+@@ -0,0 +1,52 @@
++/*
++ * drivers/usb/gadget/f_mass_storage.h
++ *
++ * Function Driver for USB Mass Storage
++ *
++ * Copyright (C) 2008 Google, Inc.
++ * Author: Mike Lockwood <lockwood@android.com>
++ *
++ * Based heavily on the file_storage gadget driver in
++ * drivers/usb/gadget/file_storage.c and licensed under the same terms:
++ *
++ * Copyright (C) 2003-2007 Alan Stern
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the above-listed copyright holders may not be used
++ *    to endorse or promote products derived from this software without
++ *    specific prior written permission.
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") as published by the Free Software
++ * Foundation, either version 2 of that License or (at your option) any
++ * later version.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
++ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
++ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
++ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
++ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
++ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
++ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
++ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
++ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#ifndef __F_MASS_STORAGE_H
++#define __F_MASS_STORAGE_H
++
++int mass_storage_function_add(struct usb_composite_dev *cdev,
++	struct usb_configuration *c, int nluns);
++
++#endif /* __F_MASS_STORAGE_H */
+--- /dev/null
++++ b/include/linux/usb/android.h
+@@ -0,0 +1,40 @@
++/*
++ * Platform data for Android USB
++ *
++ * Copyright (C) 2008 Google, Inc.
++ * Author: Mike Lockwood <lockwood@android.com>
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++#ifndef	__LINUX_USB_ANDROID_H
++#define	__LINUX_USB_ANDROID_H
++
++struct android_usb_platform_data {
++	/* USB device descriptor fields */
++	__u16 vendor_id;
++
++	/* Default product ID. */
++	__u16 product_id;
++
++	/* Product ID when adb is enabled. */
++	__u16 adb_product_id;
++
++	__u16 version;
++
++	char *product_name;
++	char *manufacturer_name;
++	char *serial_number;
++
++	/* number of LUNS for mass storage function */
++	int nluns;
++};
++
++#endif	/* __LINUX_USB_ANDROID_H */
diff --git a/target/linux/goldfish/patches-2.6.30/0105-block-block_dump-Add-number-of-sectors-to-debug-ou.patch b/target/linux/goldfish/patches-2.6.30/0105-block-block_dump-Add-number-of-sectors-to-debug-ou.patch
new file mode 100644
index 0000000000..c057e7b17e
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0105-block-block_dump-Add-number-of-sectors-to-debug-ou.patch
@@ -0,0 +1,27 @@
+From 4d3a01ba872f67bae704e37bf888c38fa83be759 Mon Sep 17 00:00:00 2001
+From: San Mehat <san@android.com>
+Date: Sat, 21 Mar 2009 18:48:05 -0700
+Subject: [PATCH 105/134] block: block_dump: Add number of sectors to debug output
+
+Signed-off-by: San Mehat <san@android.com>
+---
+ block/blk-core.c |    5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -1558,11 +1558,12 @@ void submit_bio(int rw, struct bio *bio)
+ 
+ 		if (unlikely(block_dump)) {
+ 			char b[BDEVNAME_SIZE];
+-			printk(KERN_DEBUG "%s(%d): %s block %Lu on %s\n",
++			printk(KERN_DEBUG "%s(%d): %s block %Lu on %s (%u sectors)\n",
+ 			current->comm, task_pid_nr(current),
+ 				(rw & WRITE) ? "WRITE" : "READ",
+ 				(unsigned long long)bio->bi_sector,
+-				bdevname(bio->bi_bdev, b));
++				bdevname(bio->bi_bdev, b),
++				count);
+ 		}
+ 	}
+ 
diff --git a/target/linux/goldfish/patches-2.6.30/0108-mmc-sd-Remove-debugging-printk.patch b/target/linux/goldfish/patches-2.6.30/0108-mmc-sd-Remove-debugging-printk.patch
new file mode 100644
index 0000000000..f9efdb35a0
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0108-mmc-sd-Remove-debugging-printk.patch
@@ -0,0 +1,20 @@
+From 700cfcab7eee4a822be3fe0c8cfd77caac10bfed Mon Sep 17 00:00:00 2001
+From: Dima Zavin <dima@android.com>
+Date: Wed, 25 Mar 2009 21:29:45 -0700
+Subject: [PATCH 108/134] mmc: sd: Remove debugging printk
+
+Signed-off-by: Dima Zavin <dima@android.com>
+---
+ drivers/mmc/core/sd.c |    1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -574,7 +574,6 @@ static void mmc_sd_detect(struct mmc_hos
+ #ifdef CONFIG_MMC_PARANOID_SD_INIT
+ 	while(retries) {
+ 		err = mmc_send_status(host->card, NULL);
+-		printk("%s(%s): err = %d\n", __func__, mmc_hostname(host), err);
+ 		if (err) {
+ 			retries--;
+ 			udelay(5);
diff --git a/target/linux/goldfish/patches-2.6.30/0109-Revert-printk-remove-unused-code-from-kernel-print.patch b/target/linux/goldfish/patches-2.6.30/0109-Revert-printk-remove-unused-code-from-kernel-print.patch
new file mode 100644
index 0000000000..26745a1168
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0109-Revert-printk-remove-unused-code-from-kernel-print.patch
@@ -0,0 +1,58 @@
+From fca2519ebf25db61da132932eb3fffeaa1974f43 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Thu, 15 Jan 2009 19:07:27 -0800
+Subject: [PATCH 109/134] Revert "printk: remove unused code from kernel/printk.c"
+
+This reverts commit acff181d3574244e651913df77332e897b88bff4.
+---
+ kernel/printk.c |   39 +++++++++++++++++++++++++++++++++++++++
+ 1 files changed, 39 insertions(+), 0 deletions(-)
+
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -255,6 +255,45 @@ static inline void boot_delay_msec(void)
+ #endif
+ 
+ /*
++ * Return the number of unread characters in the log buffer.
++ */
++static int log_buf_get_len(void)
++{
++	return logged_chars;
++}
++
++/*
++ * Copy a range of characters from the log buffer.
++ */
++int log_buf_copy(char *dest, int idx, int len)
++{
++	int ret, max;
++	bool took_lock = false;
++
++	if (!oops_in_progress) {
++		spin_lock_irq(&logbuf_lock);
++		took_lock = true;
++	}
++
++	max = log_buf_get_len();
++	if (idx < 0 || idx >= max) {
++		ret = -1;
++	} else {
++		if (len > max)
++			len = max;
++		ret = len;
++		idx += (log_end - max);
++		while (len-- > 0)
++			dest[len] = LOG_BUF(idx + len);
++	}
++
++	if (took_lock)
++		spin_unlock_irq(&logbuf_lock);
++
++	return ret;
++}
++
++/*
+  * Commands to do_syslog:
+  *
+  * 	0 -- Close the log.  Currently a NOP.
diff --git a/target/linux/goldfish/patches-2.6.30/0110-printk-Fix-log_buf_copy-termination.patch b/target/linux/goldfish/patches-2.6.30/0110-printk-Fix-log_buf_copy-termination.patch
new file mode 100644
index 0000000000..3956090cbf
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0110-printk-Fix-log_buf_copy-termination.patch
@@ -0,0 +1,24 @@
+From e500cd364086cfc018b100d08c97b2fdf229d029 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Mon, 14 Apr 2008 21:35:25 -0700
+Subject: [PATCH 110/134] printk: Fix log_buf_copy termination.
+
+If idx was non-zero and the log had wrapped, len did not get truncated
+to stop at the last byte written to the log.
+---
+ kernel/printk.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -279,8 +279,8 @@ int log_buf_copy(char *dest, int idx, in
+ 	if (idx < 0 || idx >= max) {
+ 		ret = -1;
+ 	} else {
+-		if (len > max)
+-			len = max;
++		if (len > max - idx)
++			len = max - idx;
+ 		ret = len;
+ 		idx += (log_end - max);
+ 		while (len-- > 0)
diff --git a/target/linux/goldfish/patches-2.6.30/0118--ARM-goldfish-Add-goldfish-platform.patch b/target/linux/goldfish/patches-2.6.30/0118--ARM-goldfish-Add-goldfish-platform.patch
new file mode 100644
index 0000000000..21e6716d80
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0118--ARM-goldfish-Add-goldfish-platform.patch
@@ -0,0 +1,2127 @@
+From 7cc9c853cf4657bc971a3bf8736fa0412f23eea2 Mon Sep 17 00:00:00 2001
+From: Mike A. Chan <mikechan@google.com>
+Date: Tue, 14 Oct 2008 19:46:11 -0700
+Subject: [PATCH 118/134] [ARM] goldfish: Add goldfish platform.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ arch/arm/Kconfig                                  |   10 +
+ arch/arm/Makefile                                 |    1 +
+ arch/arm/configs/goldfish_defconfig               | 1166 +++++++++++++++++++++
+ arch/arm/mach-goldfish/Kconfig                    |   11 +
+ arch/arm/mach-goldfish/Makefile                   |    9 +
+ arch/arm/mach-goldfish/Makefile.boot              |    4 +
+ arch/arm/mach-goldfish/board-goldfish.c           |  122 +++
+ arch/arm/mach-goldfish/include/mach/dma.h         |    1 +
+ arch/arm/mach-goldfish/include/mach/entry-macro.S |   34 +
+ arch/arm/mach-goldfish/include/mach/hardware.h    |   44 +
+ arch/arm/mach-goldfish/include/mach/io.h          |   24 +
+ arch/arm/mach-goldfish/include/mach/irqs.h        |   24 +
+ arch/arm/mach-goldfish/include/mach/memory.h      |   35 +
+ arch/arm/mach-goldfish/include/mach/system.h      |   30 +
+ arch/arm/mach-goldfish/include/mach/timer.h       |   28 +
+ arch/arm/mach-goldfish/include/mach/timex.h       |   24 +
+ arch/arm/mach-goldfish/include/mach/uncompress.h  |   40 +
+ arch/arm/mach-goldfish/include/mach/vmalloc.h     |   21 +
+ arch/arm/mach-goldfish/pdev_bus.c                 |  222 ++++
+ arch/arm/mach-goldfish/timer.c                    |  147 +++
+ 20 files changed, 1997 insertions(+), 0 deletions(-)
+ create mode 100644 arch/arm/configs/goldfish_defconfig
+ create mode 100644 arch/arm/mach-goldfish/Kconfig
+ create mode 100644 arch/arm/mach-goldfish/Makefile
+ create mode 100644 arch/arm/mach-goldfish/Makefile.boot
+ create mode 100644 arch/arm/mach-goldfish/board-goldfish.c
+ create mode 100644 arch/arm/mach-goldfish/include/mach/dma.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/entry-macro.S
+ create mode 100644 arch/arm/mach-goldfish/include/mach/hardware.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/io.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/irqs.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/memory.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/system.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/timer.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/timex.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/uncompress.h
+ create mode 100644 arch/arm/mach-goldfish/include/mach/vmalloc.h
+ create mode 100644 arch/arm/mach-goldfish/pdev_bus.c
+ create mode 100644 arch/arm/mach-goldfish/timer.c
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -206,6 +206,14 @@ config ARCH_AAEC2000
+ 	help
+ 	  This enables support for systems based on the Agilent AAEC-2000
+ 
++config ARCH_GOLDFISH
++	bool "Goldfish"
++	select CPU_ARM926T
++	select GENERIC_TIME
++	select GENERIC_CLOCKEVENTS
++	help
++	  Support for Goldfish Virtual Platform.
++
+ config ARCH_INTEGRATOR
+ 	bool "ARM Ltd. Integrator family"
+ 	select ARM_AMBA
+@@ -620,6 +628,8 @@ config ARCH_W90X900
+ 
+ endchoice
+ 
++source "arch/arm/mach-goldfish/Kconfig"
++
+ source "arch/arm/mach-clps711x/Kconfig"
+ 
+ source "arch/arm/mach-ep93xx/Kconfig"
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -138,6 +138,7 @@ endif
+  machine-$(CONFIG_ARCH_IMX)	   := imx
+  machine-$(CONFIG_ARCH_H720X)	   := h720x
+  machine-$(CONFIG_ARCH_AAEC2000)   := aaec2000
++ machine-$(CONFIG_ARCH_GOLDFISH)   := goldfish
+  machine-$(CONFIG_ARCH_REALVIEW)   := realview
+  machine-$(CONFIG_ARCH_AT91)	   := at91
+  machine-$(CONFIG_ARCH_EP93XX)	   := ep93xx
+--- /dev/null
++++ b/arch/arm/configs/goldfish_defconfig
+@@ -0,0 +1,1166 @@
++#
++# Automatically generated make config: don't edit
++# Linux kernel version: 2.6.29
++# Wed Apr  8 20:40:44 2009
++#
++CONFIG_ARM=y
++CONFIG_SYS_SUPPORTS_APM_EMULATION=y
++# CONFIG_GENERIC_GPIO is not set
++CONFIG_GENERIC_TIME=y
++CONFIG_GENERIC_CLOCKEVENTS=y
++CONFIG_MMU=y
++# CONFIG_NO_IOPORT is not set
++CONFIG_GENERIC_HARDIRQS=y
++CONFIG_STACKTRACE_SUPPORT=y
++CONFIG_HAVE_LATENCYTOP_SUPPORT=y
++CONFIG_LOCKDEP_SUPPORT=y
++CONFIG_TRACE_IRQFLAGS_SUPPORT=y
++CONFIG_HARDIRQS_SW_RESEND=y
++CONFIG_GENERIC_IRQ_PROBE=y
++CONFIG_RWSEM_GENERIC_SPINLOCK=y
++# CONFIG_ARCH_HAS_ILOG2_U32 is not set
++# CONFIG_ARCH_HAS_ILOG2_U64 is not set
++CONFIG_GENERIC_HWEIGHT=y
++CONFIG_GENERIC_CALIBRATE_DELAY=y
++CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
++CONFIG_VECTORS_BASE=0xffff0000
++CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
++
++#
++# General setup
++#
++CONFIG_EXPERIMENTAL=y
++CONFIG_BROKEN_ON_SMP=y
++CONFIG_INIT_ENV_ARG_LIMIT=32
++CONFIG_LOCALVERSION=""
++CONFIG_LOCALVERSION_AUTO=y
++CONFIG_SWAP=y
++CONFIG_SYSVIPC=y
++CONFIG_SYSVIPC_SYSCTL=y
++# CONFIG_POSIX_MQUEUE is not set
++# CONFIG_BSD_PROCESS_ACCT is not set
++# CONFIG_TASKSTATS is not set
++# CONFIG_AUDIT is not set
++
++#
++# RCU Subsystem
++#
++CONFIG_CLASSIC_RCU=y
++# CONFIG_TREE_RCU is not set
++# CONFIG_PREEMPT_RCU is not set
++# CONFIG_TREE_RCU_TRACE is not set
++# CONFIG_PREEMPT_RCU_TRACE is not set
++CONFIG_IKCONFIG=y
++CONFIG_IKCONFIG_PROC=y
++CONFIG_LOG_BUF_SHIFT=16
++# CONFIG_GROUP_SCHED is not set
++# CONFIG_CGROUPS is not set
++# CONFIG_SYSFS_DEPRECATED_V2 is not set
++# CONFIG_RELAY is not set
++CONFIG_NAMESPACES=y
++# CONFIG_UTS_NS is not set
++# CONFIG_IPC_NS is not set
++# CONFIG_USER_NS is not set
++# CONFIG_PID_NS is not set
++# CONFIG_NET_NS is not set
++CONFIG_BLK_DEV_INITRD=y
++CONFIG_INITRAMFS_SOURCE=""
++CONFIG_CC_OPTIMIZE_FOR_SIZE=y
++CONFIG_SYSCTL=y
++CONFIG_ANON_INODES=y
++CONFIG_PANIC_TIMEOUT=0
++# CONFIG_EMBEDDED is not set
++CONFIG_UID16=y
++CONFIG_SYSCTL_SYSCALL=y
++CONFIG_KALLSYMS=y
++# CONFIG_KALLSYMS_ALL is not set
++# CONFIG_KALLSYMS_EXTRA_PASS is not set
++CONFIG_HOTPLUG=y
++CONFIG_PRINTK=y
++CONFIG_BUG=y
++CONFIG_ELF_CORE=y
++CONFIG_BASE_FULL=y
++CONFIG_FUTEX=y
++CONFIG_EPOLL=y
++CONFIG_SIGNALFD=y
++CONFIG_TIMERFD=y
++CONFIG_EVENTFD=y
++CONFIG_SHMEM=y
++CONFIG_AIO=y
++CONFIG_ASHMEM=y
++CONFIG_VM_EVENT_COUNTERS=y
++CONFIG_COMPAT_BRK=y
++CONFIG_SLAB=y
++# CONFIG_SLUB is not set
++# CONFIG_SLOB is not set
++# CONFIG_PROFILING is not set
++CONFIG_HAVE_OPROFILE=y
++CONFIG_HAVE_KPROBES=y
++CONFIG_HAVE_KRETPROBES=y
++CONFIG_HAVE_GENERIC_DMA_COHERENT=y
++CONFIG_SLABINFO=y
++CONFIG_RT_MUTEXES=y
++CONFIG_BASE_SMALL=0
++# CONFIG_MODULES is not set
++CONFIG_BLOCK=y
++# CONFIG_LBD is not set
++# CONFIG_BLK_DEV_IO_TRACE is not set
++# CONFIG_BLK_DEV_BSG is not set
++# CONFIG_BLK_DEV_INTEGRITY is not set
++
++#
++# IO Schedulers
++#
++CONFIG_IOSCHED_NOOP=y
++CONFIG_IOSCHED_AS=y
++CONFIG_IOSCHED_DEADLINE=y
++CONFIG_IOSCHED_CFQ=y
++CONFIG_DEFAULT_AS=y
++# CONFIG_DEFAULT_DEADLINE is not set
++# CONFIG_DEFAULT_CFQ is not set
++# CONFIG_DEFAULT_NOOP is not set
++CONFIG_DEFAULT_IOSCHED="anticipatory"
++CONFIG_FREEZER=y
++
++#
++# System Type
++#
++# CONFIG_ARCH_AAEC2000 is not set
++CONFIG_ARCH_GOLDFISH=y
++# CONFIG_ARCH_INTEGRATOR is not set
++# CONFIG_ARCH_REALVIEW is not set
++# CONFIG_ARCH_VERSATILE is not set
++# CONFIG_ARCH_AT91 is not set
++# CONFIG_ARCH_CLPS711X is not set
++# CONFIG_ARCH_EBSA110 is not set
++# CONFIG_ARCH_EP93XX is not set
++# CONFIG_ARCH_FOOTBRIDGE is not set
++# CONFIG_ARCH_NETX is not set
++# CONFIG_ARCH_H720X is not set
++# CONFIG_ARCH_IMX is not set
++# CONFIG_ARCH_IOP13XX is not set
++# CONFIG_ARCH_IOP32X is not set
++# CONFIG_ARCH_IOP33X is not set
++# CONFIG_ARCH_IXP23XX is not set
++# CONFIG_ARCH_IXP2000 is not set
++# CONFIG_ARCH_IXP4XX is not set
++# CONFIG_ARCH_L7200 is not set
++# CONFIG_ARCH_KIRKWOOD is not set
++# CONFIG_ARCH_KS8695 is not set
++# CONFIG_ARCH_NS9XXX is not set
++# CONFIG_ARCH_LOKI is not set
++# CONFIG_ARCH_MV78XX0 is not set
++# CONFIG_ARCH_MXC is not set
++# CONFIG_ARCH_ORION5X is not set
++# CONFIG_ARCH_PNX4008 is not set
++# CONFIG_ARCH_PXA is not set
++# CONFIG_ARCH_RPC is not set
++# CONFIG_ARCH_SA1100 is not set
++# CONFIG_ARCH_S3C2410 is not set
++# CONFIG_ARCH_S3C64XX is not set
++# CONFIG_ARCH_SHARK is not set
++# CONFIG_ARCH_LH7A40X is not set
++# CONFIG_ARCH_DAVINCI is not set
++# CONFIG_ARCH_OMAP is not set
++# CONFIG_ARCH_MSM is not set
++# CONFIG_ARCH_W90X900 is not set
++
++#
++# Goldfish Options
++#
++CONFIG_MACH_GOLDFISH=y
++
++#
++# Processor Type
++#
++CONFIG_CPU_32=y
++CONFIG_CPU_ARM926T=y
++CONFIG_CPU_32v5=y
++CONFIG_CPU_ABRT_EV5TJ=y
++CONFIG_CPU_PABRT_NOIFAR=y
++CONFIG_CPU_CACHE_VIVT=y
++CONFIG_CPU_COPY_V4WB=y
++CONFIG_CPU_TLB_V4WBI=y
++CONFIG_CPU_CP15=y
++CONFIG_CPU_CP15_MMU=y
++
++#
++# Processor Features
++#
++CONFIG_ARM_THUMB=y
++# CONFIG_CPU_ICACHE_DISABLE is not set
++# CONFIG_CPU_DCACHE_DISABLE is not set
++# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
++# CONFIG_CPU_CACHE_ROUND_ROBIN is not set
++# CONFIG_OUTER_CACHE is not set
++
++#
++# Bus support
++#
++# CONFIG_PCI_SYSCALL is not set
++# CONFIG_ARCH_SUPPORTS_MSI is not set
++# CONFIG_PCCARD is not set
++
++#
++# Kernel Features
++#
++CONFIG_TICK_ONESHOT=y
++CONFIG_NO_HZ=y
++CONFIG_HIGH_RES_TIMERS=y
++CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
++CONFIG_VMSPLIT_3G=y
++# CONFIG_VMSPLIT_2G is not set
++# CONFIG_VMSPLIT_1G is not set
++CONFIG_PAGE_OFFSET=0xC0000000
++# CONFIG_PREEMPT is not set
++CONFIG_HZ=100
++CONFIG_AEABI=y
++# CONFIG_OABI_COMPAT is not set
++CONFIG_ARCH_FLATMEM_HAS_HOLES=y
++# CONFIG_ARCH_SPARSEMEM_DEFAULT is not set
++# CONFIG_ARCH_SELECT_MEMORY_MODEL is not set
++CONFIG_SELECT_MEMORY_MODEL=y
++CONFIG_FLATMEM_MANUAL=y
++# CONFIG_DISCONTIGMEM_MANUAL is not set
++# CONFIG_SPARSEMEM_MANUAL is not set
++CONFIG_FLATMEM=y
++CONFIG_FLAT_NODE_MEM_MAP=y
++CONFIG_PAGEFLAGS_EXTENDED=y
++CONFIG_SPLIT_PTLOCK_CPUS=4096
++# CONFIG_PHYS_ADDR_T_64BIT is not set
++CONFIG_ZONE_DMA_FLAG=0
++CONFIG_VIRT_TO_BUS=y
++CONFIG_UNEVICTABLE_LRU=y
++CONFIG_ALIGNMENT_TRAP=y
++
++#
++# Boot options
++#
++CONFIG_ZBOOT_ROM_TEXT=0x0
++CONFIG_ZBOOT_ROM_BSS=0x0
++CONFIG_CMDLINE=""
++# CONFIG_XIP_KERNEL is not set
++# CONFIG_KEXEC is not set
++
++#
++# CPU Power Management
++#
++# CONFIG_CPU_IDLE is not set
++
++#
++# Floating point emulation
++#
++
++#
++# At least one emulation must be selected
++#
++CONFIG_VFP=y
++
++#
++# Userspace binary formats
++#
++CONFIG_BINFMT_ELF=y
++# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
++CONFIG_HAVE_AOUT=y
++# CONFIG_BINFMT_AOUT is not set
++CONFIG_BINFMT_MISC=y
++
++#
++# Power management options
++#
++CONFIG_PM=y
++# CONFIG_PM_DEBUG is not set
++CONFIG_PM_SLEEP=y
++CONFIG_SUSPEND=y
++CONFIG_SUSPEND_FREEZER=y
++CONFIG_HAS_WAKELOCK=y
++CONFIG_HAS_EARLYSUSPEND=y
++CONFIG_WAKELOCK=y
++CONFIG_WAKELOCK_STAT=y
++CONFIG_USER_WAKELOCK=y
++CONFIG_EARLYSUSPEND=y
++# CONFIG_NO_USER_SPACE_SCREEN_ACCESS_CONTROL is not set
++CONFIG_CONSOLE_EARLYSUSPEND=y
++# CONFIG_FB_EARLYSUSPEND is not set
++# CONFIG_APM_EMULATION is not set
++CONFIG_ARCH_SUSPEND_POSSIBLE=y
++CONFIG_NET=y
++
++#
++# Networking options
++#
++CONFIG_COMPAT_NET_DEV_OPS=y
++CONFIG_PACKET=y
++CONFIG_PACKET_MMAP=y
++CONFIG_UNIX=y
++CONFIG_XFRM=y
++# CONFIG_XFRM_USER is not set
++# CONFIG_XFRM_SUB_POLICY is not set
++# CONFIG_XFRM_MIGRATE is not set
++# CONFIG_XFRM_STATISTICS is not set
++CONFIG_XFRM_IPCOMP=y
++# CONFIG_NET_KEY is not set
++CONFIG_INET=y
++CONFIG_IP_MULTICAST=y
++# CONFIG_IP_ADVANCED_ROUTER is not set
++CONFIG_IP_FIB_HASH=y
++CONFIG_IP_PNP=y
++CONFIG_IP_PNP_DHCP=y
++CONFIG_IP_PNP_BOOTP=y
++# CONFIG_IP_PNP_RARP is not set
++CONFIG_NET_IPIP=y
++CONFIG_NET_IPGRE=y
++CONFIG_NET_IPGRE_BROADCAST=y
++CONFIG_IP_MROUTE=y
++CONFIG_IP_PIMSM_V1=y
++CONFIG_IP_PIMSM_V2=y
++CONFIG_ARPD=y
++CONFIG_SYN_COOKIES=y
++CONFIG_INET_AH=y
++CONFIG_INET_ESP=y
++CONFIG_INET_IPCOMP=y
++CONFIG_INET_XFRM_TUNNEL=y
++CONFIG_INET_TUNNEL=y
++CONFIG_INET_XFRM_MODE_TRANSPORT=y
++CONFIG_INET_XFRM_MODE_TUNNEL=y
++CONFIG_INET_XFRM_MODE_BEET=y
++# CONFIG_INET_LRO is not set
++CONFIG_INET_DIAG=y
++CONFIG_INET_TCP_DIAG=y
++# CONFIG_TCP_CONG_ADVANCED is not set
++CONFIG_TCP_CONG_CUBIC=y
++CONFIG_DEFAULT_TCP_CONG="cubic"
++# CONFIG_TCP_MD5SIG is not set
++# CONFIG_IPV6 is not set
++CONFIG_ANDROID_PARANOID_NETWORK=y
++# CONFIG_NETWORK_SECMARK is not set
++# CONFIG_NETFILTER is not set
++# CONFIG_IP_DCCP is not set
++# CONFIG_IP_SCTP is not set
++# CONFIG_TIPC is not set
++# CONFIG_ATM is not set
++CONFIG_STP=y
++CONFIG_BRIDGE=y
++# CONFIG_NET_DSA is not set
++CONFIG_VLAN_8021Q=y
++# CONFIG_VLAN_8021Q_GVRP is not set
++# CONFIG_DECNET is not set
++CONFIG_LLC=y
++# CONFIG_LLC2 is not set
++# CONFIG_IPX is not set
++# CONFIG_ATALK is not set
++# CONFIG_X25 is not set
++# CONFIG_LAPB is not set
++# CONFIG_ECONET is not set
++# CONFIG_WAN_ROUTER is not set
++# CONFIG_NET_SCHED is not set
++# CONFIG_DCB is not set
++
++#
++# Network testing
++#
++# CONFIG_NET_PKTGEN is not set
++# CONFIG_HAMRADIO is not set
++# CONFIG_CAN is not set
++# CONFIG_IRDA is not set
++# CONFIG_BT is not set
++# CONFIG_AF_RXRPC is not set
++# CONFIG_PHONET is not set
++CONFIG_WIRELESS=y
++# CONFIG_CFG80211 is not set
++CONFIG_WIRELESS_OLD_REGULATORY=y
++# CONFIG_WIRELESS_EXT is not set
++# CONFIG_LIB80211 is not set
++# CONFIG_MAC80211 is not set
++# CONFIG_WIMAX is not set
++# CONFIG_RFKILL is not set
++# CONFIG_NET_9P is not set
++
++#
++# Device Drivers
++#
++
++#
++# Generic Driver Options
++#
++CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
++CONFIG_STANDALONE=y
++CONFIG_PREVENT_FIRMWARE_BUILD=y
++CONFIG_FW_LOADER=y
++CONFIG_FIRMWARE_IN_KERNEL=y
++CONFIG_EXTRA_FIRMWARE=""
++# CONFIG_DEBUG_DRIVER is not set
++# CONFIG_DEBUG_DEVRES is not set
++# CONFIG_SYS_HYPERVISOR is not set
++CONFIG_CONNECTOR=y
++CONFIG_PROC_EVENTS=y
++CONFIG_MTD=y
++# CONFIG_MTD_DEBUG is not set
++# CONFIG_MTD_CONCAT is not set
++# CONFIG_MTD_PARTITIONS is not set
++
++#
++# User Modules And Translation Layers
++#
++CONFIG_MTD_CHAR=y
++CONFIG_MTD_BLKDEVS=y
++CONFIG_MTD_BLOCK=y
++# CONFIG_FTL is not set
++# CONFIG_NFTL is not set
++# CONFIG_INFTL is not set
++# CONFIG_RFD_FTL is not set
++# CONFIG_SSFDC is not set
++# CONFIG_MTD_OOPS is not set
++
++#
++# RAM/ROM/Flash chip drivers
++#
++# CONFIG_MTD_CFI is not set
++# CONFIG_MTD_JEDECPROBE is not set
++CONFIG_MTD_MAP_BANK_WIDTH_1=y
++CONFIG_MTD_MAP_BANK_WIDTH_2=y
++CONFIG_MTD_MAP_BANK_WIDTH_4=y
++# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
++# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
++# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
++CONFIG_MTD_CFI_I1=y
++CONFIG_MTD_CFI_I2=y
++# CONFIG_MTD_CFI_I4 is not set
++# CONFIG_MTD_CFI_I8 is not set
++# CONFIG_MTD_RAM is not set
++# CONFIG_MTD_ROM is not set
++# CONFIG_MTD_ABSENT is not set
++
++#
++# Mapping drivers for chip access
++#
++# CONFIG_MTD_COMPLEX_MAPPINGS is not set
++# CONFIG_MTD_PLATRAM is not set
++
++#
++# Self-contained MTD device drivers
++#
++# CONFIG_MTD_SLRAM is not set
++# CONFIG_MTD_PHRAM is not set
++# CONFIG_MTD_MTDRAM is not set
++# CONFIG_MTD_BLOCK2MTD is not set
++
++#
++# Disk-On-Chip Device Drivers
++#
++# CONFIG_MTD_DOC2000 is not set
++# CONFIG_MTD_DOC2001 is not set
++# CONFIG_MTD_DOC2001PLUS is not set
++CONFIG_MTD_GOLDFISH_NAND=y
++# CONFIG_MTD_NAND is not set
++# CONFIG_MTD_ONENAND is not set
++
++#
++# LPDDR flash memory drivers
++#
++# CONFIG_MTD_LPDDR is not set
++
++#
++# UBI - Unsorted block images
++#
++# CONFIG_MTD_UBI is not set
++# CONFIG_PARPORT is not set
++CONFIG_BLK_DEV=y
++# CONFIG_BLK_DEV_COW_COMMON is not set
++CONFIG_BLK_DEV_LOOP=y
++# CONFIG_BLK_DEV_CRYPTOLOOP is not set
++CONFIG_BLK_DEV_NBD=y
++CONFIG_BLK_DEV_RAM=y
++CONFIG_BLK_DEV_RAM_COUNT=16
++CONFIG_BLK_DEV_RAM_SIZE=8192
++# CONFIG_BLK_DEV_XIP is not set
++# CONFIG_CDROM_PKTCDVD is not set
++# CONFIG_ATA_OVER_ETH is not set
++CONFIG_MISC_DEVICES=y
++CONFIG_ANDROID_PMEM=y
++# CONFIG_ENCLOSURE_SERVICES is not set
++# CONFIG_KERNEL_DEBUGGER_CORE is not set
++# CONFIG_UID_STAT is not set
++CONFIG_QEMU_TRACE=y
++# CONFIG_C2PORT is not set
++
++#
++# EEPROM support
++#
++# CONFIG_EEPROM_93CX6 is not set
++CONFIG_HAVE_IDE=y
++# CONFIG_IDE is not set
++
++#
++# SCSI device support
++#
++# CONFIG_RAID_ATTRS is not set
++# CONFIG_SCSI is not set
++# CONFIG_SCSI_DMA is not set
++# CONFIG_SCSI_NETLINK is not set
++# CONFIG_ATA is not set
++# CONFIG_MD is not set
++CONFIG_NETDEVICES=y
++# CONFIG_DUMMY is not set
++# CONFIG_BONDING is not set
++# CONFIG_MACVLAN is not set
++# CONFIG_EQUALIZER is not set
++# CONFIG_TUN is not set
++# CONFIG_VETH is not set
++# CONFIG_PHYLIB is not set
++CONFIG_NET_ETHERNET=y
++CONFIG_MII=y
++# CONFIG_AX88796 is not set
++CONFIG_SMC91X=y
++# CONFIG_DM9000 is not set
++# CONFIG_SMC911X is not set
++# CONFIG_SMSC911X is not set
++# CONFIG_DNET is not set
++# CONFIG_IBM_NEW_EMAC_ZMII is not set
++# CONFIG_IBM_NEW_EMAC_RGMII is not set
++# CONFIG_IBM_NEW_EMAC_TAH is not set
++# CONFIG_IBM_NEW_EMAC_EMAC4 is not set
++# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
++# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
++# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
++# CONFIG_B44 is not set
++CONFIG_NETDEV_1000=y
++CONFIG_NETDEV_10000=y
++
++#
++# Wireless LAN
++#
++# CONFIG_WLAN_PRE80211 is not set
++# CONFIG_WLAN_80211 is not set
++# CONFIG_IWLWIFI_LEDS is not set
++
++#
++# Enable WiMAX (Networking options) to see the WiMAX drivers
++#
++# CONFIG_WAN is not set
++# CONFIG_PPP is not set
++# CONFIG_SLIP is not set
++# CONFIG_NETCONSOLE is not set
++# CONFIG_NETPOLL is not set
++# CONFIG_NET_POLL_CONTROLLER is not set
++# CONFIG_ISDN is not set
++
++#
++# Input device support
++#
++CONFIG_INPUT=y
++# CONFIG_INPUT_FF_MEMLESS is not set
++# CONFIG_INPUT_POLLDEV is not set
++
++#
++# Userland interfaces
++#
++CONFIG_INPUT_MOUSEDEV=y
++CONFIG_INPUT_MOUSEDEV_PSAUX=y
++CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
++CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
++# CONFIG_INPUT_JOYDEV is not set
++CONFIG_INPUT_EVDEV=y
++# CONFIG_INPUT_EVBUG is not set
++# CONFIG_INPUT_KEYRESET is not set
++
++#
++# Input Device Drivers
++#
++CONFIG_INPUT_KEYBOARD=y
++CONFIG_KEYBOARD_ATKBD=y
++# CONFIG_KEYBOARD_SUNKBD is not set
++# CONFIG_KEYBOARD_LKKBD is not set
++# CONFIG_KEYBOARD_XTKBD is not set
++# CONFIG_KEYBOARD_NEWTON is not set
++# CONFIG_KEYBOARD_STOWAWAY is not set
++CONFIG_KEYBOARD_GOLDFISH_EVENTS=y
++# CONFIG_INPUT_MOUSE is not set
++# CONFIG_INPUT_JOYSTICK is not set
++# CONFIG_INPUT_TABLET is not set
++# CONFIG_INPUT_TOUCHSCREEN is not set
++CONFIG_INPUT_MISC=y
++# CONFIG_INPUT_ATI_REMOTE is not set
++# CONFIG_INPUT_ATI_REMOTE2 is not set
++# CONFIG_INPUT_KEYSPAN_REMOTE is not set
++# CONFIG_INPUT_POWERMATE is not set
++# CONFIG_INPUT_YEALINK is not set
++# CONFIG_INPUT_CM109 is not set
++# CONFIG_INPUT_UINPUT is not set
++# CONFIG_INPUT_GPIO is not set
++# CONFIG_INPUT_KEYCHORD is not set
++
++#
++# Hardware I/O ports
++#
++CONFIG_SERIO=y
++# CONFIG_SERIO_SERPORT is not set
++CONFIG_SERIO_LIBPS2=y
++# CONFIG_SERIO_RAW is not set
++# CONFIG_GAMEPORT is not set
++
++#
++# Character devices
++#
++CONFIG_VT=y
++CONFIG_CONSOLE_TRANSLATIONS=y
++CONFIG_VT_CONSOLE=y
++CONFIG_HW_CONSOLE=y
++# CONFIG_VT_HW_CONSOLE_BINDING is not set
++CONFIG_DEVMEM=y
++CONFIG_DEVKMEM=y
++# CONFIG_SERIAL_NONSTANDARD is not set
++
++#
++# Serial drivers
++#
++# CONFIG_SERIAL_8250 is not set
++
++#
++# Non-8250 serial port support
++#
++CONFIG_UNIX98_PTYS=y
++# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
++# CONFIG_LEGACY_PTYS is not set
++# CONFIG_IPMI_HANDLER is not set
++CONFIG_HW_RANDOM=y
++# CONFIG_R3964 is not set
++# CONFIG_RAW_DRIVER is not set
++# CONFIG_TCG_TPM is not set
++# CONFIG_DCC_TTY is not set
++CONFIG_GOLDFISH_TTY=y
++# CONFIG_I2C is not set
++# CONFIG_SPI is not set
++# CONFIG_W1 is not set
++CONFIG_POWER_SUPPLY=y
++# CONFIG_POWER_SUPPLY_DEBUG is not set
++# CONFIG_PDA_POWER is not set
++# CONFIG_BATTERY_DS2760 is not set
++CONFIG_BATTERY_GOLDFISH=y
++# CONFIG_HWMON is not set
++# CONFIG_THERMAL is not set
++# CONFIG_THERMAL_HWMON is not set
++# CONFIG_WATCHDOG is not set
++CONFIG_SSB_POSSIBLE=y
++
++#
++# Sonics Silicon Backplane
++#
++# CONFIG_SSB is not set
++
++#
++# Multifunction device drivers
++#
++# CONFIG_MFD_CORE is not set
++# CONFIG_MFD_SM501 is not set
++# CONFIG_HTC_PASIC3 is not set
++# CONFIG_MFD_TMIO is not set
++
++#
++# Multimedia devices
++#
++
++#
++# Multimedia core support
++#
++# CONFIG_VIDEO_DEV is not set
++# CONFIG_DVB_CORE is not set
++# CONFIG_VIDEO_MEDIA is not set
++
++#
++# Multimedia drivers
++#
++# CONFIG_DAB is not set
++
++#
++# Graphics support
++#
++# CONFIG_VGASTATE is not set
++# CONFIG_VIDEO_OUTPUT_CONTROL is not set
++CONFIG_FB=y
++# CONFIG_FIRMWARE_EDID is not set
++# CONFIG_FB_DDC is not set
++# CONFIG_FB_BOOT_VESA_SUPPORT is not set
++CONFIG_FB_CFB_FILLRECT=y
++CONFIG_FB_CFB_COPYAREA=y
++CONFIG_FB_CFB_IMAGEBLIT=y
++# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
++# CONFIG_FB_SYS_FILLRECT is not set
++# CONFIG_FB_SYS_COPYAREA is not set
++# CONFIG_FB_SYS_IMAGEBLIT is not set
++# CONFIG_FB_FOREIGN_ENDIAN is not set
++# CONFIG_FB_SYS_FOPS is not set
++# CONFIG_FB_SVGALIB is not set
++# CONFIG_FB_MACMODES is not set
++# CONFIG_FB_BACKLIGHT is not set
++CONFIG_FB_MODE_HELPERS=y
++CONFIG_FB_TILEBLITTING=y
++
++#
++# Frame buffer hardware drivers
++#
++# CONFIG_FB_UVESA is not set
++# CONFIG_FB_S1D13XXX is not set
++CONFIG_FB_GOLDFISH=y
++# CONFIG_FB_VIRTUAL is not set
++# CONFIG_FB_METRONOME is not set
++# CONFIG_FB_MB862XX is not set
++# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
++
++#
++# Display device support
++#
++# CONFIG_DISPLAY_SUPPORT is not set
++
++#
++# Console display driver support
++#
++# CONFIG_VGA_CONSOLE is not set
++CONFIG_DUMMY_CONSOLE=y
++CONFIG_FRAMEBUFFER_CONSOLE=y
++# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
++# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
++# CONFIG_FONTS is not set
++CONFIG_FONT_8x8=y
++CONFIG_FONT_8x16=y
++# CONFIG_LOGO is not set
++# CONFIG_SOUND is not set
++CONFIG_HID_SUPPORT=y
++CONFIG_HID=y
++# CONFIG_HID_DEBUG is not set
++# CONFIG_HIDRAW is not set
++# CONFIG_HID_PID is not set
++
++#
++# Special HID drivers
++#
++CONFIG_HID_COMPAT=y
++CONFIG_USB_SUPPORT=y
++CONFIG_USB_ARCH_HAS_HCD=y
++# CONFIG_USB_ARCH_HAS_OHCI is not set
++# CONFIG_USB_ARCH_HAS_EHCI is not set
++# CONFIG_USB is not set
++
++#
++# Enable Host or Gadget support to see Inventra options
++#
++
++#
++# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
++#
++# CONFIG_USB_GADGET is not set
++
++#
++# OTG and related infrastructure
++#
++CONFIG_MMC=y
++# CONFIG_MMC_DEBUG is not set
++# CONFIG_MMC_UNSAFE_RESUME is not set
++# CONFIG_MMC_EMBEDDED_SDIO is not set
++# CONFIG_MMC_PARANOID_SD_INIT is not set
++
++#
++# MMC/SD/SDIO Card Drivers
++#
++CONFIG_MMC_BLOCK=y
++CONFIG_MMC_BLOCK_BOUNCE=y
++CONFIG_MMC_BLOCK_PARANOID_RESUME=y
++# CONFIG_SDIO_UART is not set
++# CONFIG_MMC_TEST is not set
++
++#
++# MMC/SD/SDIO Host Controller Drivers
++#
++# CONFIG_MMC_SDHCI is not set
++CONFIG_MMC_GOLDFISH=y
++# CONFIG_MEMSTICK is not set
++# CONFIG_ACCESSIBILITY is not set
++# CONFIG_NEW_LEDS is not set
++# CONFIG_SWITCH is not set
++CONFIG_RTC_LIB=y
++CONFIG_RTC_CLASS=y
++CONFIG_RTC_HCTOSYS=y
++CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
++# CONFIG_RTC_DEBUG is not set
++
++#
++# RTC interfaces
++#
++CONFIG_RTC_INTF_SYSFS=y
++CONFIG_RTC_INTF_PROC=y
++CONFIG_RTC_INTF_DEV=y
++# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
++CONFIG_RTC_INTF_ALARM=y
++# CONFIG_RTC_DRV_TEST is not set
++
++#
++# SPI RTC drivers
++#
++
++#
++# Platform RTC drivers
++#
++# CONFIG_RTC_DRV_CMOS is not set
++# CONFIG_RTC_DRV_DS1286 is not set
++# CONFIG_RTC_DRV_DS1511 is not set
++# CONFIG_RTC_DRV_DS1553 is not set
++# CONFIG_RTC_DRV_DS1742 is not set
++# CONFIG_RTC_DRV_STK17TA8 is not set
++# CONFIG_RTC_DRV_M48T86 is not set
++# CONFIG_RTC_DRV_M48T35 is not set
++# CONFIG_RTC_DRV_M48T59 is not set
++# CONFIG_RTC_DRV_BQ4802 is not set
++# CONFIG_RTC_DRV_V3020 is not set
++
++#
++# on-CPU RTC drivers
++#
++CONFIG_RTC_DRV_GOLDFISH=y
++# CONFIG_DMADEVICES is not set
++# CONFIG_REGULATOR is not set
++# CONFIG_UIO is not set
++CONFIG_STAGING=y
++# CONFIG_STAGING_EXCLUDE_BUILD is not set
++# CONFIG_ECHO is not set
++
++#
++# Android
++#
++CONFIG_ANDROID=y
++CONFIG_ANDROID_BINDER_IPC=y
++CONFIG_ANDROID_LOGGER=y
++# CONFIG_ANDROID_RAM_CONSOLE is not set
++CONFIG_ANDROID_TIMED_OUTPUT=y
++CONFIG_ANDROID_LOW_MEMORY_KILLER=y
++
++#
++# File systems
++#
++# CONFIG_EXT2_FS is not set
++# CONFIG_EXT3_FS is not set
++# CONFIG_EXT4_FS is not set
++# CONFIG_REISERFS_FS is not set
++# CONFIG_JFS_FS is not set
++# CONFIG_FS_POSIX_ACL is not set
++CONFIG_FILE_LOCKING=y
++# CONFIG_XFS_FS is not set
++# CONFIG_OCFS2_FS is not set
++# CONFIG_BTRFS_FS is not set
++CONFIG_DNOTIFY=y
++CONFIG_INOTIFY=y
++CONFIG_INOTIFY_USER=y
++# CONFIG_QUOTA is not set
++# CONFIG_AUTOFS_FS is not set
++# CONFIG_AUTOFS4_FS is not set
++# CONFIG_FUSE_FS is not set
++
++#
++# CD-ROM/DVD Filesystems
++#
++# CONFIG_ISO9660_FS is not set
++# CONFIG_UDF_FS is not set
++
++#
++# DOS/FAT/NT Filesystems
++#
++CONFIG_FAT_FS=y
++CONFIG_MSDOS_FS=y
++CONFIG_VFAT_FS=y
++CONFIG_FAT_DEFAULT_CODEPAGE=437
++CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
++# CONFIG_NTFS_FS is not set
++
++#
++# Pseudo filesystems
++#
++CONFIG_PROC_FS=y
++CONFIG_PROC_SYSCTL=y
++CONFIG_PROC_PAGE_MONITOR=y
++CONFIG_SYSFS=y
++CONFIG_TMPFS=y
++# CONFIG_TMPFS_POSIX_ACL is not set
++# CONFIG_HUGETLB_PAGE is not set
++# CONFIG_CONFIGFS_FS is not set
++CONFIG_MISC_FILESYSTEMS=y
++# CONFIG_ADFS_FS is not set
++# CONFIG_AFFS_FS is not set
++# CONFIG_HFS_FS is not set
++# CONFIG_HFSPLUS_FS is not set
++# CONFIG_BEFS_FS is not set
++# CONFIG_BFS_FS is not set
++# CONFIG_EFS_FS is not set
++CONFIG_YAFFS_FS=y
++CONFIG_YAFFS_YAFFS1=y
++# CONFIG_YAFFS_9BYTE_TAGS is not set
++# CONFIG_YAFFS_DOES_ECC is not set
++CONFIG_YAFFS_YAFFS2=y
++CONFIG_YAFFS_AUTO_YAFFS2=y
++# CONFIG_YAFFS_DISABLE_LAZY_LOAD is not set
++# CONFIG_YAFFS_DISABLE_WIDE_TNODES is not set
++# CONFIG_YAFFS_ALWAYS_CHECK_CHUNK_ERASED is not set
++CONFIG_YAFFS_SHORT_NAMES_IN_RAM=y
++# CONFIG_JFFS2_FS is not set
++# CONFIG_CRAMFS is not set
++# CONFIG_SQUASHFS is not set
++# CONFIG_VXFS_FS is not set
++# CONFIG_MINIX_FS is not set
++# CONFIG_OMFS_FS is not set
++# CONFIG_HPFS_FS is not set
++# CONFIG_QNX4FS_FS is not set
++# CONFIG_ROMFS_FS is not set
++# CONFIG_SYSV_FS is not set
++# CONFIG_UFS_FS is not set
++CONFIG_NETWORK_FILESYSTEMS=y
++# CONFIG_NFS_FS is not set
++CONFIG_NFSD=y
++CONFIG_NFSD_V3=y
++# CONFIG_NFSD_V3_ACL is not set
++# CONFIG_NFSD_V4 is not set
++CONFIG_LOCKD=y
++CONFIG_LOCKD_V4=y
++CONFIG_EXPORTFS=y
++CONFIG_NFS_COMMON=y
++CONFIG_SUNRPC=y
++# CONFIG_SUNRPC_REGISTER_V4 is not set
++# CONFIG_RPCSEC_GSS_KRB5 is not set
++# CONFIG_RPCSEC_GSS_SPKM3 is not set
++CONFIG_SMB_FS=y
++# CONFIG_SMB_NLS_DEFAULT is not set
++# CONFIG_CIFS is not set
++# CONFIG_NCP_FS is not set
++# CONFIG_CODA_FS is not set
++# CONFIG_AFS_FS is not set
++
++#
++# Partition Types
++#
++# CONFIG_PARTITION_ADVANCED is not set
++CONFIG_MSDOS_PARTITION=y
++CONFIG_NLS=y
++CONFIG_NLS_DEFAULT="iso8859-1"
++CONFIG_NLS_CODEPAGE_437=y
++# CONFIG_NLS_CODEPAGE_737 is not set
++# CONFIG_NLS_CODEPAGE_775 is not set
++# CONFIG_NLS_CODEPAGE_850 is not set
++# CONFIG_NLS_CODEPAGE_852 is not set
++# CONFIG_NLS_CODEPAGE_855 is not set
++# CONFIG_NLS_CODEPAGE_857 is not set
++# CONFIG_NLS_CODEPAGE_860 is not set
++# CONFIG_NLS_CODEPAGE_861 is not set
++# CONFIG_NLS_CODEPAGE_862 is not set
++# CONFIG_NLS_CODEPAGE_863 is not set
++# CONFIG_NLS_CODEPAGE_864 is not set
++# CONFIG_NLS_CODEPAGE_865 is not set
++# CONFIG_NLS_CODEPAGE_866 is not set
++# CONFIG_NLS_CODEPAGE_869 is not set
++# CONFIG_NLS_CODEPAGE_936 is not set
++# CONFIG_NLS_CODEPAGE_950 is not set
++# CONFIG_NLS_CODEPAGE_932 is not set
++# CONFIG_NLS_CODEPAGE_949 is not set
++# CONFIG_NLS_CODEPAGE_874 is not set
++# CONFIG_NLS_ISO8859_8 is not set
++# CONFIG_NLS_CODEPAGE_1250 is not set
++# CONFIG_NLS_CODEPAGE_1251 is not set
++# CONFIG_NLS_ASCII is not set
++CONFIG_NLS_ISO8859_1=y
++# CONFIG_NLS_ISO8859_2 is not set
++# CONFIG_NLS_ISO8859_3 is not set
++# CONFIG_NLS_ISO8859_4 is not set
++# CONFIG_NLS_ISO8859_5 is not set
++# CONFIG_NLS_ISO8859_6 is not set
++# CONFIG_NLS_ISO8859_7 is not set
++# CONFIG_NLS_ISO8859_9 is not set
++# CONFIG_NLS_ISO8859_13 is not set
++# CONFIG_NLS_ISO8859_14 is not set
++# CONFIG_NLS_ISO8859_15 is not set
++# CONFIG_NLS_KOI8_R is not set
++# CONFIG_NLS_KOI8_U is not set
++# CONFIG_NLS_UTF8 is not set
++# CONFIG_DLM is not set
++
++#
++# Kernel hacking
++#
++# CONFIG_PRINTK_TIME is not set
++CONFIG_ENABLE_WARN_DEPRECATED=y
++CONFIG_ENABLE_MUST_CHECK=y
++CONFIG_FRAME_WARN=1024
++CONFIG_MAGIC_SYSRQ=y
++# CONFIG_UNUSED_SYMBOLS is not set
++# CONFIG_DEBUG_FS is not set
++# CONFIG_HEADERS_CHECK is not set
++CONFIG_DEBUG_KERNEL=y
++# CONFIG_DEBUG_SHIRQ is not set
++# CONFIG_DETECT_SOFTLOCKUP is not set
++CONFIG_SCHED_DEBUG=y
++CONFIG_SCHEDSTATS=y
++# CONFIG_TIMER_STATS is not set
++# CONFIG_DEBUG_OBJECTS is not set
++# CONFIG_DEBUG_SLAB is not set
++# CONFIG_DEBUG_RT_MUTEXES is not set
++# CONFIG_RT_MUTEX_TESTER is not set
++# CONFIG_DEBUG_SPINLOCK is not set
++# CONFIG_DEBUG_MUTEXES is not set
++# CONFIG_DEBUG_LOCK_ALLOC is not set
++# CONFIG_PROVE_LOCKING is not set
++# CONFIG_LOCK_STAT is not set
++# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
++# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
++# CONFIG_DEBUG_KOBJECT is not set
++CONFIG_DEBUG_BUGVERBOSE=y
++# CONFIG_DEBUG_INFO is not set
++# CONFIG_DEBUG_VM is not set
++# CONFIG_DEBUG_WRITECOUNT is not set
++CONFIG_DEBUG_MEMORY_INIT=y
++# CONFIG_DEBUG_LIST is not set
++# CONFIG_DEBUG_SG is not set
++# CONFIG_DEBUG_NOTIFIERS is not set
++CONFIG_FRAME_POINTER=y
++# CONFIG_BOOT_PRINTK_DELAY is not set
++# CONFIG_RCU_TORTURE_TEST is not set
++# CONFIG_RCU_CPU_STALL_DETECTOR is not set
++# CONFIG_BACKTRACE_SELF_TEST is not set
++# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
++# CONFIG_FAULT_INJECTION is not set
++# CONFIG_LATENCYTOP is not set
++# CONFIG_SYSCTL_SYSCALL_CHECK is not set
++CONFIG_HAVE_FUNCTION_TRACER=y
++
++#
++# Tracers
++#
++# CONFIG_FUNCTION_TRACER is not set
++# CONFIG_IRQSOFF_TRACER is not set
++# CONFIG_SCHED_TRACER is not set
++# CONFIG_CONTEXT_SWITCH_TRACER is not set
++# CONFIG_BOOT_TRACER is not set
++# CONFIG_TRACE_BRANCH_PROFILING is not set
++# CONFIG_STACK_TRACER is not set
++# CONFIG_DYNAMIC_PRINTK_DEBUG is not set
++# CONFIG_SAMPLES is not set
++CONFIG_HAVE_ARCH_KGDB=y
++# CONFIG_KGDB is not set
++# CONFIG_DEBUG_USER is not set
++# CONFIG_DEBUG_ERRORS is not set
++# CONFIG_DEBUG_STACK_USAGE is not set
++# CONFIG_DEBUG_LL is not set
++
++#
++# Security options
++#
++# CONFIG_KEYS is not set
++# CONFIG_SECURITY is not set
++# CONFIG_SECURITYFS is not set
++# CONFIG_SECURITY_FILE_CAPABILITIES is not set
++CONFIG_CRYPTO=y
++
++#
++# Crypto core or helper
++#
++# CONFIG_CRYPTO_FIPS is not set
++CONFIG_CRYPTO_ALGAPI=y
++CONFIG_CRYPTO_ALGAPI2=y
++CONFIG_CRYPTO_AEAD=y
++CONFIG_CRYPTO_AEAD2=y
++CONFIG_CRYPTO_BLKCIPHER=y
++CONFIG_CRYPTO_BLKCIPHER2=y
++CONFIG_CRYPTO_HASH=y
++CONFIG_CRYPTO_HASH2=y
++CONFIG_CRYPTO_RNG2=y
++CONFIG_CRYPTO_MANAGER=y
++CONFIG_CRYPTO_MANAGER2=y
++# CONFIG_CRYPTO_GF128MUL is not set
++# CONFIG_CRYPTO_NULL is not set
++# CONFIG_CRYPTO_CRYPTD is not set
++CONFIG_CRYPTO_AUTHENC=y
++
++#
++# Authenticated Encryption with Associated Data
++#
++# CONFIG_CRYPTO_CCM is not set
++# CONFIG_CRYPTO_GCM is not set
++# CONFIG_CRYPTO_SEQIV is not set
++
++#
++# Block modes
++#
++CONFIG_CRYPTO_CBC=y
++# CONFIG_CRYPTO_CTR is not set
++# CONFIG_CRYPTO_CTS is not set
++CONFIG_CRYPTO_ECB=y
++# CONFIG_CRYPTO_LRW is not set
++CONFIG_CRYPTO_PCBC=y
++# CONFIG_CRYPTO_XTS is not set
++
++#
++# Hash modes
++#
++CONFIG_CRYPTO_HMAC=y
++# CONFIG_CRYPTO_XCBC is not set
++
++#
++# Digest
++#
++# CONFIG_CRYPTO_CRC32C is not set
++# CONFIG_CRYPTO_MD4 is not set
++CONFIG_CRYPTO_MD5=y
++# CONFIG_CRYPTO_MICHAEL_MIC is not set
++# CONFIG_CRYPTO_RMD128 is not set
++# CONFIG_CRYPTO_RMD160 is not set
++# CONFIG_CRYPTO_RMD256 is not set
++# CONFIG_CRYPTO_RMD320 is not set
++CONFIG_CRYPTO_SHA1=y
++# CONFIG_CRYPTO_SHA256 is not set
++# CONFIG_CRYPTO_SHA512 is not set
++# CONFIG_CRYPTO_TGR192 is not set
++# CONFIG_CRYPTO_WP512 is not set
++
++#
++# Ciphers
++#
++# CONFIG_CRYPTO_AES is not set
++# CONFIG_CRYPTO_ANUBIS is not set
++# CONFIG_CRYPTO_ARC4 is not set
++# CONFIG_CRYPTO_BLOWFISH is not set
++# CONFIG_CRYPTO_CAMELLIA is not set
++# CONFIG_CRYPTO_CAST5 is not set
++# CONFIG_CRYPTO_CAST6 is not set
++CONFIG_CRYPTO_DES=y
++# CONFIG_CRYPTO_FCRYPT is not set
++# CONFIG_CRYPTO_KHAZAD is not set
++# CONFIG_CRYPTO_SALSA20 is not set
++# CONFIG_CRYPTO_SEED is not set
++# CONFIG_CRYPTO_SERPENT is not set
++# CONFIG_CRYPTO_TEA is not set
++# CONFIG_CRYPTO_TWOFISH is not set
++
++#
++# Compression
++#
++CONFIG_CRYPTO_DEFLATE=y
++# CONFIG_CRYPTO_LZO is not set
++
++#
++# Random Number Generation
++#
++# CONFIG_CRYPTO_ANSI_CPRNG is not set
++CONFIG_CRYPTO_HW=y
++
++#
++# Library routines
++#
++CONFIG_BITREVERSE=y
++CONFIG_GENERIC_FIND_LAST_BIT=y
++# CONFIG_CRC_CCITT is not set
++# CONFIG_CRC16 is not set
++# CONFIG_CRC_T10DIF is not set
++# CONFIG_CRC_ITU_T is not set
++CONFIG_CRC32=y
++# CONFIG_CRC7 is not set
++# CONFIG_LIBCRC32C is not set
++CONFIG_ZLIB_INFLATE=y
++CONFIG_ZLIB_DEFLATE=y
++CONFIG_PLIST=y
++CONFIG_HAS_IOMEM=y
++CONFIG_HAS_IOPORT=y
++CONFIG_HAS_DMA=y
+--- /dev/null
++++ b/arch/arm/mach-goldfish/Kconfig
+@@ -0,0 +1,11 @@
++if ARCH_GOLDFISH
++
++menu "Goldfish Options"
++
++config MACH_GOLDFISH
++	bool "Goldfish (Virtual Platform)"
++	select CPU_ARM926T
++
++endmenu
++
++endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/Makefile
+@@ -0,0 +1,9 @@
++#
++# Makefile for the linux kernel.
++#
++
++# Object file lists.
++
++obj-y				:= pdev_bus.o timer.o
++obj-$(CONFIG_MACH_GOLDFISH)	+= board-goldfish.o
++
+--- /dev/null
++++ b/arch/arm/mach-goldfish/Makefile.boot
+@@ -0,0 +1,4 @@
++   zreladdr-y	:= 0x00008000
++params_phys-y	:= 0x00000100
++initrd_phys-y	:= 0x00800000
++
+--- /dev/null
++++ b/arch/arm/mach-goldfish/board-goldfish.c
+@@ -0,0 +1,122 @@
++/* arch/arm/mach-goldfish/board-goldfish.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/platform_device.h>
++#include <linux/delay.h>
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/nand.h>
++#include <linux/mtd/partitions.h>
++#include <linux/input.h>
++
++#include <mach/hardware.h>
++#include <asm/io.h>
++#include <asm/mach-types.h>
++#include <asm/mach/arch.h>
++#include <asm/mach/flash.h>
++#include <asm/mach/map.h>
++#include <asm/mach/time.h>
++
++int GOLDFISH_READY = 0;
++
++static struct resource goldfish_pdev_bus_resources[] = {
++	{
++		.start  = GOLDFISH_PDEV_BUS_BASE,
++		.end    = GOLDFISH_PDEV_BUS_BASE + GOLDFISH_PDEV_BUS_END - 1,
++		.flags  = IORESOURCE_IO,
++	},
++	{
++		.start	= IRQ_PDEV_BUS,
++		.end	= IRQ_PDEV_BUS,
++		.flags	= IORESOURCE_IRQ,
++	}
++};
++
++
++struct platform_device goldfish_pdev_bus_device = {
++	.name = "goldfish_pdev_bus",
++	.id = -1,
++	.num_resources = ARRAY_SIZE(goldfish_pdev_bus_resources),
++	.resource = goldfish_pdev_bus_resources
++};
++
++static void __init goldfish_init(void)
++{
++	platform_device_register(&goldfish_pdev_bus_device);
++}
++
++void goldfish_mask_irq(unsigned int irq)
++{
++	writel(irq, IO_ADDRESS(GOLDFISH_INTERRUPT_BASE) + GOLDFISH_INTERRUPT_DISABLE);
++}
++
++void goldfish_unmask_irq(unsigned int irq)
++{
++	writel(irq, IO_ADDRESS(GOLDFISH_INTERRUPT_BASE) + GOLDFISH_INTERRUPT_ENABLE);
++}
++
++static struct irq_chip goldfish_irq_chip = {
++	.name	= "goldfish",
++	.mask	= goldfish_mask_irq,
++	.mask_ack = goldfish_mask_irq,
++	.unmask = goldfish_unmask_irq,
++};
++
++void goldfish_init_irq(void)
++{
++	unsigned int i;
++	uint32_t int_base = IO_ADDRESS(GOLDFISH_INTERRUPT_BASE);
++
++	/*
++	 * Disable all interrupt sources
++	 */
++	writel(1, int_base + GOLDFISH_INTERRUPT_DISABLE_ALL);
++
++	for (i = 0; i < NR_IRQS; i++) {
++		set_irq_chip(i, &goldfish_irq_chip);
++		set_irq_handler(i, handle_level_irq);
++		set_irq_flags(i, IRQF_VALID | IRQF_PROBE);
++	}
++}
++
++static struct map_desc goldfish_io_desc[] __initdata = {
++	{
++		.virtual	= IO_BASE,
++		.pfn		= __phys_to_pfn(IO_START),
++		.length		= IO_SIZE,
++		.type		= MT_DEVICE
++	},
++};
++
++static void __init goldfish_map_io(void)
++{
++	iotable_init(goldfish_io_desc, ARRAY_SIZE(goldfish_io_desc));
++    GOLDFISH_READY = 1;
++}
++
++extern struct sys_timer goldfish_timer;
++
++MACHINE_START(GOLDFISH, "Goldfish")
++	.phys_io	= 0xff000000,
++	.io_pg_offst	= ((0xfe000000) >> 18) & 0xfffc,
++	.boot_params	= 0x00000100,
++	.map_io		= goldfish_map_io,
++	.init_irq	= goldfish_init_irq,
++	.init_machine	= goldfish_init,
++	.timer		= &goldfish_timer,
++MACHINE_END
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/dma.h
+@@ -0,0 +1 @@
++/* include/asm-arm/arch-goldfish/dma.h */
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/entry-macro.S
+@@ -0,0 +1,34 @@
++/* include/asm-arm/arch-goldfish/entry-macro.S
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <mach/hardware.h>
++#include <mach/irqs.h>
++
++	.macro  disable_fiq
++	.endm
++
++	.macro  get_irqnr_preamble, base, tmp
++	.endm
++
++	.macro  arch_ret_to_user, tmp1, tmp2
++	.endm
++
++	.macro  get_irqnr_and_base, irqnr, irqstat, base, tmp
++	ldr     \base, =IO_ADDRESS(GOLDFISH_INTERRUPT_BASE)
++	ldr     \irqnr, [\base, #GOLDFISH_INTERRUPT_NUMBER]
++	ldr     \irqstat, [\base, #GOLDFISH_INTERRUPT_STATUS]
++	teq     \irqstat, #0
++	/* EQ will be set if no irqs pending */
++	.endm
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/hardware.h
+@@ -0,0 +1,44 @@
++/* include/asm-arm/arch-goldfish/hardware.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARCH_HARDWARE_H
++#define __ASM_ARCH_HARDWARE_H
++
++#include <asm/sizes.h>
++
++/*
++ * Where in virtual memory the IO devices (timers, system controllers
++ * and so on)
++ */
++#define IO_BASE			0xfe000000                 // VA of IO 
++#define IO_SIZE			0x00800000                 // How much?
++#define IO_START		0xff000000                 // PA of IO
++
++#define GOLDFISH_INTERRUPT_BASE     (0x0)
++#define GOLDFISH_INTERRUPT_STATUS       (0x00) // number of pending interrupts
++#define GOLDFISH_INTERRUPT_NUMBER       (0x04)
++#define GOLDFISH_INTERRUPT_DISABLE_ALL  (0x08)
++#define GOLDFISH_INTERRUPT_DISABLE      (0x0c)
++#define GOLDFISH_INTERRUPT_ENABLE       (0x10)
++
++#define GOLDFISH_PDEV_BUS_BASE      (0x1000)
++#define GOLDFISH_PDEV_BUS_END       (0x100)
++
++#define GOLDFISH_TIMER_BASE     (0x3000)
++
++/* macro to get at IO space when running virtually */
++#define IO_ADDRESS(x) ((x) + IO_BASE)
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/io.h
+@@ -0,0 +1,24 @@
++/* include/asm-arm/arch-goldfish/io.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARM_ARCH_IO_H
++#define __ASM_ARM_ARCH_IO_H
++
++#define IO_SPACE_LIMIT 0xffffffff
++
++#define __io(a)			((void __iomem *)(a))
++#define __mem_pci(a)		(a)
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/irqs.h
+@@ -0,0 +1,24 @@
++/* include/asm-arm/arch-goldfish/irqs.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARCH_IRQS_H
++#define __ASM_ARCH_IRQS_H
++
++#define IRQ_PDEV_BUS    (1)
++#define IRQ_TIMER       (3)
++
++#define NR_IRQS         (256)
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/memory.h
+@@ -0,0 +1,35 @@
++/* include/asm-arm/arch-goldfish/memory.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARCH_MEMORY_H
++#define __ASM_ARCH_MEMORY_H
++
++/*
++ * Physical DRAM offset.
++ */
++#define PHYS_OFFSET	UL(0x00000000)
++#define BUS_OFFSET	UL(0x00000000)
++
++/*
++ * Virtual view <-> DMA view memory address translations
++ * virt_to_bus: Used to translate the virtual address to an
++ *              address suitable to be passed to set_dma_addr
++ * bus_to_virt: Used to convert an address for DMA operations
++ *              to an address that the kernel can use.
++ */
++#define __virt_to_bus(x)	(x - PAGE_OFFSET + BUS_OFFSET)
++#define __bus_to_virt(x)	(x - BUS_OFFSET + PAGE_OFFSET)
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/system.h
+@@ -0,0 +1,30 @@
++/* include/asm-arm/arch-goldfish/system.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARCH_SYSTEM_H
++#define __ASM_ARCH_SYSTEM_H
++
++#include <asm/proc-fns.h>
++
++static inline void arch_idle(void)
++{
++	cpu_do_idle();
++}
++
++static inline void arch_reset(char mode, const char *cmd)
++{
++}
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/timer.h
+@@ -0,0 +1,28 @@
++/* include/asm-arm/arch-goldfish/timer.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARCH_TIMER_H
++#define __ASM_ARCH_TIMER_H
++
++enum {
++	TIMER_TIME_LOW          = 0x00, // get low bits of current time and update TIMER_TIME_HIGH
++	TIMER_TIME_HIGH         = 0x04, // get high bits of time at last TIMER_TIME_LOW read
++	TIMER_ALARM_LOW         = 0x08, // set low bits of alarm and activate it
++	TIMER_ALARM_HIGH        = 0x0c, // set high bits of next alarm
++	TIMER_CLEAR_INTERRUPT   = 0x10,
++	TIMER_CLEAR_ALARM       = 0x14
++};
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/timex.h
+@@ -0,0 +1,24 @@
++/* include/asm-arm/arch-goldfish/timex.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARCH_TIMEX_H
++#define __ASM_ARCH_TIMEX_H
++
++/*
++ * ??
++ */
++#define CLOCK_TICK_RATE		(50000000 / 16)
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/uncompress.h
+@@ -0,0 +1,40 @@
++/* include/asm-arm/arch-goldfish/uncompress.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARCH_UNCOMPRESS_H
++#define __ASM_ARCH_UNCOMPRESS_H
++
++#define GOLDFISH_TTY_PUT_CHAR (*(volatile unsigned int *)0xff002000)
++
++/*
++ * This does not append a newline
++ */
++static void putc(int c)
++{
++	GOLDFISH_TTY_PUT_CHAR = c;
++}
++
++static inline void flush(void)
++{
++}
++
++/*
++ * nothing to do
++ */
++#define arch_decomp_setup()
++
++#define arch_decomp_wdog()
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/include/mach/vmalloc.h
+@@ -0,0 +1,21 @@
++/* include/asm-arm/arch-goldfish/vmalloc.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef __ASM_ARCH_VMALLOC_H
++#define __ASM_ARCH_VMALLOC_H
++
++#define VMALLOC_END       (PAGE_OFFSET + 0x3c000000)
++
++#endif
+--- /dev/null
++++ b/arch/arm/mach-goldfish/pdev_bus.c
+@@ -0,0 +1,222 @@
++/* arch/arm/mach-goldfish/pdev_bus.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/platform_device.h>
++
++#include <mach/hardware.h>
++#include <asm/io.h>
++#include <asm/mach-types.h>
++#include <asm/mach/arch.h>
++
++#define PDEV_BUS_OP_DONE        (0x00)
++#define PDEV_BUS_OP_REMOVE_DEV  (0x04)
++#define PDEV_BUS_OP_ADD_DEV     (0x08)
++
++#define PDEV_BUS_OP_INIT        (0x00)
++
++#define PDEV_BUS_OP             (0x00)
++#define PDEV_BUS_GET_NAME       (0x04)
++#define PDEV_BUS_NAME_LEN       (0x08)
++#define PDEV_BUS_ID             (0x0c)
++#define PDEV_BUS_IO_BASE        (0x10)
++#define PDEV_BUS_IO_SIZE        (0x14)
++#define PDEV_BUS_IRQ            (0x18)
++#define PDEV_BUS_IRQ_COUNT      (0x1c)
++
++struct pdev_bus_dev {
++	struct list_head list;
++	struct platform_device pdev;
++	struct resource resources[0];
++};
++
++static void goldfish_pdev_worker(struct work_struct *work);
++
++static uint32_t pdev_bus_base;
++static uint32_t pdev_bus_irq;
++static LIST_HEAD(pdev_bus_new_devices);
++static LIST_HEAD(pdev_bus_registered_devices);
++static LIST_HEAD(pdev_bus_removed_devices);
++static DECLARE_WORK(pdev_bus_worker, goldfish_pdev_worker);
++
++
++static void goldfish_pdev_worker(struct work_struct *work)
++{
++	int ret;
++	struct pdev_bus_dev *pos, *n;
++
++	list_for_each_entry_safe(pos, n, &pdev_bus_removed_devices, list) {
++		list_del(&pos->list);
++		platform_device_unregister(&pos->pdev);
++		kfree(pos);
++	}
++	list_for_each_entry_safe(pos, n, &pdev_bus_new_devices, list) {
++		list_del(&pos->list);
++		ret = platform_device_register(&pos->pdev);
++		if(ret) {
++			printk("goldfish_pdev_worker failed to register device, %s\n", pos->pdev.name);
++		}
++		else {
++			printk("goldfish_pdev_worker registered %s\n", pos->pdev.name);
++		}
++		list_add(&pos->list, &pdev_bus_registered_devices);
++	}
++}
++
++static void goldfish_pdev_remove(void)
++{
++	struct pdev_bus_dev *pos, *n;
++	uint32_t base;
++	
++	base = readl(pdev_bus_base + PDEV_BUS_IO_BASE);
++
++	list_for_each_entry_safe(pos, n, &pdev_bus_new_devices, list) {
++		if(pos->resources[0].start == base) {
++			list_del(&pos->list);
++			kfree(pos);
++			return;
++		}
++	}
++	list_for_each_entry_safe(pos, n, &pdev_bus_registered_devices, list) {
++		if(pos->resources[0].start == base) {
++			list_del(&pos->list);
++			list_add(&pos->list, &pdev_bus_removed_devices);
++			schedule_work(&pdev_bus_worker);
++			return;
++		}
++	};
++	printk("goldfish_pdev_remove could not find device at %x\n", base);
++}
++
++static int goldfish_new_pdev(void)
++{
++	struct pdev_bus_dev *dev;
++	uint32_t name_len;
++	uint32_t irq = -1, irq_count;
++	int resource_count = 2;
++	uint32_t base;
++	char *name;
++
++	base = readl(pdev_bus_base + PDEV_BUS_IO_BASE);
++
++	irq_count = readl(pdev_bus_base + PDEV_BUS_IRQ_COUNT);
++	name_len = readl(pdev_bus_base + PDEV_BUS_NAME_LEN);
++	if(irq_count)
++		resource_count++;
++
++	dev = kzalloc(sizeof(*dev) + sizeof(struct resource) * resource_count + name_len + 1, GFP_ATOMIC);
++	if(dev == NULL)
++		return -ENOMEM;
++
++	dev->pdev.num_resources = resource_count;
++	dev->pdev.resource = (struct resource *)(dev + 1);
++	dev->pdev.name = name = (char *)(dev->pdev.resource + resource_count);
++	dev->pdev.dev.coherent_dma_mask = ~0;
++
++	writel(name, pdev_bus_base + PDEV_BUS_GET_NAME);
++	name[name_len] = '\0';
++	dev->pdev.id = readl(pdev_bus_base + PDEV_BUS_ID);
++	dev->pdev.resource[0].start = base;
++	dev->pdev.resource[0].end = base + readl(pdev_bus_base + PDEV_BUS_IO_SIZE) - 1;
++	dev->pdev.resource[0].flags = IORESOURCE_MEM;
++	if(irq_count) {
++		irq = readl(pdev_bus_base + PDEV_BUS_IRQ);
++		dev->pdev.resource[1].start = irq;
++		dev->pdev.resource[1].end = irq + irq_count - 1;
++		dev->pdev.resource[1].flags = IORESOURCE_IRQ;
++	}
++
++	printk("goldfish_new_pdev %s at %x irq %d\n", name, base, irq);
++	list_add(&dev->list, &pdev_bus_new_devices);
++	schedule_work(&pdev_bus_worker);
++	
++	return 0;
++}
++
++static irqreturn_t goldfish_pdev_bus_interrupt(int irq, void *dev_id)
++{
++	irqreturn_t ret = IRQ_NONE;
++	while(1) {
++		uint32_t op = readl(pdev_bus_base + PDEV_BUS_OP);
++		switch(op) {
++			case PDEV_BUS_OP_DONE:
++				return IRQ_NONE;
++
++			case PDEV_BUS_OP_REMOVE_DEV:
++				goldfish_pdev_remove();
++				break;
++
++			case PDEV_BUS_OP_ADD_DEV:
++				goldfish_new_pdev();
++				break;
++		}
++		ret = IRQ_HANDLED;
++	}
++}
++
++static int __devinit goldfish_pdev_bus_probe(struct platform_device *pdev)
++{
++	int ret;
++	struct resource *r;
++	r = platform_get_resource(pdev, IORESOURCE_IO, 0);
++	if(r == NULL)
++		return -EINVAL;
++	pdev_bus_base = IO_ADDRESS(r->start);
++
++	r = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++	if(r == NULL)
++		return -EINVAL;
++	pdev_bus_irq = r->start;
++
++	ret = request_irq(pdev_bus_irq, goldfish_pdev_bus_interrupt, IRQF_SHARED, "goldfish_pdev_bus", pdev);
++	if(ret)
++		goto err_request_irq_failed;
++
++	writel(PDEV_BUS_OP_INIT, pdev_bus_base + PDEV_BUS_OP);
++
++err_request_irq_failed:
++	return ret;
++}
++
++static int __devexit goldfish_pdev_bus_remove(struct platform_device *pdev)
++{
++	free_irq(pdev_bus_irq, pdev);
++	return 0;
++}
++
++static struct platform_driver goldfish_pdev_bus_driver = {
++	.probe = goldfish_pdev_bus_probe,
++	.remove = __devexit_p(goldfish_pdev_bus_remove),
++	.driver = {
++		.name = "goldfish_pdev_bus"
++	}
++};
++
++static int __init goldfish_pdev_bus_init(void)
++{
++	return platform_driver_register(&goldfish_pdev_bus_driver);
++}
++
++static void __exit goldfish_pdev_bus_exit(void)
++{
++	platform_driver_unregister(&goldfish_pdev_bus_driver);
++}
++
++module_init(goldfish_pdev_bus_init);
++module_exit(goldfish_pdev_bus_exit);
++
+--- /dev/null
++++ b/arch/arm/mach-goldfish/timer.c
+@@ -0,0 +1,147 @@
++/* arch/arm/mach-goldfish/timer.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <linux/clockchips.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++
++#include <mach/timer.h>
++#include <mach/hardware.h>
++#include <asm/io.h>
++#include <asm/mach/time.h>
++
++#include <linux/platform_device.h>
++
++static DEFINE_SPINLOCK(goldfish_timer_lock);
++static int goldfish_timer_ready;
++
++static irqreturn_t goldfish_timer_interrupt(int irq, void *dev_id)
++{
++	uint32_t timer_base = IO_ADDRESS(GOLDFISH_TIMER_BASE);
++	struct clock_event_device *evt = dev_id;
++
++	writel(1, timer_base + TIMER_CLEAR_INTERRUPT);
++	if (evt->event_handler)
++		evt->event_handler(evt);
++	return IRQ_HANDLED;
++}
++
++static cycle_t goldfish_timer_read(void)
++{
++	uint32_t timer_base = IO_ADDRESS(GOLDFISH_TIMER_BASE);
++	unsigned long irqflags;
++	cycle_t rv;
++
++	spin_lock_irqsave(&goldfish_timer_lock, irqflags);
++	rv = readl(timer_base + TIMER_TIME_LOW);
++	rv |= (int64_t)readl(timer_base + TIMER_TIME_HIGH) << 32;
++	spin_unlock_irqrestore(&goldfish_timer_lock, irqflags);
++	return rv;
++}
++
++static int goldfish_timer_set_next_event(unsigned long cycles,
++                                         struct clock_event_device *evt)
++{
++	uint32_t timer_base = IO_ADDRESS(GOLDFISH_TIMER_BASE);
++	unsigned long irqflags;
++	uint64_t alarm;
++
++	spin_lock_irqsave(&goldfish_timer_lock, irqflags);
++	alarm = readl(timer_base + TIMER_TIME_LOW);
++	alarm |= (int64_t)readl(timer_base + TIMER_TIME_HIGH) << 32;
++	alarm += cycles;
++	writel(alarm >> 32, timer_base + TIMER_ALARM_HIGH);
++	writel(alarm, timer_base + TIMER_ALARM_LOW);
++	spin_unlock_irqrestore(&goldfish_timer_lock, irqflags);
++	return 0;
++}
++
++static void goldfish_timer_set_mode(enum clock_event_mode mode,
++                                    struct clock_event_device *evt)
++{
++	uint32_t timer_base = IO_ADDRESS(GOLDFISH_TIMER_BASE);
++	switch (mode) {
++		case CLOCK_EVT_MODE_RESUME:
++		case CLOCK_EVT_MODE_PERIODIC:
++			break;
++		case CLOCK_EVT_MODE_ONESHOT:
++			break;
++		case CLOCK_EVT_MODE_UNUSED:
++		case CLOCK_EVT_MODE_SHUTDOWN:
++			writel(1, timer_base + TIMER_CLEAR_ALARM);
++			break;
++	}
++}
++
++unsigned long long sched_clock(void)
++{
++	if(goldfish_timer_ready)
++		return ktime_to_ns(ktime_get());
++	else
++		return 0;
++}
++
++static struct clock_event_device goldfish_clockevent = {
++	.name           = "goldfish_timer",
++	.features       = CLOCK_EVT_FEAT_ONESHOT,
++	.max_delta_ns   = ULONG_MAX,
++	.min_delta_ns   = 1,
++	.mult           = 1,
++	.shift          = 0,
++	.rating         = 200,
++	.set_next_event = goldfish_timer_set_next_event,
++	.set_mode       = goldfish_timer_set_mode,
++};
++
++static struct clocksource goldfish_clocksource = {
++	.name           = "goldfish_timer",
++	.rating         = 200,
++	.read           = goldfish_timer_read,
++	.mult           = 1,
++	.mask           = CLOCKSOURCE_MASK(64),
++	.shift          = 0,
++	.flags          = CLOCK_SOURCE_IS_CONTINUOUS,
++};
++
++static struct irqaction goldfish_timer_irq = {
++	.name		= "Goldfish Timer Tick",
++	.flags		= IRQF_DISABLED | IRQF_TIMER,
++	.handler	= goldfish_timer_interrupt,
++	.dev_id		= &goldfish_clockevent,
++};
++
++static void __init goldfish_timer_init(void)
++{
++	int res;
++
++	res = clocksource_register(&goldfish_clocksource);
++	if (res)
++		printk(KERN_ERR "goldfish_timer_init: "
++		       "clocksource_register failed\n");
++
++	res = setup_irq(IRQ_TIMER, &goldfish_timer_irq);
++	if (res)
++		printk(KERN_ERR "goldfish_timer_init: setup_irq failed\n");
++
++	goldfish_clockevent.cpumask = cpumask_of(0);
++	clockevents_register_device(&goldfish_clockevent);
++
++	goldfish_timer_ready = 1;
++}
++
++struct sys_timer goldfish_timer = {
++	.init		= goldfish_timer_init,
++};
++
diff --git a/target/linux/goldfish/patches-2.6.30/0120--ARM-goldfish-Add-audio-driver-for-goldfish.patch b/target/linux/goldfish/patches-2.6.30/0120--ARM-goldfish-Add-audio-driver-for-goldfish.patch
new file mode 100644
index 0000000000..23f4b8f659
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0120--ARM-goldfish-Add-audio-driver-for-goldfish.patch
@@ -0,0 +1,404 @@
+From aefe5257bf3ed9bf950ad962a63e5315566c2f97 Mon Sep 17 00:00:00 2001
+From: Mike Lockwood <lockwood@google.com>
+Date: Mon, 23 Jul 2007 09:31:54 -0400
+Subject: [PATCH 120/134] [ARM] goldfish: Add audio driver for goldfish.
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+---
+ arch/arm/mach-goldfish/Makefile |    2 +-
+ arch/arm/mach-goldfish/audio.c  |  379 +++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 380 insertions(+), 1 deletions(-)
+ create mode 100644 arch/arm/mach-goldfish/audio.c
+
+--- a/arch/arm/mach-goldfish/Makefile
++++ b/arch/arm/mach-goldfish/Makefile
+@@ -4,6 +4,6 @@
+ 
+ # Object file lists.
+ 
+-obj-y				:= pdev_bus.o timer.o
++obj-y				:= pdev_bus.o timer.o audio.o
+ obj-$(CONFIG_MACH_GOLDFISH)	+= board-goldfish.o
+ 
+--- /dev/null
++++ b/arch/arm/mach-goldfish/audio.c
+@@ -0,0 +1,379 @@
++/* arch/arm/mach-goldfish/audio.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <linux/module.h>
++#include <linux/miscdevice.h>
++#include <linux/fs.h>
++#include <linux/platform_device.h>
++
++#include <linux/types.h>
++#include <linux/pci.h>
++#include <linux/interrupt.h>
++
++#include <asm/types.h>
++#include <asm/io.h>
++#include <asm/uaccess.h>
++
++
++MODULE_AUTHOR("Google, Inc.");
++MODULE_DESCRIPTION("Android QEMU Audio Driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION("1.0");
++
++struct goldfish_audio {
++	uint32_t reg_base;
++	int irq;
++	spinlock_t lock;
++	wait_queue_head_t wait;
++	
++	char __iomem *buffer_virt;      /* combined buffer virtual address */
++	unsigned long buffer_phys;      /* combined buffer physical address */
++
++	char __iomem *write_buffer1;    /* write buffer 1 virtual address */
++	char __iomem *write_buffer2;    /* write buffer 2 virtual address */
++	char __iomem *read_buffer;      /* read buffer virtual address */
++	int buffer_status;
++	int read_supported;         /* true if we have audio input support */
++};
++
++/* We will allocate two read buffers and two write buffers.
++   Having two read buffers facilitate stereo -> mono conversion.
++   Having two write buffers facilitate interleaved IO.
++*/
++#define READ_BUFFER_SIZE        16384
++#define WRITE_BUFFER_SIZE       16384
++#define COMBINED_BUFFER_SIZE    ((2 * READ_BUFFER_SIZE) + (2 * WRITE_BUFFER_SIZE))
++
++#define GOLDFISH_AUDIO_READ(data, addr)   (readl(data->reg_base + addr))
++#define GOLDFISH_AUDIO_WRITE(data, addr, x)   (writel(x, data->reg_base + addr))
++
++/* temporary variable used between goldfish_audio_probe() and goldfish_audio_open() */
++static struct goldfish_audio* audio_data;
++
++enum {
++	/* audio status register */
++	AUDIO_INT_STATUS	= 0x00, 
++	/* set this to enable IRQ */
++	AUDIO_INT_ENABLE	= 0x04,
++	/* set these to specify buffer addresses */
++	AUDIO_SET_WRITE_BUFFER_1 = 0x08,
++	AUDIO_SET_WRITE_BUFFER_2 = 0x0C,
++	/* set number of bytes in buffer to write */
++	AUDIO_WRITE_BUFFER_1  = 0x10,
++	AUDIO_WRITE_BUFFER_2  = 0x14,
++
++	/* true if audio input is supported */
++	AUDIO_READ_SUPPORTED = 0x18,
++	/* buffer to use for audio input */
++	AUDIO_SET_READ_BUFFER = 0x1C,
++	
++	/* driver writes number of bytes to read */
++	AUDIO_START_READ  = 0x20,
++
++	/* number of bytes available in read buffer */
++	AUDIO_READ_BUFFER_AVAILABLE  = 0x24,
++
++	/* AUDIO_INT_STATUS bits */
++	
++	/* this bit set when it is safe to write more bytes to the buffer */
++	AUDIO_INT_WRITE_BUFFER_1_EMPTY	= 1U << 0,
++	AUDIO_INT_WRITE_BUFFER_2_EMPTY	= 1U << 1,
++	AUDIO_INT_READ_BUFFER_FULL      = 1U << 2,
++	
++	AUDIO_INT_MASK                  = AUDIO_INT_WRITE_BUFFER_1_EMPTY | 
++	                                  AUDIO_INT_WRITE_BUFFER_2_EMPTY | 
++	                                  AUDIO_INT_READ_BUFFER_FULL,
++};
++
++
++static atomic_t open_count = ATOMIC_INIT(0);
++
++
++static ssize_t goldfish_audio_read(struct file *fp, char __user *buf,
++							size_t count, loff_t *pos)
++{
++	struct goldfish_audio* data = fp->private_data;
++	int length;
++	int result = 0;
++	
++	if (!data->read_supported)
++		return -ENODEV;
++
++	while (count > 0) {
++		length = (count > READ_BUFFER_SIZE ? READ_BUFFER_SIZE : count);
++		GOLDFISH_AUDIO_WRITE(data, AUDIO_START_READ, length);
++
++		wait_event_interruptible(data->wait, (data->buffer_status & AUDIO_INT_READ_BUFFER_FULL));
++
++		length = GOLDFISH_AUDIO_READ(data, AUDIO_READ_BUFFER_AVAILABLE);
++   
++		/* copy data to user space */
++		if (copy_to_user(buf, data->read_buffer, length))
++		{
++			printk("copy_from_user failed!\n");
++			return -EFAULT;
++		}
++		
++		result += length;
++		buf += length;
++		count -= length;
++	}
++
++	return result;
++}
++
++static ssize_t goldfish_audio_write(struct file *fp, const char __user *buf,
++							 size_t count, loff_t *pos)
++{
++	struct goldfish_audio* data = fp->private_data;
++	unsigned long irq_flags;
++	ssize_t result = 0;
++	char __iomem *kbuf;
++
++	while (count > 0)
++	{
++		ssize_t copy = count;
++		if (copy > WRITE_BUFFER_SIZE)
++			copy = WRITE_BUFFER_SIZE;
++		wait_event_interruptible(data->wait, 
++				(data->buffer_status & (AUDIO_INT_WRITE_BUFFER_1_EMPTY | AUDIO_INT_WRITE_BUFFER_2_EMPTY)));
++		
++		if ((data->buffer_status & AUDIO_INT_WRITE_BUFFER_1_EMPTY) != 0) {
++			kbuf = data->write_buffer1;
++		} else {
++			kbuf = data->write_buffer2;
++		}
++
++		/* copy from user space to the appropriate buffer */
++		if (copy_from_user(kbuf, buf, copy))
++		{
++			printk("copy_from_user failed!\n");
++			result = -EFAULT;
++			break;
++		}
++		else
++		{
++			spin_lock_irqsave(&data->lock, irq_flags);
++
++			/* clear the buffer empty flag, and signal the emulator to start writing the buffer */
++			if (kbuf == data->write_buffer1) {
++				data->buffer_status &= ~AUDIO_INT_WRITE_BUFFER_1_EMPTY;
++				GOLDFISH_AUDIO_WRITE(data, AUDIO_WRITE_BUFFER_1, copy);
++			} else {
++				data->buffer_status &= ~AUDIO_INT_WRITE_BUFFER_2_EMPTY;
++				GOLDFISH_AUDIO_WRITE(data, AUDIO_WRITE_BUFFER_2, copy);
++			}
++
++			spin_unlock_irqrestore(&data->lock, irq_flags);
++		}
++ 
++		buf += copy;
++		result += copy;
++		count -= copy;
++	}
++
++	return result;
++}
++
++static int goldfish_audio_open(struct inode *ip, struct file *fp)
++{
++	if (!audio_data)
++		return -ENODEV;
++
++	if (atomic_inc_return(&open_count) == 1) 
++	{
++		fp->private_data = audio_data;
++		audio_data->buffer_status = (AUDIO_INT_WRITE_BUFFER_1_EMPTY | AUDIO_INT_WRITE_BUFFER_2_EMPTY);
++		GOLDFISH_AUDIO_WRITE(audio_data, AUDIO_INT_ENABLE, AUDIO_INT_MASK);
++		return 0;
++	} 
++	else 
++	{
++		atomic_dec(&open_count);
++		return -EBUSY;
++	}
++}
++
++static int goldfish_audio_release(struct inode *ip, struct file* fp)
++{
++	atomic_dec(&open_count);
++	GOLDFISH_AUDIO_WRITE(audio_data, AUDIO_INT_ENABLE, 0);
++	return 0;
++}
++	   
++static int goldfish_audio_ioctl(struct inode* ip, struct file* fp, unsigned int cmd, unsigned long arg)
++{
++	/* temporary workaround, until we switch to the ALSA API */
++	if (cmd == 315)
++		return -1;
++	else
++		return 0;
++}
++
++static irqreturn_t
++goldfish_audio_interrupt(int irq, void *dev_id)
++{
++	unsigned long irq_flags;
++	struct goldfish_audio	*data = dev_id;
++	uint32_t status;
++
++	spin_lock_irqsave(&data->lock, irq_flags);
++	
++	/* read buffer status flags */
++	status = GOLDFISH_AUDIO_READ(data, AUDIO_INT_STATUS);
++	status &= AUDIO_INT_MASK;
++	/* if buffers are newly empty, wake up blocked goldfish_audio_write() call */
++	if(status) {
++		data->buffer_status = status;
++		wake_up(&data->wait);
++	}
++	
++	spin_unlock_irqrestore(&data->lock, irq_flags);
++	return status ? IRQ_HANDLED : IRQ_NONE;
++}
++
++/* file operations for /dev/eac */
++static struct file_operations goldfish_audio_fops = {
++	.owner = THIS_MODULE,
++	.read = goldfish_audio_read,
++	.write = goldfish_audio_write,
++	.open = goldfish_audio_open,
++	.release = goldfish_audio_release,
++   .ioctl = goldfish_audio_ioctl,
++
++};
++	
++static struct miscdevice goldfish_audio_device = {
++	.minor = MISC_DYNAMIC_MINOR,
++	.name = "eac",
++	.fops = &goldfish_audio_fops,
++};
++
++static int goldfish_audio_probe(struct platform_device *pdev)
++{
++	int ret;
++	struct resource *r;
++	struct goldfish_audio *data;
++	dma_addr_t buf_addr;
++
++printk("goldfish_audio_probe\n");
++	data = kzalloc(sizeof(*data), GFP_KERNEL);
++	if(data == NULL) {
++		ret = -ENOMEM;
++		goto err_data_alloc_failed;
++	}
++	spin_lock_init(&data->lock);
++	init_waitqueue_head(&data->wait);
++	platform_set_drvdata(pdev, data);
++
++	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if(r == NULL) {
++		printk("platform_get_resource failed\n");
++		ret = -ENODEV;
++		goto err_no_io_base;
++	}
++	data->reg_base = IO_ADDRESS(r->start - IO_START);
++
++	data->irq = platform_get_irq(pdev, 0);
++	if(data->irq < 0) {
++		printk("platform_get_irq failed\n");
++		ret = -ENODEV;
++		goto err_no_irq;
++	}
++
++	data->buffer_virt = dma_alloc_writecombine(&pdev->dev, COMBINED_BUFFER_SIZE,
++												&buf_addr, GFP_KERNEL);
++	if(data->buffer_virt == 0) {
++		ret = -ENOMEM;
++		goto err_alloc_write_buffer_failed;
++	}
++	data->buffer_phys = buf_addr;
++	data->write_buffer1 = data->buffer_virt;
++	data->write_buffer2 = data->buffer_virt + WRITE_BUFFER_SIZE;
++	data->read_buffer = data->buffer_virt + 2 * WRITE_BUFFER_SIZE;
++	
++	ret = request_irq(data->irq, goldfish_audio_interrupt, IRQF_SHARED, pdev->name, data);
++	if(ret)
++		goto err_request_irq_failed;
++
++	if((ret = misc_register(&goldfish_audio_device))) 
++	{
++		printk("misc_register returned %d in goldfish_audio_init\n", ret);
++		goto err_misc_register_failed;
++	}
++
++	
++	GOLDFISH_AUDIO_WRITE(data, AUDIO_SET_WRITE_BUFFER_1, buf_addr);
++	GOLDFISH_AUDIO_WRITE(data, AUDIO_SET_WRITE_BUFFER_2, buf_addr + WRITE_BUFFER_SIZE);
++
++	data->read_supported = GOLDFISH_AUDIO_READ(data, AUDIO_READ_SUPPORTED);
++	if (data->read_supported)
++		GOLDFISH_AUDIO_WRITE(data, AUDIO_SET_READ_BUFFER, buf_addr + 2 * WRITE_BUFFER_SIZE);
++
++	audio_data = data;
++	return 0;
++
++err_misc_register_failed:
++err_request_irq_failed:
++	dma_free_writecombine(&pdev->dev, COMBINED_BUFFER_SIZE, data->buffer_virt, data->buffer_phys);
++err_alloc_write_buffer_failed:
++err_no_irq:
++err_no_io_base:
++	kfree(data);
++err_data_alloc_failed:
++	return ret;
++}
++
++static int goldfish_audio_remove(struct platform_device *pdev)
++{
++	struct goldfish_audio *data = platform_get_drvdata(pdev);
++
++	misc_deregister(&goldfish_audio_device);
++	free_irq(data->irq, data);
++	dma_free_writecombine(&pdev->dev, COMBINED_BUFFER_SIZE, data->buffer_virt, data->buffer_phys);
++	kfree(data);
++	audio_data = NULL;
++	return 0;
++}
++
++static struct platform_driver goldfish_audio_driver = {
++	.probe		= goldfish_audio_probe,
++	.remove		= goldfish_audio_remove,
++	.driver = {
++		.name = "goldfish_audio"
++	}
++};
++
++static int __init goldfish_audio_init(void)
++{
++	int ret;
++
++	ret = platform_driver_register(&goldfish_audio_driver);
++	if (ret < 0)
++	{
++		printk("platform_driver_register returned %d\n", ret);
++		return ret;
++	}
++
++	return ret;
++}
++
++static void __exit goldfish_audio_exit(void)
++{
++	platform_driver_unregister(&goldfish_audio_driver);
++}
++
++module_init(goldfish_audio_init);
++module_exit(goldfish_audio_exit);
diff --git a/target/linux/goldfish/patches-2.6.30/0121--ARM-goldfish-Implement-suspend-as-wait-for-interr.patch b/target/linux/goldfish/patches-2.6.30/0121--ARM-goldfish-Implement-suspend-as-wait-for-interr.patch
new file mode 100644
index 0000000000..0190820ed8
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0121--ARM-goldfish-Implement-suspend-as-wait-for-interr.patch
@@ -0,0 +1,72 @@
+From f0266de1899f043daff3b472b8fdd6e30012cb25 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Wed, 9 Jan 2008 11:46:33 -0800
+Subject: [PATCH 121/134] [ARM] goldfish: Implement suspend as wait-for-interrupt.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ arch/arm/mach-goldfish/Makefile |    2 +-
+ arch/arm/mach-goldfish/pm.c     |   43 +++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 44 insertions(+), 1 deletions(-)
+ create mode 100644 arch/arm/mach-goldfish/pm.c
+
+--- a/arch/arm/mach-goldfish/Makefile
++++ b/arch/arm/mach-goldfish/Makefile
+@@ -4,6 +4,6 @@
+ 
+ # Object file lists.
+ 
+-obj-y				:= pdev_bus.o timer.o audio.o
++obj-y				:= pdev_bus.o timer.o audio.o pm.o
+ obj-$(CONFIG_MACH_GOLDFISH)	+= board-goldfish.o
+ 
+--- /dev/null
++++ b/arch/arm/mach-goldfish/pm.c
+@@ -0,0 +1,43 @@
++/* arch/arm/mach-msm/pm.c
++ *
++ * Goldfish Power Management Routines
++ *
++ * Copyright (C) 2007 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/pm.h>
++#include <linux/suspend.h>
++#include <mach/system.h>
++
++static int goldfish_pm_enter(suspend_state_t state)
++{
++	arch_idle();
++	return 0;
++}
++
++static struct platform_suspend_ops goldfish_pm_ops = {
++	.enter		= goldfish_pm_enter,
++	.valid		= suspend_valid_only_mem,
++};
++
++static int __init goldfish_pm_init(void)
++{
++	suspend_set_ops(&goldfish_pm_ops);
++	return 0;
++}
++
++__initcall(goldfish_pm_init);
++
diff --git a/target/linux/goldfish/patches-2.6.30/0122--ARM-goldfish-tty-Adding-tty-driver-for-goldfish.patch b/target/linux/goldfish/patches-2.6.30/0122--ARM-goldfish-tty-Adding-tty-driver-for-goldfish.patch
new file mode 100644
index 0000000000..e8767e6bdd
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0122--ARM-goldfish-tty-Adding-tty-driver-for-goldfish.patch
@@ -0,0 +1,368 @@
+From 4ff5a10b94c0c41088c8bbfa5be1ebab3822371b Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@google.com>
+Date: Fri, 29 Jun 2007 21:41:20 -0700
+Subject: [PATCH 122/134] [ARM] goldfish: tty: Adding tty driver for goldfish.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/char/Kconfig        |    6 +
+ drivers/char/Makefile       |    1 +
+ drivers/char/goldfish_tty.c |  323 +++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 330 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/char/goldfish_tty.c
+
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -1106,6 +1106,12 @@ config DEVPORT
+ 	depends on ISA || PCI
+ 	default y
+ 
++config GOLDFISH_TTY
++	tristate "Goldfish TTY Driver"
++	default n
++	help
++	  TTY driver for Goldfish Virtual Platform.
++
+ source "drivers/s390/char/Kconfig"
+ 
+ endmenu
+--- a/drivers/char/Makefile
++++ b/drivers/char/Makefile
+@@ -98,6 +98,7 @@ obj-$(CONFIG_GPIO_DEVICE)	+= gpio_dev.o
+ obj-$(CONFIG_GPIO_VR41XX)	+= vr41xx_giu.o
+ obj-$(CONFIG_GPIO_TB0219)	+= tb0219.o
+ obj-$(CONFIG_TELCLOCK)		+= tlclk.o
++obj-$(CONFIG_GOLDFISH_TTY)	+= goldfish_tty.o
+ 
+ obj-$(CONFIG_MWAVE)		+= mwave/
+ obj-$(CONFIG_AGP)		+= agp/
+--- /dev/null
++++ b/drivers/char/goldfish_tty.c
+@@ -0,0 +1,323 @@
++/* drivers/char/goldfish_tty.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <linux/console.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/platform_device.h>
++#include <linux/tty.h>
++#include <linux/tty_flip.h>
++
++#include <mach/hardware.h>
++#include <asm/io.h>
++
++enum {
++	GOLDFISH_TTY_PUT_CHAR       = 0x00,
++	GOLDFISH_TTY_BYTES_READY    = 0x04,
++	GOLDFISH_TTY_CMD            = 0x08,
++
++	GOLDFISH_TTY_DATA_PTR       = 0x10,
++	GOLDFISH_TTY_DATA_LEN       = 0x14,
++
++	GOLDFISH_TTY_CMD_INT_DISABLE    = 0,
++	GOLDFISH_TTY_CMD_INT_ENABLE     = 1,
++	GOLDFISH_TTY_CMD_WRITE_BUFFER   = 2,
++	GOLDFISH_TTY_CMD_READ_BUFFER    = 3,
++};
++
++struct goldfish_tty {
++	spinlock_t lock;
++	uint32_t base;
++	uint32_t irq;
++	int opencount;
++	struct tty_struct *tty;
++	struct console console;
++};
++
++static DEFINE_MUTEX(goldfish_tty_lock);
++static struct tty_driver *goldfish_tty_driver;
++static uint32_t goldfish_tty_line_count = 8;
++static uint32_t goldfish_tty_current_line_count;
++static struct goldfish_tty *goldfish_ttys;
++
++static void goldfish_tty_do_write(int line, const char *buf, unsigned count)
++{
++	unsigned long irq_flags;
++	struct goldfish_tty *qtty = &goldfish_ttys[line];
++	uint32_t base = qtty->base;
++	spin_lock_irqsave(&qtty->lock, irq_flags);
++	writel(buf, base + GOLDFISH_TTY_DATA_PTR);
++	writel(count, base + GOLDFISH_TTY_DATA_LEN);
++	writel(GOLDFISH_TTY_CMD_WRITE_BUFFER, base + GOLDFISH_TTY_CMD);
++	spin_unlock_irqrestore(&qtty->lock, irq_flags);
++}
++
++static irqreturn_t goldfish_tty_interrupt(int irq, void *dev_id)
++{
++	struct platform_device *pdev = dev_id;
++	struct goldfish_tty *qtty = &goldfish_ttys[pdev->id];
++	uint32_t base = qtty->base;
++	unsigned long irq_flags;
++	unsigned char *buf;
++	uint32_t count;
++
++	count = readl(base + GOLDFISH_TTY_BYTES_READY);
++	if(count == 0) {
++		return IRQ_NONE;
++	}
++	count = tty_prepare_flip_string(qtty->tty, &buf, count);
++	spin_lock_irqsave(&qtty->lock, irq_flags);
++	writel(buf, base + GOLDFISH_TTY_DATA_PTR);
++	writel(count, base + GOLDFISH_TTY_DATA_LEN);
++	writel(GOLDFISH_TTY_CMD_READ_BUFFER, base + GOLDFISH_TTY_CMD);
++	spin_unlock_irqrestore(&qtty->lock, irq_flags);
++	tty_schedule_flip(qtty->tty);
++	return IRQ_HANDLED;
++}
++
++static int goldfish_tty_open(struct tty_struct * tty, struct file * filp)
++{
++	int ret;
++	struct goldfish_tty *qtty = &goldfish_ttys[tty->index];
++
++	mutex_lock(&goldfish_tty_lock);
++	if(qtty->tty == NULL || qtty->tty == tty) {
++		if(qtty->opencount++ == 0) {
++			qtty->tty = tty;
++			writel(GOLDFISH_TTY_CMD_INT_ENABLE, qtty->base + GOLDFISH_TTY_CMD);
++		}
++		ret = 0;
++	}
++	else
++		ret = -EBUSY;
++	mutex_unlock(&goldfish_tty_lock);
++	return ret;
++}
++
++static void goldfish_tty_close(struct tty_struct * tty, struct file * filp)
++{
++	struct goldfish_tty *qtty = &goldfish_ttys[tty->index];
++
++	mutex_lock(&goldfish_tty_lock);
++	if(qtty->tty == tty) {
++		if(--qtty->opencount == 0) {
++			writel(GOLDFISH_TTY_CMD_INT_DISABLE, qtty->base + GOLDFISH_TTY_CMD);
++			qtty->tty = NULL;
++		}
++	}
++	mutex_unlock(&goldfish_tty_lock);
++}
++
++static int goldfish_tty_write(struct tty_struct * tty, const unsigned char *buf, int count)
++{
++	goldfish_tty_do_write(tty->index, buf, count);
++	return count;
++}
++
++static int goldfish_tty_write_room(struct tty_struct *tty)
++{
++	return 0x10000;
++}
++
++static int goldfish_tty_chars_in_buffer(struct tty_struct *tty)
++{
++	struct goldfish_tty *qtty = &goldfish_ttys[tty->index];
++	uint32_t base = qtty->base;
++	return readl(base + GOLDFISH_TTY_BYTES_READY);
++}
++
++static void goldfish_tty_console_write(struct console *co, const char *b, unsigned count)
++{
++	goldfish_tty_do_write(co->index, b, count);
++}
++
++static struct tty_driver *goldfish_tty_console_device(struct console *c, int *index)
++{
++	*index = c->index;
++	return goldfish_tty_driver;
++}
++
++static int goldfish_tty_console_setup(struct console *co, char *options)
++{
++	if((unsigned)co->index > goldfish_tty_line_count)
++		return -ENODEV;
++	if(goldfish_ttys[co->index].base == 0)
++		return -ENODEV;
++	return 0;
++}
++
++static struct tty_operations goldfish_tty_ops = {
++	.open = goldfish_tty_open,
++	.close = goldfish_tty_close,
++	.write = goldfish_tty_write,
++	.write_room = goldfish_tty_write_room,
++	.chars_in_buffer = goldfish_tty_chars_in_buffer,
++};
++
++static int __devinit goldfish_tty_create_driver(void)
++{
++	int ret;
++	struct tty_driver *tty;
++
++	goldfish_ttys = kzalloc(sizeof(*goldfish_ttys) * goldfish_tty_line_count, GFP_KERNEL);
++	if(goldfish_ttys == NULL) {
++		ret = -ENOMEM;
++		goto err_alloc_goldfish_ttys_failed;
++	}
++
++	tty = alloc_tty_driver(goldfish_tty_line_count);
++	if(tty == NULL) {
++		ret = -ENOMEM;
++		goto err_alloc_tty_driver_failed;
++	}
++	tty->driver_name = "goldfish";
++	tty->name = "ttyS";
++	tty->type = TTY_DRIVER_TYPE_SERIAL;
++	tty->subtype = SERIAL_TYPE_NORMAL;
++	tty->init_termios = tty_std_termios;
++	tty->flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
++	tty_set_operations(tty, &goldfish_tty_ops);
++	ret = tty_register_driver(tty);
++	if(ret)
++		goto err_tty_register_driver_failed;
++
++	goldfish_tty_driver = tty;
++	return 0;
++
++err_tty_register_driver_failed:
++	put_tty_driver(tty);
++err_alloc_tty_driver_failed:
++	kfree(goldfish_ttys);
++	goldfish_ttys = NULL;
++err_alloc_goldfish_ttys_failed:
++	return ret;
++}
++
++static void goldfish_tty_delete_driver(void)
++{
++	tty_unregister_driver(goldfish_tty_driver);
++	put_tty_driver(goldfish_tty_driver);
++	goldfish_tty_driver = NULL;
++	kfree(goldfish_ttys);
++	goldfish_ttys = NULL;
++}
++
++static int __devinit goldfish_tty_probe(struct platform_device *pdev)
++{
++	int ret;
++	int i;
++	struct resource *r;
++	struct device *ttydev;
++	uint32_t base;
++	uint32_t irq;
++
++	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if(r == NULL)
++		return -EINVAL;
++	base = IO_ADDRESS(r->start - IO_START);
++	r = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++	if(r == NULL)
++		return -EINVAL;
++	irq = r->start;
++
++	if(pdev->id >= goldfish_tty_line_count)
++		return -EINVAL;
++
++	mutex_lock(&goldfish_tty_lock);
++	if(goldfish_tty_current_line_count == 0) {
++		ret = goldfish_tty_create_driver();
++		if(ret)
++			goto err_create_driver_failed;
++	}
++	goldfish_tty_current_line_count++;
++
++	spin_lock_init(&goldfish_ttys[pdev->id].lock);
++	goldfish_ttys[pdev->id].base = base;
++	goldfish_ttys[pdev->id].irq = irq;
++
++	writel(GOLDFISH_TTY_CMD_INT_DISABLE, base + GOLDFISH_TTY_CMD);
++
++	ret = request_irq(irq, goldfish_tty_interrupt, IRQF_SHARED, "goldfish_tty", pdev);
++	if(ret)
++		goto err_request_irq_failed;
++
++
++	ttydev = tty_register_device(goldfish_tty_driver, pdev->id, NULL);
++	if(IS_ERR(ttydev)) {
++		ret = PTR_ERR(ttydev);
++		goto err_tty_register_device_failed;
++	}
++
++	strcpy(goldfish_ttys[pdev->id].console.name, "ttyS");
++	goldfish_ttys[pdev->id].console.write		= goldfish_tty_console_write;
++	goldfish_ttys[pdev->id].console.device		= goldfish_tty_console_device;
++	goldfish_ttys[pdev->id].console.setup		= goldfish_tty_console_setup;
++	goldfish_ttys[pdev->id].console.flags		= CON_PRINTBUFFER;
++	goldfish_ttys[pdev->id].console.index		= pdev->id;
++	register_console(&goldfish_ttys[pdev->id].console);
++
++
++	mutex_unlock(&goldfish_tty_lock);
++
++	return 0;
++
++	tty_unregister_device(goldfish_tty_driver, i);
++err_tty_register_device_failed:
++	free_irq(irq, pdev);
++err_request_irq_failed:
++	goldfish_tty_current_line_count--;
++	if(goldfish_tty_current_line_count == 0) {
++		goldfish_tty_delete_driver();
++	}
++err_create_driver_failed:
++	mutex_unlock(&goldfish_tty_lock);
++	return ret;
++}
++
++static int __devexit goldfish_tty_remove(struct platform_device *pdev)
++{
++	mutex_lock(&goldfish_tty_lock);
++	unregister_console(&goldfish_ttys[pdev->id].console);
++	tty_unregister_device(goldfish_tty_driver, pdev->id);
++	goldfish_ttys[pdev->id].base = 0;
++	free_irq(goldfish_ttys[pdev->id].irq, pdev);
++	goldfish_tty_current_line_count--;
++	if(goldfish_tty_current_line_count == 0) {
++		goldfish_tty_delete_driver();
++	}
++	mutex_unlock(&goldfish_tty_lock);
++	return 0;
++}
++
++static struct platform_driver goldfish_tty_platform_driver = {
++	.probe = goldfish_tty_probe,
++	.remove = __devexit_p(goldfish_tty_remove),
++	.driver = {
++		.name = "goldfish_tty"
++	}
++};
++
++static int __init goldfish_tty_init(void)
++{
++	return platform_driver_register(&goldfish_tty_platform_driver);
++}
++
++static void __exit goldfish_tty_exit(void)
++{
++	platform_driver_unregister(&goldfish_tty_platform_driver);
++}
++
++module_init(goldfish_tty_init);
++module_exit(goldfish_tty_exit);
diff --git a/target/linux/goldfish/patches-2.6.30/0123--ARM-goldfish-events-Add-event-driver-for-goldfis.patch b/target/linux/goldfish/patches-2.6.30/0123--ARM-goldfish-events-Add-event-driver-for-goldfis.patch
new file mode 100644
index 0000000000..fd9566e7a7
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0123--ARM-goldfish-events-Add-event-driver-for-goldfis.patch
@@ -0,0 +1,234 @@
+From 226fd290dc2d052e5cd437cc8464e1424e7ebf2c Mon Sep 17 00:00:00 2001
+From: Brian Swetland <swetland@google.com>
+Date: Sun, 13 Aug 2006 21:50:14 +0700
+Subject: [PATCH 123/134] [ARM] goldfish: events: Add event driver for goldfish
+
+this device is a direct pipe from "hardware" to the input
+event subsystem, allowing us to avoid having to route
+"keypad" style events through an AT keyboard driver (gross!)
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+---
+ drivers/input/keyboard/Kconfig           |    5 +
+ drivers/input/keyboard/Makefile          |    1 +
+ drivers/input/keyboard/goldfish_events.c |  190 ++++++++++++++++++++++++++++++
+ 3 files changed, 196 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/input/keyboard/goldfish_events.c
+
+--- a/drivers/input/keyboard/Kconfig
++++ b/drivers/input/keyboard/Kconfig
+@@ -304,6 +304,11 @@ config KEYBOARD_GPIO
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called gpio-keys.
+ 
++config KEYBOARD_GOLDFISH_EVENTS
++	tristate "Generic Input Event device for Goldfish"
++	help
++	  no help
++
+ config KEYBOARD_MAPLE
+ 	tristate "Maple bus keyboard"
+ 	depends on SH_DREAMCAST && MAPLE
+--- a/drivers/input/keyboard/Makefile
++++ b/drivers/input/keyboard/Makefile
+@@ -23,6 +23,7 @@ obj-$(CONFIG_KEYBOARD_PXA27x)		+= pxa27x
+ obj-$(CONFIG_KEYBOARD_PXA930_ROTARY)	+= pxa930_rotary.o
+ obj-$(CONFIG_KEYBOARD_AAED2000)		+= aaed2000_kbd.o
+ obj-$(CONFIG_KEYBOARD_GPIO)		+= gpio_keys.o
++obj-$(CONFIG_KEYBOARD_GOLDFISH_EVENTS)	+= goldfish_events.o
+ obj-$(CONFIG_KEYBOARD_HP6XX)		+= jornada680_kbd.o
+ obj-$(CONFIG_KEYBOARD_HP7XX)		+= jornada720_kbd.o
+ obj-$(CONFIG_KEYBOARD_MAPLE)		+= maple_keyb.o
+--- /dev/null
++++ b/drivers/input/keyboard/goldfish_events.c
+@@ -0,0 +1,190 @@
++/* drivers/input/keyboard/goldfish-events.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/types.h>
++#include <linux/input.h>
++#include <linux/kernel.h>
++#include <linux/platform_device.h>
++
++#include <mach/hardware.h>
++#include <asm/irq.h>
++#include <asm/io.h>
++
++enum {
++	REG_READ        = 0x00,
++	REG_SET_PAGE    = 0x00,
++	REG_LEN         = 0x04,
++	REG_DATA        = 0x08,
++
++	PAGE_NAME       = 0x00000,
++	PAGE_EVBITS     = 0x10000,
++	PAGE_ABSDATA    = 0x20000 | EV_ABS,
++};
++
++struct event_dev {
++    struct input_dev *input;
++    int irq;
++    unsigned addr;
++    char name[0];
++};
++
++static irqreturn_t events_interrupt(int irq, void *dev_id)
++{
++    struct event_dev *edev = dev_id;
++    unsigned type, code, value;
++
++    type = __raw_readl(edev->addr + REG_READ);
++    code = __raw_readl(edev->addr + REG_READ);
++    value = __raw_readl(edev->addr + REG_READ);
++
++    input_event(edev->input, type, code, value);
++    return IRQ_HANDLED;
++}
++
++static void events_import_bits(struct event_dev *edev, unsigned long bits[], unsigned type, size_t count)
++{
++	int i, j;
++	size_t size;
++	uint8_t val;
++	unsigned addr = edev->addr;
++	__raw_writel(PAGE_EVBITS | type, addr + REG_SET_PAGE);
++	size = __raw_readl(addr + REG_LEN) * 8;
++	if (size < count)
++		count = size;
++	addr = addr + REG_DATA;
++	for (i = 0; i < count; i += 8) {
++		val = __raw_readb(addr++);
++		for (j = 0; j < 8; j++)
++			if(val & 1 << j)
++				set_bit(i + j, bits);
++	}
++}
++
++static int events_probe(struct platform_device *pdev)
++{
++    struct input_dev *input_dev;
++    struct event_dev *edev = NULL;
++    struct resource *res;
++    unsigned keymapnamelen;
++    int i;
++    int count;
++    int irq;
++    unsigned addr;
++    int ret;
++    
++    printk("*** events probe ***\n");
++
++    input_dev = input_allocate_device();
++    res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++    if(!input_dev || !res) goto fail;
++
++    addr = (unsigned) ioremap(res->start, 4096);
++    irq = platform_get_irq(pdev, 0);
++
++    printk("events_probe() addr=0x%08x irq=%d\n", addr, irq);
++
++    if(!addr) goto fail;
++    if(irq < 0) goto fail;
++
++    __raw_writel(PAGE_NAME, addr + REG_SET_PAGE);
++    keymapnamelen = __raw_readl(addr + REG_LEN);
++
++    edev = kzalloc(sizeof(struct event_dev) + keymapnamelen + 1, GFP_KERNEL);
++    if (!edev) goto fail;
++
++    edev->input = input_dev;
++    edev->addr = addr;
++    edev->irq = irq;
++    
++    for (i = 0; i < keymapnamelen; i++) {
++        edev->name[i] = __raw_readb(edev->addr + REG_DATA + i);
++    }
++    printk("events_probe() keymap=%s\n", edev->name);
++
++    events_import_bits(edev, input_dev->evbit, EV_SYN, EV_MAX);
++    events_import_bits(edev, input_dev->keybit, EV_KEY, KEY_MAX);
++    events_import_bits(edev, input_dev->relbit, EV_REL, REL_MAX);
++    events_import_bits(edev, input_dev->absbit, EV_ABS, ABS_MAX);
++    events_import_bits(edev, input_dev->mscbit, EV_MSC, MSC_MAX);
++    events_import_bits(edev, input_dev->ledbit, EV_LED, LED_MAX);
++    events_import_bits(edev, input_dev->sndbit, EV_SND, SND_MAX);
++    events_import_bits(edev, input_dev->ffbit, EV_FF, FF_MAX);
++    events_import_bits(edev, input_dev->swbit, EV_SW, SW_MAX);
++
++    __raw_writel(PAGE_ABSDATA, addr + REG_SET_PAGE);
++    count = __raw_readl(addr + REG_LEN) / (4 * 4);
++    if (count > ABS_MAX)
++        count = ABS_MAX;
++    for(i = 0; i < count; i++) {
++        int val[4]; 
++        int j;
++        if (!test_bit(i, input_dev->absbit))
++            continue;
++        for(j = 0; j < ARRAY_SIZE(val); j++)
++            val[j] = __raw_readl(edev->addr + REG_DATA + (i * ARRAY_SIZE(val) + j) * 4);
++        input_set_abs_params(input_dev, i, val[0], val[1], val[2], val[3]);
++    }
++    
++    platform_set_drvdata(pdev, edev);
++
++    input_dev->name = edev->name;
++    input_set_drvdata(input_dev, edev);
++    
++    ret = input_register_device(input_dev);
++    if (ret)
++        goto fail;
++
++    if(request_irq(edev->irq, events_interrupt, 0,
++                   "goldfish-events-keypad", edev) < 0) {
++        input_unregister_device(input_dev);
++        kfree(edev);
++        return -EINVAL;
++    }
++
++    return 0;
++
++fail:
++    kfree(edev);
++    input_free_device(input_dev);
++    
++    return -EINVAL;
++}
++
++static struct platform_driver events_driver = {
++    .probe = events_probe,
++    .driver = {
++        .name = "goldfish_events",
++    },
++};
++
++static int __devinit events_init(void)
++{
++    return platform_driver_register(&events_driver);
++}
++
++
++static void __exit events_exit(void)
++{
++}
++
++module_init(events_init);
++module_exit(events_exit);
++
++MODULE_AUTHOR("Brian Swetland");
++MODULE_DESCRIPTION("Goldfish Event Device");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/goldfish/patches-2.6.30/0124--ARM-goldfish-mmc-goldfish-MMC-driver-building-an.patch b/target/linux/goldfish/patches-2.6.30/0124--ARM-goldfish-mmc-goldfish-MMC-driver-building-an.patch
new file mode 100644
index 0000000000..58ccbb0b12
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0124--ARM-goldfish-mmc-goldfish-MMC-driver-building-an.patch
@@ -0,0 +1,626 @@
+From 2eccfcf4c5c50b412a0859a345d8d28fc043956b Mon Sep 17 00:00:00 2001
+From: Mike Lockwood <lockwood@android.com>
+Date: Thu, 7 Feb 2008 07:47:30 -0500
+Subject: [PATCH 124/134] [ARM] goldfish: mmc: goldfish MMC driver building and runnning in 2.6.27.
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+---
+ drivers/mmc/host/Kconfig    |    8 +
+ drivers/mmc/host/Makefile   |    1 +
+ drivers/mmc/host/goldfish.c |  583 +++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 592 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/mmc/host/goldfish.c
+
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -200,6 +200,14 @@ config MMC_MVSDIO
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called mvsdio.
+ 
++config MMC_GOLDFISH
++	tristate "goldfish qemu Multimedia Card Interface support"
++	depends on ARCH_GOLDFISH
++	help
++	  This selects the Goldfish Multimedia card Interface emulation.
++
++	  If unsure, say N.
++
+ config MMC_SPI
+ 	tristate "MMC/SD/SDIO over SPI"
+ 	depends on SPI_MASTER && !HIGHMEM && HAS_DMA
+--- a/drivers/mmc/host/Makefile
++++ b/drivers/mmc/host/Makefile
+@@ -26,6 +26,7 @@ obj-$(CONFIG_MMC_SPI)		+= mmc_spi.o
+ ifeq ($(CONFIG_OF),y)
+ obj-$(CONFIG_MMC_SPI)		+= of_mmc_spi.o
+ endif
++obj-$(CONFIG_MMC_GOLDFISH)	+= goldfish.o
+ obj-$(CONFIG_MMC_S3C)   	+= s3cmci.o
+ obj-$(CONFIG_MMC_SDRICOH_CS)	+= sdricoh_cs.o
+ obj-$(CONFIG_MMC_TMIO)		+= tmio_mmc.o
+--- /dev/null
++++ b/drivers/mmc/host/goldfish.c
+@@ -0,0 +1,583 @@
++/*
++ *  linux/drivers/media/mmc/goldfish.c
++ *
++ *  Copyright 2007, Google Inc.
++ *
++ *  based on omap.c driver, which was
++ *  Copyright (C) 2004 Nokia Corporation
++ *  Written by Tuukka Tikkanen and Juha Yrjölä<juha.yrjola@nokia.com>
++ *  Misc hacks here and there by Tony Lindgren <tony@atomide.com>
++ *  Other hacks (DMA, SD, etc) by David Brownell
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/major.h>
++
++#include <linux/types.h>
++#include <linux/pci.h>
++#include <linux/interrupt.h>
++
++#include <linux/kernel.h>
++#include <linux/fs.h>
++#include <linux/errno.h>
++#include <linux/hdreg.h>
++#include <linux/kdev_t.h>
++#include <linux/blkdev.h>
++#include <linux/mutex.h>
++#include <linux/scatterlist.h>
++#include <linux/mmc/mmc.h>
++#include <linux/mmc/sdio.h>
++#include <linux/mmc/host.h>
++#include <linux/mmc/card.h>
++
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/ioport.h>
++#include <linux/dma-mapping.h>
++#include <linux/delay.h>
++#include <linux/spinlock.h>
++#include <linux/timer.h>
++#include <linux/clk.h>
++
++#include <asm/io.h>
++#include <asm/irq.h>
++#include <asm/scatterlist.h>
++#include <asm/mach-types.h>
++
++
++#include <asm/types.h>
++#include <asm/io.h>
++#include <asm/uaccess.h>
++
++#define DRIVER_NAME "goldfish_mmc"
++
++#define BUFFER_SIZE   16384
++
++#define GOLDFISH_MMC_READ(host, addr)   (readl(host->reg_base + addr))
++#define GOLDFISH_MMC_WRITE(host, addr, x)   (writel(x, host->reg_base + addr))
++
++
++enum {
++	/* status register */
++	MMC_INT_STATUS	        = 0x00, 
++	/* set this to enable IRQ */
++	MMC_INT_ENABLE	        = 0x04,
++	/* set this to specify buffer address */
++	MMC_SET_BUFFER          = 0x08,
++	
++	/* MMC command number */
++	MMC_CMD	                = 0x0C,	
++
++	/* MMC argument */
++	MMC_ARG	                = 0x10,
++	
++	/* MMC response (or R2 bits 0 - 31) */
++	MMC_RESP_0		        = 0x14,
++
++	/* MMC R2 response bits 32 - 63 */
++	MMC_RESP_1		        = 0x18,
++
++	/* MMC R2 response bits 64 - 95 */
++	MMC_RESP_2		        = 0x1C,
++
++	/* MMC R2 response bits 96 - 127 */
++	MMC_RESP_3		        = 0x20,
++
++	MMC_BLOCK_LENGTH        = 0x24,
++	MMC_BLOCK_COUNT         = 0x28,
++
++	/* MMC state flags */
++	MMC_STATE               = 0x2C,
++
++	/* MMC_INT_STATUS bits */
++	
++	MMC_STAT_END_OF_CMD     = 1U << 0,
++	MMC_STAT_END_OF_DATA    = 1U << 1,
++	MMC_STAT_STATE_CHANGE   = 1U << 2,
++
++	/* MMC_STATE bits */
++	MMC_STATE_INSERTED     = 1U << 0,
++	MMC_STATE_READ_ONLY    = 1U << 1,
++};
++
++/*
++ * Command types
++ */
++#define OMAP_MMC_CMDTYPE_BC	0
++#define OMAP_MMC_CMDTYPE_BCR	1
++#define OMAP_MMC_CMDTYPE_AC	2
++#define OMAP_MMC_CMDTYPE_ADTC	3
++
++
++struct goldfish_mmc_host {
++	struct mmc_request *	mrq;
++	struct mmc_command *	cmd;
++	struct mmc_data *	data;
++	struct mmc_host *	mmc;
++	struct device *		dev;
++	unsigned char		id; /* 16xx chips have 2 MMC blocks */
++	void __iomem		*virt_base;
++	unsigned int		phys_base;
++	int			irq;
++	unsigned char		bus_mode;
++	unsigned char		hw_bus_mode;
++
++	unsigned int		sg_len;
++	unsigned		dma_done:1;
++	unsigned		dma_in_use:1;
++
++	struct work_struct	switch_work;
++	int			switch_last_state;
++
++	uint32_t			reg_base;
++};
++
++static inline int
++goldfish_mmc_cover_is_open(struct goldfish_mmc_host *host)
++{
++	return 0;
++}
++
++static ssize_t
++goldfish_mmc_show_cover_switch(struct device *dev,
++	struct device_attribute *attr, char *buf)
++{
++	struct goldfish_mmc_host *host = dev_get_drvdata(dev);
++
++	return sprintf(buf, "%s\n", goldfish_mmc_cover_is_open(host) ? "open" :
++			"closed");
++}
++
++static DEVICE_ATTR(cover_switch, S_IRUGO, goldfish_mmc_show_cover_switch, NULL);
++
++static void
++goldfish_mmc_start_command(struct goldfish_mmc_host *host, struct mmc_command *cmd)
++{
++	u32 cmdreg;
++	u32 resptype;
++	u32 cmdtype;
++
++	host->cmd = cmd;
++
++	resptype = 0;
++	cmdtype = 0;
++
++	/* Our hardware needs to know exact type */
++	switch (mmc_resp_type(cmd)) {
++	case MMC_RSP_NONE:
++		break;
++	case MMC_RSP_R1:
++	case MMC_RSP_R1B:
++		/* resp 1, 1b, 6, 7 */
++		resptype = 1;
++		break;
++	case MMC_RSP_R2:
++		resptype = 2;
++		break;
++	case MMC_RSP_R3:
++		resptype = 3;
++		break;
++	default:
++		dev_err(mmc_dev(host->mmc), "Invalid response type: %04x\n", mmc_resp_type(cmd));
++		break;
++	}
++
++	if (mmc_cmd_type(cmd) == MMC_CMD_ADTC) {
++		cmdtype = OMAP_MMC_CMDTYPE_ADTC;
++	} else if (mmc_cmd_type(cmd) == MMC_CMD_BC) {
++		cmdtype = OMAP_MMC_CMDTYPE_BC;
++	} else if (mmc_cmd_type(cmd) == MMC_CMD_BCR) {
++		cmdtype = OMAP_MMC_CMDTYPE_BCR;
++	} else {
++		cmdtype = OMAP_MMC_CMDTYPE_AC;
++	}
++
++	cmdreg = cmd->opcode | (resptype << 8) | (cmdtype << 12);
++
++	if (host->bus_mode == MMC_BUSMODE_OPENDRAIN)
++		cmdreg |= 1 << 6;
++
++	if (cmd->flags & MMC_RSP_BUSY)
++		cmdreg |= 1 << 11;
++
++	if (host->data && !(host->data->flags & MMC_DATA_WRITE))
++		cmdreg |= 1 << 15;
++
++	GOLDFISH_MMC_WRITE(host, MMC_ARG, cmd->arg);
++	GOLDFISH_MMC_WRITE(host, MMC_CMD, cmdreg);
++}
++
++static void
++goldfish_mmc_xfer_done(struct goldfish_mmc_host *host, struct mmc_data *data)
++{
++	if (host->dma_in_use) {
++		enum dma_data_direction dma_data_dir;
++
++		if (data->flags & MMC_DATA_WRITE)
++			dma_data_dir = DMA_TO_DEVICE;
++		else
++			dma_data_dir = DMA_FROM_DEVICE;
++
++		if (dma_data_dir == DMA_FROM_DEVICE) {
++			// we don't really have DMA, so we need to copy from our platform driver buffer
++			uint8_t* dest = (uint8_t *)sg_virt(data->sg);
++			memcpy(dest, host->virt_base, data->sg->length);
++		}
++
++		host->data->bytes_xfered += data->sg->length;
++
++		dma_unmap_sg(mmc_dev(host->mmc), data->sg, host->sg_len, dma_data_dir);
++	}
++	
++	host->data = NULL;
++	host->sg_len = 0;
++
++	/* NOTE:  MMC layer will sometimes poll-wait CMD13 next, issuing
++	 * dozens of requests until the card finishes writing data.
++	 * It'd be cheaper to just wait till an EOFB interrupt arrives...
++	 */
++
++	if (!data->stop) {
++		host->mrq = NULL;
++		mmc_request_done(host->mmc, data->mrq);
++		return;
++	}
++
++	goldfish_mmc_start_command(host, data->stop);
++}
++
++static void
++goldfish_mmc_end_of_data(struct goldfish_mmc_host *host, struct mmc_data *data)
++{
++	if (!host->dma_in_use) {
++		goldfish_mmc_xfer_done(host, data);
++		return;
++	}
++	if (host->dma_done)
++		goldfish_mmc_xfer_done(host, data);
++}
++
++static void
++goldfish_mmc_cmd_done(struct goldfish_mmc_host *host, struct mmc_command *cmd)
++{
++	host->cmd = NULL;
++	if (cmd->flags & MMC_RSP_PRESENT) {
++		if (cmd->flags & MMC_RSP_136) {
++			/* response type 2 */
++			cmd->resp[3] =
++				GOLDFISH_MMC_READ(host, MMC_RESP_0);
++			cmd->resp[2] =
++				GOLDFISH_MMC_READ(host, MMC_RESP_1);
++			cmd->resp[1] =
++				GOLDFISH_MMC_READ(host, MMC_RESP_2);
++			cmd->resp[0] =
++				GOLDFISH_MMC_READ(host, MMC_RESP_3);
++		} else {
++			/* response types 1, 1b, 3, 4, 5, 6 */
++			cmd->resp[0] =
++				GOLDFISH_MMC_READ(host, MMC_RESP_0);
++		}
++	}
++
++	if (host->data == NULL || cmd->error) {
++		host->mrq = NULL;
++		mmc_request_done(host->mmc, cmd->mrq);
++	}
++}
++
++static irqreturn_t goldfish_mmc_irq(int irq, void *dev_id)
++{
++	struct goldfish_mmc_host * host = (struct goldfish_mmc_host *)dev_id;
++	u16 status;
++	int end_command;
++	int end_transfer;
++	int transfer_error;
++	int state_changed;
++
++	if (host->cmd == NULL && host->data == NULL) {
++		status = GOLDFISH_MMC_READ(host, MMC_INT_STATUS);
++		dev_info(mmc_dev(host->mmc),"spurious irq 0x%04x\n", status);
++		if (status != 0) {
++			GOLDFISH_MMC_WRITE(host, MMC_INT_STATUS, status);
++			GOLDFISH_MMC_WRITE(host, MMC_INT_ENABLE, 0);
++		}
++		return IRQ_HANDLED;
++	}
++
++	end_command = 0;
++	end_transfer = 0;
++	transfer_error = 0;
++	state_changed = 0;
++
++	while ((status = GOLDFISH_MMC_READ(host, MMC_INT_STATUS)) != 0) {
++		GOLDFISH_MMC_WRITE(host, MMC_INT_STATUS, status);
++
++		if (status & MMC_STAT_END_OF_CMD) {
++			end_command = 1;
++		}
++
++		if (status & MMC_STAT_END_OF_DATA) {
++			end_transfer = 1;
++		}
++		if (status & MMC_STAT_STATE_CHANGE) {
++			state_changed = 1;
++		}
++	}
++
++	if (end_command) {
++		goldfish_mmc_cmd_done(host, host->cmd);
++	}
++	if (transfer_error)
++		goldfish_mmc_xfer_done(host, host->data);
++	else if (end_transfer) {
++		host->dma_done = 1;
++		goldfish_mmc_end_of_data(host, host->data);
++	}
++	if (state_changed) {
++		schedule_work(&host->switch_work);
++	}
++
++	return IRQ_HANDLED;
++}
++
++
++static void goldfish_mmc_switch_handler(struct work_struct *work)
++{
++/*
++	struct goldfish_mmc_host *host = container_of(work, struct goldfish_mmc_host, switch_work);
++	struct mmc_card *card;
++	static int complained = 0;
++	int cards = 0, cover_open;
++
++	cover_open = goldfish_mmc_cover_is_open(host);
++	if (cover_open != host->switch_last_state) {
++		kobject_uevent(&host->dev->kobj, KOBJ_CHANGE);
++		host->switch_last_state = cover_open;
++	}
++	mmc_detect_change(host->mmc, 0);
++	list_for_each_entry(card, &host->mmc->cards, node) {
++		if (mmc_card_present(card))
++			cards++;
++	}
++	if (goldfish_mmc_cover_is_open(host)) {
++		if (!complained) {
++			dev_info(mmc_dev(host->mmc), "cover is open\n");
++			complained = 1;
++		}
++	} else {
++		complained = 0;
++	}
++*/
++}
++
++
++static void
++goldfish_mmc_prepare_data(struct goldfish_mmc_host *host, struct mmc_request *req)
++{
++	struct mmc_data *data = req->data;
++	int block_size;
++	unsigned sg_len;
++	enum dma_data_direction dma_data_dir;
++
++	host->data = data;
++	if (data == NULL) {
++		GOLDFISH_MMC_WRITE(host, MMC_BLOCK_LENGTH, 0);
++		GOLDFISH_MMC_WRITE(host, MMC_BLOCK_COUNT, 0);
++		host->dma_in_use = 0;
++		return;
++	}
++
++	block_size = data->blksz;
++
++	GOLDFISH_MMC_WRITE(host, MMC_BLOCK_COUNT, data->blocks - 1);
++	GOLDFISH_MMC_WRITE(host, MMC_BLOCK_LENGTH, block_size - 1);
++
++	/* cope with calling layer confusion; it issues "single
++	 * block" writes using multi-block scatterlists.
++	 */
++	sg_len = (data->blocks == 1) ? 1 : data->sg_len;
++
++	if (data->flags & MMC_DATA_WRITE)
++		dma_data_dir = DMA_TO_DEVICE;
++	else
++		dma_data_dir = DMA_FROM_DEVICE;
++
++	host->sg_len = dma_map_sg(mmc_dev(host->mmc), data->sg,
++				sg_len, dma_data_dir);
++	host->dma_done = 0;
++	host->dma_in_use = 1;
++	
++	if (dma_data_dir == DMA_TO_DEVICE) {
++		// we don't really have DMA, so we need to copy to our platform driver buffer
++		const uint8_t* src = (uint8_t *)sg_virt(data->sg);
++		memcpy(host->virt_base, src, data->sg->length);
++	}
++}
++
++static void goldfish_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
++{
++	struct goldfish_mmc_host *host = mmc_priv(mmc);
++
++	WARN_ON(host->mrq != NULL);
++
++	host->mrq = req;
++	goldfish_mmc_prepare_data(host, req);
++	goldfish_mmc_start_command(host, req->cmd);
++
++	/* this is to avoid accidentally being detected as an SDIO card in mmc_attach_sdio() */
++	if (req->cmd->opcode == SD_IO_SEND_OP_COND &&
++		req->cmd->flags == (MMC_RSP_SPI_R4 | MMC_RSP_R4 | MMC_CMD_BCR)) {
++		req->cmd->error = -EINVAL;
++	}
++}
++
++static void goldfish_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
++{
++	struct goldfish_mmc_host *host = mmc_priv(mmc);
++
++	host->bus_mode = ios->bus_mode;
++	host->hw_bus_mode = host->bus_mode;
++}
++
++static int goldfish_mmc_get_ro(struct mmc_host *mmc)
++{
++	uint32_t state;
++	struct goldfish_mmc_host *host = mmc_priv(mmc);
++	
++	state = GOLDFISH_MMC_READ(host, MMC_STATE);
++	return ((state & MMC_STATE_READ_ONLY) != 0);
++}
++
++static const struct mmc_host_ops goldfish_mmc_ops = {
++	.request	= goldfish_mmc_request,
++	.set_ios	= goldfish_mmc_set_ios,
++	.get_ro		= goldfish_mmc_get_ro,
++};
++
++static int __init goldfish_mmc_probe(struct platform_device *pdev)
++{
++	struct mmc_host *mmc;
++	struct goldfish_mmc_host *host = NULL;
++	struct resource *res;
++	int ret = 0;
++	int irq;
++	dma_addr_t buf_addr;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	irq = platform_get_irq(pdev, 0);
++	if (res == NULL || irq < 0)
++		return -ENXIO;
++
++	mmc = mmc_alloc_host(sizeof(struct goldfish_mmc_host), &pdev->dev);
++	if (mmc == NULL) {
++		ret = -ENOMEM;
++		goto err_alloc_host_failed;
++	}
++
++	host = mmc_priv(mmc);
++	host->mmc = mmc;	
++	host->reg_base = IO_ADDRESS(res->start - IO_START);
++	host->virt_base = dma_alloc_writecombine(&pdev->dev, BUFFER_SIZE,
++												&buf_addr, GFP_KERNEL);
++	if(host->virt_base == 0) {
++		ret = -EBUSY;
++		goto dma_alloc_failed;
++	}
++	host->phys_base = buf_addr;
++
++	host->id = pdev->id;
++	host->irq = irq;
++
++	mmc->ops = &goldfish_mmc_ops;
++	mmc->f_min = 400000;
++	mmc->f_max = 24000000;
++	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
++	mmc->caps = MMC_CAP_4_BIT_DATA;
++
++	/* Use scatterlist DMA to reduce per-transfer costs.
++	 * NOTE max_seg_size assumption that small blocks aren't
++	 * normally used (except e.g. for reading SD registers).
++	 */
++	mmc->max_phys_segs = 32;
++	mmc->max_hw_segs = 32;
++	mmc->max_blk_size = 2048;	/* MMC_BLOCK_LENGTH is 11 bits (+1) */
++	mmc->max_blk_count = 2048;	/* MMC_BLOCK_COUNT is 11 bits (+1) */
++	mmc->max_req_size = BUFFER_SIZE;
++	mmc->max_seg_size = mmc->max_req_size;
++
++	ret = request_irq(host->irq, goldfish_mmc_irq, 0, DRIVER_NAME, host);
++	if (ret)
++		goto err_request_irq_failed;
++
++	host->dev = &pdev->dev;
++	platform_set_drvdata(pdev, host);
++
++	ret = device_create_file(&pdev->dev, &dev_attr_cover_switch);
++	if (ret)
++		dev_warn(mmc_dev(host->mmc), "Unable to create sysfs attributes\n");
++
++	mmc_add_host(mmc);
++
++	GOLDFISH_MMC_WRITE(host, MMC_SET_BUFFER, host->phys_base);	
++	GOLDFISH_MMC_WRITE(host, MMC_INT_ENABLE, 
++			MMC_STAT_END_OF_CMD | MMC_STAT_END_OF_DATA | MMC_STAT_STATE_CHANGE 
++			);
++
++	// we start with the card present
++	kobject_uevent(&host->dev->kobj, KOBJ_CHANGE);
++	mmc_detect_change(host->mmc, 0);
++
++	INIT_WORK(&host->switch_work, goldfish_mmc_switch_handler);
++
++	return 0;
++
++err_request_irq_failed:
++	dma_free_writecombine(&pdev->dev, BUFFER_SIZE, host->virt_base, host->phys_base);
++dma_alloc_failed:
++	mmc_free_host(host->mmc);
++err_alloc_host_failed:
++	return ret;
++}
++
++static int goldfish_mmc_remove(struct platform_device *pdev)
++{
++	struct goldfish_mmc_host *host = platform_get_drvdata(pdev);
++
++	platform_set_drvdata(pdev, NULL);
++
++	BUG_ON(host == NULL);
++
++	mmc_remove_host(host->mmc);
++	free_irq(host->irq, host);
++	dma_free_writecombine(&pdev->dev, BUFFER_SIZE, host->virt_base, host->phys_base);
++	mmc_free_host(host->mmc);
++
++	return 0;
++}
++
++static struct platform_driver goldfish_mmc_driver = {
++	.probe		= goldfish_mmc_probe,
++	.remove		= goldfish_mmc_remove,
++	.driver		= {
++		.name	= DRIVER_NAME,
++	},
++};
++
++static int __init goldfish_mmc_init(void)
++{
++	return platform_driver_register(&goldfish_mmc_driver);
++}
++
++static void __exit goldfish_mmc_exit(void)
++{
++	platform_driver_unregister(&goldfish_mmc_driver);
++}
++
++module_init(goldfish_mmc_init);
++module_exit(goldfish_mmc_exit);
++
diff --git a/target/linux/goldfish/patches-2.6.30/0125--ARM-goldfish-NAND-Add-nand-driver-for-goldfish.patch b/target/linux/goldfish/patches-2.6.30/0125--ARM-goldfish-NAND-Add-nand-driver-for-goldfish.patch
new file mode 100644
index 0000000000..7aa9525350
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0125--ARM-goldfish-NAND-Add-nand-driver-for-goldfish.patch
@@ -0,0 +1,534 @@
+From bed297dad6283a5926962c1c59f95ad641824630 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@google.com>
+Date: Fri, 29 Jun 2007 22:20:07 -0700
+Subject: [PATCH 125/134] [ARM] goldfish: NAND: Add nand driver for goldfish.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/mtd/devices/Kconfig             |    5 +
+ drivers/mtd/devices/Makefile            |    1 +
+ drivers/mtd/devices/goldfish_nand.c     |  418 +++++++++++++++++++++++++++++++
+ drivers/mtd/devices/goldfish_nand_reg.h |   58 +++++
+ 4 files changed, 482 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/mtd/devices/goldfish_nand.c
+ create mode 100644 drivers/mtd/devices/goldfish_nand_reg.h
+
+diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
+index 6fde0a2..0e9bdd7 100644
+--- a/drivers/mtd/devices/Kconfig
++++ b/drivers/mtd/devices/Kconfig
+@@ -297,5 +297,10 @@ config MTD_DOCPROBE_55AA
+ 	  LinuxBIOS or if you need to recover a DiskOnChip Millennium on which
+ 	  you have managed to wipe the first block.
+ 
++config MTD_GOLDFISH_NAND
++	tristate "Goldfish NAND device"
++	help
++	  none
++
+ endmenu
+ 
+diff --git a/drivers/mtd/devices/Makefile b/drivers/mtd/devices/Makefile
+index 0993d5c..46cf8a8 100644
+--- a/drivers/mtd/devices/Makefile
++++ b/drivers/mtd/devices/Makefile
+@@ -16,3 +16,4 @@ obj-$(CONFIG_MTD_LART)		+= lart.o
+ obj-$(CONFIG_MTD_BLOCK2MTD)	+= block2mtd.o
+ obj-$(CONFIG_MTD_DATAFLASH)	+= mtd_dataflash.o
+ obj-$(CONFIG_MTD_M25P80)	+= m25p80.o
++obj-$(CONFIG_MTD_GOLDFISH_NAND)	+= goldfish_nand.o
+diff --git a/drivers/mtd/devices/goldfish_nand.c b/drivers/mtd/devices/goldfish_nand.c
+new file mode 100644
+index 0000000..6b4b8b1
+--- /dev/null
++++ b/drivers/mtd/devices/goldfish_nand.c
+@@ -0,0 +1,418 @@
++/* drivers/mtd/devices/goldfish_nand.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <asm/div64.h>
++#include <asm/io.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/ioport.h>
++#include <linux/vmalloc.h>
++#include <linux/init.h>
++#include <linux/mtd/compatmac.h>
++#include <linux/mtd/mtd.h>
++#include <linux/platform_device.h>
++
++#include "goldfish_nand_reg.h"
++
++struct goldfish_nand {
++	spinlock_t              lock;
++	unsigned char __iomem  *base;
++	size_t                  mtd_count;
++	struct mtd_info         mtd[0];
++};
++
++static uint32_t goldfish_nand_cmd(struct mtd_info *mtd, enum nand_cmd cmd,
++                              uint64_t addr, uint32_t len, void *ptr)
++{
++	struct goldfish_nand *nand = mtd->priv;
++	uint32_t rv;
++	unsigned long irq_flags;
++	unsigned char __iomem  *base = nand->base;
++
++	spin_lock_irqsave(&nand->lock, irq_flags);
++	writel(mtd - nand->mtd, base + NAND_DEV);
++	writel((uint32_t)(addr >> 32), base + NAND_ADDR_HIGH);
++	writel((uint32_t)addr, base + NAND_ADDR_LOW);
++	writel(len, base + NAND_TRANSFER_SIZE);
++	writel(ptr, base + NAND_DATA);
++	writel(cmd, base + NAND_COMMAND);
++	rv = readl(base + NAND_RESULT);
++	spin_unlock_irqrestore(&nand->lock, irq_flags);
++	return rv;
++}
++
++static int goldfish_nand_erase(struct mtd_info *mtd, struct erase_info *instr)
++{
++	loff_t ofs = instr->addr;
++	uint32_t len = instr->len;
++	uint32_t rem;
++
++	if (ofs + len > mtd->size)
++		goto invalid_arg;
++	rem = do_div(ofs, mtd->writesize);
++	if(rem)
++		goto invalid_arg;
++	ofs *= (mtd->writesize + mtd->oobsize);
++	
++	if(len % mtd->writesize)
++		goto invalid_arg;
++	len = len / mtd->writesize * (mtd->writesize + mtd->oobsize);
++
++	if(goldfish_nand_cmd(mtd, NAND_CMD_ERASE, ofs, len, NULL) != len) {
++		printk("goldfish_nand_erase: erase failed, start %llx, len %x, dev_size "
++		       "%llx, erase_size %x\n", ofs, len, mtd->size, mtd->erasesize);
++		return -EIO;
++	}
++
++	instr->state = MTD_ERASE_DONE;
++	mtd_erase_callback(instr);
++
++	return 0;
++
++invalid_arg:
++	printk("goldfish_nand_erase: invalid erase, start %llx, len %x, dev_size "
++	       "%llx, erase_size %x\n", ofs, len, mtd->size, mtd->erasesize);
++	return -EINVAL;
++}
++
++static int goldfish_nand_read_oob(struct mtd_info *mtd, loff_t ofs,
++                              struct mtd_oob_ops *ops)
++{
++	uint32_t rem;
++
++	if(ofs + ops->len > mtd->size)
++		goto invalid_arg;
++	if(ops->datbuf && ops->len && ops->len != mtd->writesize)
++		goto invalid_arg;
++	if(ops->ooblen + ops->ooboffs > mtd->oobsize)
++		goto invalid_arg;
++
++	rem = do_div(ofs, mtd->writesize);
++	if(rem)
++		goto invalid_arg;
++	ofs *= (mtd->writesize + mtd->oobsize);
++
++	if(ops->datbuf)
++		ops->retlen = goldfish_nand_cmd(mtd, NAND_CMD_READ, ofs,
++		                            ops->len, ops->datbuf);
++	ofs += mtd->writesize + ops->ooboffs;
++	if(ops->oobbuf)
++		ops->oobretlen = goldfish_nand_cmd(mtd, NAND_CMD_READ, ofs,
++		                               ops->ooblen, ops->oobbuf);
++	return 0;
++
++invalid_arg:
++	printk("goldfish_nand_read_oob: invalid read, start %llx, len %x, "
++	       "ooblen %x, dev_size %llx, write_size %x\n",
++	       ofs, ops->len, ops->ooblen, mtd->size, mtd->writesize);
++	return -EINVAL;
++}
++
++static int goldfish_nand_write_oob(struct mtd_info *mtd, loff_t ofs,
++                               struct mtd_oob_ops *ops)
++{
++	uint32_t rem;
++
++	if(ofs + ops->len > mtd->size)
++		goto invalid_arg;
++	if(ops->len && ops->len != mtd->writesize)
++		goto invalid_arg;
++	if(ops->ooblen + ops->ooboffs > mtd->oobsize)
++		goto invalid_arg;
++	
++	rem = do_div(ofs, mtd->writesize);
++	if(rem)
++		goto invalid_arg;
++	ofs *= (mtd->writesize + mtd->oobsize);
++
++	if(ops->datbuf)
++		ops->retlen = goldfish_nand_cmd(mtd, NAND_CMD_WRITE, ofs,
++		                            ops->len, ops->datbuf);
++	ofs += mtd->writesize + ops->ooboffs;
++	if(ops->oobbuf)
++		ops->oobretlen = goldfish_nand_cmd(mtd, NAND_CMD_WRITE, ofs,
++		                               ops->ooblen, ops->oobbuf);
++	return 0;
++
++invalid_arg:
++	printk("goldfish_nand_write_oob: invalid write, start %llx, len %x, "
++	       "ooblen %x, dev_size %llx, write_size %x\n",
++	       ofs, ops->len, ops->ooblen, mtd->size, mtd->writesize);
++	return -EINVAL;
++}
++
++static int goldfish_nand_read(struct mtd_info *mtd, loff_t from, size_t len,
++                          size_t *retlen, u_char *buf)
++{
++	uint32_t rem;
++
++	if(from + len > mtd->size)
++		goto invalid_arg;
++	if(len != mtd->writesize)
++		goto invalid_arg;
++
++	rem = do_div(from, mtd->writesize);
++	if(rem)
++		goto invalid_arg;
++	from *= (mtd->writesize + mtd->oobsize);
++
++	*retlen = goldfish_nand_cmd(mtd, NAND_CMD_READ, from, len, buf);
++	return 0;
++
++invalid_arg:
++	printk("goldfish_nand_read: invalid read, start %llx, len %x, dev_size %llx"
++	       ", write_size %x\n", from, len, mtd->size, mtd->writesize);
++	return -EINVAL;
++}
++
++static int goldfish_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
++                           size_t *retlen, const u_char *buf)
++{
++	uint32_t rem;
++
++	if(to + len > mtd->size)
++		goto invalid_arg;
++	if(len != mtd->writesize)
++		goto invalid_arg;
++
++	rem = do_div(to, mtd->writesize);
++	if(rem)
++		goto invalid_arg;
++	to *= (mtd->writesize + mtd->oobsize);
++
++	*retlen = goldfish_nand_cmd(mtd, NAND_CMD_WRITE, to, len, (void *)buf);
++	return 0;
++
++invalid_arg:
++	printk("goldfish_nand_write: invalid write, start %llx, len %x, dev_size %llx"
++	       ", write_size %x\n", to, len, mtd->size, mtd->writesize);
++	return -EINVAL;
++}
++
++static int goldfish_nand_block_isbad(struct mtd_info *mtd, loff_t ofs)
++{
++	uint32_t rem;
++
++	if(ofs >= mtd->size)
++		goto invalid_arg;
++
++	rem = do_div(ofs, mtd->erasesize);
++	if(rem)
++		goto invalid_arg;
++	ofs *= mtd->erasesize / mtd->writesize;
++	ofs *= (mtd->writesize + mtd->oobsize);
++
++	return goldfish_nand_cmd(mtd, NAND_CMD_BLOCK_BAD_GET, ofs, 0, NULL);
++
++invalid_arg:
++	printk("goldfish_nand_block_isbad: invalid arg, ofs %llx, dev_size %llx, "
++	       "write_size %x\n", ofs, mtd->size, mtd->writesize);
++	return -EINVAL;
++}
++
++static int goldfish_nand_block_markbad(struct mtd_info *mtd, loff_t ofs)
++{
++	uint32_t rem;
++
++	if(ofs >= mtd->size)
++		goto invalid_arg;
++
++	rem = do_div(ofs, mtd->erasesize);
++	if(rem)
++		goto invalid_arg;
++	ofs *= mtd->erasesize / mtd->writesize;
++	ofs *= (mtd->writesize + mtd->oobsize);
++
++	if(goldfish_nand_cmd(mtd, NAND_CMD_BLOCK_BAD_SET, ofs, 0, NULL) != 1)
++		return -EIO;
++	return 0;
++
++invalid_arg:
++	printk("goldfish_nand_block_markbad: invalid arg, ofs %llx, dev_size %llx, "
++	       "write_size %x\n", ofs, mtd->size, mtd->writesize);
++	return -EINVAL;
++}
++
++static int goldfish_nand_init_device(struct goldfish_nand *nand, int id)
++{
++	uint32_t name_len;
++	uint32_t result;
++	uint32_t flags;
++	unsigned long irq_flags;
++	unsigned char __iomem  *base = nand->base;
++	struct mtd_info *mtd = &nand->mtd[id];
++	char *name;
++
++	spin_lock_irqsave(&nand->lock, irq_flags);
++	writel(id, base + NAND_DEV);
++	flags = readl(base + NAND_DEV_FLAGS);
++	name_len = readl(base + NAND_DEV_NAME_LEN);
++	mtd->writesize = readl(base + NAND_DEV_PAGE_SIZE);
++	mtd->size = readl(base + NAND_DEV_SIZE_LOW);
++	mtd->size |= (uint64_t)readl(base + NAND_DEV_SIZE_HIGH) << 32;
++	mtd->oobsize = readl(base + NAND_DEV_EXTRA_SIZE);
++	mtd->oobavail = mtd->oobsize;
++	mtd->erasesize = readl(base + NAND_DEV_ERASE_SIZE) /
++	                 (mtd->writesize + mtd->oobsize) * mtd->writesize;
++	do_div(mtd->size, mtd->writesize + mtd->oobsize);
++	mtd->size *= mtd->writesize;
++	printk("goldfish nand dev%d: size %llx, page %d, extra %d, erase %d\n",
++	       id, mtd->size, mtd->writesize, mtd->oobsize, mtd->erasesize);
++	spin_unlock_irqrestore(&nand->lock, irq_flags);
++
++	mtd->priv = nand;
++
++	mtd->name = name = kmalloc(name_len + 1, GFP_KERNEL);
++	if(name == NULL)
++		return -ENOMEM;
++
++	result = goldfish_nand_cmd(mtd, NAND_CMD_GET_DEV_NAME, 0, name_len, name);
++	if(result != name_len) {
++		kfree(mtd->name);
++		mtd->name = NULL;
++		printk("goldfish_nand_init_device failed to get dev name %d != %d\n",
++		       result, name_len);
++		return -ENODEV;
++	}
++	((char *) mtd->name)[name_len] = '\0';
++
++	/* Setup the MTD structure */
++	mtd->type = MTD_NANDFLASH;
++	mtd->flags = MTD_CAP_NANDFLASH;
++	if(flags & NAND_DEV_FLAG_READ_ONLY)
++		mtd->flags &= ~MTD_WRITEABLE;
++
++	mtd->owner = THIS_MODULE;
++	mtd->erase = goldfish_nand_erase;
++	mtd->read = goldfish_nand_read;
++	mtd->write = goldfish_nand_write;
++	mtd->read_oob = goldfish_nand_read_oob;
++	mtd->write_oob = goldfish_nand_write_oob;
++	mtd->block_isbad = goldfish_nand_block_isbad;
++	mtd->block_markbad = goldfish_nand_block_markbad;
++
++	if (add_mtd_device(mtd)) {
++		kfree(mtd->name);
++		mtd->name = NULL;
++		return -EIO;
++	}
++
++	return 0;
++}
++
++static int goldfish_nand_probe(struct platform_device *pdev)
++{
++	uint32_t num_dev;
++	int i;
++	int err;
++	uint32_t num_dev_working;
++	uint32_t version;
++	struct resource *r;
++	struct goldfish_nand *nand;
++	unsigned char __iomem  *base;
++
++	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if(r == NULL) {
++		err = -ENODEV;
++		goto err_no_io_base;
++	}
++
++	base = ioremap(r->start, PAGE_SIZE);
++	if(base == NULL) {
++		err = -ENOMEM;
++		goto err_ioremap;
++	}
++	version = readl(base + NAND_VERSION);
++	if(version != NAND_VERSION_CURRENT) {
++		printk("goldfish_nand_init: version mismatch, got %d, expected %d\n",
++		       version, NAND_VERSION_CURRENT);
++		err = -ENODEV;
++		goto err_no_dev;
++	}
++	num_dev = readl(base + NAND_NUM_DEV);
++	if(num_dev == 0) {
++		err = -ENODEV;
++		goto err_no_dev;
++	}
++
++	nand = kzalloc(sizeof(*nand) + sizeof(struct mtd_info) * num_dev, GFP_KERNEL);
++	if(nand == NULL) {
++		err = -ENOMEM;
++		goto err_nand_alloc_failed;
++	}
++	spin_lock_init(&nand->lock);
++	nand->base = base;
++	nand->mtd_count = num_dev;
++	platform_set_drvdata(pdev, nand);
++
++	num_dev_working = 0;
++	for(i = 0; i < num_dev; i++) {
++		err = goldfish_nand_init_device(nand, i);
++		if(err == 0)
++			num_dev_working++;
++	}
++	if(num_dev_working == 0) {
++		err = -ENODEV;
++		goto err_no_working_dev;
++	}
++	return 0;
++
++err_no_working_dev:
++	kfree(nand);
++err_nand_alloc_failed:
++err_no_dev:
++	iounmap(base);
++err_ioremap:
++err_no_io_base:
++	return err;
++}
++
++static int goldfish_nand_remove(struct platform_device *pdev)
++{
++	struct goldfish_nand *nand = platform_get_drvdata(pdev);
++	int i;
++	for(i = 0; i < nand->mtd_count; i++) {
++		if(nand->mtd[i].name) {
++			del_mtd_device(&nand->mtd[i]);
++			kfree(nand->mtd[i].name);
++		}
++	}
++	iounmap(nand->base);
++	kfree(nand);
++	return 0;
++}
++
++static struct platform_driver goldfish_nand_driver = {
++	.probe		= goldfish_nand_probe,
++	.remove		= goldfish_nand_remove,
++	.driver = {
++		.name = "goldfish_nand"
++	}
++};
++
++static int __init goldfish_nand_init(void)
++{
++	return platform_driver_register(&goldfish_nand_driver);
++}
++
++static void __exit goldfish_nand_exit(void)
++{
++	platform_driver_unregister(&goldfish_nand_driver);
++}
++
++
++module_init(goldfish_nand_init);
++module_exit(goldfish_nand_exit);
++
+diff --git a/drivers/mtd/devices/goldfish_nand_reg.h b/drivers/mtd/devices/goldfish_nand_reg.h
+new file mode 100644
+index 0000000..7c17a44
+--- /dev/null
++++ b/drivers/mtd/devices/goldfish_nand_reg.h
+@@ -0,0 +1,58 @@
++/* drivers/mtd/devices/goldfish_nand_reg.h
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#ifndef GOLDFISH_NAND_REG_H
++#define GOLDFISH_NAND_REG_H
++
++enum nand_cmd {
++	NAND_CMD_GET_DEV_NAME,  // Write device name for NAND_DEV to NAND_DATA (vaddr)
++	NAND_CMD_READ,
++	NAND_CMD_WRITE,
++	NAND_CMD_ERASE,
++	NAND_CMD_BLOCK_BAD_GET, // NAND_RESULT is 1 if block is bad, 0 if it is not
++	NAND_CMD_BLOCK_BAD_SET
++};
++
++enum nand_dev_flags {
++	NAND_DEV_FLAG_READ_ONLY = 0x00000001
++};
++
++#define NAND_VERSION_CURRENT (1)
++
++enum nand_reg {
++	// Global
++	NAND_VERSION        = 0x000,
++	NAND_NUM_DEV        = 0x004,
++	NAND_DEV            = 0x008,
++
++	// Dev info
++	NAND_DEV_FLAGS      = 0x010,
++	NAND_DEV_NAME_LEN   = 0x014,
++	NAND_DEV_PAGE_SIZE  = 0x018,
++	NAND_DEV_EXTRA_SIZE = 0x01c,
++	NAND_DEV_ERASE_SIZE = 0x020,
++	NAND_DEV_SIZE_LOW   = 0x028,
++	NAND_DEV_SIZE_HIGH  = 0x02c,
++
++	// Command
++	NAND_RESULT         = 0x040,
++	NAND_COMMAND        = 0x044,
++	NAND_DATA           = 0x048,
++	NAND_TRANSFER_SIZE  = 0x04c,
++	NAND_ADDR_LOW       = 0x050,
++	NAND_ADDR_HIGH      = 0x054,
++};
++
++#endif
+-- 
+1.6.2
+
diff --git a/target/linux/goldfish/patches-2.6.30/0126--ARM-goldfish-POWER-New-power-supply-driver-for-g.patch b/target/linux/goldfish/patches-2.6.30/0126--ARM-goldfish-POWER-New-power-supply-driver-for-g.patch
new file mode 100644
index 0000000000..4b5265ab37
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0126--ARM-goldfish-POWER-New-power-supply-driver-for-g.patch
@@ -0,0 +1,308 @@
+From 7041346d379e563e9ee66f9dd31277e4fb6b1b1f Mon Sep 17 00:00:00 2001
+From: Mike Lockwood <lockwood@android.com>
+Date: Wed, 6 Feb 2008 11:37:10 -0500
+Subject: [PATCH 126/134] [ARM] goldfish: POWER: New power supply driver for goldfish.
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+---
+ drivers/power/Kconfig            |    5 +
+ drivers/power/Makefile           |    3 +-
+ drivers/power/goldfish_battery.c |  254 ++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 261 insertions(+), 1 deletions(-)
+ create mode 100644 drivers/power/goldfish_battery.c
+
+diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig
+index 33da112..593c616 100644
+--- a/drivers/power/Kconfig
++++ b/drivers/power/Kconfig
+@@ -88,4 +88,9 @@ config CHARGER_PCF50633
+ 	help
+ 	 Say Y to include support for NXP PCF50633 Main Battery Charger.
+ 
++config BATTERY_GOLDFISH
++	tristate "Goldfish battery driver"
++	help
++	  Say Y to enable support for the battery and AC power in the Goldfish emulator.
++
+ endif # POWER_SUPPLY
+diff --git a/drivers/power/Makefile b/drivers/power/Makefile
+index 2fcf41d..5be0fbb 100644
+--- a/drivers/power/Makefile
++++ b/drivers/power/Makefile
+@@ -19,10 +19,11 @@ obj-$(CONFIG_APM_POWER)		+= apm_power.o
+ obj-$(CONFIG_WM8350_POWER)	+= wm8350_power.o
+ 
+ obj-$(CONFIG_BATTERY_DS2760)	+= ds2760_battery.o
++obj-$(CONFIG_BATTERY_GOLDFISH)	+= goldfish_battery.o
+ obj-$(CONFIG_BATTERY_PMU)	+= pmu_battery.o
+ obj-$(CONFIG_BATTERY_OLPC)	+= olpc_battery.o
+ obj-$(CONFIG_BATTERY_TOSA)	+= tosa_battery.o
+ obj-$(CONFIG_BATTERY_WM97XX)	+= wm97xx_battery.o
+ obj-$(CONFIG_BATTERY_BQ27x00)	+= bq27x00_battery.o
+ obj-$(CONFIG_BATTERY_DA9030)	+= da9030_battery.o
+-obj-$(CONFIG_CHARGER_PCF50633)	+= pcf50633-charger.o
+\ No newline at end of file
++obj-$(CONFIG_CHARGER_PCF50633)	+= pcf50633-charger.o
+diff --git a/drivers/power/goldfish_battery.c b/drivers/power/goldfish_battery.c
+new file mode 100644
+index 0000000..868dc83
+--- /dev/null
++++ b/drivers/power/goldfish_battery.c
+@@ -0,0 +1,254 @@
++/* drivers/power/goldfish_battery.c
++ *
++ * Power supply driver for the goldfish emulator
++ *
++ * Copyright (C) 2008 Google, Inc.
++ * Author: Mike Lockwood <lockwood@android.com>
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/err.h>
++#include <linux/platform_device.h>
++#include <linux/power_supply.h>
++#include <linux/types.h>
++#include <linux/pci.h>
++#include <linux/interrupt.h>
++#include <asm/io.h>
++
++
++struct goldfish_battery_data {
++	uint32_t reg_base;
++	int irq;
++	spinlock_t lock;
++
++	struct power_supply battery;
++	struct power_supply ac;
++};
++
++#define GOLDFISH_BATTERY_READ(data, addr)   (readl(data->reg_base + addr))
++#define GOLDFISH_BATTERY_WRITE(data, addr, x)   (writel(x, data->reg_base + addr))
++
++
++/* temporary variable used between goldfish_battery_probe() and goldfish_battery_open() */
++static struct goldfish_battery_data *battery_data;
++
++enum {
++	/* status register */
++	BATTERY_INT_STATUS	    = 0x00,
++	/* set this to enable IRQ */
++	BATTERY_INT_ENABLE	    = 0x04,
++
++	BATTERY_AC_ONLINE       = 0x08,
++	BATTERY_STATUS          = 0x0C,
++	BATTERY_HEALTH          = 0x10,
++	BATTERY_PRESENT         = 0x14,
++	BATTERY_CAPACITY        = 0x18,
++
++	BATTERY_STATUS_CHANGED	= 1U << 0,
++	AC_STATUS_CHANGED   	= 1U << 1,
++	BATTERY_INT_MASK        = BATTERY_STATUS_CHANGED | AC_STATUS_CHANGED,
++};
++
++
++static int goldfish_ac_get_property(struct power_supply *psy,
++			enum power_supply_property psp,
++			union power_supply_propval *val)
++{
++	struct goldfish_battery_data *data = container_of(psy,
++		struct goldfish_battery_data, ac);
++	int ret = 0;
++
++	switch (psp) {
++	case POWER_SUPPLY_PROP_ONLINE:
++		val->intval = GOLDFISH_BATTERY_READ(data, BATTERY_AC_ONLINE);
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++	return ret;
++}
++
++static int goldfish_battery_get_property(struct power_supply *psy,
++				 enum power_supply_property psp,
++				 union power_supply_propval *val)
++{
++	struct goldfish_battery_data *data = container_of(psy,
++		struct goldfish_battery_data, battery);
++	int ret = 0;
++
++	switch (psp) {
++	case POWER_SUPPLY_PROP_STATUS:
++		val->intval = GOLDFISH_BATTERY_READ(data, BATTERY_STATUS);
++		break;
++	case POWER_SUPPLY_PROP_HEALTH:
++		val->intval = GOLDFISH_BATTERY_READ(data, BATTERY_HEALTH);
++		break;
++	case POWER_SUPPLY_PROP_PRESENT:
++		val->intval = GOLDFISH_BATTERY_READ(data, BATTERY_PRESENT);
++		break;
++	case POWER_SUPPLY_PROP_TECHNOLOGY:
++		val->intval = POWER_SUPPLY_TECHNOLOGY_LION;
++		break;
++	case POWER_SUPPLY_PROP_CAPACITY:
++		val->intval = GOLDFISH_BATTERY_READ(data, BATTERY_CAPACITY);
++		break;
++	default:
++		ret = -EINVAL;
++		break;
++	}
++
++	return ret;
++}
++
++static enum power_supply_property goldfish_battery_props[] = {
++	POWER_SUPPLY_PROP_STATUS,
++	POWER_SUPPLY_PROP_HEALTH,
++	POWER_SUPPLY_PROP_PRESENT,
++	POWER_SUPPLY_PROP_TECHNOLOGY,
++	POWER_SUPPLY_PROP_CAPACITY,
++};
++
++static enum power_supply_property goldfish_ac_props[] = {
++	POWER_SUPPLY_PROP_ONLINE,
++};
++
++static irqreturn_t goldfish_battery_interrupt(int irq, void *dev_id)
++{
++	unsigned long irq_flags;
++	struct goldfish_battery_data *data = dev_id;
++	uint32_t status;
++
++	spin_lock_irqsave(&data->lock, irq_flags);
++
++	/* read status flags, which will clear the interrupt */
++	status = GOLDFISH_BATTERY_READ(data, BATTERY_INT_STATUS);
++	status &= BATTERY_INT_MASK;
++
++	if (status & BATTERY_STATUS_CHANGED)
++		power_supply_changed(&data->battery);
++	if (status & AC_STATUS_CHANGED)
++		power_supply_changed(&data->ac);
++
++	spin_unlock_irqrestore(&data->lock, irq_flags);
++	return status ? IRQ_HANDLED : IRQ_NONE;
++}
++
++
++static int goldfish_battery_probe(struct platform_device *pdev)
++{
++	int ret;
++	struct resource *r;
++	struct goldfish_battery_data *data;
++
++	data = kzalloc(sizeof(*data), GFP_KERNEL);
++	if (data == NULL) {
++		ret = -ENOMEM;
++		goto err_data_alloc_failed;
++	}
++	spin_lock_init(&data->lock);
++
++	data->battery.properties = goldfish_battery_props;
++	data->battery.num_properties = ARRAY_SIZE(goldfish_battery_props);
++	data->battery.get_property = goldfish_battery_get_property;
++	data->battery.name = "battery";
++	data->battery.type = POWER_SUPPLY_TYPE_BATTERY;
++
++	data->ac.properties = goldfish_ac_props;
++	data->ac.num_properties = ARRAY_SIZE(goldfish_ac_props);
++	data->ac.get_property = goldfish_ac_get_property;
++	data->ac.name = "ac";
++	data->ac.type = POWER_SUPPLY_TYPE_MAINS;
++
++	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (r == NULL) {
++		printk(KERN_ERR "%s: platform_get_resource failed\n", pdev->name);
++		ret = -ENODEV;
++		goto err_no_io_base;
++	}
++	data->reg_base = IO_ADDRESS(r->start - IO_START);
++
++	data->irq = platform_get_irq(pdev, 0);
++	if (data->irq < 0) {
++		printk(KERN_ERR "%s: platform_get_irq failed\n", pdev->name);
++		ret = -ENODEV;
++		goto err_no_irq;
++	}
++
++	ret = request_irq(data->irq, goldfish_battery_interrupt, IRQF_SHARED, pdev->name, data);
++	if (ret)
++		goto err_request_irq_failed;
++
++	ret = power_supply_register(&pdev->dev, &data->ac);
++	if (ret)
++		goto err_ac_failed;
++
++	ret = power_supply_register(&pdev->dev, &data->battery);
++	if (ret)
++		goto err_battery_failed;
++
++	platform_set_drvdata(pdev, data);
++	battery_data = data;
++
++	GOLDFISH_BATTERY_WRITE(data, BATTERY_INT_ENABLE, BATTERY_INT_MASK);
++	return 0;
++
++err_battery_failed:
++	power_supply_unregister(&data->ac);
++err_ac_failed:
++	free_irq(data->irq, data);
++err_request_irq_failed:
++err_no_irq:
++err_no_io_base:
++	kfree(data);
++err_data_alloc_failed:
++	return ret;
++}
++
++static int goldfish_battery_remove(struct platform_device *pdev)
++{
++	struct goldfish_battery_data *data = platform_get_drvdata(pdev);
++
++	power_supply_unregister(&data->battery);
++	power_supply_unregister(&data->ac);
++
++	free_irq(data->irq, data);
++	kfree(data);
++	battery_data = NULL;
++	return 0;
++}
++
++static struct platform_driver goldfish_battery_device = {
++	.probe		= goldfish_battery_probe,
++	.remove		= goldfish_battery_remove,
++	.driver = {
++		.name = "goldfish-battery"
++	}
++};
++
++static int __init goldfish_battery_init(void)
++{
++	return platform_driver_register(&goldfish_battery_device);
++}
++
++static void __exit goldfish_battery_exit(void)
++{
++	platform_driver_unregister(&goldfish_battery_device);
++}
++
++module_init(goldfish_battery_init);
++module_exit(goldfish_battery_exit);
++
++MODULE_AUTHOR("Mike Lockwood lockwood@android.com");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("Battery driver for the Goldfish emulator");
+-- 
+1.6.2
+
diff --git a/target/linux/goldfish/patches-2.6.30/0127--ARM-goldfish-RTC-Add-RTC-driver-for-goldfish.patch b/target/linux/goldfish/patches-2.6.30/0127--ARM-goldfish-RTC-Add-RTC-driver-for-goldfish.patch
new file mode 100644
index 0000000000..bb0c29da27
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0127--ARM-goldfish-RTC-Add-RTC-driver-for-goldfish.patch
@@ -0,0 +1,186 @@
+From fce981438497199217ed19f14c4d0f1a1aa309f3 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@google.com>
+Date: Fri, 29 Jun 2007 21:46:31 -0700
+Subject: [PATCH 127/134] [ARM] goldfish: RTC: Add RTC driver for goldfish.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Gets the current time from the host.
+Alarms are not supported yet.
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/rtc/Kconfig        |    6 ++
+ drivers/rtc/Makefile       |    1 +
+ drivers/rtc/rtc-goldfish.c |  138 ++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 145 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/rtc/rtc-goldfish.c
+
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -691,6 +691,12 @@ config RTC_DRV_BFIN
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called rtc-bfin.
+ 
++config RTC_DRV_GOLDFISH
++	tristate "GOLDFISH"
++	depends on ARCH_GOLDFISH
++	help
++	  RTC driver for Goldfish Virtual Platform
++
+ config RTC_DRV_RS5C313
+ 	tristate "Ricoh RS5C313"
+ 	depends on SH_LANDISK
+--- a/drivers/rtc/Makefile
++++ b/drivers/rtc/Makefile
+@@ -39,6 +39,7 @@ obj-$(CONFIG_RTC_DRV_DS3234)	+= rtc-ds32
+ obj-$(CONFIG_RTC_DRV_EFI)	+= rtc-efi.o
+ obj-$(CONFIG_RTC_DRV_EP93XX)	+= rtc-ep93xx.o
+ obj-$(CONFIG_RTC_DRV_FM3130)	+= rtc-fm3130.o
++obj-$(CONFIG_RTC_DRV_GOLDFISH)	+= rtc-goldfish.o
+ obj-$(CONFIG_RTC_DRV_ISL1208)	+= rtc-isl1208.o
+ obj-$(CONFIG_RTC_DRV_M41T80)	+= rtc-m41t80.o
+ obj-$(CONFIG_RTC_DRV_M41T94)	+= rtc-m41t94.o
+--- /dev/null
++++ b/drivers/rtc/rtc-goldfish.c
+@@ -0,0 +1,138 @@
++/* drivers/rtc/rtc-goldfish.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/platform_device.h>
++#include <linux/rtc.h>
++
++#include <mach/timer.h>
++#include <mach/hardware.h>
++#include <asm/io.h>
++
++struct goldfish_rtc {
++	uint32_t base;
++	uint32_t irq;
++	struct rtc_device *rtc;
++};
++
++static irqreturn_t
++goldfish_rtc_interrupt(int irq, void *dev_id)
++{
++	struct goldfish_rtc	*qrtc = dev_id;
++	unsigned long		events = 0;
++
++	writel(1, qrtc->base + TIMER_CLEAR_INTERRUPT);
++	events = RTC_IRQF | RTC_AF;
++
++	rtc_update_irq(qrtc->rtc, 1, events);
++
++	return IRQ_HANDLED;
++}
++
++static int goldfish_rtc_read_time(struct device *dev, struct rtc_time *tm)
++{
++	int64_t time;
++	struct goldfish_rtc	*qrtc = platform_get_drvdata(to_platform_device(dev));
++
++	time = readl(qrtc->base + TIMER_TIME_LOW);
++	time |= (int64_t)readl(qrtc->base + TIMER_TIME_HIGH) << 32;
++	do_div(time, NSEC_PER_SEC);
++
++	rtc_time_to_tm(time, tm);
++	return 0;
++}
++
++static struct rtc_class_ops goldfish_rtc_ops = {
++//	.ioctl		= goldfish_rtc_ioctl,
++	.read_time	= goldfish_rtc_read_time,
++//	.set_time	= goldfish_rtc_set_time,
++//	.read_alarm	= goldfish_rtc_read_alarm,
++//	.set_alarm	= goldfish_rtc_set_alarm,
++};
++
++
++static int goldfish_rtc_probe(struct platform_device *pdev)
++{
++	int ret;
++	struct resource *r;
++	struct goldfish_rtc *qrtc;
++
++	qrtc = kzalloc(sizeof(*qrtc), GFP_KERNEL);
++	if(qrtc == NULL) {
++		ret = -ENOMEM;
++		goto err_qrtc_alloc_failed;
++	}
++	platform_set_drvdata(pdev, qrtc);
++
++	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if(r == NULL) {
++		ret = -ENODEV;
++		goto err_no_io_base;
++	}
++	qrtc->base = IO_ADDRESS(r->start - IO_START);
++	qrtc->irq = platform_get_irq(pdev, 0);
++	if(qrtc->irq < 0) {
++		ret = -ENODEV;
++		goto err_no_irq;
++	}
++	qrtc->rtc = rtc_device_register(pdev->name, &pdev->dev,
++	                                &goldfish_rtc_ops, THIS_MODULE);
++	if (IS_ERR(qrtc->rtc)) {
++		ret = PTR_ERR(qrtc->rtc);
++		goto err_rtc_device_register_failed;
++	}
++
++	ret = request_irq(qrtc->irq, goldfish_rtc_interrupt, 0, pdev->name, qrtc);
++	if(ret)
++		goto request_irq;
++
++	return 0;
++
++	free_irq(qrtc->irq, qrtc);
++request_irq:
++	rtc_device_unregister(qrtc->rtc);
++err_rtc_device_register_failed:
++err_no_irq:
++err_no_io_base:
++	kfree(qrtc);
++err_qrtc_alloc_failed:
++	return ret;
++}
++
++static int goldfish_rtc_remove(struct platform_device *pdev)
++{
++	struct goldfish_rtc	*qrtc = platform_get_drvdata(pdev);
++	free_irq(qrtc->irq, qrtc);
++	rtc_device_unregister(qrtc->rtc);
++	kfree(qrtc);
++	return 0;
++}
++
++static struct platform_driver goldfish_timer = {
++	.probe = goldfish_rtc_probe,
++	.remove = goldfish_rtc_remove,
++	.driver = {
++		.name = "goldfish_rtc"
++	}
++};
++
++static int __init goldfish_rtc_init(void)
++{
++	return platform_driver_register(&goldfish_timer);
++}
++
++module_init(goldfish_rtc_init);
++
diff --git a/target/linux/goldfish/patches-2.6.30/0128--ARM-goldfish-fb-Add-fb-driver-for-goldfish.patch b/target/linux/goldfish/patches-2.6.30/0128--ARM-goldfish-fb-Add-fb-driver-for-goldfish.patch
new file mode 100644
index 0000000000..48e69daae0
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0128--ARM-goldfish-fb-Add-fb-driver-for-goldfish.patch
@@ -0,0 +1,384 @@
+From f8101c780fdc050eda9f93c94f8841de9f384b4f Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@google.com>
+Date: Fri, 29 Jun 2007 22:14:27 -0700
+Subject: [PATCH 128/134] [ARM] goldfish: fb: Add fb driver for goldfish.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+Supports panning for double buffering.
+
+Signed-off-by: Mike A. Chan <mikechan@google.com>
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+---
+ drivers/video/Kconfig      |    9 ++
+ drivers/video/Makefile     |    1 +
+ drivers/video/goldfishfb.c |  334 ++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 344 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/video/goldfishfb.c
+
+--- a/drivers/video/Kconfig
++++ b/drivers/video/Kconfig
+@@ -2005,6 +2005,15 @@ config FB_XILINX
+ 	  framebuffer. ML300 carries a 640*480 LCD display on the board,
+ 	  ML403 uses a standard DB15 VGA connector.
+ 
++config FB_GOLDFISH
++	tristate "Goldfish Framebuffer"
++	depends on FB
++	select FB_CFB_FILLRECT
++	select FB_CFB_COPYAREA
++	select FB_CFB_IMAGEBLIT
++	---help---
++	  Framebuffer driver for Goldfish Virtual Platform
++
+ config FB_COBALT
+ 	tristate "Cobalt server LCD frame buffer support"
+ 	depends on FB && MIPS_COBALT
+--- a/drivers/video/Makefile
++++ b/drivers/video/Makefile
+@@ -92,6 +92,7 @@ obj-$(CONFIG_FB_ATMEL)		  += atmel_lcdfb
+ obj-$(CONFIG_FB_PVR2)             += pvr2fb.o
+ obj-$(CONFIG_FB_VOODOO1)          += sstfb.o
+ obj-$(CONFIG_FB_ARMCLCD)	  += amba-clcd.o
++obj-$(CONFIG_FB_GOLDFISH)         += goldfishfb.o
+ obj-$(CONFIG_FB_68328)            += 68328fb.o
+ obj-$(CONFIG_FB_GBE)              += gbefb.o
+ obj-$(CONFIG_FB_CIRRUS)		  += cirrusfb.o
+--- /dev/null
++++ b/drivers/video/goldfishfb.c
+@@ -0,0 +1,334 @@
++/* drivers/video/goldfishfb.c
++**
++** Copyright (C) 2007 Google, Inc.
++**
++** This software is licensed under the terms of the GNU General Public
++** License version 2, as published by the Free Software Foundation, and
++** may be copied, distributed, and modified under those terms.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++** GNU General Public License for more details.
++**
++*/
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/dma-mapping.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++#include <linux/mm.h>
++#include <linux/fb.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/ioport.h>
++#include <linux/platform_device.h>
++#ifdef CONFIG_ANDROID_POWER
++#include <linux/android_power.h>
++#endif
++
++#include <mach/hardware.h>
++
++enum {
++	FB_GET_WIDTH        = 0x00,
++	FB_GET_HEIGHT       = 0x04,
++	FB_INT_STATUS       = 0x08,
++	FB_INT_ENABLE       = 0x0c,
++	FB_SET_BASE         = 0x10,
++	FB_SET_ROTATION     = 0x14,
++	FB_SET_BLANK        = 0x18,
++	FB_GET_PHYS_WIDTH   = 0x1c,
++	FB_GET_PHYS_HEIGHT  = 0x20,
++
++	FB_INT_VSYNC             = 1U << 0,
++	FB_INT_BASE_UPDATE_DONE  = 1U << 1
++};
++
++struct goldfish_fb {
++	uint32_t reg_base;
++	int irq;
++	spinlock_t lock;
++	wait_queue_head_t wait;
++	int base_update_count;
++	int rotation;
++	struct fb_info fb;
++	u32			cmap[16];
++#ifdef CONFIG_ANDROID_POWER
++        android_early_suspend_t early_suspend;
++#endif
++};
++
++static irqreturn_t
++goldfish_fb_interrupt(int irq, void *dev_id)
++{
++	unsigned long irq_flags;
++	struct goldfish_fb	*fb = dev_id;
++	uint32_t status;
++
++	spin_lock_irqsave(&fb->lock, irq_flags);
++	status = readl(fb->reg_base + FB_INT_STATUS);
++	if(status & FB_INT_BASE_UPDATE_DONE) {
++		fb->base_update_count++;
++		wake_up(&fb->wait);
++	}
++	spin_unlock_irqrestore(&fb->lock, irq_flags);
++	return status ? IRQ_HANDLED : IRQ_NONE;
++}
++
++static inline u32 convert_bitfield(int val, struct fb_bitfield *bf)
++{
++	unsigned int mask = (1 << bf->length) - 1;
++
++	return (val >> (16 - bf->length) & mask) << bf->offset;
++}
++
++static int
++goldfish_fb_setcolreg(unsigned int regno, unsigned int red, unsigned int green,
++		 unsigned int blue, unsigned int transp, struct fb_info *info)
++{
++	struct goldfish_fb *fb = container_of(info, struct goldfish_fb, fb);
++
++	if (regno < 16) {
++		fb->cmap[regno] = convert_bitfield(transp, &fb->fb.var.transp) |
++				  convert_bitfield(blue, &fb->fb.var.blue) |
++				  convert_bitfield(green, &fb->fb.var.green) |
++				  convert_bitfield(red, &fb->fb.var.red);
++		return 0;
++	}
++	else {
++		return 1;
++	}
++}
++
++static int goldfish_fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
++{
++	if((var->rotate & 1) != (info->var.rotate & 1)) {
++		if((var->xres != info->var.yres) ||
++		   (var->yres != info->var.xres) ||
++		   (var->xres_virtual != info->var.yres) ||
++		   (var->yres_virtual > info->var.xres * 2) ||
++		   (var->yres_virtual < info->var.xres )) {
++			return -EINVAL;
++		}
++	}
++	else {
++		if((var->xres != info->var.xres) ||
++		   (var->yres != info->var.yres) ||
++		   (var->xres_virtual != info->var.xres) ||
++		   (var->yres_virtual > info->var.yres * 2) ||
++		   (var->yres_virtual < info->var.yres )) {
++			return -EINVAL;
++		}
++	}
++	if((var->xoffset != info->var.xoffset) ||
++	   (var->bits_per_pixel != info->var.bits_per_pixel) ||
++	   (var->grayscale != info->var.grayscale)) {
++		return -EINVAL;
++	}
++	return 0;
++}
++
++static int goldfish_fb_set_par(struct fb_info *info)
++{
++	struct goldfish_fb *fb = container_of(info, struct goldfish_fb, fb);
++	if(fb->rotation != fb->fb.var.rotate) {
++		info->fix.line_length = info->var.xres * 2;
++		fb->rotation = fb->fb.var.rotate;
++		writel(fb->rotation, fb->reg_base + FB_SET_ROTATION);
++	}
++	return 0;
++}
++
++
++static int goldfish_fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info)
++{
++	unsigned long irq_flags;
++	int base_update_count;
++	struct goldfish_fb *fb = container_of(info, struct goldfish_fb, fb);
++
++	spin_lock_irqsave(&fb->lock, irq_flags);
++	base_update_count = fb->base_update_count;
++	writel(fb->fb.fix.smem_start + fb->fb.var.xres * 2 * var->yoffset, fb->reg_base + FB_SET_BASE);
++	spin_unlock_irqrestore(&fb->lock, irq_flags);
++	wait_event_timeout(fb->wait, fb->base_update_count != base_update_count, HZ / 15);
++	if(fb->base_update_count == base_update_count)
++		printk("goldfish_fb_pan_display: timeout wating for base update\n");
++	return 0;
++}
++
++#ifdef CONFIG_ANDROID_POWER
++static void goldfish_fb_early_suspend(android_early_suspend_t *h)
++{
++	struct goldfish_fb *fb = container_of(h, struct goldfish_fb, early_suspend);
++	writel(1, fb->reg_base + FB_SET_BLANK);
++}
++
++static void goldfish_fb_late_resume(android_early_suspend_t *h)
++{
++	struct goldfish_fb *fb = container_of(h, struct goldfish_fb, early_suspend);
++        writel(0, fb->reg_base + FB_SET_BLANK);
++}
++#endif
++
++static struct fb_ops goldfish_fb_ops = {
++	.owner          = THIS_MODULE,
++	.fb_check_var   = goldfish_fb_check_var,
++	.fb_set_par     = goldfish_fb_set_par,
++	.fb_setcolreg   = goldfish_fb_setcolreg,
++	.fb_pan_display = goldfish_fb_pan_display,
++	.fb_fillrect    = cfb_fillrect,
++	.fb_copyarea    = cfb_copyarea,
++	.fb_imageblit   = cfb_imageblit,
++};
++
++
++static int goldfish_fb_probe(struct platform_device *pdev)
++{
++	int ret;
++	struct resource *r;
++	struct goldfish_fb *fb;
++	size_t framesize;
++	uint32_t width, height;
++	dma_addr_t fbpaddr;
++
++	fb = kzalloc(sizeof(*fb), GFP_KERNEL);
++	if(fb == NULL) {
++		ret = -ENOMEM;
++		goto err_fb_alloc_failed;
++	}
++	spin_lock_init(&fb->lock);
++	init_waitqueue_head(&fb->wait);
++	platform_set_drvdata(pdev, fb);
++
++	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if(r == NULL) {
++		ret = -ENODEV;
++		goto err_no_io_base;
++	}
++	fb->reg_base = IO_ADDRESS(r->start - IO_START);
++
++	fb->irq = platform_get_irq(pdev, 0);
++	if(fb->irq < 0) {
++		ret = -ENODEV;
++		goto err_no_irq;
++	}
++
++	width = readl(fb->reg_base + FB_GET_WIDTH);
++	height = readl(fb->reg_base + FB_GET_HEIGHT);
++
++	fb->fb.fbops		= &goldfish_fb_ops;
++	fb->fb.flags		= FBINFO_FLAG_DEFAULT;
++	fb->fb.pseudo_palette	= fb->cmap;
++	//strncpy(fb->fb.fix.id, clcd_name, sizeof(fb->fb.fix.id));
++	fb->fb.fix.type		= FB_TYPE_PACKED_PIXELS;
++	fb->fb.fix.visual = FB_VISUAL_TRUECOLOR;
++	fb->fb.fix.line_length = width * 2;
++	fb->fb.fix.accel	= FB_ACCEL_NONE;
++	fb->fb.fix.ypanstep = 1;
++
++	fb->fb.var.xres		= width;
++	fb->fb.var.yres		= height;
++	fb->fb.var.xres_virtual	= width;
++	fb->fb.var.yres_virtual	= height * 2;
++	fb->fb.var.bits_per_pixel = 16;
++	fb->fb.var.activate	= FB_ACTIVATE_NOW;
++	fb->fb.var.height	= readl(fb->reg_base + FB_GET_PHYS_HEIGHT);
++	fb->fb.var.width	= readl(fb->reg_base + FB_GET_PHYS_WIDTH);
++
++	fb->fb.var.red.offset = 11;
++	fb->fb.var.red.length = 5;
++	fb->fb.var.green.offset = 5;
++	fb->fb.var.green.length = 6;
++	fb->fb.var.blue.offset = 0;
++	fb->fb.var.blue.length = 5;
++
++	framesize = width * height * 2 * 2;
++	fb->fb.screen_base = dma_alloc_writecombine(&pdev->dev, framesize,
++	                                            &fbpaddr, GFP_KERNEL);
++	printk("allocating frame buffer %d * %d, got %p\n", width, height, fb->fb.screen_base);
++	if(fb->fb.screen_base == 0) {
++		ret = -ENOMEM;
++		goto err_alloc_screen_base_failed;
++	}
++	fb->fb.fix.smem_start = fbpaddr;
++	fb->fb.fix.smem_len = framesize;
++
++	ret = fb_set_var(&fb->fb, &fb->fb.var);
++	if(ret)
++		goto err_fb_set_var_failed;
++
++	ret = request_irq(fb->irq, goldfish_fb_interrupt, IRQF_SHARED, pdev->name, fb);
++	if(ret)
++		goto err_request_irq_failed;
++
++	writel(FB_INT_BASE_UPDATE_DONE, fb->reg_base + FB_INT_ENABLE);
++	goldfish_fb_pan_display(&fb->fb.var, &fb->fb); // updates base
++
++	ret = register_framebuffer(&fb->fb);
++	if(ret)
++		goto err_register_framebuffer_failed;
++
++#ifdef CONFIG_ANDROID_POWER
++	fb->early_suspend.suspend = goldfish_fb_early_suspend;
++	fb->early_suspend.resume = goldfish_fb_late_resume;
++	android_register_early_suspend(&fb->early_suspend);
++#endif
++
++	return 0;
++
++
++err_register_framebuffer_failed:
++	free_irq(fb->irq, fb);
++err_request_irq_failed:
++err_fb_set_var_failed:
++	dma_free_writecombine(&pdev->dev, framesize, fb->fb.screen_base, fb->fb.fix.smem_start);
++err_alloc_screen_base_failed:
++err_no_irq:
++err_no_io_base:
++	kfree(fb);
++err_fb_alloc_failed:
++	return ret;
++}
++
++static int goldfish_fb_remove(struct platform_device *pdev)
++{
++	size_t framesize;
++	struct goldfish_fb *fb = platform_get_drvdata(pdev);
++	
++	framesize = fb->fb.var.xres_virtual * fb->fb.var.yres_virtual * 2;
++
++#ifdef CONFIG_ANDROID_POWER
++        android_unregister_early_suspend(&fb->early_suspend);
++#endif
++	unregister_framebuffer(&fb->fb);
++	free_irq(fb->irq, fb);
++	dma_free_writecombine(&pdev->dev, framesize, fb->fb.screen_base, fb->fb.fix.smem_start);
++	kfree(fb);
++	return 0;
++}
++
++
++static struct platform_driver goldfish_fb_driver = {
++	.probe		= goldfish_fb_probe,
++	.remove		= goldfish_fb_remove,
++	.driver = {
++		.name = "goldfish_fb"
++	}
++};
++
++static int __init goldfish_fb_init(void)
++{
++	return platform_driver_register(&goldfish_fb_driver);
++}
++
++static void __exit goldfish_fb_exit(void)
++{
++	platform_driver_unregister(&goldfish_fb_driver);
++}
++
++module_init(goldfish_fb_init);
++module_exit(goldfish_fb_exit);
++
diff --git a/target/linux/goldfish/patches-2.6.30/0129--ARM-goldfish-qemutrace-Kernel-instrumentation-fo.patch b/target/linux/goldfish/patches-2.6.30/0129--ARM-goldfish-qemutrace-Kernel-instrumentation-fo.patch
new file mode 100644
index 0000000000..c8463ff240
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0129--ARM-goldfish-qemutrace-Kernel-instrumentation-fo.patch
@@ -0,0 +1,854 @@
+From fcd69dd4537320a25a294c82362cc7abe4fe773c Mon Sep 17 00:00:00 2001
+From: Ye Wen <ywen@google.com>
+Date: Fri, 14 Jul 2006 14:51:45 +0700
+Subject: [PATCH 129/134] [ARM] goldfish: qemutrace: Kernel instrumentation for tracing the events.
+
+Like fork, context switch, execve and exit.
+This code is to complement Jack's tracing facility.
+
+To turn tracing on:
+echo 1 > /sysfs/qemu_trace/state
+To turn tracing off: echo 0 > /sysfs/qemu_trace/state
+I also added java methods to Debug.java to turn tracing on and off.
+The kernel driver also supports adding dynamic symbols to the trace.
+To add a symbol 'foo' with hex address 'abcd1234' to the trace:
+echo 'abcd1234 foo' > /sysfs/qemu_trace/symbol
+
+Signed-off-by: Mike Chan <mike@android.com>
+
+[ARM] goldfish: qemutrace: Improved support for tracing thread and process names.
+
+Added a new pseudo file /sys/qemu_trace/process_name to allow user
+programs to add a trace record for a process name change.  Removed
+the tracing of thread and process names from the exit() system call
+because that was not sufficiently general.  Added tracing of thread
+names in set_task_comm() and daemonize().  Added tracing of the
+thread group id to fork() and clone().
+
+Signed-off-by: Jack Veenstra <veenstra@google.com>
+Signed-off-by: Mike Chan <mike@android.com>
+---
+ arch/arm/kernel/entry-armv.S              |    5 +
+ drivers/misc/Kconfig                      |    5 +
+ drivers/misc/Makefile                     |    1 +
+ drivers/misc/qemutrace/Makefile           |    2 +
+ drivers/misc/qemutrace/qemu_trace.c       |  386 +++++++++++++++++++++++++++++
+ drivers/misc/qemutrace/qemu_trace.h       |   22 ++
+ drivers/misc/qemutrace/qemu_trace_sysfs.c |  182 ++++++++++++++
+ fs/exec.c                                 |   14 +
+ kernel/exit.c                             |   14 +
+ kernel/fork.c                             |    8 +
+ kernel/sched.c                            |    9 +
+ mm/mmap.c                                 |   13 +
+ 12 files changed, 661 insertions(+), 0 deletions(-)
+ create mode 100644 drivers/misc/qemutrace/Makefile
+ create mode 100644 drivers/misc/qemutrace/qemu_trace.c
+ create mode 100644 drivers/misc/qemutrace/qemu_trace.h
+ create mode 100644 drivers/misc/qemutrace/qemu_trace_sysfs.c
+
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -733,6 +733,11 @@ ENTRY(__switch_to)
+ 	ldr	r0, =thread_notify_head
+ 	mov	r1, #THREAD_NOTIFY_SWITCH
+ 	bl	atomic_notifier_call_chain
++#ifdef CONFIG_QEMU_TRACE
++/*
++	mcr	p15, 0, r0, c15, c0, 0		@ signal context switch
++*/
++#endif
+ 	mov	r0, r5
+ 	ldmia	r4, {r4 - sl, fp, sp, pc}	@ Load all regs saved previously
+  UNWIND(.fnend		)
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -233,6 +233,11 @@ config ISL29003
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called isl29003.
+ 
++config QEMU_TRACE
++        tristate "Virtual Device for QEMU tracing"
++        ---help---
++          This is a virtual device for QEMU tracing.
++
+ source "drivers/misc/c2port/Kconfig"
+ source "drivers/misc/eeprom/Kconfig"
+ 
+--- a/drivers/misc/Makefile
++++ b/drivers/misc/Makefile
+@@ -20,4 +20,5 @@ obj-$(CONFIG_SGI_GRU)		+= sgi-gru/
+ obj-$(CONFIG_HP_ILO)		+= hpilo.o
+ obj-$(CONFIG_ISL29003)		+= isl29003.o
+ obj-$(CONFIG_C2PORT)		+= c2port/
++obj-$(CONFIG_QEMU_TRACE)	+= qemutrace/
+ obj-y				+= eeprom/
+--- /dev/null
++++ b/drivers/misc/qemutrace/Makefile
+@@ -0,0 +1,2 @@
++obj-$(CONFIG_QEMU_TRACE) := qemu_trace.o
++obj-$(CONFIG_QEMU_TRACE) += qemu_trace_sysfs.o
+--- /dev/null
++++ b/drivers/misc/qemutrace/qemu_trace.c
+@@ -0,0 +1,386 @@
++/* drivers/misc/qemutrace/qemu_trace.c
++ *
++ * Copyright (C) 2007-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/spinlock.h>
++#include <linux/miscdevice.h>
++#include <linux/pci.h>
++#include <linux/proc_fs.h>
++#include <linux/platform_device.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <asm/uaccess.h>
++#include <asm/io.h>
++#include <asm/sizes.h>
++#include "qemu_trace.h"
++
++/* trace device registers */
++#define TRACE_DEV_REG_SWITCH            0
++#define TRACE_DEV_REG_FORK              1
++#define TRACE_DEV_REG_EXECVE_PID        2
++#define TRACE_DEV_REG_EXECVE_VMSTART    3
++#define TRACE_DEV_REG_EXECVE_VMEND      4
++#define TRACE_DEV_REG_EXECVE_OFFSET     5
++#define TRACE_DEV_REG_EXECVE_EXEPATH    6
++#define TRACE_DEV_REG_EXIT              7
++#define TRACE_DEV_REG_CMDLINE           8
++#define TRACE_DEV_REG_CMDLINE_LEN       9
++#define TRACE_DEV_REG_MMAP_EXEPATH      10
++#define TRACE_DEV_REG_INIT_PID          11
++#define TRACE_DEV_REG_INIT_NAME         12
++#define TRACE_DEV_REG_CLONE             13
++#define TRACE_DEV_REG_UNMAP_START       14
++#define TRACE_DEV_REG_UNMAP_END         15
++#define TRACE_DEV_REG_NAME              16
++#define TRACE_DEV_REG_TGID              17
++#define TRACE_DEV_REG_DYN_SYM           50
++#define TRACE_DEV_REG_DYN_SYM_ADDR      51
++#define TRACE_DEV_REG_REMOVE_ADDR       52
++#define TRACE_DEV_REG_ENABLE            100
++
++static unsigned char __iomem *qt_base;
++static int init_called;
++
++/* PIDs that start before our device registered */
++#define MAX_INIT_PIDS   2048
++static int tb_next = 0;
++static int init_pids[MAX_INIT_PIDS];
++static DEFINE_SPINLOCK(qemu_trace_lock);
++
++void qemu_trace_start(void)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(1, qt_base + (TRACE_DEV_REG_ENABLE << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++
++void qemu_trace_stop(void)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(0, qt_base + (TRACE_DEV_REG_ENABLE << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++
++int qemu_trace_get_tracing(void)
++{
++	int val = 0;
++	if (qt_base != NULL)
++		val = readl(qt_base + (TRACE_DEV_REG_ENABLE << 2));
++	return val;
++}
++
++void qemu_trace_add_mapping(unsigned int addr, const char *symbol)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++
++	/* Write the address first, then the symbol name. */
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(addr, qt_base + (TRACE_DEV_REG_DYN_SYM_ADDR << 2));
++	writel(symbol, qt_base + (TRACE_DEV_REG_DYN_SYM << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++
++void qemu_trace_remove_mapping(unsigned int addr)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(addr, qt_base + (TRACE_DEV_REG_REMOVE_ADDR << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++
++/* trace the context switch */
++void qemu_trace_cs(struct task_struct *next)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(task_pid_nr(next), qt_base);
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++EXPORT_SYMBOL(qemu_trace_cs);
++
++/* trace the execve */
++void qemu_trace_execve(int argc, char __user * __user *argv)
++{
++	unsigned long irq_flags;
++	char page[PAGE_SIZE];
++	char *ptr = page;
++
++	if (qt_base == NULL)
++		return;
++
++	while (argc-- > 0) {
++		char __user *str;
++		int len;
++		if (get_user(str, argv ++))
++			return;
++		len = strnlen_user(str, PAGE_SIZE);
++		if (len == 0)
++			return;
++		if (copy_from_user(ptr, str, len))
++			return;
++		ptr += len;
++	}
++
++	if (ptr > page) {
++		int len = ptr - page;
++		spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++		writel(len, qt_base + (TRACE_DEV_REG_CMDLINE_LEN << 2));
++		writel(page, qt_base + (TRACE_DEV_REG_CMDLINE << 2));
++		spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++	}
++}
++EXPORT_SYMBOL(qemu_trace_execve);
++
++/* trace the mmap */
++void qemu_trace_mmap(struct vm_area_struct *vma)
++{
++	unsigned long irq_flags;
++	char page[PAGE_SIZE];
++	char *p;
++
++	if (qt_base == NULL)
++		return;
++
++	if (vma->vm_file == NULL)
++		return;
++
++	p = d_path(&vma->vm_file->f_path, page, PAGE_SIZE);
++	if (IS_ERR(p))
++		return;
++
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(vma->vm_start, qt_base + (TRACE_DEV_REG_EXECVE_VMSTART << 2));
++	writel(vma->vm_end, qt_base + (TRACE_DEV_REG_EXECVE_VMEND << 2));
++	writel(vma->vm_pgoff * PAGE_SIZE, qt_base + (TRACE_DEV_REG_EXECVE_OFFSET << 2));
++	writel(p, qt_base + (TRACE_DEV_REG_MMAP_EXEPATH << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++EXPORT_SYMBOL(qemu_trace_mmap);
++
++/* trace the munmap */
++void qemu_trace_munmap(unsigned long start, unsigned long end)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(start, qt_base + (TRACE_DEV_REG_UNMAP_START << 2));
++	writel(end, qt_base + (TRACE_DEV_REG_UNMAP_END << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++EXPORT_SYMBOL(qemu_trace_munmap);
++
++/* trace the fork */
++void qemu_trace_fork(struct task_struct *forked, unsigned long clone_flags)
++{
++	unsigned long irq_flags;
++
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	if (qt_base == NULL) {
++		if (tb_next >= MAX_INIT_PIDS) {
++			if (!init_called)
++				printk(KERN_ERR
++				       "QEMU Trace: too many PIDs before "
++				       "device registered ignoring %d\n",
++				       forked->pid);
++		} else {
++			init_pids[tb_next] = task_pid_nr(forked);
++			tb_next++;
++		}
++	} else {
++		writel(task_tgid_nr(forked), qt_base + (TRACE_DEV_REG_TGID << 2));
++		if (clone_flags & CLONE_VM)
++			writel(task_pid_nr(forked), qt_base + (TRACE_DEV_REG_CLONE << 2));
++		else
++			writel(task_pid_nr(forked), qt_base + (TRACE_DEV_REG_FORK << 2));
++	}
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++EXPORT_SYMBOL(qemu_trace_fork);
++
++/* trace the exit */
++void qemu_trace_exit(int code)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(code, qt_base + (TRACE_DEV_REG_EXIT << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++EXPORT_SYMBOL(qemu_trace_exit);
++
++/* trace the thread name */
++void qemu_trace_thread_name(const char *name)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(name, qt_base + (TRACE_DEV_REG_NAME << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++EXPORT_SYMBOL(qemu_trace_thread_name);
++
++/* trace the process name */
++void qemu_trace_process_name(const char *name)
++{
++	unsigned long irq_flags;
++
++	if (qt_base == NULL)
++		return;
++
++	spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++	writel(name, qt_base + (TRACE_DEV_REG_NAME << 2));
++	spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++}
++EXPORT_SYMBOL(qemu_trace_process_name);
++
++static void qemu_trace_pid_exec(struct task_struct *tsk)
++{
++	unsigned long irq_flags;
++	char page[PAGE_SIZE];
++	struct mm_struct *mm = get_task_mm(tsk);
++	if (mm == NULL)
++		return;
++	down_read(&mm->mmap_sem);
++	{
++		struct vm_area_struct *vma = mm->mmap;
++		while (vma) {
++			if ((vma->vm_flags & VM_EXEC) && vma->vm_file) {
++				char *p;
++				p = d_path(&vma->vm_file->f_path, page, PAGE_SIZE);
++				if (!IS_ERR(p)) {
++					spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++					writel(vma->vm_start, qt_base + (TRACE_DEV_REG_EXECVE_VMSTART << 2));
++					writel(vma->vm_end, qt_base + (TRACE_DEV_REG_EXECVE_VMEND << 2));
++					writel(vma->vm_pgoff * PAGE_SIZE, qt_base + (TRACE_DEV_REG_EXECVE_OFFSET << 2));
++					writel(p, qt_base + (TRACE_DEV_REG_EXECVE_EXEPATH << 2));
++					spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++				}
++			}
++			vma = vma->vm_next;
++		}
++	}
++	up_read(&mm->mmap_sem);
++	mmput(mm);
++}
++
++static void qemu_trace_dump_init_threads(void)
++{
++	unsigned long irq_flags;
++	int i;
++
++	for (i = 0; i < tb_next; i++) {
++		struct task_struct *tsk;
++		struct pid *pid = find_get_pid(init_pids[i]);
++		if (pid == NULL)
++			continue;
++
++		if ((tsk = get_pid_task(pid, PIDTYPE_PID)) != NULL) {
++			/* first give the pid and name */
++			task_lock(tsk);
++			spin_lock_irqsave(&qemu_trace_lock, irq_flags);
++			writel(task_tgid_nr(tsk), qt_base + (TRACE_DEV_REG_TGID << 2));
++			writel(task_pid_nr(tsk), qt_base + (TRACE_DEV_REG_INIT_PID << 2));
++			writel(tsk->comm, qt_base + (TRACE_DEV_REG_INIT_NAME << 2));
++			spin_unlock_irqrestore(&qemu_trace_lock, irq_flags);
++			task_unlock(tsk);
++			/* check if the task has execs */
++			qemu_trace_pid_exec(tsk);
++		}
++	}
++}
++
++static int qemu_trace_probe(struct platform_device *pdev)
++{
++	struct resource *r;
++
++	/* not thread safe, but this should not happen */
++	if (qt_base != NULL) {
++		printk(KERN_ERR "QEMU TRACE Device: already mapped at %p\n", qt_base);
++		return -ENODEV;
++	}
++	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (r == NULL)
++		return -EINVAL;
++	qt_base = ioremap(r->start, PAGE_SIZE);
++	printk(KERN_INFO "QEMU TRACE Device: The mapped IO base is %p\n", qt_base);
++
++	qemu_trace_dump_init_threads();
++
++	return 0;
++}
++
++static int qemu_trace_remove(struct platform_device *pdev)
++{
++	iounmap(qt_base);
++	qt_base = NULL;
++	return 0;
++}
++
++static struct platform_driver qemu_trace = {
++	.probe = qemu_trace_probe,
++	.remove = qemu_trace_remove,
++	.driver = {
++		.name = "qemu_trace"
++	}
++};
++
++static int __init qemu_trace_dev_init(void)
++{
++	int ret;
++	ret = platform_driver_register(&qemu_trace);
++	init_called = 1;
++	return ret;
++}
++
++static void qemu_trace_dev_exit(void)
++{
++	platform_driver_unregister(&qemu_trace);
++}
++
++
++module_init(qemu_trace_dev_init);
++module_exit(qemu_trace_dev_exit);
++
++MODULE_AUTHOR("Ye Wen <ywen@google.com>");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/drivers/misc/qemutrace/qemu_trace.h
+@@ -0,0 +1,22 @@
++/* drivers/misc/qemutrace/qemu_trace.h
++ *
++ * Copyright (C) 2007-2008 Google, Inc.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ *
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++void qemu_trace_start(void);
++void qemu_trace_stop(void);
++int qemu_trace_get_tracing(void);
++void qemu_trace_add_mapping(unsigned int addr, const char *symbol);
++void qemu_trace_remove_mapping(unsigned int addr);
++void qemu_trace_process_name(const char *name);
+--- /dev/null
++++ b/drivers/misc/qemutrace/qemu_trace_sysfs.c
+@@ -0,0 +1,182 @@
++/* drivers/misc/qemu_sysfs.c
++ *
++ * Copyright (C) 2007-2008 Google, Inc.
++ * Author: Jack Veenstra
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/miscdevice.h>
++#include <linux/sysdev.h>
++#include <linux/fs.h>
++#include <linux/poll.h>
++#include <linux/interrupt.h>
++#include <linux/delay.h>
++#include <linux/clk.h>
++#include <linux/wait.h>
++#include "qemu_trace.h"
++
++MODULE_DESCRIPTION("Qemu Trace Driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION("1.0");
++
++static struct kobject *qemu_trace_kobj;
++
++static ssize_t state_show(struct kobject *kobj, struct kobj_attribute *attr, char * buf)
++{
++    int val = qemu_trace_get_tracing();
++    buf[0] = '0' + val;
++    buf[1] = '\n';
++    return 2;
++}
++
++static ssize_t state_store(struct kobject *kobj, struct kobj_attribute *attr, const char * buf, size_t n)
++{
++    if (n <= 0)
++	return -EINVAL;
++    if (buf[0] == '0')
++        qemu_trace_stop();
++    else if (buf[0] == '1')
++        qemu_trace_start();
++    else
++	return -EINVAL;
++    return n;
++}
++
++static ssize_t symbol_show(struct kobject *kobj, struct kobj_attribute *attr, char * buf)
++{
++    return 0;
++}
++
++// We are expecting a string of the form "addr symbol" where 'addr' is a hex address
++// (without the leading '0x') and symbol is a newline-terminated string.  This symbol
++// with its corresponding address will be added to the trace file.
++//
++// To remove the mapping for (addr, symbol) in the trace file, write just the
++// address.  As before, the address is in hex without the leading '0x'.  It can
++// be newline-terminated or zero-terminated.
++static ssize_t symbol_store(struct kobject *kobj, struct kobj_attribute *attr, const char * buf, size_t n)
++{
++    const char *cp;
++    unsigned int addr = 0;
++    int len;
++    char *sym;
++
++    if (n <= 0 || buf == NULL)
++	return -EINVAL;
++    for (cp = buf; *cp != ' '; ++cp) {
++        unsigned int digit;
++
++        if (*cp >= '0' && *cp <= '9')
++            digit = *cp - '0';
++        else if (*cp >= 'a' && *cp <= 'f')
++            digit = *cp - 'a' + 10;
++        else if (*cp == 0 || *cp == '\n') {
++            qemu_trace_remove_mapping(addr);
++            return n;
++        } else
++            return -EINVAL;
++        addr = (addr << 4) + digit;
++    }
++    // Move past the space
++    cp += 1;
++
++    // Copy the string to a new buffer so that we can replace the newline
++    // with '\0'.
++    len = strlen(cp);
++    sym = kzalloc(len + 1, GFP_KERNEL);
++    strcpy(sym, cp);
++    if (sym[len - 1] == '\n')
++        sym[len - 1] = 0;
++
++    qemu_trace_add_mapping(addr, sym);
++    kfree(sym);
++    return n;
++}
++
++static ssize_t process_name_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
++{
++    return 0;
++}
++
++/* This expects a string that is the process name.  If the string contains
++ * a trailing newline, that is removed in the emulator tracing code because
++ * it is simpler to do it there.
++ */
++static ssize_t process_name_store(struct kobject *kobj, struct kobj_attribute *attr, const char *buf, size_t n)
++{
++    if (n <= 0 || buf == NULL)
++	return -EINVAL;
++
++    qemu_trace_process_name(buf);
++    return n;
++}
++
++
++#define qemu_trace_attr(_name) \
++static struct kobj_attribute _name##_attr = {	\
++	.attr	= {				\
++		.name = __stringify(_name),	\
++		.mode = 0666,			\
++	},					\
++	.show	= _name##_show,			\
++	.store	= _name##_store,		\
++}
++
++qemu_trace_attr(state);
++qemu_trace_attr(symbol);
++qemu_trace_attr(process_name);
++
++static struct attribute * qemu_trace_attrs[] = {
++	&state_attr.attr,
++	&symbol_attr.attr,
++	&process_name_attr.attr,
++	NULL,
++};
++
++static struct attribute_group qemu_trace_attr_group = {
++	.attrs = qemu_trace_attrs,
++};
++
++static int __init qemu_trace_init(void)
++{
++	int ret;
++
++	qemu_trace_kobj = kobject_create_and_add("qemu_trace", NULL);
++	if (qemu_trace_kobj == NULL) {
++		printk("qemu_trace_init: kobject_create_and_add failed\n");
++		ret = -ENOMEM;
++		return ret;
++	}
++	ret = sysfs_create_group(qemu_trace_kobj, &qemu_trace_attr_group);
++	if (ret) {
++		printk("qemu_trace_init: sysfs_create_group failed\n");
++		goto err;
++	}
++
++	return 0;
++
++err:
++	kobject_del(qemu_trace_kobj);
++	qemu_trace_kobj = NULL;
++	return ret;
++}
++
++static void  __exit qemu_trace_exit(void)
++{
++	sysfs_remove_group(qemu_trace_kobj, &qemu_trace_attr_group);
++	kobject_del(qemu_trace_kobj);
++}
++
++core_initcall(qemu_trace_init);
++module_exit(qemu_trace_exit);
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -59,6 +59,9 @@
+ #include <asm/mmu_context.h>
+ #include <asm/tlb.h>
+ #include "internal.h"
++#ifdef CONFIG_QEMU_TRACE
++	void qemu_trace_thread_name(char *name);
++#endif
+ 
+ int core_uses_pid;
+ char core_pattern[CORENAME_MAX_SIZE] = "core";
+@@ -922,6 +925,9 @@ void set_task_comm(struct task_struct *t
+ 	task_lock(tsk);
+ 	strlcpy(tsk->comm, buf, sizeof(tsk->comm));
+ 	task_unlock(tsk);
++#ifdef CONFIG_QEMU_TRACE
++	qemu_trace_thread_name(buf);
++#endif
+ }
+ 
+ int flush_old_exec(struct linux_binprm * bprm)
+@@ -1245,6 +1251,10 @@ void free_bprm(struct linux_binprm *bprm
+ 	kfree(bprm);
+ }
+ 
++#ifdef CONFIG_QEMU_TRACE
++extern void qemu_trace_execve(int argc, char __user * __user * argv);
++#endif
++
+ /*
+  * sys_execve() executes a new program.
+  */
+@@ -1324,6 +1334,10 @@ int do_execve(char * filename,
+ 		goto out;
+ 
+ 	current->flags &= ~PF_KTHREAD;
++#ifdef CONFIG_QEMU_TRACE
++        qemu_trace_execve(bprm->argc, argv);
++#endif
++
+ 	retval = search_binary_handler(bprm,regs);
+ 	if (retval < 0)
+ 		goto out;
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -60,6 +60,11 @@ DEFINE_TRACE(sched_process_free);
+ DEFINE_TRACE(sched_process_exit);
+ DEFINE_TRACE(sched_process_wait);
+ 
++#ifdef CONFIG_QEMU_TRACE
++void qemu_trace_thread_name(char *name);
++void qemu_trace_exit(int code);
++#endif
++
+ static void exit_mm(struct task_struct * tsk);
+ 
+ static void __unhash_process(struct task_struct *p)
+@@ -426,6 +431,9 @@ void daemonize(const char *name, ...)
+ 	va_start(args, name);
+ 	vsnprintf(current->comm, sizeof(current->comm), name, args);
+ 	va_end(args);
++#ifdef CONFIG_QEMU_TRACE
++	qemu_trace_thread_name(current->comm);
++#endif
+ 
+ 	/*
+ 	 * If we were started as result of loading a module, close all of the
+@@ -1012,6 +1020,12 @@ NORET_TYPE void do_exit(long code)
+ 	preempt_disable();
+ 	/* causes final put_task_struct in finish_task_switch(). */
+ 	tsk->state = TASK_DEAD;
++
++#ifdef CONFIG_QEMU_TRACE
++	/* Emit a trace record for the exit() call. */
++	qemu_trace_exit(code);
++#endif
++
+ 	schedule();
+ 	BUG();
+ 	/* Avoid "noreturn function does return".  */
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1333,6 +1333,10 @@ struct task_struct * __cpuinit fork_idle
+ 	return task;
+ }
+ 
++#ifdef CONFIG_QEMU_TRACE
++extern void qemu_trace_fork(struct task_struct *forked, unsigned long clone_flags);
++#endif
++
+ /*
+  *  Ok, this is the main fork-routine.
+  *
+@@ -1434,6 +1438,10 @@ long do_fork(unsigned long clone_flags,
+ 		tracehook_report_clone_complete(trace, regs,
+ 						clone_flags, nr, p);
+ 
++#ifdef CONFIG_QEMU_TRACE
++                qemu_trace_fork(p, clone_flags);
++#endif
++
+ 		if (clone_flags & CLONE_VFORK) {
+ 			freezer_do_not_count();
+ 			wait_for_completion(&vfork);
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -2747,6 +2747,10 @@ asmlinkage void schedule_tail(struct tas
+ 		put_user(task_pid_vnr(current), current->set_child_tid);
+ }
+ 
++#ifdef CONFIG_QEMU_TRACE
++void qemu_trace_cs(struct task_struct *next);
++#endif
++
+ /*
+  * context_switch - switch to the new MM and the new
+  * thread's register state.
+@@ -2789,6 +2793,11 @@ context_switch(struct rq *rq, struct tas
+ 	spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
+ #endif
+ 
++#ifdef CONFIG_QEMU_TRACE
++	/* Emit a trace record for the context switch. */
++	qemu_trace_cs(next);
++#endif
++
+ 	/* Here we just switch the register state and the stack. */
+ 	switch_to(prev, next, prev);
+ 
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -903,6 +903,11 @@ void vm_stat_account(struct mm_struct *m
+ }
+ #endif /* CONFIG_PROC_FS */
+ 
++#ifdef CONFIG_QEMU_TRACE
++extern void qemu_trace_mmap(struct vm_area_struct * vma);
++extern void qemu_trace_munmap(unsigned long start, unsigned long end);
++#endif
++
+ /*
+  * The caller must hold down_write(current->mm->mmap_sem).
+  */
+@@ -1209,6 +1214,10 @@ munmap_back:
+ 	pgoff = vma->vm_pgoff;
+ 	vm_flags = vma->vm_flags;
+ 
++#ifdef CONFIG_QEMU_TRACE
++        qemu_trace_mmap(vma);       
++#endif
++
+ 	if (vma_wants_writenotify(vma))
+ 		vma->vm_page_prot = vm_get_page_prot(vm_flags & ~VM_SHARED);
+ 
+@@ -1935,6 +1944,10 @@ int do_munmap(struct mm_struct *mm, unsi
+ 	 * Remove the vma's, and unmap the actual pages
+ 	 */
+ 	detach_vmas_to_be_unmapped(mm, vma, prev, end);
++
++#ifdef CONFIG_QEMU_TRACE
++	qemu_trace_munmap(start, end);
++#endif
+ 	unmap_region(mm, vma, prev, start, end);
+ 
+ 	/* Fix up all other VM information */
diff --git a/target/linux/goldfish/patches-2.6.30/0133--ARM-goldfish-qemutrace-Add-mmap-support.patch b/target/linux/goldfish/patches-2.6.30/0133--ARM-goldfish-qemutrace-Add-mmap-support.patch
new file mode 100644
index 0000000000..44554a6176
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/0133--ARM-goldfish-qemutrace-Add-mmap-support.patch
@@ -0,0 +1,84 @@
+From 2309613958ee518f94f1a7ba900e08e604e06048 Mon Sep 17 00:00:00 2001
+From: Jack Veenstra <veenstra@android.com>
+Date: Fri, 1 May 2009 18:50:10 -0700
+Subject: [PATCH 133/134] [ARM] goldfish: qemutrace: Add mmap support.
+
+This makes a page of data available for writing from user-space to allow
+the Dalvik interpreter to send method trace information to the emulator.
+
+Signed-off-by: Jack Veenstra <veenstra@android.com>
+---
+ drivers/misc/qemutrace/qemu_trace.c |   35 ++++++++++++++++++++++++++++++++++-
+ 1 files changed, 34 insertions(+), 1 deletions(-)
+
+--- a/drivers/misc/qemutrace/qemu_trace.c
++++ b/drivers/misc/qemutrace/qemu_trace.c
+@@ -53,6 +53,7 @@
+ 
+ static unsigned char __iomem *qt_base;
+ static int init_called;
++static uint32_t qemu_trace_paddr;
+ 
+ /* PIDs that start before our device registered */
+ #define MAX_INIT_PIDS   2048
+@@ -330,8 +331,30 @@ static void qemu_trace_dump_init_threads
+ 	}
+ }
+ 
++static int qemu_trace_mmap_fop(struct file *file, struct vm_area_struct *vma)
++{
++	int ret = io_remap_pfn_range(vma, vma->vm_start,
++			(qemu_trace_paddr >> PAGE_SHIFT) + 1,
++			PAGE_SIZE, vma->vm_page_prot);
++	if (ret < 0)
++		return ret;
++	return 0;
++}
++
++static const struct file_operations qemu_trace_fops = {
++	.owner = THIS_MODULE,
++	.mmap = qemu_trace_mmap_fop,
++};
++
++static struct miscdevice qemu_trace_device = {
++	.minor = MISC_DYNAMIC_MINOR,
++	.name = "qemu_trace",
++	.fops = &qemu_trace_fops,
++};
++
+ static int qemu_trace_probe(struct platform_device *pdev)
+ {
++	int err;
+ 	struct resource *r;
+ 
+ 	/* not thread safe, but this should not happen */
+@@ -340,18 +363,28 @@ static int qemu_trace_probe(struct platf
+ 		return -ENODEV;
+ 	}
+ 	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	if (r == NULL)
++	if (r == NULL || r->end - r->start < 2 * PAGE_SIZE - 1)
+ 		return -EINVAL;
++	qemu_trace_paddr = r->start;
+ 	qt_base = ioremap(r->start, PAGE_SIZE);
+ 	printk(KERN_INFO "QEMU TRACE Device: The mapped IO base is %p\n", qt_base);
+ 
+ 	qemu_trace_dump_init_threads();
++	err = misc_register(&qemu_trace_device);
++	if (err)
++		goto err_misc_register;
+ 
+ 	return 0;
++
++err_misc_register:
++	iounmap(qt_base);
++	qt_base = NULL;
++	return err;
+ }
+ 
+ static int qemu_trace_remove(struct platform_device *pdev)
+ {
++	misc_deregister(&qemu_trace_device);
+ 	iounmap(qt_base);
+ 	qt_base = NULL;
+ 	return 0;
diff --git a/target/linux/goldfish/patches-2.6.30/1000-nand_driver_fixes.patch b/target/linux/goldfish/patches-2.6.30/1000-nand_driver_fixes.patch
new file mode 100644
index 0000000000..0cd366ce90
--- /dev/null
+++ b/target/linux/goldfish/patches-2.6.30/1000-nand_driver_fixes.patch
@@ -0,0 +1,94 @@
+--- a/drivers/mtd/devices/goldfish_nand.c
++++ b/drivers/mtd/devices/goldfish_nand.c
+@@ -65,7 +65,7 @@ static int goldfish_nand_erase(struct mt
+ 	if(rem)
+ 		goto invalid_arg;
+ 	ofs *= (mtd->writesize + mtd->oobsize);
+-	
++
+ 	if(len % mtd->writesize)
+ 		goto invalid_arg;
+ 	len = len / mtd->writesize * (mtd->writesize + mtd->oobsize);
+@@ -94,15 +94,12 @@ static int goldfish_nand_read_oob(struct
+ 
+ 	if(ofs + ops->len > mtd->size)
+ 		goto invalid_arg;
+-	if(ops->datbuf && ops->len && ops->len != mtd->writesize)
+-		goto invalid_arg;
+ 	if(ops->ooblen + ops->ooboffs > mtd->oobsize)
+ 		goto invalid_arg;
+ 
+ 	rem = do_div(ofs, mtd->writesize);
+-	if(rem)
+-		goto invalid_arg;
+ 	ofs *= (mtd->writesize + mtd->oobsize);
++	ofs += rem;
+ 
+ 	if(ops->datbuf)
+ 		ops->retlen = goldfish_nand_cmd(mtd, NAND_CMD_READ, ofs,
+@@ -131,7 +128,7 @@ static int goldfish_nand_write_oob(struc
+ 		goto invalid_arg;
+ 	if(ops->ooblen + ops->ooboffs > mtd->oobsize)
+ 		goto invalid_arg;
+-	
++
+ 	rem = do_div(ofs, mtd->writesize);
+ 	if(rem)
+ 		goto invalid_arg;
+@@ -160,15 +157,24 @@ static int goldfish_nand_read(struct mtd
+ 
+ 	if(from + len > mtd->size)
+ 		goto invalid_arg;
+-	if(len != mtd->writesize)
+-		goto invalid_arg;
++
++	*retlen = 0;
+ 
+ 	rem = do_div(from, mtd->writesize);
+-	if(rem)
+-		goto invalid_arg;
+ 	from *= (mtd->writesize + mtd->oobsize);
++	from += rem;
+ 
+-	*retlen = goldfish_nand_cmd(mtd, NAND_CMD_READ, from, len, buf);
++	do {
++		*retlen += goldfish_nand_cmd(mtd, NAND_CMD_READ, from, min(len, mtd->writesize - rem), buf);
++		if (len > mtd->writesize - rem) {
++			len -= mtd->writesize - rem;
++			buf += mtd->writesize - rem;
++			from += mtd->writesize + mtd->oobsize - rem;
++			rem = 0;
++		} else {
++			len = 0;
++		}
++	} while (len);
+ 	return 0;
+ 
+ invalid_arg:
+@@ -184,15 +190,23 @@ static int goldfish_nand_write(struct mt
+ 
+ 	if(to + len > mtd->size)
+ 		goto invalid_arg;
+-	if(len != mtd->writesize)
+-		goto invalid_arg;
+ 
+ 	rem = do_div(to, mtd->writesize);
+ 	if(rem)
+ 		goto invalid_arg;
+ 	to *= (mtd->writesize + mtd->oobsize);
+ 
+-	*retlen = goldfish_nand_cmd(mtd, NAND_CMD_WRITE, to, len, (void *)buf);
++	*retlen = 0;
++	do {
++		*retlen += goldfish_nand_cmd(mtd, NAND_CMD_WRITE, to, min(len, mtd->writesize), (void *)buf);
++		if (len > mtd->writesize) {
++			len -= mtd->writesize;
++			buf += mtd->writesize;
++			to += mtd->writesize + mtd->oobsize;
++		} else {
++			len = 0;
++		}
++	} while (len);
+ 	return 0;
+ 
+ invalid_arg: