Merged.

26 files changed, 124 insertions, 147 deletions

diff --git a/linux-2.6-xen-sparse/arch/xen/configs/xen_defconfig_x86_32 b/linux-2.6-xen-sparse/arch/xen/configs/xen_defconfig_x86_32
index 04403f1a20..22af9b3176 100644
--- a/linux-2.6-xen-sparse/arch/xen/configs/xen_defconfig_x86_32
+++ b/linux-2.6-xen-sparse/arch/xen/configs/xen_defconfig_x86_32
@@ -2724,7 +2724,7 @@ CONFIG_NTFS_FS=m
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_SYSFS=y
-CONFIG_DEVFS_FS=y
+# CONFIG_DEVFS_FS is not set
 # CONFIG_DEVFS_MOUNT is not set
 # CONFIG_DEVFS_DEBUG is not set
 CONFIG_DEVPTS_FS_XATTR=y
diff --git a/linux-2.6-xen-sparse/arch/xen/configs/xen_defconfig_x86_64 b/linux-2.6-xen-sparse/arch/xen/configs/xen_defconfig_x86_64
index cea13495a4..ef41e78d32 100644
--- a/linux-2.6-xen-sparse/arch/xen/configs/xen_defconfig_x86_64
+++ b/linux-2.6-xen-sparse/arch/xen/configs/xen_defconfig_x86_64
@@ -2201,7 +2201,7 @@ CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_SYSFS=y
-CONFIG_DEVFS_FS=y
+# CONFIG_DEVFS_FS is not set
 CONFIG_DEVPTS_FS_XATTR=y
 CONFIG_DEVPTS_FS_SECURITY=y
 CONFIG_TMPFS=y
diff --git a/linux-2.6-xen-sparse/arch/xen/i386/kernel/smp.c b/linux-2.6-xen-sparse/arch/xen/i386/kernel/smp.c
index 115869898a..9c3a0d534e 100644
--- a/linux-2.6-xen-sparse/arch/xen/i386/kernel/smp.c
+++ b/linux-2.6-xen-sparse/arch/xen/i386/kernel/smp.c
@@ -28,8 +28,6 @@
 #endif
 #include <asm-xen/evtchn.h>
 
-#define xxprint(msg) HYPERVISOR_console_io(CONSOLEIO_write, strlen(msg), msg)
-
 /*
  *	Some notes on x86 processor bugs affecting SMP operation:
  *
@@ -542,9 +540,7 @@ static void stop_this_cpu (void * dummy)
 	 */
 	cpu_clear(smp_processor_id(), cpu_online_map);
 	local_irq_disable();
-#if 1
-	xxprint("stop_this_cpu disable_local_APIC\n");
-#else
+#if 0
 	disable_local_APIC();
 #endif
 	if (cpu_data[smp_processor_id()].hlt_works_ok)
@@ -561,9 +557,7 @@ void smp_send_stop(void)
 	smp_call_function(stop_this_cpu, NULL, 1, 0);
 
 	local_irq_disable();
-#if 1
-	xxprint("smp_send_stop disable_local_APIC\n");
-#else
+#if 0
 	disable_local_APIC();
 #endif
 	local_irq_enable();
diff --git a/linux-2.6-xen-sparse/arch/xen/i386/mm/pgtable.c b/linux-2.6-xen-sparse/arch/xen/i386/mm/pgtable.c
index 6431722c25..c904a1fd44 100644
--- a/linux-2.6-xen-sparse/arch/xen/i386/mm/pgtable.c
+++ b/linux-2.6-xen-sparse/arch/xen/i386/mm/pgtable.c
@@ -389,7 +389,6 @@ void pgd_free(pgd_t *pgd)
 }
 
 #ifndef CONFIG_XEN_SHADOW_MODE
-asmlinkage int xprintk(const char *fmt, ...);
 void make_lowmem_page_readonly(void *va)
 {
 	pte_t *pte = virt_to_ptep(va);
diff --git a/linux-2.6-xen-sparse/arch/xen/x86_64/kernel/smp.c b/linux-2.6-xen-sparse/arch/xen/x86_64/kernel/smp.c
index 978ae5cf51..0e6ee3c72b 100644
--- a/linux-2.6-xen-sparse/arch/xen/x86_64/kernel/smp.c
+++ b/linux-2.6-xen-sparse/arch/xen/x86_64/kernel/smp.c
@@ -31,8 +31,6 @@
 #ifdef CONFIG_XEN
 #include <asm-xen/evtchn.h>
 
-#define xxprint(msg) HYPERVISOR_console_io(CONSOLEIO_write, strlen(msg), msg)
-
 #else
 /*
  *	Smarter SMP flushing macros. 
@@ -379,8 +377,6 @@ void smp_stop_cpu(void)
 	local_irq_disable();
 #ifndef CONFIG_XEN
 	disable_local_APIC();
-#else
-	xxprint("stop_this_cpu disable_local_APIC\n");
 #endif
 	local_irq_enable(); 
 }
@@ -409,9 +405,7 @@ void smp_send_stop(void)
 		spin_unlock(&call_lock);
 
 	local_irq_disable();
-#ifdef CONFIG_XEN
-	xxprint("stop_this_cpu disable_local_APIC\n");
-#else
+#ifndef CONFIG_XEN
 	disable_local_APIC();
 #endif
 	local_irq_enable();
diff --git a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
index bbe6d29acd..0e2c8105cc 100644
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
@@ -498,10 +498,14 @@ static void make_response(blkif_t *blkif, unsigned long id,
          * notifications if requests are already in flight (lower overheads
          * and promotes batching).
          */
-	if (!__on_blkdev_list(blkif) &&
-	    RING_HAS_UNCONSUMED_REQUESTS(blk_ring)) {
-		add_to_blkdev_list_tail(blkif);
-		maybe_trigger_blkio_schedule();
+	mb();
+	if (!__on_blkdev_list(blkif)) {
+		int more_to_do;
+		RING_FINAL_CHECK_FOR_REQUESTS(blk_ring, more_to_do);
+		if (more_to_do) {
+			add_to_blkdev_list_tail(blkif);
+			maybe_trigger_blkio_schedule();
+		}
 	}
 
 	if (notify)
diff --git a/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c b/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
index 0200c779fb..6c9e5b6480 100644
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
@@ -311,7 +311,7 @@ static void connect(struct blkfront_info *info)
 	int err;
 
         if( (info->connected == BLKIF_STATE_CONNECTED) || 
-	    (info->connected == BLKIF_STATE_SUSPENDED) ) 
+	    (info->connected == BLKIF_STATE_SUSPENDED) )
 		return;
 
 	DPRINTK("blkfront.c:connect:%s.\n", info->xbdev->otherend);
@@ -327,16 +327,18 @@ static void connect(struct blkfront_info *info)
 				 info->xbdev->otherend);
 		return;
 	}
-	
+
         xlvbd_add(sectors, info->vdevice, binfo, sector_size, info);
 
 	(void)xenbus_switch_state(info->xbdev, NULL, XenbusStateConnected); 
-	
+
 	/* Kick pending requests. */
 	spin_lock_irq(&blkif_io_lock);
 	info->connected = BLKIF_STATE_CONNECTED;
 	kick_pending_request_queues(info);
 	spin_unlock_irq(&blkif_io_lock);
+
+	add_disk(info->gd);
 }
 
 /**
@@ -395,16 +397,11 @@ static inline void ADD_ID_TO_FREELIST(
 
 static inline void flush_requests(struct blkfront_info *info)
 {
-	RING_IDX old_prod = info->ring.sring->req_prod;
+	int notify;
 
-	RING_PUSH_REQUESTS(&info->ring);
+	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&info->ring, notify);
 
-	/*
-         * Send new requests /then/ check if any old requests are still in
-         * flight. If so then there is no need to send a notification.
-         */
-	mb();
-	if (info->ring.sring->rsp_prod == old_prod)
+	if (notify)
 		notify_remote_via_irq(info->irq);
 }
 
@@ -593,7 +590,6 @@ void do_blkif_request(request_queue_t *rq)
 
 	while ((req = elv_next_request(rq)) != NULL) {
 		info = req->rq_disk->private_data;
-
 		if (!blk_fs_request(req)) {
 			end_request(req, 0);
 			continue;
diff --git a/linux-2.6-xen-sparse/drivers/xen/blkfront/block.h b/linux-2.6-xen-sparse/drivers/xen/blkfront/block.h
index 809451aec7..3809f9067b 100644
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/block.h
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/block.h
@@ -146,6 +146,9 @@ extern int blkif_revalidate(dev_t dev);
 extern void do_blkif_request (request_queue_t *rq); 
 
 /* Virtual block-device subsystem. */
+/* Note that xlvbd_add doesn't call add_disk for you: you're expected
+   to call add_disk on info->gd once the disk is properly connected
+   up. */
 int xlvbd_add(blkif_sector_t capacity, int device,
 	      u16 vdisk_info, u16 sector_size, struct blkfront_info *info);
 void xlvbd_del(struct blkfront_info *info);
diff --git a/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c b/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c
index 47ebba39f2..d97f798e6f 100644
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c
@@ -261,7 +261,6 @@ xlvbd_alloc_gendisk(int minor, blkif_sector_t capacity, int vdevice,
 	if (vdisk_info & VDISK_CDROM)
 		gd->flags |= GENHD_FL_CD;
 
-	add_disk(gd);
 	info->gd = gd;
 
 	return 0;
diff --git a/linux-2.6-xen-sparse/drivers/xen/console/console.c b/linux-2.6-xen-sparse/drivers/xen/console/console.c
index 137af277f3..292d4beaad 100644
--- a/linux-2.6-xen-sparse/drivers/xen/console/console.c
+++ b/linux-2.6-xen-sparse/drivers/xen/console/console.c
@@ -55,7 +55,6 @@
 #include <asm-xen/evtchn.h>
 #include <asm-xen/xencons.h>
 
-#include "xencons_ring.h"
 /*
  * Modes:
  *  'xencons=off'  [XC_OFF]:     Console is disabled.
@@ -135,19 +134,21 @@ static struct tty_driver *xencons_driver;
 static void kcons_write(
 	struct console *c, const char *s, unsigned int count)
 {
-	int           i;
+	int           i = 0;
 	unsigned long flags;
 
 	spin_lock_irqsave(&xencons_lock, flags);
-    
-	for (i = 0; i < count; i++) {
-		if ((wp - wc) >= (wbuf_size - 1))
-			break;
-		if ((wbuf[WBUF_MASK(wp++)] = s[i]) == '\n')
-			wbuf[WBUF_MASK(wp++)] = '\r';
-	}
 
-	__xencons_tx_flush();
+	while (i < count) {
+		for (; i < count; i++) {
+			if ((wp - wc) >= (wbuf_size - 1))
+				break;
+			if ((wbuf[WBUF_MASK(wp++)] = s[i]) == '\n')
+				wbuf[WBUF_MASK(wp++)] = '\r';
+		}
+
+		__xencons_tx_flush();
+	}
 
 	spin_unlock_irqrestore(&xencons_lock, flags);
 }
@@ -247,7 +248,6 @@ void xencons_force_flush(void)
 	if (xen_start_info->flags & SIF_INITDOMAIN)
 		return;
 
-
 	/* Spin until console data is flushed through to the daemon. */
 	while (wc != wp) {
 		int sent = 0;
@@ -271,8 +271,7 @@ static struct tty_struct *xencons_tty;
 static int xencons_priv_irq;
 static char x_char;
 
-/* Non-privileged receive callback. */
-static void xencons_rx(char *buf, unsigned len, struct pt_regs *regs)
+void xencons_rx(char *buf, unsigned len, struct pt_regs *regs)
 {
 	int           i;
 	unsigned long flags;
@@ -311,10 +310,9 @@ static void xencons_rx(char *buf, unsigned len, struct pt_regs *regs)
 	spin_unlock_irqrestore(&xencons_lock, flags);
 }
 
-/* Privileged and non-privileged transmit worker. */
 static void __xencons_tx_flush(void)
 {
-	int sz, work_done = 0;
+	int sent, sz, work_done = 0;
 
 	if (xen_start_info->flags & SIF_INITDOMAIN) {
 		if (x_char) {
@@ -340,20 +338,18 @@ static void __xencons_tx_flush(void)
 		}
 
 		while (wc != wp) {
-			int sent;
 			sz = wp - wc;
 			if (sz > (wbuf_size - WBUF_MASK(wc)))
 				sz = wbuf_size - WBUF_MASK(wc);
 			sent = xencons_ring_send(&wbuf[WBUF_MASK(wc)], sz);
-			if (sent > 0) {
-				wc += sent;
-				work_done = 1;
-			}
+			if (sent == 0)
+				break;
+			wc += sent;
+			work_done = 1;
 		}
 	}
 
-	if (work_done && (xencons_tty != NULL))
-	{
+	if (work_done && (xencons_tty != NULL)) {
 		wake_up_interruptible(&xencons_tty->write_wait);
 		if ((xencons_tty->flags & (1 << TTY_DO_WRITE_WAKEUP)) &&
 		    (xencons_tty->ldisc.write_wakeup != NULL))
@@ -361,31 +357,26 @@ static void __xencons_tx_flush(void)
 	}
 }
 
-/* Privileged receive callback and transmit kicker. */
-static irqreturn_t xencons_priv_interrupt(int irq, void *dev_id,
-                                          struct pt_regs *regs)
+void xencons_tx(void)
 {
-	static char   rbuf[16];
-	int           i, l;
 	unsigned long flags;
 
 	spin_lock_irqsave(&xencons_lock, flags);
+	__xencons_tx_flush();
+	spin_unlock_irqrestore(&xencons_lock, flags);
+}
 
-	if (xencons_tty != NULL)
-	{
-		/* Receive work. */
-		while ((l = HYPERVISOR_console_io(
-			CONSOLEIO_read, 16, rbuf)) > 0)
-			for (i = 0; i < l; i++)
-				tty_insert_flip_char(xencons_tty, rbuf[i], 0);
-		if (xencons_tty->flip.count != 0)
-			tty_flip_buffer_push(xencons_tty);
-	}
+/* Privileged receive callback and transmit kicker. */
+static irqreturn_t xencons_priv_interrupt(int irq, void *dev_id,
+                                          struct pt_regs *regs)
+{
+	static char rbuf[16];
+	int         l;
 
-	/* Transmit work. */
-	__xencons_tx_flush();
+	while ((l = HYPERVISOR_console_io(CONSOLEIO_read, 16, rbuf)) > 0)
+		xencons_rx(rbuf, l, regs);
 
-	spin_unlock_irqrestore(&xencons_lock, flags);
+	xencons_tx();
 
 	return IRQ_HANDLED;
 }
@@ -664,7 +655,8 @@ static int __init xencons_init(void)
 	if ((rc = tty_register_driver(DRV(xencons_driver))) != 0) {
 		printk("WARNING: Failed to register Xen virtual "
 		       "console driver as '%s%d'\n",
-		       DRV(xencons_driver)->name, DRV(xencons_driver)->name_base);
+		       DRV(xencons_driver)->name,
+		       DRV(xencons_driver)->name_base);
 		put_tty_driver(xencons_driver);
 		xencons_driver = NULL;
 		return rc;
@@ -681,8 +673,6 @@ static int __init xencons_init(void)
 			"console",
 			NULL);
 		BUG_ON(xencons_priv_irq < 0);
-	} else {
-		xencons_ring_register_receiver(xencons_rx);
 	}
 
 	printk("Xen virtual console successfully installed as %s%d\n",
diff --git a/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.c b/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.c
index 2d6eb044b6..1f97c77657 100644
--- a/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.c
+++ b/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.c
@@ -15,15 +15,14 @@
 
 #include <asm/hypervisor.h>
 #include <asm-xen/evtchn.h>
+#include <asm-xen/xencons.h>
 #include <linux/wait.h>
 #include <linux/interrupt.h>
 #include <linux/sched.h>
 #include <linux/err.h>
-#include "xencons_ring.h"
 #include <asm-xen/xen-public/io/console.h>
 
 static int xencons_irq;
-static xencons_receiver_func *xencons_receiver;
 
 static inline struct xencons_interface *xencons_interface(void)
 {
@@ -69,10 +68,8 @@ static irqreturn_t handle_input(int irq, void *unused, struct pt_regs *regs)
 	BUG_ON((prod - cons) > sizeof(intf->in));
 
 	while (cons != prod) {
-		if (xencons_receiver != NULL)
-			xencons_receiver(
-				intf->in + MASK_XENCONS_IDX(cons++, intf->in),
-				1, regs);
+		xencons_rx(intf->in+MASK_XENCONS_IDX(cons,intf->in), 1, regs);
+		cons++;
 	}
 
 	mb();
@@ -80,12 +77,9 @@ static irqreturn_t handle_input(int irq, void *unused, struct pt_regs *regs)
 
 	notify_daemon();
 
-	return IRQ_HANDLED;
-}
+	xencons_tx();
 
-void xencons_ring_register_receiver(xencons_receiver_func *f)
-{
-	xencons_receiver = f;
+	return IRQ_HANDLED;
 }
 
 int xencons_ring_init(void)
@@ -103,7 +97,7 @@ int xencons_ring_init(void)
 		xen_start_info->console_evtchn,
 		handle_input, 0, "xencons", NULL);
 	if (err <= 0) {
-		xprintk("XEN console request irq failed %i\n", err);
+		printk(KERN_ERR "XEN console request irq failed %i\n", err);
 		return err;
 	}
 
diff --git a/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.h b/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.h
deleted file mode 100644
index 25af2107f0..0000000000
--- a/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.h
+++ /dev/null
@@ -1,23 +0,0 @@
-#ifndef _XENCONS_RING_H
-#define _XENCONS_RING_H
-
-asmlinkage int xprintk(const char *fmt, ...);
-
-int xencons_ring_init(void);
-int xencons_ring_send(const char *data, unsigned len);
-
-typedef void (xencons_receiver_func)(
-	char *buf, unsigned len, struct pt_regs *regs);
-void xencons_ring_register_receiver(xencons_receiver_func *f);
-
-#endif /* _XENCONS_RING_H */
-
-/*
- * Local variables:
- *  c-file-style: "linux"
- *  indent-tabs-mode: t
- *  c-indent-level: 8
- *  c-basic-offset: 8
- *  tab-width: 8
- * End:
- */
diff --git a/linux-2.6-xen-sparse/drivers/xen/netback/netback.c b/linux-2.6-xen-sparse/drivers/xen/netback/netback.c
index a4d4439239..fa106a3834 100644
--- a/linux-2.6-xen-sparse/drivers/xen/netback/netback.c
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/netback.c
@@ -25,7 +25,7 @@ static int  make_rx_response(netif_t *netif,
                              s8       st,
                              u16      offset,
                              u16      size,
-                             u16      csum_valid);
+                             u16      flags);
 
 static void net_tx_action(unsigned long unused);
 static DECLARE_TASKLET(net_tx_tasklet, net_tx_action, 0);
@@ -301,7 +301,8 @@ static void net_rx_action(unsigned long unused)
 		id = RING_GET_REQUEST(&netif->rx, netif->rx.rsp_prod_pvt)->id;
 		if (make_rx_response(netif, id, status,
 				     (unsigned long)skb->data & ~PAGE_MASK,
-				     size, skb->proto_csum_valid) &&
+				     size, skb->proto_csum_valid ?
+				     NETRXF_csum_valid : 0) &&
 		    (rx_notify[irq] == 0)) {
 			rx_notify[irq] = 1;
 			notify_list[notify_nr++] = irq;
@@ -632,7 +633,7 @@ static void net_tx_action(unsigned long unused)
                  */
 		skb->ip_summed        = CHECKSUM_UNNECESSARY;
 		skb->proto_csum_valid = 1;
-		skb->proto_csum_blank = txreq.csum_blank;
+		skb->proto_csum_blank = !!(txreq.flags & NETTXF_csum_blank);
 
 		netif->stats.rx_bytes += txreq.size;
 		netif->stats.rx_packets++;
@@ -706,7 +707,7 @@ static int make_rx_response(netif_t *netif,
                             s8       st,
                             u16      offset,
                             u16      size,
-                            u16      csum_valid)
+                            u16      flags)
 {
 	RING_IDX i = netif->rx.rsp_prod_pvt;
 	netif_rx_response_t *resp;
@@ -714,7 +715,7 @@ static int make_rx_response(netif_t *netif,
 
 	resp = RING_GET_RESPONSE(&netif->rx, i);
 	resp->offset     = offset;
-	resp->csum_valid = csum_valid;
+	resp->flags      = flags;
 	resp->id         = id;
 	resp->status     = (s16)size;
 	if (st < 0)
diff --git a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
index e71d800c73..3a5541a28d 100644
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
@@ -660,7 +660,7 @@ static int network_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	tx->gref = np->grant_tx_ref[id] = ref;
 	tx->offset = (unsigned long)skb->data & ~PAGE_MASK;
 	tx->size = skb->len;
-	tx->csum_blank = (skb->ip_summed == CHECKSUM_HW);
+	tx->flags = (skb->ip_summed == CHECKSUM_HW) ? NETTXF_csum_blank : 0;
 
 	np->tx.req_prod_pvt = i + 1;
 	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&np->tx, notify);
@@ -775,7 +775,7 @@ static int netif_poll(struct net_device *dev, int *pbudget)
 		skb->len  = rx->status;
 		skb->tail = skb->data + skb->len;
 
-		if ( rx->csum_valid )
+		if ( rx->flags & NETRXF_csum_valid )
 			skb->ip_summed = CHECKSUM_UNNECESSARY;
 
 		np->stats.rx_packets++;
@@ -957,7 +957,8 @@ static void network_connect(struct net_device *dev)
 		tx->gref = np->grant_tx_ref[i];
 		tx->offset = (unsigned long)skb->data & ~PAGE_MASK;
 		tx->size = skb->len;
-		tx->csum_blank = (skb->ip_summed == CHECKSUM_HW);
+		tx->flags = (skb->ip_summed == CHECKSUM_HW) ?
+			NETTXF_csum_blank : 0;
 
 		np->stats.tx_bytes += skb->len;
 		np->stats.tx_packets++;
diff --git a/linux-2.6-xen-sparse/drivers/xen/tpmback/common.h b/linux-2.6-xen-sparse/drivers/xen/tpmback/common.h
index 231f28bdb6..cb7a1edffa 100644
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/common.h
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/common.h
@@ -12,6 +12,7 @@
 #include <linux/slab.h>
 #include <asm-xen/evtchn.h>
 #include <asm-xen/driver_util.h>
+#include <asm-xen/xen-public/grant_table.h>
 #include <asm-xen/xen-public/io/tpmif.h>
 #include <asm/io.h>
 #include <asm/pgalloc.h>
diff --git a/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c b/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c
index 84a31717eb..72b1971421 100644
--- a/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c
@@ -44,6 +44,7 @@
 #include <asm/semaphore.h>
 #include <asm/io.h>
 #include <asm-xen/evtchn.h>
+#include <asm-xen/xen-public/grant_table.h>
 #include <asm-xen/xen-public/io/tpmif.h>
 #include <asm/uaccess.h>
 #include <asm-xen/xenbus.h>
diff --git a/linux-2.6-xen-sparse/include/asm-xen/xencons.h b/linux-2.6-xen-sparse/include/asm-xen/xencons.h
index 4b4909ba91..fa2160d89d 100644
--- a/linux-2.6-xen-sparse/include/asm-xen/xencons.h
+++ b/linux-2.6-xen-sparse/include/asm-xen/xencons.h
@@ -4,4 +4,11 @@
 void xencons_force_flush(void);
 void xencons_resume(void);
 
+/* Interrupt work hooks. Receive data, or kick data out. */
+void xencons_rx(char *buf, unsigned len, struct pt_regs *regs);
+void xencons_tx(void);
+
+int xencons_ring_init(void);
+int xencons_ring_send(const char *data, unsigned len);
+
 #endif /* __ASM_XENCONS_H__ */
diff --git a/linux-2.6-xen-sparse/net/core/dev.c b/linux-2.6-xen-sparse/net/core/dev.c
index 8c73647ecb..5c59e4ca79 100644
--- a/linux-2.6-xen-sparse/net/core/dev.c
+++ b/linux-2.6-xen-sparse/net/core/dev.c
@@ -1283,6 +1283,11 @@ int dev_queue_xmit(struct sk_buff *skb)
 			skb->csum = offsetof(struct udphdr, check);
 			break;
 		default:
+			if (net_ratelimit())
+				printk(KERN_ERR "Attempting to checksum a non-"
+				       "TCP/UDP packet, dropping a protocol"
+				       " %d packet", skb->nh.iph->protocol);
+			rc = -EPROTO;
 			goto out_kfree_skb;
 		}
 		if ((skb->h.raw + skb->csum + 2) > skb->tail)
diff --git a/xen/arch/x86/shadow.c b/xen/arch/x86/shadow.c
index 0663d16f6d..d19f2fec78 100644
--- a/xen/arch/x86/shadow.c
+++ b/xen/arch/x86/shadow.c
@@ -2750,10 +2750,10 @@ static unsigned long shadow_l3_table(
                     g2mfn, g2mfn);
                 BUG(); /* XXX Deal gracefully with failure. */
             }
-
-            if (!get_shadow_ref(s2mfn))
-                BUG();
         } 
+
+        if (!get_shadow_ref(s2mfn))
+            BUG();
             
         /* Map shadow L2 into shadow L3 */
         spl3e[L3_PAGETABLE_ENTRIES - 1] = l3e_from_pfn(s2mfn, _PAGE_PRESENT);
@@ -3526,10 +3526,11 @@ static void shadow_invlpg_64(struct vcpu *v, unsigned long va)
 
     shadow_lock(d);
 
+    __shadow_sync_va(v, va);
+
     if ( __shadow_get_l1e(v, va, &old_sl1e) )
         if ( l1e_get_flags(old_sl1e) & _PAGE_PRESENT )
-            put_page_from_l1e(old_sl1e, d);
-
+            shadow_put_page_from_l1e(old_sl1e, d);
 
     sl1e = l1e_empty();
     __shadow_set_l1e(v, va, &sl1e);
diff --git a/xen/arch/x86/shadow_public.c b/xen/arch/x86/shadow_public.c
index 10b40f294b..70dd30abcd 100644
--- a/xen/arch/x86/shadow_public.c
+++ b/xen/arch/x86/shadow_public.c
@@ -1425,7 +1425,7 @@ alloc_p2m_table(struct domain *d)
 
 void shadow_l1_normal_pt_update(
     struct domain *d,
-    unsigned long pa, l1_pgentry_t gpte,
+    physaddr_t pa, l1_pgentry_t gpte,
     struct domain_mmap_cache *cache)
 {
     unsigned long sl1mfn;    
@@ -1450,7 +1450,7 @@ void shadow_l1_normal_pt_update(
 
 void shadow_l2_normal_pt_update(
     struct domain *d,
-    unsigned long pa, l2_pgentry_t gpde,
+    physaddr_t pa, l2_pgentry_t gpde,
     struct domain_mmap_cache *cache)
 {
     unsigned long sl2mfn;
@@ -1475,7 +1475,7 @@ void shadow_l2_normal_pt_update(
 #if CONFIG_PAGING_LEVELS >= 3
 void shadow_l3_normal_pt_update(
     struct domain *d,
-    unsigned long pa, l3_pgentry_t l3e,
+    physaddr_t pa, l3_pgentry_t l3e,
     struct domain_mmap_cache *cache)
 {
     unsigned long sl3mfn;
@@ -1502,7 +1502,7 @@ void shadow_l3_normal_pt_update(
 #if CONFIG_PAGING_LEVELS >= 4
 void shadow_l4_normal_pt_update(
     struct domain *d,
-    unsigned long pa, l4_pgentry_t l4e,
+    physaddr_t pa, l4_pgentry_t l4e,
     struct domain_mmap_cache *cache)
 {
     unsigned long sl4mfn;
diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 5d4955196b..93c352e6ed 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -74,7 +74,7 @@ __gnttab_map_grant_ref(
     grant_ref_t    ref;
     struct domain *ld, *rd;
     struct vcpu   *led;
-    u16            dev_hst_ro_flags;
+    u32            dev_hst_ro_flags;
     int            handle;
     u64            addr;
     unsigned long  frame = 0;
diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c
index 4595dc08ed..b7d24107b6 100644
--- a/xen/drivers/char/ns16550.c
+++ b/xen/drivers/char/ns16550.c
@@ -211,7 +211,8 @@ static void ns16550_init_postirq(struct serial_port *port)
     {
         /* Polled mode. Calculate time to fill RX FIFO and/or empty TX FIFO. */
         bits = uart->data_bits + uart->stop_bits + !!uart->parity;
-        uart->timeout_ms = (bits * port->tx_fifo_size * 1000) / uart->baud;
+        uart->timeout_ms = max_t(
+            unsigned int, 1, (bits * port->tx_fifo_size * 1000) / uart->baud);
         init_ac_timer(&uart->timer, ns16550_poll, port, 0);
         set_ac_timer(&uart->timer, NOW() + MILLISECS(uart->timeout_ms));
     }
diff --git a/xen/include/asm-x86/shadow.h b/xen/include/asm-x86/shadow.h
index fa1488cc06..b0c24dd895 100644
--- a/xen/include/asm-x86/shadow.h
+++ b/xen/include/asm-x86/shadow.h
@@ -131,10 +131,10 @@ extern int set_p2m_entry(
 extern void remove_shadow(struct domain *d, unsigned long gpfn, u32 stype);
 
 extern void shadow_l1_normal_pt_update(struct domain *d,
-                                       unsigned long pa, l1_pgentry_t l1e,
+                                       physaddr_t pa, l1_pgentry_t l1e,
                                        struct domain_mmap_cache *cache);
 extern void shadow_l2_normal_pt_update(struct domain *d,
-                                       unsigned long pa, l2_pgentry_t l2e,
+                                       physaddr_t pa, l2_pgentry_t l2e,
                                        struct domain_mmap_cache *cache);
 #if CONFIG_PAGING_LEVELS >= 3
 #include <asm/page-guest32.h>
@@ -148,12 +148,12 @@ extern void shadow_l2_normal_pt_update(struct domain *d,
 
 extern unsigned long gva_to_gpa(unsigned long gva);
 extern void shadow_l3_normal_pt_update(struct domain *d,
-                                       unsigned long pa, l3_pgentry_t l3e,
+                                       physaddr_t pa, l3_pgentry_t l3e,
                                        struct domain_mmap_cache *cache);
 #endif
 #if CONFIG_PAGING_LEVELS >= 4
 extern void shadow_l4_normal_pt_update(struct domain *d,
-                                       unsigned long pa, l4_pgentry_t l4e,
+                                       physaddr_t pa, l4_pgentry_t l4e,
                                        struct domain_mmap_cache *cache);
 #endif
 extern int shadow_do_update_va_mapping(unsigned long va,
diff --git a/xen/include/public/io/blkif.h b/xen/include/public/io/blkif.h
index 924c9d357c..44780ced7e 100644
--- a/xen/include/public/io/blkif.h
+++ b/xen/include/public/io/blkif.h
@@ -12,11 +12,10 @@
 #include "ring.h"
 
 /*
- * Front->back notifications: When enqueuing a new request, there is no
- * need to send a notification if there are old requests still in flight
- * (that is, old_req_prod != sring->rsp_prod). The backend guarantees to check
- * for new requests after queuing the response for the last in-flight request.
- * (NB. The generic req_event mechanism is not used for blk requests.)
+ * Front->back notifications: When enqueuing a new request, sending a
+ * notification can be made conditional on req_event (i.e., the generic
+ * hold-off mechanism provided by the ring macros). Backends must set
+ * req_event appropriately (e.g., using RING_FINAL_CHECK_FOR_REQUESTS()).
  * 
  * Back->front notifications: When enqueuing a new response, sending a
  * notification can be made conditional on rsp_event (i.e., the generic
diff --git a/xen/include/public/io/netif.h b/xen/include/public/io/netif.h
index 70ad3227b4..8bae672061 100644
--- a/xen/include/public/io/netif.h
+++ b/xen/include/public/io/netif.h
@@ -18,17 +18,21 @@
  * or rsp_event field in the shared ring.
  */
 
+/* Protocol checksum field is blank in the packet (hardware offload)? */
+#define _NETTXF_csum_blank (0)
+#define  NETTXF_csum_blank (1U<<_NETTXF_csum_blank)
+
 typedef struct netif_tx_request {
     grant_ref_t gref;      /* Reference to buffer page */
-    uint16_t offset:15;    /* Offset within buffer page */
-    uint16_t csum_blank:1; /* Proto csum field blank?   */
+    uint16_t offset;       /* Offset within buffer page */
+    uint16_t flags;        /* NETTXF_* */
     uint16_t id;           /* Echoed in response message. */
     uint16_t size;         /* Packet size in bytes.       */
 } netif_tx_request_t;
 
 typedef struct netif_tx_response {
     uint16_t id;
-    int8_t   status;
+    int16_t  status;       /* NETIF_RSP_* */
 } netif_tx_response_t;
 
 typedef struct {
@@ -36,11 +40,15 @@ typedef struct {
     grant_ref_t gref;      /* Reference to incoming granted frame */
 } netif_rx_request_t;
 
+/* Protocol checksum already validated (e.g., performed by hardware)? */
+#define _NETRXF_csum_valid (0)
+#define  NETRXF_csum_valid (1U<<_NETRXF_csum_valid)
+
 typedef struct {
-    uint16_t offset;     /* Offset in page of start of received packet  */
-    uint16_t csum_valid; /* Protocol checksum is validated?       */
     uint16_t id;
-    int16_t  status;     /* -ve: BLKIF_RSP_* ; +ve: Rx'ed pkt size. */
+    uint16_t offset;       /* Offset in page of start of received packet  */
+    uint16_t flags;        /* NETRXF_* */
+    int16_t  status;       /* -ve: BLKIF_RSP_* ; +ve: Rx'ed pkt size. */
 } netif_rx_response_t;
 
 /*
diff --git a/xen/include/public/io/ring.h b/xen/include/public/io/ring.h
index 6f1df572d3..d509181ae0 100644
--- a/xen/include/public/io/ring.h
+++ b/xen/include/public/io/ring.h
@@ -71,6 +71,7 @@ union __name##_sring_entry {                                            \
 struct __name##_sring {                                                 \
     RING_IDX req_prod, req_event;                                       \
     RING_IDX rsp_prod, rsp_event;                                       \
+    uint8_t  pad[48];                                                   \
     union __name##_sring_entry ring[1]; /* variable-length */           \
 };                                                                      \
                                                                         \
@@ -114,6 +115,7 @@ typedef struct __name##_back_ring __name##_back_ring_t
 #define SHARED_RING_INIT(_s) do {                                       \
     (_s)->req_prod  = (_s)->rsp_prod  = 0;                              \
     (_s)->req_event = (_s)->rsp_event = 1;                              \
+    memset((_s)->pad, 0, sizeof((_s)->pad));                            \
 } while(0)
 
 #define FRONT_RING_INIT(_r, _s, __size) do {                            \