merge of '96413855622926bccdbbfe20ecfe75876ce63806'

     and 'c506dccde8011523567684ad6f95b95ffc334a5a'

38 files changed, 8596 insertions, 396 deletions

diff --git a/packages/arm-kernel-shim/arm-kernel-shim_1.5.bb b/packages/arm-kernel-shim/arm-kernel-shim_1.5.bb
index 9e2b6fd912..fee3691c3c 100644
--- a/packages/arm-kernel-shim/arm-kernel-shim_1.5.bb
+++ b/packages/arm-kernel-shim/arm-kernel-shim_1.5.bb
@@ -5,7 +5,7 @@ HOMEPAGE = "http://wiki.buici.com/twiki/bin/view/Main/ApexBootloader"
 LICENSE = "GPL"
 PR = "r2"
 
-COMPATIBLE_MACHINE = "(ixp4xx|nslu2)"
+COMPATIBLE_MACHINE = "(ixp4xx|nslu2|fsg3)"
 
 SRC_URI = "ftp://ftp.buici.com/pub/arm/arm-kernel-shim/arm-kernel-shim-${PV}.tar.gz \
 	   file://config-nslu2.h \
diff --git a/packages/efl1/etk_0.1.0.003.bb b/packages/efl1/etk_0.1.0.004.bb
index 569b5c9242..c693f17ce5 100644
--- a/packages/efl1/etk_0.1.0.003.bb
+++ b/packages/efl1/etk_0.1.0.004.bb
@@ -1,7 +1,7 @@
 DESCRIPTION = "Etk is an advanced widget toolkit based on the Enlightenment Foundation Libraries."
 DEPENDS = "evas ecore edje"
 LICENSE = "MIT"
-PR = "r1"
+PR = "r2"
 
 inherit efl1
 
@@ -10,4 +10,5 @@ FILES_${PN} = "${libdir}/libetk.so*"
 FILES_${PN}-examples += "${bindir}"
 FILES_${PN}-engines = "${libdir}/etk/engines/*.so ${datadir}"
 FILES_${PN}-dev += "${libdir}/etk/engines/*.a ${libdir}/etk/engines/*.la"
-FILES_${PN}-dbg += "${libdir}/etk/engines/*/.debug/"
+FILES_${PN}-dbg += "${libdir}/etk/engines/.debug/"
+
diff --git a/packages/gcc/gcc-cross-kernel-3.4.4_csl-arm-2005q3.bb b/packages/gcc/gcc-cross-kernel-3.4.4_csl-arm-2005q3.bb
new file mode 100644
index 0000000000..4b7e7b715c
--- /dev/null
+++ b/packages/gcc/gcc-cross-kernel-3.4.4_csl-arm-2005q3.bb
@@ -0,0 +1,25 @@
+# This kernel compiler is required by the Freecom FSG-3 machine
+# Please talk to Rod Whitby before considering removing this file.
+
+DEFAULT_PREFERENCE = "-1"
+
+SECTION = "devel"
+# cut-down gcc for kernel builds
+# only installs ${TARGET_PREFIX}gcc-${PV}, not ${TARGET_PREFIX}gcc.
+
+require gcc-cross-initial_${PV}.bb
+
+PROVIDES = "virtual/${TARGET_PREFIX}gcc-${PV}"
+
+SRC_URI += "file://gcc-3.4.4-makefile-fix.patch;patch=1"
+
+do_install () {
+	:
+}
+
+do_stage () {
+	cd gcc
+	oe_runmake install-common install-headers install-libgcc
+	install -m 0755 xgcc ${CROSS_DIR}/bin/${TARGET_PREFIX}gcc-${PV}
+}
+
diff --git a/packages/gpe-scap/gpe-scap_1.3.bb b/packages/gpe-scap/gpe-scap_1.3.bb
new file mode 100644
index 0000000000..aec5819e6e
--- /dev/null
+++ b/packages/gpe-scap/gpe-scap_1.3.bb
@@ -0,0 +1,13 @@
+DESCRIPTION = "GPE screenshot application"
+LICENSE = "GPL"
+PRIORITY = "optional"
+SECTION = "gpe"
+PR = "r0"
+
+RREPLACES = "gpe-screenshot"
+
+DEPENDS = "glib-2.0 gtk+ libgpewidget libglade libsoup"
+
+GPE_TARBALL_SUFFIX = "bz2"
+
+inherit gpe autotools
diff --git a/packages/ixp4xx/ixp4xx-npe-native-2.3.2/IxNpeMicrocode.h b/packages/ixp4xx/ixp4xx-npe-native-2.3.2/IxNpeMicrocode.h
index 1c3d1ff473..2229619a27 100644
--- a/packages/ixp4xx/ixp4xx-npe-native-2.3.2/IxNpeMicrocode.h
+++ b/packages/ixp4xx/ixp4xx-npe-native-2.3.2/IxNpeMicrocode.h
@@ -51,11 +51,11 @@
 // #define IX_NPEDL_NPEIMAGE_NPEC_DMA
 // #define IX_NPEDL_NPEIMAGE_NPEC_CRYPTO_AES_ETH_LEARN_FILTER_SPAN
 // #define IX_NPEDL_NPEIMAGE_NPEC_CRYPTO_AES_ETH_LEARN_FILTER_FIREWALL
-#define IX_NPEDL_NPEIMAGE_NPEC_CRYPTO_AES_CCM_ETH
+// #define IX_NPEDL_NPEIMAGE_NPEC_CRYPTO_AES_CCM_ETH
 // #define IX_NPEDL_NPEIMAGE_NPEC_CRYPTO_ETH_LEARN_FILTER_SPAN_FIREWALL
 // #define IX_NPEDL_NPEIMAGE_NPEC_ETH_SPAN_FIREWALL_VLAN_QOS_HDR_CONV
 // #define IX_NPEDL_NPEIMAGE_NPEC_ETH_LEARN_FILTER_SPAN_FIREWALL_VLAN_QOS
-// #define IX_NPEDL_NPEIMAGE_NPEC_ETH_LEARN_FILTER_SPAN_FIREWALL
+#define IX_NPEDL_NPEIMAGE_NPEC_ETH_LEARN_FILTER_SPAN_FIREWALL
 
 
 #include <stdio.h>
diff --git a/packages/ixp4xx/ixp4xx-npe-native_2.3.2.bb b/packages/ixp4xx/ixp4xx-npe-native_2.3.2.bb
index 5b8af8f254..9db83352c4 100644
--- a/packages/ixp4xx/ixp4xx-npe-native_2.3.2.bb
+++ b/packages/ixp4xx/ixp4xx-npe-native_2.3.2.bb
@@ -1,6 +1,6 @@
 DESCRIPTION = "Firmware converter for the IXP4xx line of devices"
 LICENSE = "Intel Public Licence"
-PR = "r0"
+PR = "r1"
 
 SRC_URI = "http://You-Have-To-Download-The-Microcode-Manually-So-Please-Read-ixp4xx-npe_2.3.2.bb-For-Instructions/IPL_ixp400NpeLibrary-2_3_2.zip"
 SRC_URI += "file://IxNpeMicrocode.h"
diff --git a/packages/ixp4xx/ixp4xx-npe_2.3.2.bb b/packages/ixp4xx/ixp4xx-npe_2.3.2.bb
index 3a13074240..b5b1665735 100644
--- a/packages/ixp4xx/ixp4xx-npe_2.3.2.bb
+++ b/packages/ixp4xx/ixp4xx-npe_2.3.2.bb
@@ -1,6 +1,6 @@
 DESCRIPTION = "NPE firmware for the IXP4xx line of devices"
 LICENSE = "Intel Public Licence"
-PR = "r0"
+PR = "r1"
 DEPENDS = "ixp4xx-npe-native"
 
 # You need to download the IPL_ixp400NpeLibrary-2_3_2.zip file (without crypto) from:
@@ -13,7 +13,7 @@ S = "${WORKDIR}/ixp400_xscale_sw/src/npeDl"
 
 COMPATIBLE_MACHINE = "(nslu2|ixp4xx)"
 
-FILES_${PN} = "${base_libdir}/firmware/NPE-B"
+FILES_${PN} = "${base_libdir}/firmware/NPE-B ${base_libdir}/firmware/NPE-C"
 
 do_compile() {
 	${STAGING_BINDIR_NATIVE}/IxNpeMicrocode-${PV} -be
@@ -24,10 +24,14 @@ do_install() {
 	rm ${S}/NPE-B
 	mv ${S}/NPE-B.* ${S}/NPE-B
 	install ${S}/NPE-B ${D}/${base_libdir}/firmware/
+	rm ${S}/NPE-C
+	mv ${S}/NPE-C.* ${S}/NPE-C
+	install ${S}/NPE-C ${D}/${base_libdir}/firmware/
 }
 
 do_populate_staging() {
 	install -d ${STAGING_FIRMWARE_DIR}
 	install ${S}/NPE-B ${STAGING_FIRMWARE_DIR}/
+	install ${S}/NPE-C ${STAGING_FIRMWARE_DIR}/
 }
 
diff --git a/packages/linux/ixp4xx-kernel.inc b/packages/linux/ixp4xx-kernel.inc
index 1c9d004d0f..367685f112 100644
--- a/packages/linux/ixp4xx-kernel.inc
+++ b/packages/linux/ixp4xx-kernel.inc
@@ -151,7 +151,7 @@ SRC_URI  = "${IXP4XX_SRCURI}"
 SRC_URI += "${IXP4XX_PATCHES}"
 
 COMPATIBLE_HOST = 'arm.*-linux.*'
-COMPATIBLE_MACHINE = '(ixp4xx|nslu2)'
+COMPATIBLE_MACHINE = '(ixp4xx|nslu2|fsg3)'
 
 inherit kernel
 
diff --git a/packages/linux/linux-rp-2.6.21/connectplus-prevent-oops-HACK.patch b/packages/linux/linux-rp-2.6.21/connectplus-prevent-oops-HACK.patch
new file mode 100644
index 0000000000..b5439c62e7
--- /dev/null
+++ b/packages/linux/linux-rp-2.6.21/connectplus-prevent-oops-HACK.patch
@@ -0,0 +1,17 @@
+Index: linux-2.6.21/drivers/net/wireless/hostap/hostap_hw.c
+===================================================================
+--- linux-2.6.21.orig/drivers/net/wireless/hostap/hostap_hw.c	2007-07-07 12:45:39.000000000 +0100
++++ linux-2.6.21/drivers/net/wireless/hostap/hostap_hw.c	2007-07-07 12:47:30.000000000 +0100
+@@ -2666,6 +2666,12 @@
+ 	iface = netdev_priv(dev);
+ 	local = iface->local;
+ 
++	if(dev->base_addr == 0)
++	{
++		printk(KERN_DEBUG "%s: IRQ before base_addr set\n", dev->name);
++		return IRQ_HANDLED;
++	}
++
+ 	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 0);
+ 
+ 	if (local->func->card_present && !local->func->card_present(local)) {
diff --git a/packages/linux/linux-rp_2.6.21.bb b/packages/linux/linux-rp_2.6.21.bb
index 5c3b5e3a28..980732d409 100644
--- a/packages/linux/linux-rp_2.6.21.bb
+++ b/packages/linux/linux-rp_2.6.21.bb
@@ -1,6 +1,6 @@
 require linux-rp.inc
 
-PR = "r8"
+PR = "r9"
 
 # Handy URLs
 # git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git;protocol=git;tag=ef7d1b244fa6c94fb76d5f787b8629df64ea4046
@@ -49,6 +49,7 @@ SRC_URI = "http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.21.tar.bz2 \
            ${RPSRC}/pxa_cf_initorder_hack-r1.patch;patch=1;status=hack \
            file://pxa-serial-hack.patch;patch=1;status=hack \
            file://connectplus-remove-ide-HACK.patch;patch=1;status=hack \
+	   file://connectplus-prevent-oops-HACK.patch;patch=1;status=hack \
            file://squashfs3.0-2.6.15.patch;patch=1;status=external \
            file://vesafb-tng-1.0-rc2-2.6.20-rc2.patch;patch=1;status=external \
            file://sharpsl-rc-r1.patch;patch=1 \
diff --git a/packages/linux/linux/simpad/defconfig b/packages/linux/linux/simpad/defconfig
index 36d5e942b4..33f08a0593 100644
--- a/packages/linux/linux/simpad/defconfig
+++ b/packages/linux/linux/simpad/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.21
-# Sun May  6 14:01:42 2007
+# Sat Jul  7 00:02:55 2007
 #
 CONFIG_ARM=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
@@ -38,15 +38,16 @@ CONFIG_LOCALVERSION="oe1"
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
-# CONFIG_IPC_NS is not set
+CONFIG_IPC_NS=y
 CONFIG_SYSVIPC_SYSCTL=y
-# CONFIG_POSIX_MQUEUE is not set
-# CONFIG_BSD_PROCESS_ACCT is not set
+CONFIG_POSIX_MQUEUE=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
 # CONFIG_TASKSTATS is not set
 # CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
-CONFIG_SYSFS_DEPRECATED=y
+# CONFIG_SYSFS_DEPRECATED is not set
 # CONFIG_RELAY is not set
 # CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -76,8 +77,9 @@ CONFIG_BASE_SMALL=0
 # Loadable module support
 #
 CONFIG_MODULES=y
-# CONFIG_MODULE_UNLOAD is not set
-# CONFIG_MODVERSIONS is not set
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_KMOD=y
 
@@ -186,7 +188,7 @@ CONFIG_PCCARD=y
 # CONFIG_PCMCIA_DEBUG is not set
 CONFIG_PCMCIA=y
 CONFIG_PCMCIA_LOAD_CIS=y
-CONFIG_PCMCIA_IOCTL=y
+# CONFIG_PCMCIA_IOCTL is not set
 
 #
 # PC-card bridges
@@ -225,7 +227,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="mtdparts=sa1100:512k(boot),1m(kernel),-(root) console=ttySA0 root=1f02 noinitrd mem=64M jffs2_orphaned_inodes=delete rootfstype=jffs2"
+CONFIG_CMDLINE=""
 # CONFIG_XIP_KERNEL is not set
 # CONFIG_KEXEC is not set
 
@@ -257,10 +259,10 @@ CONFIG_BINFMT_MISC=m
 # Power management options
 #
 CONFIG_PM=y
-# CONFIG_PM_LEGACY is not set
+CONFIG_PM_LEGACY=y
 # CONFIG_PM_DEBUG is not set
 # CONFIG_PM_SYSFS_DEPRECATED is not set
-# CONFIG_APM_EMULATION is not set
+CONFIG_APM_EMULATION=y
 
 #
 # Networking
@@ -551,7 +553,30 @@ CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 #
 # ATA/ATAPI/MFM/RLL support
 #
-# CONFIG_IDE is not set
+CONFIG_IDE=m
+CONFIG_IDE_MAX_HWIFS=4
+CONFIG_BLK_DEV_IDE=m
+
+#
+# Please see Documentation/ide.txt for help/info on IDE drives
+#
+# CONFIG_BLK_DEV_IDE_SATA is not set
+CONFIG_BLK_DEV_IDEDISK=m
+CONFIG_IDEDISK_MULTI_MODE=y
+CONFIG_BLK_DEV_IDECS=m
+CONFIG_BLK_DEV_IDECD=m
+# CONFIG_BLK_DEV_IDETAPE is not set
+# CONFIG_BLK_DEV_IDEFLOPPY is not set
+# CONFIG_IDE_TASK_IOCTL is not set
+
+#
+# IDE chipset support/bugfixes
+#
+# CONFIG_IDE_GENERIC is not set
+# CONFIG_IDE_ARM is not set
+# CONFIG_IDE_CHIPSETS is not set
+# CONFIG_BLK_DEV_IDEDMA is not set
+# CONFIG_BLK_DEV_HD is not set
 
 #
 # SCSI device support
@@ -587,10 +612,10 @@ CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 # Network device support
 #
 CONFIG_NETDEVICES=y
-CONFIG_DUMMY=y
+CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
-# CONFIG_TUN is not set
+CONFIG_TUN=m
 
 #
 # ARCnet devices
@@ -674,12 +699,12 @@ CONFIG_NET_WIRELESS=y
 CONFIG_NET_PCMCIA=y
 CONFIG_PCMCIA_3C589=m
 CONFIG_PCMCIA_3C574=m
-# CONFIG_PCMCIA_FMVJ18X is not set
+CONFIG_PCMCIA_FMVJ18X=m
 CONFIG_PCMCIA_PCNET=m
-# CONFIG_PCMCIA_NMCLAN is not set
+CONFIG_PCMCIA_NMCLAN=m
 CONFIG_PCMCIA_SMC91C92=m
 CONFIG_PCMCIA_XIRC2PS=m
-# CONFIG_PCMCIA_AXNET is not set
+CONFIG_PCMCIA_AXNET=m
 
 #
 # Wan interfaces
@@ -692,7 +717,7 @@ CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
 CONFIG_PPP_DEFLATE=m
 CONFIG_PPP_BSDCOMP=m
-# CONFIG_PPP_MPPE is not set
+CONFIG_PPP_MPPE=m
 CONFIG_PPPOE=m
 # CONFIG_SLIP is not set
 CONFIG_SLHC=m
@@ -734,13 +759,14 @@ CONFIG_INPUT_KEYBOARD=y
 # CONFIG_KEYBOARD_SUNKBD is not set
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
-# CONFIG_KEYBOARD_NEWTON is not set
-# CONFIG_KEYBOARD_STOWAWAY is not set
+CONFIG_KEYBOARD_NEWTON=m
+CONFIG_KEYBOARD_STOWAWAY=m
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_INPUT_JOYSTICK is not set
 # CONFIG_INPUT_TOUCHSCREEN is not set
-# CONFIG_INPUT_MISC is not set
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_UINPUT=m
 
 #
 # Hardware I/O ports
@@ -937,7 +963,7 @@ CONFIG_SOUND=y
 #
 # HID Devices
 #
-CONFIG_HID=y
+CONFIG_HID=m
 # CONFIG_HID_DEBUG is not set
 
 #
@@ -960,6 +986,7 @@ CONFIG_USB_ARCH_HAS_HCD=y
 #
 # MMC/SD Card support
 #
+# CONFIG_MMC_SPI_BLOCK is not set
 # CONFIG_MMC is not set
 
 #
@@ -987,24 +1014,27 @@ CONFIG_REISERFS_FS=m
 CONFIG_REISERFS_PROC_INFO=y
 # CONFIG_REISERFS_FS_XATTR is not set
 # CONFIG_JFS_FS is not set
-# CONFIG_FS_POSIX_ACL is not set
+CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
 # CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
-# CONFIG_ROMFS_FS is not set
+CONFIG_ROMFS_FS=m
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
-# CONFIG_AUTOFS4_FS is not set
+CONFIG_AUTOFS4_FS=m
 # CONFIG_FUSE_FS is not set
+CONFIG_GENERIC_ACL=y
 
 #
 # CD-ROM/DVD Filesystems
 #
-# CONFIG_ISO9660_FS is not set
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
 # CONFIG_UDF_FS is not set
 
 #
@@ -1023,7 +1053,8 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 CONFIG_PROC_FS=y
 CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_CONFIGFS_FS is not set
@@ -1059,20 +1090,28 @@ CONFIG_CRAMFS=m
 #
 CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
-# CONFIG_NFS_V3_ACL is not set
-# CONFIG_NFS_V4 is not set
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
 # CONFIG_NFS_DIRECTIO is not set
 # CONFIG_NFSD is not set
-# CONFIG_ROOT_NFS is not set
+CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
+CONFIG_NFS_ACL_SUPPORT=y
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
-# CONFIG_RPCSEC_GSS_KRB5 is not set
+CONFIG_SUNRPC_GSS=y
+CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
 # CONFIG_SMB_NLS_DEFAULT is not set
-# CONFIG_CIFS is not set
+CONFIG_CIFS=m
+# CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+# CONFIG_CIFS_DEBUG2 is not set
+# CONFIG_CIFS_EXPERIMENTAL is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
@@ -1184,7 +1223,46 @@ CONFIG_DEBUG_LL=y
 #
 # Cryptographic options
 #
-# CONFIG_CRYPTO is not set
+CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_MANAGER=y
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_MD4 is not set
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_SHA1=m
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_WP512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_GF128MUL is not set
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_PCBC=m
+# CONFIG_CRYPTO_LRW is not set
+CONFIG_CRYPTO_DES=y
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_TEA is not set
+CONFIG_CRYPTO_ARC4=m
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_DEFLATE is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_TEST is not set
+
+#
+# Hardware crypto devices
+#
 
 #
 # Library routines
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-GPIO-MMC-mod.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-GPIO-MMC-mod.patch
new file mode 100644
index 0000000000..22f220de8a
--- /dev/null
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-GPIO-MMC-mod.patch
@@ -0,0 +1,1650 @@
+diff -uNr linux-2.6.21.vanilla/drivers/mmc/Kconfig linux-2.6.21/drivers/mmc/Kconfig
+--- linux-2.6.21.vanilla/drivers/mmc/Kconfig	2007-05-30 18:00:30.000000000 +0200
++++ linux-2.6.21/drivers/mmc/Kconfig	2007-05-30 18:26:18.000000000 +0200
+@@ -4,6 +4,12 @@
+ 
+ menu "MMC/SD Card support"
+ 
++config MMC_SPI_BLOCK
++	tristate "MMC support for SIMpad over GPIO"
++	help
++	  Say Y here to enable MMC block device over GPIO
++	  if you have done the MMC-Mod. For Module say M.
++
+ config MMC
+ 	tristate "MMC support"
+ 	help
+diff -uNr linux-2.6.21.vanilla/drivers/mmc/Makefile linux-2.6.21/drivers/mmc/Makefile
+--- linux-2.6.21.vanilla/drivers/mmc/Makefile	2007-05-30 18:00:30.000000000 +0200
++++ linux-2.6.21/drivers/mmc/Makefile	2007-05-30 18:26:18.000000000 +0200
+@@ -2,6 +2,8 @@
+ # Makefile for the kernel mmc device drivers.
+ #
+ 
++obj-$(CONFIG_MMC_SPI_BLOCK)	+= mmc_spi_block.o
++
+ #
+ # Core
+ #
+diff -uNr linux-2.6.21.vanilla/drivers/mmc/mmc_spi_block.c linux-2.6.21/drivers/mmc/mmc_spi_block.c
+--- linux-2.6.21.vanilla/drivers/mmc/mmc_spi_block.c	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.21/drivers/mmc/mmc_spi_block.c	2007-05-30 18:30:58.000000000 +0200
+@@ -0,0 +1,1618 @@
++/*
++ * Copyright (c) Cl�ent Ballabriga, 2005 - GPL
++ * Copyright (c) Guylhem Aznar, 2005 - GPL
++ *
++ * Please check http://externe.net/zaurus/simpad-bluetooth reference design first.
++ *
++ * Based on Madsuk/Rohde work on a MMC driver for the WRT54G.
++ *
++ * This is an ugly hack of a driver. I am surprised if it ever works!
++ * So please use a real driver or contribute one to the 2.4/2.6 mmc framework
++ *
++ * mrdata: ported to 2.6
++ */
++
++#include <linux/module.h>
++#include <linux/init.h>
++
++#include <linux/sched.h>
++#include <linux/kernel.h>
++#include <linux/fs.h>
++#include <linux/errno.h>
++#include <linux/hdreg.h>
++#include <linux/kdev_t.h>
++#include <linux/blkdev.h>
++#include <linux/spinlock.h>
++#include <linux/time.h>
++#include <linux/delay.h>
++#include <linux/timer.h>
++
++#include <linux/platform_device.h>
++
++#include <asm/hardware.h>
++#include <asm/arch/simpad.h>
++#include <asm/arch/gpio.h>
++
++static int major = 121;
++
++#define DEVICE_NAME "mmc_spi"
++
++static int hd_sizes[1<<6];
++static int hd_blocksizes[1<<6];
++static int hd_hardsectsizes[1<<6];
++static int hd_maxsect[1<<6];
++static struct hd_struct hd[1<<6];
++
++static struct gendisk *mmc_disk;
++
++static struct platform_device *mmc_dev; /* the one and only instance */
++
++static spinlock_t mmc_spi_lock;
++
++/*
++ * *******************************************************************
++ *
++ *                This is the only configurable part.
++ *
++ * *******************************************************************
++ *
++ */
++
++// #define DEBUG 1
++// #define DEBUG_HD 1
++// #define CHECK_MEDIA_CHANGE  // for developement ONLY, not working yet
++
++/* Let that include where it is or compilation fails on INIT_REQUEST/CURRENT */
++
++
++/*
++ * If you are using different GPIOs in your hardware hack, you must
++ * first make sure they are unused for other functions and then
++ * configure them here.
++ *
++ * On the simpad I use spare pins from the UART1 (internal serial port -> DECT 20-polig):
++ * 
++ *   Funktion  PIN  ##  Original direction  GPIO  ##  SPI function                New direction  SD/MMC   
++ * - DCD       PIN  08  (in)                GPIO  23  DO  - new name: DI -> MISO  (in)           PIN  7  Data Out
++ * - DTR       PIN  11  (out)               GPIO  07  CS                          (out)          PIN  1  Chip Select
++ * - RI        PIN  14  (in)                GPIO  19  CLK                         (out)          PIN  5  Clock
++ * - DSR       PIN  16  (in)                GPIO  06  DI  - new name: DO -> MOSI  (out)          PIN  2  Data In
++ * 
++ *
++ * SPI: MISO = Master In / Slave OUT   MOSI = Master Out / Slave In
++ *
++ * Don't worry about in/out original function - the GPIOs will be
++ * reprogrammed.
++ */
++
++#define GPIO_SD_DI   23
++#define GPIO_SD_CS   7
++#define GPIO_SD_CLK  19
++#define GPIO_SD_DO   6
++
++// #define FAST_GPIO_SD_DI		GPIO_GPIO23
++// #define FAST_GPIO_SD_CS		GPIO_GPIO7
++// #define FAST_GPIO_SD_CLK		GPIO_GPIO19
++// #define FAST_GPIO_SD_DO		GPIO_GPIO6
++
++#define FAST_GPIO_SD_DI   GPIO_UART1_DCD
++#define FAST_GPIO_SD_CS   GPIO_UART1_DTR
++#define FAST_GPIO_SD_CLK  GPIO_UART1_RI
++#define FAST_GPIO_SD_DO   GPIO_UART1_DSR
++
++/*
++ * *******************************************************************
++ *
++ *               Do not change anything below !
++ *
++ * *******************************************************************
++ *
++ */
++
++/* GPIO states */
++#define LOW 0
++#define HIGH 1
++
++#define INPUT 0
++#define OUTPUT 1
++
++#define PRESENT 1
++#define ABSENT 0
++
++typedef unsigned int   uint32;
++typedef unsigned long  u32_t;
++typedef unsigned short u16_t;
++typedef unsigned char  u8_t;
++
++static struct timer_list mmc_timer;
++
++// static struct timeval s_zeit, e_zeit;
++
++/* start with no card */
++static int mmc_media_detect = 0;
++static int mmc_media_changed = 1;
++
++
++/////////////////////
++// prototypes
++static int mmc_open(struct inode *inode, struct file *filp);
++static int mmc_release(struct inode *inode, struct file *filp);
++static int mmc_ioctl(struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg);
++static void mmc_request(request_queue_t *q);
++
++
++/*
++ * *******************************************************************
++ *
++ *             Begin GPIO hardware access functions.
++ *
++ * *******************************************************************
++ *
++ */
++
++#define gpio_read(a)		((GPLR & a) ? 1 : 0)
++#define gpio_write_high(a)	GPSR = a
++#define gpio_write_low(a)	GPCR = a
++
++/* set MMC_Chip_Select to HIGH (MMC/SD-Card inaktiv) */
++#define MMC_Disable() gpio_write_high( FAST_GPIO_SD_CS)
++
++/* set MMC_Chip_Select to LOW (MMC/SD-Card aktiv) */
++#define MMC_Enable() gpio_write_low( FAST_GPIO_SD_CS)
++
++/*
++ * *******************************************************************
++ *
++ *             Begin SPI hardware access functions.
++ *
++ * *******************************************************************
++ *
++ */
++static int mmc_spi_media_detect(void)
++{
++// FIXME: add card detection/test by SPI
++
++    return 1;
++}
++
++static int mmc_spi_hardware_init(void)
++{
++	printk("\nmmc: GPIO init\n");
++
++	/* cut existing functions */
++	gpio_set_alternative_function(GPIO_SD_CLK, 0);
++	gpio_set_alternative_function(GPIO_SD_DI, 0);
++	gpio_set_alternative_function(GPIO_SD_DO, 0);
++	gpio_set_alternative_function(GPIO_SD_CS, 0);
++
++	/* remap directions and set state of spi pins */
++	gpio_direction_output(GPIO_SD_CLK, 0);
++	gpio_direction_input(GPIO_SD_DI);	
++	gpio_direction_output(GPIO_SD_DO, 0);
++	gpio_direction_output(GPIO_SD_CS, 0);
++
++	printk("mmc: initialising MMC\n");
++
++	/* Start */
++	MMC_Disable();
++	gpio_write_low( FAST_GPIO_SD_CLK);
++	gpio_write_high( FAST_GPIO_SD_DO);
++	return 0;
++}
++
++/* return what has been read, write the parameter */
++/* Clockrate round about 1,2 MHz                  */
++
++static unsigned char mmc_spi_readwrite(unsigned char data_out)
++{
++    unsigned char i;
++    unsigned char result = 0;
++
++    for(i = 0x80 ; i != 0 ; i >>= 1)
++    {
++        if (data_out & i)
++        {
++            gpio_write_high( FAST_GPIO_SD_DO);
++        }
++	  else
++        {
++            gpio_write_low( FAST_GPIO_SD_DO);
++        }
++
++        gpio_write_high( FAST_GPIO_SD_CLK);
++	
++        if (gpio_read( FAST_GPIO_SD_DI) == 1)
++        {
++            result |= i;
++        }
++
++        gpio_write_low( FAST_GPIO_SD_CLK);
++	
++    }
++
++    gpio_write_high( FAST_GPIO_SD_DO);
++
++    return (result);
++}
++
++/* return what has been read, write the parameter */
++/* Clockrate round 200 kHz                        */
++ 
++static unsigned char mmc_spi_readwrite_slow(unsigned char data_out)
++{
++    unsigned char i;
++    unsigned char result = 0;
++
++    for(i = 0x80 ; i != 0 ; i >>= 1)
++    {	
++        if (data_out & i)
++        {
++            gpio_write_high( FAST_GPIO_SD_DO);
++        }
++        else
++        {
++            gpio_write_low( FAST_GPIO_SD_DO);
++        }
++
++        udelay(10);
++
++        gpio_write_high( FAST_GPIO_SD_CLK);
++
++        udelay(10);
++
++        if (gpio_read( FAST_GPIO_SD_DI) == 1)
++        {
++            result |= i;
++        }
++
++        udelay(10);
++	
++        gpio_write_low( FAST_GPIO_SD_CLK);
++
++        udelay(10);
++	
++    }
++
++    gpio_write_high( FAST_GPIO_SD_DO);
++
++    udelay(10);
++
++    // printk("Send Byte = 0x%2X   Receive Byte = 0x%2X \n", data_out, result);
++
++    return (result);
++}
++
++/* return what has been read */
++
++static unsigned char mmc_spi_read_only(void)
++{
++    unsigned char i;
++    unsigned char result = 0;
++
++    for(i = 0x80 ; i != 0 ; i >>= 1)
++    {
++
++        gpio_write_high( FAST_GPIO_SD_CLK);
++	
++        if (gpio_read( FAST_GPIO_SD_DI) == 1)
++        {
++            result |= i;
++        }
++
++        gpio_write_low( FAST_GPIO_SD_CLK);
++	
++    }
++
++    return (result);
++}
++
++/* write the parameter */
++/* Clockrate round about 3,6 MHz                  */
++
++static unsigned char mmc_spi_write_only(unsigned char data_out)
++{
++    unsigned char i;
++    unsigned char result = 0;
++
++    for(i = 0x80 ; i != 0 ; i >>= 1)
++    {
++    
++        if (data_out & i)
++        {
++            gpio_write_high( FAST_GPIO_SD_DO);
++        }
++	  else
++        {
++            gpio_write_low( FAST_GPIO_SD_DO);
++        }
++
++        gpio_write_high( FAST_GPIO_SD_CLK);
++	
++        gpio_write_low( FAST_GPIO_SD_CLK);
++	
++    }
++
++    gpio_write_high( FAST_GPIO_SD_DO);
++
++    return (result);
++}
++
++
++/**
++ * this function was contributed by: rcichielo from openwrt forums
++ *
++ * Comments added by Marc DENTY on 2007-03-20
++ *
++ * Sequence to read a card's "CID" bytes (name, serial number etc)
++ *
++ * Send: 4ah,00h,00h,00h,00h,00h  - CMD10, no args, null CRC
++ * Read: xx                       - NCR Time
++ * Read: xx                       - Command Response (Should be 00h)
++ * Read: until FEh is received    - Wait for Data token
++ * Read: yy  * 16                 - Get 16 bytes from CID
++ * Read: zz                       - Read CRC lo byte
++ * Read: zz                       - Read CRC hi byte
++ *
++ * Useful locations in the returned data packet:
++ *
++ * 03h-08h Manufacturers's name in ascii
++ * 0ah-0dh Card's 32 bit serial number 
++ */
++/**
++ * Comments added by Cyril CATTIAUX on 2007-03-21
++ *
++ * CID format specification (from Sandisk SD Product Manual v1.9)
++ *
++ * cid[00   ] Manufacturer ID (unsigned byte)
++ * cid[01-02] OEM/Application ID (ASCII)
++ * cid[03-07] Product Name (ASCII)
++ * cid[08   ] Product Revistion (BCD coded number)
++ * cid[09-12] Serial Number (32-bit unsigned int)
++ * cid[13-14] Reserved(bit 12->15) - Manufacture Date(bit 0->11)
++ * cid[15   ] CRC7(bit 1->7) - Not used, allways 1 (bit 0)
++*/
++static int mmc_read_cid(unsigned char *cid)
++{
++	unsigned char result = 0;
++        int i;
++
++        MMC_Enable();
++	
++	/* wait */
++	for (i = 0; i < 4; i++)
++	{
++ 		result=mmc_spi_readwrite(0xff);
++	}
++
++	/* issue CID (card identification data) read request */
++	mmc_spi_readwrite(0xff);
++	mmc_spi_readwrite(0x40 | 10);
++	mmc_spi_readwrite(0x00);
++	mmc_spi_readwrite(0x00);
++	mmc_spi_readwrite(0x00);
++	mmc_spi_readwrite(0x00);
++	mmc_spi_readwrite(0x95);
++	
++	for (i = 0; i < 8; i++)
++	{
++ 		result=mmc_spi_readwrite(0xff);
++
++		if(result == 0x00)
++			break;
++	}
++
++	if (result != 0x00) {
++		MMC_Disable();
++		mmc_spi_readwrite(0xff);
++		return(1);
++	}
++
++	for (i = 0; i < 8; i++) {
++		result = mmc_spi_readwrite(0xff);
++		if (result == 0xfe) break;
++	}
++
++	if (result != 0xfe) {
++		MMC_Disable();
++		mmc_spi_readwrite(0xff);
++		return(2);
++	}
++
++	for (i = 0; i < 16; i++) {
++		result = mmc_spi_readwrite(0xff);
++		cid[i] = result;
++	}
++	
++	mmc_spi_readwrite(0xff);
++	mmc_spi_readwrite(0xff);
++	
++	MMC_Disable();
++	mmc_spi_readwrite(0xff);
++
++	return 0;
++}
++
++
++/**
++ * Comments added by Cyril CATTIAUX on 2007-03-21
++ *
++ * CID format specification (from Sandisk SD Product Manual v1.9)
++ *
++ * cid[00   ] Manufacturer ID (unsigned byte)
++ * cid[01-02] OEM/Application ID (ASCII)
++ * cid[03-07] Product Name (ASCII)
++ * cid[08   ] Product Revision (BCD coded 2 digit number)
++ * cid[09-12] Serial Number (32-bit unsigned int)
++ * cid[13-14] Manufacture Date(bit 0->11) (BCD coded 3 digit number YYM offset from 2000) - Reserved(bit 12->15)
++ * cid[15   ] Not used, allways 1 (bit 0) - CRC7(bit 1->7)
++*/
++static void mmc_show_cid_info(void)
++{
++	int i, result;
++	unsigned short tmps;
++	unsigned char  cid[16];
++	
++	char           manufacturer_id;
++	char           oem_id[3];
++	char           product_name[6];
++	unsigned char  product_revision_h, product_revision_l;
++	unsigned int   product_sn;
++	unsigned short product_date_y;
++	unsigned char  product_date_m;
++
++	result = mmc_read_cid(cid);
++
++	if (result == 0)
++	{
++		printk("mmc_init: MMC/SD Card ID: ");
++		for (i=0; i<16; i++) {
++			printk("%02X ", cid[i]);
++		}
++		manufacturer_id=cid[0];
++		strncpy(oem_id,       &cid[1], 2);
++		oem_id[2]='\0';
++		strncpy(product_name, &cid[3], 5);
++		product_name[5]='\0';
++		product_revision_h=(cid[8] >> 4) & 0xf;
++		product_revision_l=cid[8] & 0xf;
++		product_sn=(cid[9]<<24) + (cid[10]<<16) + (cid[11]<<8) + cid[12];
++		tmps=((cid[13]<<8) + cid[14]) & 0x0fff;
++		product_date_y=2000 + (((tmps >> 8) & 0xf) * 10) + ((tmps >> 4) & 0xf);
++		product_date_m=tmps & 0xf;
++		
++		printk("\nManufacturer ID   : %02X\n",  manufacturer_id);
++		printk("OEM/Application ID: %s\n",      oem_id);
++		printk("Product name      : %s\n",      product_name);
++		printk("Product revision  : %d.%d\n",   product_revision_h, product_revision_l);
++		printk("Product SN        : %08X\n",    product_sn);
++		printk("Product Date      : %d-%d\n",   product_date_y, product_date_m);
++		
++	} else {
++		printk("mmc_init: impossible to get card indentification info for reason code: %02x", result);
++	}
++}
++
++
++/*
++static int mmc_spi_hw_test(void)
++{
++    unsigned char result, k;
++    
++    unsigned int i, j, t;
++    
++    printk("mmc_spi_hw_test -> \n\n");
++    k = 0x55;
++    for ( i = 0 ; i < 5; i++) {
++
++	printk("\n0x%2X - ", k);
++	for ( j = 0 ; j < 8; j++ ) {
++            do_gettimeofday( &s_zeit );
++	    result = mmc_spi_readwrite_slow(k);
++            do_gettimeofday( &e_zeit );
++	    	    
++	    if ( result != k ) {
++		printk("!>ERROR<! Transfer = 0x%2X Receive = 0x%2X Trail = %d \n", k, result, j);
++		// i = 255; j = 1000;
++	    }
++	    
++            t = (e_zeit.tv_sec-s_zeit.tv_sec)*1000000+(e_zeit.tv_usec-s_zeit.tv_usec);
++            printk("Durchlauf: %i Versuch: %i von 8 -> Laufzeit: 0x%X s\n", i , j, t);
++	    udelay(200);
++	}
++	printk("ready  ");
++
++	// k++;
++    }
++    printk("ready  ");
++    printk("\n\n");
++    return (0);
++}
++*/
++	
++/*
++static int mmc_spi_speed_test(void)
++{
++    unsigned int i, j, k, l, t;
++    
++    MMC_Disable();
++    
++    for (k = 1; k < 6; k++)
++    {
++        l = 10000 * k;
++        for (j = 0; j < 5; j++)
++        {
++            do_gettimeofday( &s_zeit );
++            for (i = 0; i < l; i++)
++	        mmc_spi_readwrite(0xff);	
++            do_gettimeofday( &e_zeit );
++            t = (e_zeit.tv_sec-s_zeit.tv_sec)*1000000+(e_zeit.tv_usec-s_zeit.tv_usec);
++            printk("mmc_spi_readwrite: Laufzeit %u x : 0x%X \n", l, t);
++        }
++    }
++    
++    for (k = 1; k < 1; k++)
++    {
++        l = 10000 * k;
++        for (j = 0; j < 1; j++)
++        {
++            do_gettimeofday( &s_zeit );
++            for (i = 0; i < l; i++)
++	        mmc_spi_readwrite_slow(0xff);	
++            do_gettimeofday( &e_zeit );
++            t = (e_zeit.tv_sec-s_zeit.tv_sec)*1000000+(e_zeit.tv_usec-s_zeit.tv_usec);
++            printk("mmc_spi_readwrite_slow: Laufzeit %u x : 0x%X \n", l, t);
++        }
++    }
++
++    for (k = 1; k < 6; k++)
++    {
++        l = 10000 * k;
++        for (j = 0; j < 5; j++)
++        {
++            do_gettimeofday( &s_zeit );
++            for (i = 0; i < l; i++)
++	        mmc_spi_read_only();	
++            do_gettimeofday( &e_zeit );
++            t = (e_zeit.tv_sec-s_zeit.tv_sec)*1000000+(e_zeit.tv_usec-s_zeit.tv_usec);
++            printk("mmc_spi_read_only: Laufzeit %u x : 0x%X \n", l, t);
++        }
++    }
++
++    for (k = 1; k < 6; k++)
++    {
++        l = 10000 * k;
++        for (j = 0; j < 5; j++)
++        {
++            do_gettimeofday( &s_zeit );
++            for (i = 0; i < l; i++)
++	        mmc_spi_write_only(0xff);	
++            do_gettimeofday( &e_zeit );
++            t = (e_zeit.tv_sec-s_zeit.tv_sec)*1000000+(e_zeit.tv_usec-s_zeit.tv_usec);
++            printk("mmc_spi_write_only: Laufzeit %u x : 0x%X \n", l, t);
++        }
++    }
++        
++    return (1); 
++    	
++}
++*/
++	
++
++static int mmc_spi_card_init(void)
++{
++    unsigned char result = 0;
++    short i, j;
++
++//     unsigned long flags;
++
++    // save_flags(flags);
++    // cli();
++
++/*
++    printk("GPIO_SD_CS dir: %u alt: %u\n", gpio_getdir(&gp, GPIO_SD_CS), gpio_getalt(&gp, GPIO_SD_CS));
++    printk("GPIO_SD_DI dir: %u alt: %u\n", gpio_getdir(&gp, GPIO_SD_DI), gpio_getalt(&gp, GPIO_SD_DI));
++    printk("GPIO_SD_DO dir: %u alt: %u\n", gpio_getdir(&gp, GPIO_SD_DO), gpio_getalt(&gp, GPIO_SD_DO));
++    printk("GPIO_SD_CS dir: %u alt: %u\n", gpio_getdir(&gp, GPIO_SD_CLK), gpio_getalt(&gp, GPIO_SD_CLK));
++*/
++
++    // printk("\nmmc: mmc_spi_hw_test() *START*\n");
++
++    // mmc_spi_hw_test();
++
++    printk("\nmmc: card init 1/2 (CMD0)\n");
++
++    for (j = 0; j < 10; j++)
++    {
++        MMC_Disable();
++	
++        for (i = 0; i < 10; i++)
++	    mmc_spi_readwrite_slow(0xff);
++
++        MMC_Enable();
++	
++	mmc_spi_readwrite_slow(0xff);
++	
++        mmc_spi_readwrite_slow(0x40);
++
++        for (i = 0; i < 4; i++) {
++
++	    mmc_spi_readwrite_slow(0x00);
++
++	}
++
++        mmc_spi_readwrite_slow(0x95);
++
++        for (i = 0; i < 8; i++) {
++
++	    result = mmc_spi_readwrite_slow(0xff);
++
++#ifdef DEBUG_HD	    
++            if (result != 0xff) {
++ 	        if (result > 0x1F && result < 0x80)
++	            printk("mmc: resp. (CMD0) Versuch(%d) BYTE: %d  result = 0x%X  Zeichen = %c\n", j, i, result, result);
++                else
++  	            printk("mmc: resp. (CMD0) Versuch(%d) BYTE: %d  result = 0x%X\n", j, i, result);
++	    }
++#endif
++	    if (result == 0x01)
++	        break;
++        }
++    		
++	if (result == 0x01)
++	    break;
++
++        MMC_Disable();
++        mmc_spi_readwrite_slow(0xff);
++	    
++	mdelay(60);
++    }
++    
++    if (result != 0x01) {
++
++        printk("mmc: card init 1/2 error: %d (CMD0) failed\n", result);
++	printk(" -> Hint: MMC/SD-Card realy (fully) inserted ?\n");
++	
++	return (1);
++    }
++
++    printk("mmc: card init 1/2 (CMD0) success\n\n");
++
++    mdelay(1);
++
++    printk("mmc: card init 2/2 (CMD1)\n");
++    for (j = 0; j < 10; j++) {
++
++	mmc_spi_readwrite_slow(0xff);			
++	mmc_spi_readwrite_slow(0x41);
++	for (i = 0; i < 4; i++)
++	    mmc_spi_readwrite_slow(0x00);
++	mmc_spi_readwrite_slow(0x95);
++	for (i = 0; i < 8; i++) {
++	    result = mmc_spi_readwrite_slow(0xff);
++#ifdef DEBUG_HD
++ 	    // if (result >= 32 && result <= 127)
++	    //     printk("mmc: response (CMD1) Versuch(%d) start token BYTE: %d  result = 0x%X  Zeichen = %c\n", j, i, result, result);
++            // else
++  	    //     printk("mmc: response (CMD1) Versuch(%d) start token BYTE: %d  result = 0x%X\n", j, i, result);
++#endif
++	    if (result == 0x00)
++		break;
++	}
++
++	mmc_spi_readwrite_slow(0xff);
++
++	if (result == 0x00) {
++	    printk("mmc: card init 2/2 (CMD1) success\n\n");
++
++	    mmc_spi_readwrite_slow(0xff);
++	    mmc_spi_readwrite_slow(0x4d);
++	    mmc_spi_readwrite_slow(0x00);
++	    mmc_spi_readwrite_slow(0x00);
++	    mmc_spi_readwrite_slow(0x00);
++	    mmc_spi_readwrite_slow(0x00);
++	    mmc_spi_readwrite_slow(0x95);
++ 	    for (i = 0; i < 6; i++) {
++		result = mmc_spi_readwrite_slow(0xff);
++#ifdef DEBUG_HD
++ 		// if (result > 31 && result < 128)
++	    	//     printk("mmc: response (CMD13) Versuch(%d) start token BYTE: %d  result = 0x%X  Zeichen = %c\n", j, i, result, result);
++        	// else
++  	    	//     printk("mmc: response (CMD13) Versuch(%d) start token BYTE: %d  result = 0x%X\n", j, i, result);
++#endif
++		// if (result == 0x00)
++		// break;
++	    }
++	    // mdelay(60);
++	    MMC_Disable();
++	    mmc_spi_readwrite_slow(0xff);
++	    // mmc_spi_readwrite_slow(0xff);
++	    // mdelay(10);
++
++    	    // restore_flags(flags);
++	    
++	    return (0);
++	}
++        mdelay(60);	
++    }
++    return (2);
++}
++
++
++static int mmc_spi_card_config(void)
++{
++    unsigned char result = 0;
++    short i, j;
++    unsigned char csd[32];
++    unsigned int c_size;
++    unsigned int c_size_mult;
++    unsigned int mult;
++    unsigned int read_bl_len;
++    unsigned int blocknr = 0;
++    unsigned int block_len = 0;
++    unsigned int size = 0;
++    unsigned char rd_buffer[528];
++//    unsigned long flags;
++    
++    MMC_Enable();
++    
++    mmc_spi_readwrite_slow(0xff);
++    result = mmc_spi_readwrite_slow(0x51); 
++    // mmc_spi_readwrite_slow(0x4A);
++    // mmc_spi_readwrite_slow(0x40+0x0D);
++    // mmc_spi_readwrite_slow(0x42);
++    for (i = 0; i < 4; i++)
++	mmc_spi_readwrite_slow(0x00);
++    mmc_spi_readwrite_slow(0x95);
++
++    // printk("mmc: (CMD17) response von 0x51 result = 0x%X\n", result);
++
++    for (i = 0; i < 8; i++) {
++	result = mmc_spi_readwrite_slow(0xff);
++#ifdef DEBUG_HD
++	// printk("mmc: (CMD17) response (start token) result = 0x%X\n", result);
++#endif
++	if (result == 0x00)
++	    break;
++    }
++    if (result != 0x00) {
++	MMC_Disable();
++	mmc_spi_readwrite_slow(0xff);
++	// restore_flags(flags);
++	// mmc_spi_readwrite_slow(0xff);
++	return (1);
++    }
++    // restore_flags(flags);
++    for (i = 0; i < 8; i++) {
++	result = mmc_spi_readwrite_slow(0xff);
++	rd_buffer[i] = result;
++#ifdef DEBUG_HD
++        /*
++	if (result >= 32 && result <= 127)
++	    printk("mmc: CMD17 response (start token) result = 0x%X  Zeichen = %c\n", result, result);
++        else
++  	    printk("mmc: CMD17 response (start token) result = 0x%X\n", result);
++	*/
++#endif
++	// if (result == 0xfe)
++	//    break;
++    }
++    /*
++    if (result != 0xfe) {
++        MMC_Disable();
++	mmc_spi_readwrite_slow(0xff);
++	mmc_spi_readwrite_slow(0xff);
++	return(1);
++    }
++    */
++
++    for (i = 8; i < 520; i++) {
++	result = mmc_spi_readwrite_slow(0xff);
++	rd_buffer[i] = result;
++    }
++    for (i = 0; i < 2; i++) {
++	result = mmc_spi_readwrite_slow(0xff);
++    }
++    MMC_Disable();
++    mmc_spi_readwrite_slow(0xff);
++    // mmc_spi_readwrite_slow(0xff);
++
++    printk("Buffer - Start\n");
++    
++    for ( i = 0 ; i < 33 ; i++) {
++	printk("\r\n%4X - ", i*16);
++	for ( j = 0 ; j < 16 ; j++) {
++	    if ( rd_buffer[i*16+j] < 16)
++		printk("0%X ", rd_buffer[i*16+j]);
++	    else
++		printk("%2X ", rd_buffer[i*16+j]);
++	}
++	for ( j = 0 ; j < 16 ; j++) {
++	    if ( rd_buffer[i*16+j] < ' ')
++		printk(".");
++	    else
++		printk("%c", rd_buffer[i*16+j]);
++	}
++    }
++
++    printk("\nBuffer - Ende\n");
++
++    mmc_show_cid_info();
++    
++    for(j = 0 ; j < 1; j++) {
++    MMC_Enable();
++
++    // mdelay(1);
++    
++    // save_flags(flags);
++    // cli();
++    mmc_spi_readwrite_slow(0xff);
++    mmc_spi_readwrite_slow(0x49); 
++    // mmc_spi_readwrite_slow(0x4A);
++    // mmc_spi_readwrite_slow(0x40+0x0D);
++    // mmc_spi_readwrite_slow(0x42);
++    for (i = 0; i < 4; i++)
++	mmc_spi_readwrite_slow(0x00);
++    mmc_spi_readwrite_slow(0x95);
++    for (i = 0; i < 8; i++) {
++	result = mmc_spi_readwrite_slow(0xff);
++#ifdef DEBUG_HD
++	// printk("mmc: (CMD9) response (start token) result = 0x%X\n", result);
++#endif
++	if (result == 0x00)
++	    break;
++    }
++    // restore_flags(flags);
++    if (result != 0x00) {
++	MMC_Disable();
++	mmc_spi_readwrite_slow(0xff);
++	// mmc_spi_readwrite_slow(0xff);
++	return (1);
++    }
++    for (i = 0; i < 22; i++) {
++	result = mmc_spi_readwrite_slow(0xff);
++#ifdef DEBUG_HD
++	if (result >= 32 && result <= 127)
++	    printk("mmc: response (start token) result = 0x%X  Zeichen = %c\n", result, result);
++        else
++  	    printk("mmc: response (start token) result = 0x%X\n", result);
++#endif
++	if (result == 0xfe)
++	    break;
++    }
++    if (result == 0xfe)
++	break;
++        
++    if (result != 0xfe) {
++        MMC_Disable();
++	mmc_spi_readwrite_slow(0xff);
++	// mmc_spi_readwrite_slow(0xff);
++    }
++    mdelay(60);
++    }	
++    
++    if (result != 0xfe) {
++	MMC_Disable();
++	mmc_spi_readwrite_slow(0xff);
++	printk("mmc: mmc card config (CMD9) failed result = 0x%X\n\n", result);	
++	return (2);
++    }
++    for (i = 0; i < 16; i++) {
++	result = mmc_spi_readwrite_slow(0xff);
++	csd[i] = result;
++    }
++    for (i = 0; i < 2; i++) {
++	result = mmc_spi_readwrite_slow(0xff);
++    }
++    MMC_Disable();
++    mmc_spi_readwrite_slow(0xff);
++    // mmc_spi_readwrite_slow(0xff);
++    
++    if (result == 0x00)
++	return (3);
++
++    c_size = (csd[8] & 0xC0) + (csd[7] << 8) + ((csd[6] & 0x03) << 16);
++    c_size >>= 6;
++    c_size_mult = (csd[10] & 0x80) + ((csd[9] & 0x03) << 8);
++    c_size_mult >>= 7;
++    read_bl_len = csd[5] & 0x0f;
++    mult = 1;
++    mult <<= c_size_mult + 2;
++    blocknr = (c_size + 1) * mult;
++    block_len = 1;
++    block_len <<= read_bl_len;
++    size = block_len * blocknr;
++    size >>= 10;
++
++    for (i = 0; i < (1 << 6); i++) {
++	hd_blocksizes[i] = 1024;
++	hd_hardsectsizes[i] = block_len;
++	hd_maxsect[i] = 256;
++    }
++    hd_sizes[0] = size;
++    hd[0].nr_sects = blocknr;
++
++    printk("Size = %d, hardsectsize = %d, sectors = %d\n",
++	   size, block_len, blocknr);
++
++    return 0;
++}
++
++
++/*
++ * *******************************************************************
++ *
++ *             End of SPI hardware access functions.
++ *
++ * *******************************************************************
++ */
++
++
++static int mmc_spi_write_block(unsigned int dest_addr, unsigned char *data)
++{
++    unsigned int address;
++    unsigned char result = 0;
++    unsigned char ab0, ab1, ab2, ab3;
++    int i;
++
++    address = dest_addr;
++
++    ab3 = 0xff & (address >> 24);
++    ab2 = 0xff & (address >> 16);
++    ab1 = 0xff & (address >> 8);
++    ab0 = 0xff & address;
++
++    MMC_Enable();
++
++    mmc_spi_readwrite(0xff);
++
++    mmc_spi_readwrite(0x58);
++    mmc_spi_readwrite(ab3);		/* msb */
++    mmc_spi_readwrite(ab2);
++    mmc_spi_readwrite(ab1);
++    mmc_spi_readwrite(ab0);		/* lsb */
++    mmc_spi_readwrite(0xff);
++
++    for (i = 0; i < 8; i++) 
++    {
++        result = mmc_spi_readwrite(0xff);
++        if (result == 0x00)
++        {
++            break;
++        }
++    }
++
++    if (result != 0x00) 
++    {
++        MMC_Disable();
++        mmc_spi_readwrite(0xff);
++        return (1);
++    }
++
++    mmc_spi_readwrite(0xfe);
++
++    for (i = 0; i < 512; i += 32)
++    {
++        mmc_spi_write_only(data[i]);
++        mmc_spi_write_only(data[i+1]);
++        mmc_spi_write_only(data[i+2]);
++        mmc_spi_write_only(data[i+3]);
++        mmc_spi_write_only(data[i+4]);
++        mmc_spi_write_only(data[i+5]);
++        mmc_spi_write_only(data[i+6]);
++        mmc_spi_write_only(data[i+7]);
++        mmc_spi_write_only(data[i+8]);
++        mmc_spi_write_only(data[i+9]);
++        mmc_spi_write_only(data[i+10]);
++        mmc_spi_write_only(data[i+11]);
++        mmc_spi_write_only(data[i+12]);
++        mmc_spi_write_only(data[i+13]);
++        mmc_spi_write_only(data[i+14]);
++        mmc_spi_write_only(data[i+15]);
++        mmc_spi_write_only(data[i+16]);
++        mmc_spi_write_only(data[i+17]);
++        mmc_spi_write_only(data[i+18]);
++        mmc_spi_write_only(data[i+19]);
++        mmc_spi_write_only(data[i+20]);
++        mmc_spi_write_only(data[i+21]);
++        mmc_spi_write_only(data[i+22]);
++        mmc_spi_write_only(data[i+23]);
++        mmc_spi_write_only(data[i+24]);
++        mmc_spi_write_only(data[i+25]);
++        mmc_spi_write_only(data[i+26]);
++        mmc_spi_write_only(data[i+27]);
++        mmc_spi_write_only(data[i+28]);
++        mmc_spi_write_only(data[i+29]);
++        mmc_spi_write_only(data[i+30]);
++        mmc_spi_write_only(data[i+31]);
++    }
++
++    mmc_spi_readwrite(0xff);
++    mmc_spi_readwrite(0xff);    
++
++    for (i = 0; i < 1000000; i++) 
++    {
++        result = mmc_spi_readwrite(0xff);
++        if (result == 0xff)
++        {
++            break;
++        }
++    }
++
++    if (result != 0xff) 
++    {
++        MMC_Disable();
++        mmc_spi_readwrite(0xff);
++        return (3);
++    }
++
++    MMC_Disable();
++    mmc_spi_readwrite(0xff);
++    return (0);
++}
++
++static int mmc_spi_read_block(unsigned char *data, unsigned int src_addr)
++{
++    unsigned int address;
++    unsigned char result = 0;
++    unsigned char ab0, ab1, ab2, ab3;
++    unsigned long flags;
++    int i, j;
++
++    address = src_addr;
++
++    ab3 = 0xff & (address >> 24);
++    ab2 = 0xff & (address >> 16);
++    ab1 = 0xff & (address >> 8);
++    ab0 = 0xff & address;
++
++    MMC_Enable();
++
++    mmc_spi_readwrite(0xff);
++
++    mmc_spi_readwrite(0x51);
++    mmc_spi_readwrite(ab3);		/* msb */
++    mmc_spi_readwrite(ab2);
++    mmc_spi_readwrite(ab1);
++    mmc_spi_readwrite(ab0);		/* lsb */
++    mmc_spi_readwrite(0xff);
++    
++    for (i = 0; i < 8; i++) 
++    {
++        result = mmc_spi_readwrite(0xff);
++        if (result == 0x00)
++        {
++            break;
++        }
++    }
++
++    if (result != 0x00) 
++    {
++        MMC_Disable();
++        mmc_spi_readwrite(0xff);
++        return (1);
++    }
++
++    for (i = 0; i < 100000; i++) 
++    {
++        result = mmc_spi_readwrite(0xff);
++        if (result == 0xfe)
++        {
++            break;
++        }
++    }
++
++    if (result != 0xfe) 
++    {
++        MMC_Disable();
++        mmc_spi_readwrite(0xff);
++        return (2);
++    }
++
++    for (i = 0; i < 512; i += 32 ) 
++    {
++    	    data[i] = mmc_spi_read_only();
++    	    data[i+1] = mmc_spi_read_only();
++    	    data[i+2] = mmc_spi_read_only();
++    	    data[i+3] = mmc_spi_read_only();
++    	    data[i+4] = mmc_spi_read_only();
++    	    data[i+5] = mmc_spi_read_only();
++    	    data[i+6] = mmc_spi_read_only();
++    	    data[i+7] = mmc_spi_read_only();
++    	    data[i+8] = mmc_spi_read_only();
++    	    data[i+9] = mmc_spi_read_only();
++    	    data[i+10] = mmc_spi_read_only();
++    	    data[i+11] = mmc_spi_read_only();
++    	    data[i+12] = mmc_spi_read_only();
++    	    data[i+13] = mmc_spi_read_only();
++    	    data[i+14] = mmc_spi_read_only();
++    	    data[i+15] = mmc_spi_read_only();
++    	    data[i+16] = mmc_spi_read_only();
++    	    data[i+17] = mmc_spi_read_only();
++    	    data[i+18] = mmc_spi_read_only();
++    	    data[i+19] = mmc_spi_read_only();
++    	    data[i+20] = mmc_spi_read_only();
++    	    data[i+21] = mmc_spi_read_only();
++    	    data[i+22] = mmc_spi_read_only();
++    	    data[i+23] = mmc_spi_read_only();
++    	    data[i+24] = mmc_spi_read_only();
++    	    data[i+25] = mmc_spi_read_only();
++    	    data[i+26] = mmc_spi_read_only();
++    	    data[i+27] = mmc_spi_read_only();
++    	    data[i+28] = mmc_spi_read_only();
++    	    data[i+29] = mmc_spi_read_only();
++    	    data[i+30] = mmc_spi_read_only();
++    	    data[i+31] = mmc_spi_read_only();
++    }
++
++    result = mmc_spi_readwrite(0xff);
++    result = mmc_spi_readwrite(0xff);	
++
++    MMC_Disable();
++    mmc_spi_readwrite(0xff);
++
++    return (0);
++}
++
++/*
++static int mmc_revalidate(kdev_t dev)
++{
++    int target, max_p, start, i;
++
++    mmc_media_detect = mmc_spi_media_detect();
++
++    if (mmc_media_detect == 0)
++    {
++        return -ENODEV;
++    }
++
++    target = DEVICE_NR(dev);
++
++    max_p = hd_gendisk.max_p;
++    start = target << 6;
++    for (i = max_p - 1; i >= 0; i--) 
++    {
++        int minor = start + i;
++        invalidate_device(MKDEV(MAJOR_NR, minor), 1);
++        hd_gendisk.part[minor].start_sect = 0;
++        hd_gendisk.part[minor].nr_sects = 0;
++    }
++
++    grok_partitions(&hd_gendisk, target, 1 << 6, hd_sizes[0] * 2);
++
++    return 0;
++}
++*/
++
++
++static int mmc_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
++		     unsigned long arg)
++{
++	if (!inode || !inode->i_rdev)
++		return -EINVAL;
++
++	switch (cmd) {
++#if 0
++	case BLKGETSIZE:
++		return put_user(hd[MINOR(inode->i_rdev)].nr_sects,
++				(unsigned long *)arg);
++	case BLKGETSIZE64:
++		return put_user((u64) hd[MINOR(inode->i_rdev)].
++				nr_sects, (u64 *) arg);
++	case BLKRRPART:
++		if (!capable(CAP_SYS_ADMIN))
++			return -EACCES;
++
++		return mmc_revalidate(inode->i_rdev);
++#endif
++	case HDIO_GETGEO:
++		{
++			struct block_device *bdev = inode->i_bdev;
++			struct hd_geometry *loc, g;
++			loc = (struct hd_geometry *)arg;
++			if (!loc)
++				return -EINVAL;
++			memset(loc, 0, sizeof(struct hd_geometry));
++			g.heads = 4;
++			g.sectors = 16;
++			g.cylinders = get_capacity(bdev->bd_disk) / (4*16);
++			g.start = get_start_sect(bdev);
++			return copy_to_user(loc, &g, sizeof(g)) ? -EFAULT : 0;
++		}
++	default:
++		return -ENOTTY;
++	}
++}
++
++
++/*
++static int mmc_check_media_change(kdev_t dev)
++{
++    (void) dev;
++    if (mmc_media_changed == 1) 
++    {
++        mmc_media_changed = 0;
++        return 1;
++    } 
++    else
++    {
++        return 0;
++    }
++}
++*/
++
++
++/*
++static int mmc_init(void)
++{
++    int result;
++
++    result = mmc_spi_hardware_init();
++
++    if (result != 0) 
++    {
++        printk("mmc: error %d in mmc_spi_hardware_init\n", result);
++        return -1;
++    }
++
++
++    result = mmc_spi_hw_test();
++
++    if (result != 0) 
++    {
++        printk("\n mmc: mmc_spi_hw_test i.O. \n\n");
++        return -1;
++    }
++
++
++    result = mmc_spi_speed_test();
++
++    if (result != 0) 
++    {
++        printk("\n mmc: mmc_spi_speed_test i.O. \n\n");
++        return -1;
++    }
++
++
++    result = mmc_spi_card_init();
++    mdelay(50);
++    if (result != 0) 
++    {
++        // Give it an extra shot
++        // result = mmc_spi_card_init();
++        if (result != 0) 
++        {
++            printk("mmc: error %d in mmc_card_init\n", result);
++            return -1;
++        }
++    }
++
++    result = mmc_spi_card_config();
++    if (result != 0) 
++    {
++        printk("mmc: error %d in mmc_card_config\n", result);
++        return -1;
++    }
++
++
++    return 0;
++}
++*/
++
++/*
++static void mmc_exit(void)
++{
++}
++*/
++
++
++/*
++static void mmc_check_media(void)
++{
++    int old_state, new_state;
++    int result;
++
++    old_state = mmc_media_detect;
++    new_state = mmc_spi_media_detect();
++
++    if (old_state != new_state) 
++    {
++        mmc_media_changed = 1;
++        if (new_state == PRESENT) 
++        {
++            result = mmc_init();
++            if (result != 0)
++            {
++                printk("mmc: error %d in mmc_init\n", result);
++            } 
++            else 
++            {
++                mmc_exit();
++            }
++        }
++    }
++
++#ifdef CHECK_MEDIA_CHANGE
++    del_timer(&mmc_timer);
++    mmc_timer.expires = jiffies + 10*HZ;
++    add_timer(&mmc_timer);
++#endif
++
++}
++*/
++
++
++/* NB: There might be several requests in the queue, simply dequeuing only one
++	and not checking for more will cause a stall because the block subsystem
++	will not call this function again unless the queue is "plugged" which can
++	only happen if it runs empty... */
++static void mmc_spi_request(struct request_queue *q)
++{
++	struct request *req;
++	int ret;
++	
++	unsigned int mmc_address;
++	unsigned char *buffer_address;
++	int nr_sectors;
++	int i;
++	int result, success;
++
++	if (blk_queue_plugged(q)) {
++		return;
++	}
++
++	spin_lock(&mmc_spi_lock);
++	for(;;) {
++		req = elv_next_request(q);
++		if (!req)
++			break;
++		
++		if (!blk_fs_request(req)) {
++			printk("not a blk_fs_request\n");
++			spin_unlock(&mmc_spi_lock);
++			continue;
++		}
++
++		mmc_address = req->sector * hd_hardsectsizes[0];
++		buffer_address = req->buffer;
++		nr_sectors = req->current_nr_sectors;
++		success = 1;
++		if (rq_data_dir(req) == READ) {
++			spin_unlock_irq(q->queue_lock);
++			for (i = 0; i < nr_sectors; i++) {
++				result = mmc_spi_read_block(buffer_address, mmc_address);
++				if (unlikely(result < 0)) {
++					printk(KERN_ERR "mmi_spi_block: error reading block (%d)\n", result);
++					success = 0;
++					break;
++				}
++				mmc_address += hd_hardsectsizes[0];
++				buffer_address += hd_hardsectsizes[0];
++			}
++			spin_lock_irq(q->queue_lock);
++		} else {
++			spin_unlock_irq(q->queue_lock);
++			for (i = 0; i < nr_sectors; i++) {
++				result = mmc_spi_write_block(mmc_address, buffer_address);
++				if (unlikely(result < 0)) {
++					printk(KERN_ERR "mmi_spi_block: error writing block (%d)\n", result);
++					success = 0;
++					break;
++				}
++				mmc_address += hd_hardsectsizes[0];
++				buffer_address += hd_hardsectsizes[0];
++			}
++			spin_lock_irq(q->queue_lock);
++		}
++		ret = end_that_request_chunk(req, success, nr_sectors * hd_hardsectsizes[0]);
++		if (!ret) {
++			blkdev_dequeue_request(req);
++			end_that_request_last(req, 0);
++		}
++	}
++	spin_unlock(&mmc_spi_lock);
++}
++
++
++static int mmc_open(struct inode *inode, struct file *filp)
++{
++    // int device;
++    (void) filp;
++    mmc_media_detect = mmc_spi_media_detect();
++
++    if (mmc_media_detect == 0)
++        return -ENODEV;
++
++    return 0;
++}
++
++static int mmc_release(struct inode *inode, struct file *filp)
++{
++    return 0;
++}
++
++
++static struct block_device_operations mmc_spi_bdops = {
++	.open = mmc_open,
++	.release = mmc_release,
++	.ioctl = mmc_ioctl,
++	.owner = THIS_MODULE,
++#if 0
++	.check_media_change = mmc_check_media_change,
++	.revalidate = mmc_revalidate,
++#endif
++};
++
++static int detect_card(void)
++{
++	int result;
++
++	result = mmc_spi_card_init();
++	if (result != 0) {
++		// Give it an extra shot
++		result = mmc_spi_card_init();
++		if (result != 0) {
++			printk(KERN_ERR "mmc_spi_block: error in mmc_card_init (%d)\n", result);
++			return -ENODEV;
++		}
++	}
++
++	result = mmc_spi_card_config();
++	// result = mmc_spi_speed_test();
++	if (result != 0) {
++		printk(KERN_ERR "mmc_spi_block: error in mmc_card_config (%d)\n", result);
++		return -ENODEV;
++	}
++
++	return 0;
++}
++
++/* Fills in the gendisk structure from the received card
++   data.  */
++static int gendisk_init(struct device *dev, struct gendisk *gd)
++{
++	if (!gd)
++		return -EINVAL;
++
++	gd->major = major;
++	gd->first_minor = 0; /* only one device supported */
++	gd->fops = &mmc_spi_bdops;
++	gd->driverfs_dev = dev;
++
++	gd->queue = blk_init_queue(mmc_spi_request,NULL);
++
++	if (!gd->queue)
++		return -ENOMEM;
++
++	sprintf(gd->disk_name, "mmcblk");
++
++	blk_queue_hardsect_size(gd->queue, hd_hardsectsizes[0]);
++
++	set_capacity(gd, hd_sizes[0]<<1);
++
++	return 0;
++}
++
++static int gendisk_fini(struct gendisk *gd)
++{
++	BUG_ON(!gd);
++
++	if (gd->queue)
++		blk_cleanup_queue(gd->queue);
++
++	del_gendisk(gd);
++}
++
++/* platform driver device instance routines */
++static int mmc_spi_probe(struct platform_device *pdev)
++{
++	int result;
++	printk("$Id: mmc_spi_block.c,v 1.04 2007/05/25 23:27:16 mrdata Exp $\n");
++
++	result = mmc_spi_hardware_init();
++	if (result != 0) {
++		printk(KERN_ERR "mmc_spi_block: error in mmc_spi_hardware_init (%d)\n", result);
++		result = -ENODEV;
++		return result;
++	}
++	
++	result = detect_card();
++	if (result < 0)
++		return result;
++
++	mmc_media_detect = 1;
++
++	result = register_blkdev(major, DEVICE_NAME);
++	if (result < 0)
++		return result;
++
++	if (!major)
++		major = result;
++
++	/* allow 8 partitions per device */
++	BUG_ON(mmc_disk!=NULL);
++	mmc_disk = alloc_disk(1 << 3);
++	if (!mmc_disk) {
++		result = -ENOMEM;
++		goto out;
++	}
++
++	result = gendisk_init(&pdev->dev, mmc_disk);
++	if (result < 0)
++		goto out;
++
++	add_disk(mmc_disk);
++	
++	/*init_timer(&mmc_timer);
++	   mmc_timer.expires = jiffies + HZ;
++	   mmc_timer.function = (void *)mmc_check_media;
++	   add_timer(&mmc_timer); */
++	return 0;
++
++out:
++	if (mmc_disk)
++		put_disk(mmc_disk);
++		
++	unregister_blkdev(major, DEVICE_NAME);
++	return result;
++}
++
++static int mmc_spi_remove(struct platform_device *dev)
++{
++	int ret;
++
++	if (mmc_disk) {
++		gendisk_fini(mmc_disk);
++		put_disk(mmc_disk);
++	}
++
++	ret = unregister_blkdev(major, DEVICE_NAME);
++	return ret;
++}
++
++struct platform_driver mmc_spi_driver = {
++	.probe		= mmc_spi_probe,
++	.remove		= mmc_spi_remove,
++	.driver		= {
++		.name	= "mmc_spi",
++		.owner	= THIS_MODULE,
++	},
++};
++
++
++/* module init/exit */
++static int __init mmc_block_spi_init(void)
++{
++	int ret;
++	spin_lock_init(&mmc_spi_lock);
++	
++	ret = platform_driver_register(&mmc_spi_driver);
++	if (ret < 0)
++		return ret;
++	
++	/* we just support one device */
++	mmc_dev = platform_device_register_simple("mmc_spi", -1, NULL, 0);
++	if (IS_ERR(mmc_dev))
++		return PTR_ERR(mmc_dev);
++	
++	return 0;
++}
++
++
++static void __exit mmc_block_spi_exit(void)
++{
++	platform_driver_unregister(&mmc_spi_driver);
++	if (mmc_dev)
++		platform_device_unregister(mmc_dev);
++}
++
++
++module_init(mmc_block_spi_init);
++module_exit(mmc_block_spi_exit);
++
++MODULE_AUTHOR("Madsuk,Rohde,TaGana,Carsten Juttner <carjay@gmx.net>,Guylhem Aznar <mmc-driver@externe.net>,mrdata");
++MODULE_DESCRIPTION("Driver for MMC/SD-Cards in SPI mode by GPIO");
++MODULE_SUPPORTED_DEVICE("SIMpad");
++MODULE_LICENSE("GPL");
++
++module_param(major, int, 0444);
++MODULE_PARM_DESC(major, "specify the major device number for the MMC/SD SPI driver");
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-battery-old-way-but-also-with-sysfs.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-battery-old-way-but-also-with-sysfs.patch
new file mode 100644
index 0000000000..ee18ff2bb0
--- /dev/null
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-battery-old-way-but-also-with-sysfs.patch
@@ -0,0 +1,571 @@
+diff -uNr linux-2.6.21.vanilla/drivers/mfd/Makefile linux-2.6.21/drivers/mfd/Makefile
+--- linux-2.6.21.vanilla/drivers/mfd/Makefile	2007-05-30 18:00:30.000000000 +0200
++++ linux-2.6.21/drivers/mfd/Makefile	2007-05-30 18:43:10.000000000 +0200
+@@ -12,3 +12,7 @@
+ ifeq ($(CONFIG_SA1100_ASSABET),y)
+ obj-$(CONFIG_MCP_UCB1200)	+= ucb1x00-assabet.o
+ endif
++
++ifeq ($(CONFIG_SA1100_SIMPAD),y)
++obj-$(CONFIG_MCP_UCB1200)     += ucb1x00-simpad.o
++endif
+diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-simpad.c linux-2.6.21/drivers/mfd/ucb1x00-simpad.c
+--- linux-2.6.21.vanilla/drivers/mfd/ucb1x00-simpad.c	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.21/drivers/mfd/ucb1x00-simpad.c	2007-05-30 18:35:48.000000000 +0200
+@@ -0,0 +1,226 @@
++/*
++ *  linux/drivers/mfd/ucb1x00-simpad.c
++ *
++ *  Copyright (C) 2001-2003 Russell King, All Rights Reserved.
++ *  2007/03/18 mrdata:
++ *             - adapted ucb1x00-assabet.c
++ *             - transfer ucb1x00-simpad.c from kernel24
++ *               to new structur of kernel26
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License.
++ *
++ *  We handle the machine-specific bits of the UCB1x00 driver here.
++ */
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/fs.h>
++#include <linux/proc_fs.h>
++#include <linux/device.h>
++
++#include <linux/apm-emulation.h>
++
++#include <asm/dma.h>
++
++#include <asm/arch/simpad.h>
++#include <asm/arch-sa1100/simpad_pm.h>
++
++#include "ucb1x00.h"
++#include "ucb1x00-simpad.h"
++
++#define UCB1X00_ATTR(name,input,designation) \
++static ssize_t name##_show(struct class_device *dev, char *buf)		\
++{									\
++	struct ucb1x00 *ucb = classdev_to_ucb1x00(dev);			\
++	int val;							\
++	ucb1x00_adc_enable(ucb);					\
++	val = ucb1x00_adc_read(ucb, input, UCB_NOSYNC); 		\
++	ucb1x00_adc_disable(ucb); 					\
++	return sprintf(buf, "%d\n", CALIBRATE_##designation(val)); 	\
++}									\
++static CLASS_DEVICE_ATTR(name,0444,name##_show,NULL)
++
++UCB1X00_ATTR(vbatt, UCB_ADC_INP_AD1, BATTERY);
++UCB1X00_ATTR(vcharger, UCB_ADC_INP_AD2, SUPPLY);
++UCB1X00_ATTR(icharger, UCB_ADC_INP_AD3, CHARGING);
++
++static struct ucb1x00 *ucb_alt;
++
++#define UCB1X00_WERT(name,input,designation) \
++static int ucb1x00_simpad_read_##name(struct ucb1x00 *ucb_alt) 		\
++{									\
++	int val;							\
++	ucb1x00_adc_enable(ucb_alt);					\
++	val = ucb1x00_adc_read(ucb_alt, input, UCB_NOSYNC); 		\
++	ucb1x00_adc_disable(ucb_alt); 					\
++	return CALIBRATE_##designation(val);				\
++}
++
++UCB1X00_WERT(vbatt, UCB_ADC_INP_AD1, BATTERY);
++UCB1X00_WERT(vcharger, UCB_ADC_INP_AD2, SUPPLY);
++UCB1X00_WERT(icharger, UCB_ADC_INP_AD3, CHARGING);
++
++static int ucb1x00_simpad_add(struct ucb1x00_dev *dev)
++{
++	class_device_create_file(&dev->ucb->cdev, &class_device_attr_vbatt);
++	class_device_create_file(&dev->ucb->cdev, &class_device_attr_vcharger);
++	class_device_create_file(&dev->ucb->cdev, &class_device_attr_icharger);
++	ucb_alt = dev->ucb;
++	return 0;
++}
++
++static void ucb1x00_simpad_remove(struct ucb1x00_dev *dev)
++{
++	class_device_remove_file(&dev->ucb->cdev, &class_device_attr_icharger);
++	class_device_remove_file(&dev->ucb->cdev, &class_device_attr_vcharger);
++	class_device_remove_file(&dev->ucb->cdev, &class_device_attr_vbatt);
++}
++
++static struct ucb1x00_driver ucb1x00_simpad_driver = {
++	.add	= ucb1x00_simpad_add,
++	.remove	= ucb1x00_simpad_remove,
++};
++
++static int __init ucb1x00_simpad_init(void)
++{
++	apm_get_power_status = simpad_apm_get_power_status;
++	return ucb1x00_register_driver(&ucb1x00_simpad_driver);
++}
++
++static void __exit ucb1x00_simpad_exit(void)
++{
++	apm_get_power_status = NULL;
++	ucb1x00_unregister_driver(&ucb1x00_simpad_driver);
++}
++
++/****************************************************************************/
++/*  Functions exported for use by the kernel and kernel modules             */
++/****************************************************************************/
++
++int simpad_get_battery(struct simpad_battery_apm *bstat)
++{
++ 	int icharger, vcharger, vbatt;
++
++ 	if ( ucb_alt ) {
++ 		icharger = ucb1x00_simpad_read_icharger( ucb_alt );
++ 		vcharger = ucb1x00_simpad_read_vcharger( ucb_alt );
++ 		vbatt    = ucb1x00_simpad_read_vbatt( ucb_alt );
++ 	} else {
++ 		bstat->ac_status = SIMPAD_AC_STATUS_AC_UNKNOWN;
++		bstat->status = SIMPAD_BATT_STATUS_UNKNOWN;
++		bstat->percentage = 0x64;    // lets say 100%
++		bstat->life = 330;	     // lets say a long time 
++		return 0;
++	}
++
++	/* AC status */
++	bstat->ac_status = SIMPAD_AC_STATUS_AC_OFFLINE;
++	if ( vcharger>MIN_SUPPLY ) {
++		bstat->ac_status = SIMPAD_AC_STATUS_AC_ONLINE;
++	}
++
++	/* charging */
++	bstat->status = 0x0;
++	if ( icharger >= CHARGING_LED_LEVEL ) 
++		bstat->status = SIMPAD_BATT_STATUS_CHARGING;
++
++	if ( vbatt > BATT_LOW )
++		bstat->status |= SIMPAD_BATT_STATUS_HIGH;
++	else if ( vbatt < BATT_CRITICAL )
++		bstat->status |= SIMPAD_BATT_STATUS_CRITICAL;
++	else
++		bstat->status |= SIMPAD_BATT_STATUS_LOW;
++
++	if (bstat->status & SIMPAD_BATT_STATUS_CHARGING) {
++		if (icharger > CHARGING_MAX_LEVEL)
++			icharger = CHARGING_MAX_LEVEL;
++		if (icharger < CHARGING_LED_LEVEL)
++			icharger = CHARGING_LED_LEVEL;
++
++		bstat->percentage = 100 - 100 * (icharger - CHARGING_LED_LEVEL) /
++		(CHARGING_MAX_LEVEL - CHARGING_LED_LEVEL);
++	} else {
++		if (vbatt > BATT_FULL)
++			vbatt = BATT_FULL;
++		if (vbatt < BATT_EMPTY)
++			vbatt = BATT_EMPTY;
++
++		bstat->percentage = 100 * (vbatt - BATT_EMPTY) / (BATT_FULL - BATT_EMPTY);
++	}
++
++	/* let's assume: full load is 7h */
++	/* bstat->life = 420*bstat->percentage/100; */
++	/* mrdata: think, 4h is more realistic */
++	bstat->life = 240*(bstat->percentage)/100;
++
++#if 0
++	printk("get_battery: ac: %02x / ch: %02x /  perc: %02x / life: %d \n",
++	bstat->ac_status, bstat->status,
++	bstat->percentage, bstat->life );
++#endif
++
++	return 0;
++}
++
++void simpad_apm_get_power_status(struct apm_power_info *info)
++{
++	struct simpad_battery_apm bstat;
++	unsigned char ac    = APM_AC_UNKNOWN;
++	unsigned char level = APM_BATTERY_STATUS_UNKNOWN;
++	int status, result;
++
++	result = simpad_get_battery(&bstat);
++	if (result) {
++		printk("%s: unable to access battery information: result=%d\n", __FUNCTION__, result);
++		return;
++	}
++
++	switch (bstat.ac_status) {
++	case SIMPAD_AC_STATUS_AC_OFFLINE:
++		ac = APM_AC_OFFLINE;
++		break;
++	case SIMPAD_AC_STATUS_AC_ONLINE:
++		ac = APM_AC_ONLINE;
++		break;
++	case SIMPAD_AC_STATUS_AC_BACKUP:
++		ac = APM_AC_BACKUP;
++		break;
++	}
++
++	info->ac_line_status = ac;
++
++	status = bstat.status;
++	if (status & (SIMPAD_BATT_STATUS_CHARGING | SIMPAD_BATT_STATUS_CHARGE_MAIN))
++		level = APM_BATTERY_STATUS_CHARGING;
++	else if (status & (SIMPAD_BATT_STATUS_HIGH | SIMPAD_BATT_STATUS_FULL))
++		level = APM_BATTERY_STATUS_HIGH;
++	else if (status & SIMPAD_BATT_STATUS_LOW)
++		level = APM_BATTERY_STATUS_LOW;
++	else if (status & SIMPAD_BATT_STATUS_CRITICAL)
++		level = APM_BATTERY_STATUS_CRITICAL;
++
++	info->battery_status = level;
++	info->battery_flag = info->battery_status;
++
++	info->battery_life = bstat.percentage;
++
++	/* we have a dumb battery - so we know nothing */
++	info->time = bstat.life;
++	info->units = APM_UNITS_MINS;
++
++#if 0
++	printk("apm_get_power: ac: %02x / bs: %02x / bf: %02x / perc: %02x / life: %d\n",
++	       info->ac_line_status, info->battery_status, info->battery_flag,
++	       info->battery_life, info->time );
++#endif
++	return;
++}
++
++module_init(ucb1x00_simpad_init);
++module_exit(ucb1x00_simpad_exit);
++
++
++MODULE_AUTHOR("Juergen Messerer <juergen.messerer@freesurf.ch>");
++MODULE_DESCRIPTION("SIMpad noddy testing only example ADC driver");
++MODULE_LICENSE("GPL");
+diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-simpad.h linux-2.6.21/drivers/mfd/ucb1x00-simpad.h
+--- linux-2.6.21.vanilla/drivers/mfd/ucb1x00-simpad.h	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.21/drivers/mfd/ucb1x00-simpad.h	2007-05-30 18:35:48.000000000 +0200
+@@ -0,0 +1,86 @@
++/*
++ *  linux/drivers/mfd/ucb1x00-simpad.h
++ *
++ *  Copyright (C) 2001 Russell King, All Rights Reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License.
++ */
++#ifndef UCB1300_SIMPAD_H
++#define UCB1300_SIMPAD_H
++
++/*
++ * Conversion from AD -> mV
++ * 7.5V = 1023   7.33137mV/Digit
++ *
++ * 400 Units == 9.7V
++ * a     = ADC value
++ * 2007/03/24 mrdata:
++ *            according UCB1300 datasheet ADC error max. 3 LSB
++ *            5-95% of full scale -> 3*7.33137mV = 21.99mV
++ * // old 
++ * 21    = ADC error 
++ * 12600 = Divident to get 2*7.3242 
++ * 860   = Divider to get 2*7.3242
++ * 170   = Voltagedrop over
++ *
++ * // new
++ * 3     = ADC error 
++ * 12610 = Divident to get 2*7.33139
++ * 860   = Divider  to get 2*7.33139
++ * 170   = Voltagedrop over
++ */
++// #define CALIBRATE_BATTERY(a)   ((((a + 21)*12600)/860) + 170)
++#define CALIBRATE_BATTERY(a)   ((((a + 3)*12610)/860) + 170)
++
++/*
++ * We have two types of batteries a small and a large one
++ * To get the right value we to distinguish between those two
++ * 450 Units == 15 V
++ */
++#ifdef SMALL_BATTERY 
++#define CALIBRATE_SUPPLY(a)   (((a) * 1500) / 51)
++#define MIN_SUPPLY            8500 /* Less then 8.5V means no powersupply */
++#else
++#define CALIBRATE_SUPPLY(a)   (((a) * 1500) / 45)
++//#define MIN_SUPPLY            14000 /* Less then 14V means no powersupply */
++#define MIN_SUPPLY            12000 /* Less then 12V means no powersupply */
++#endif
++
++/*
++ * Charging Current 
++ * if value is >= 50 then charging is on
++ */
++// #define CALIBRATE_CHARGING(a)    (((a) * 1000) / (152/4))
++#define CALIBRATE_CHARGING(a)    (a)
++//#define CHARGING_LED_LEVEL     50
++
++#ifdef CONFIG_SA1100_SIMPAD_SINUSPAD
++
++// type small battery
++#define CHARGING_LED_LEVEL     12
++#define CHARGING_MAX_LEVEL     120
++#define BATT_FULL	8100
++#define BATT_LOW	7300
++#define BATT_CRITICAL	6700
++#define BATT_EMPTY	6400
++
++#else // CONFIG_SA1100_SIMPAD_SINUSPAD
++
++// type large battery
++// because of ADC error CHARGING_LED_LEVEL can changed
++// from 27 to 28
++#define CHARGING_LED_LEVEL     27
++#define CHARGING_MAX_LEVEL     265
++// BATT_FULL with SIMPAD_AC_STATUS_AC_OFFLINE
++#define BATT_FULL	8100
++#define BATT_LOW	7400
++#define BATT_CRITICAL	6800
++#define BATT_EMPTY	6500
++
++#endif // CONFIG_SA1100_SIMPAD_SINUSPAD
++
++// int simpad_get_battery(struct simpad_battery_apm *bstat);
++
++#endif
+diff -uNr linux-2.6.21.vanilla/include/asm-arm/arch-sa1100/simpad_pm.h linux-2.6.21/include/asm-arm/arch-sa1100/simpad_pm.h
+--- linux-2.6.21.vanilla/include/asm-arm/arch-sa1100/simpad_pm.h	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.21/include/asm-arm/arch-sa1100/simpad_pm.h	2007-05-30 18:36:07.000000000 +0200
+@@ -0,0 +1,236 @@
++/*
++* Abstraction interface for microcontroller connection to rest of system
++*
++* Copyright 2003 Peter Pregler
++* Copyright 2000,1 Compaq Computer Corporation.
++*
++* Use consistent with the GNU GPL is permitted,
++* provided that this copyright notice is
++* preserved in its entirety in all copies and derived works.
++*
++* COMPAQ COMPUTER CORPORATION MAKES NO WARRANTIES, EXPRESSED OR IMPLIED,
++* AS TO THE USEFULNESS OR CORRECTNESS OF THIS CODE OR ITS
++* FITNESS FOR ANY PARTICULAR PURPOSE.
++*
++* Author: Peter Pregler (based on work for ipaq by Andrew Christian)
++*
++*/
++
++#ifndef __SIMPAD_HAL_H
++#define __SIMPAD_HAL_H
++
++#include <linux/apm-emulation.h>
++
++struct simpad_battery_apm {
++	unsigned char ac_status;	/* line connected yes/no */
++	unsigned char status;		/* battery loading yes/no */
++	unsigned char percentage;	/* percentage loaded */
++	unsigned short life;		/* life till empty */
++};
++
++extern void simpad_apm_get_power_status(struct apm_power_info *);
++
++// extern int simpad_get_battery(struct simpad_battery_apm *bstat);
++
++/* These should match the apm_bios.h definitions */
++#define SIMPAD_AC_STATUS_AC_OFFLINE      0x00
++#define SIMPAD_AC_STATUS_AC_ONLINE       0x01
++#define SIMPAD_AC_STATUS_AC_BACKUP       0x02   /* What does this mean? */
++#define SIMPAD_AC_STATUS_AC_UNKNOWN      0xff
++
++
++/* These bitfields are rarely "or'd" together */
++#define SIMPAD_BATT_STATUS_HIGH          0x01
++#define SIMPAD_BATT_STATUS_LOW           0x02
++#define SIMPAD_BATT_STATUS_CRITICAL      0x04
++#define SIMPAD_BATT_STATUS_CHARGING      0x08
++#define SIMPAD_BATT_STATUS_CHARGE_MAIN   0x10
++#define SIMPAD_BATT_STATUS_DEAD          0x20   /* Battery will not charge */
++#define SIMPAD_BATT_NOT_INSTALLED        0x20   /* For expansion pack batteries */
++#define SIMPAD_BATT_STATUS_FULL          0x40   /* Battery fully charged (and connected to AC) */
++#define SIMPAD_BATT_STATUS_NOBATT        0x80
++#define SIMPAD_BATT_STATUS_UNKNOWN       0xff
++                                                                                                                                           
++#if 0 // FIXME
++#include <linux/simpad_ts.h>
++
++enum simpad_asset_type {
++	ASSET_TCHAR = 0,
++	ASSET_SHORT,
++	ASSET_LONG
++};
++
++#define TTYPE(_type)           (((unsigned int)_type) << 8)
++#define TCHAR(_len)            (TTYPE(ASSET_TCHAR) | (_len))
++#define TSHORT                 TTYPE(ASSET_SHORT)
++#define TLONG                  TTYPE(ASSET_LONG)
++#define ASSET(_type,_num)      ((((unsigned int)_type)<<16) | (_num))
++
++#define ASSET_HM_VERSION        ASSET( TCHAR(10), 0 )   /* 1.1, 1.2 */
++#define ASSET_SERIAL_NUMBER     ASSET( TCHAR(40), 1 )   /* Unique iPAQ serial number */
++#define ASSET_MODULE_ID         ASSET( TCHAR(20), 2 )   /* E.g., "iPAQ 3700" */    
++#define ASSET_PRODUCT_REVISION  ASSET( TCHAR(10), 3 )   /* 1.0, 2.0 */
++#define ASSET_PRODUCT_ID        ASSET( TSHORT,    4 )   /* 2 = Palm-sized computer */
++#define ASSET_FRAME_RATE        ASSET( TSHORT,    5 )
++#define ASSET_PAGE_MODE         ASSET( TSHORT,    6 )   /* 0 = Flash memory */
++#define ASSET_COUNTRY_ID        ASSET( TSHORT,    7 )   /* 0 = USA */
++#define ASSET_IS_COLOR_DISPLAY  ASSET( TSHORT,    8 )   /* Boolean, 1 = yes */
++#define ASSET_ROM_SIZE          ASSET( TSHORT,    9 )   /* 16, 32 */
++#define ASSET_RAM_SIZE          ASSET( TSHORT,   10 )   /* 32768 */
++#define ASSET_HORIZONTAL_PIXELS ASSET( TSHORT,   11 )   /* 240 */
++#define ASSET_VERTICAL_PIXELS   ASSET( TSHORT,   12 )   /* 320 */
++
++#define ASSET_TYPE(_asset)       (((_asset)&0xff000000)>>24)
++#define ASSET_TCHAR_LEN(_asset)  (((_asset)&0x00ff0000)>>16)
++#define ASSET_NUMBER(_asset)     ((_asset)&0x0000ffff)
++
++#define MAX_TCHAR_LEN 40
++
++struct simpad_asset {
++	unsigned int type;
++	union {
++		unsigned char  tchar[ MAX_TCHAR_LEN ];
++		unsigned short vshort;
++		unsigned long  vlong;
++	} a;
++};
++
++/********************************************************************
++ * Interface to the hardware-type specific functions
++ *
++ * get_version           Read the version number of the microcontroller on the option pack SPI bus
++ * spi_read              Reads from the serial EEPROM memory on the option pack SPI bus
++ * spi_write             Write to the serial EEPROM memory on the option pack SPI bus
++ * get_option_detect     Returns whether or not an option pack is present
++ *
++ * get_thermal_sensor    Return measured temperature of the unit, in units of 0.125 deg C
++ * set_notify_led        Turns on, off, or blinks the Green LED
++ * read_light_sensor     Returns the value of the front light sensor
++ * get_battery           Returns the current voltage and charging state of all batteries
++ * audio_clock           Sets the audio CODEC to run at a particular rate
++ * audio_power           Turns on/off audio CODEC (internally calls audio_clock)
++ * audio_mute            Mutes the audio CODEC
++ * asset_read            Extracts PocketPC-style asset information from persistent memory
++ * backlight_control     Adjusts the backlight level  (only on/off for 3100)
++ *
++ *
++ * iPAQ 3100 only
++ * ==============
++ * codec_control         Reset/mute/control level of 3100 audio codec
++ * contrast_control      Adjusts the contrast level   (only for 3100)
++ *
++ * iPAQ 3600, 3700 only
++ * ====================
++ * eeprom_read           Reads from the asset information on the eeprom of a 3600 (deprecated)
++ * eeprom_write          Writes to the asset information on the eeprom (deprecated)
++ *
++ * The interfaces to the EEPROM functions are maintained only because the simpad_ts driver has
++ * a deprecated ioctl call for them.  They are used internally by the "asset_read" function.
++ *
++ * iPAQ 3800, 3900 only
++ * ====================
++ * set_ebat              Tells enhanced PCMCIA sleeves that this iPAQ can handle 
++ *                       a wider voltage range (applies to 3800, 3900)
++ *
++ *********************************************************************/
++
++struct simpad_hal_ops {
++	/* Functions provided by the underlying hardware */
++	int (*get_version)( struct simpad_ts_version * );
++	int (*eeprom_read)( unsigned short address, unsigned char *data, unsigned short len );
++	int (*eeprom_write)( unsigned short address, unsigned char *data, unsigned short len );
++	int (*get_thermal_sensor)( unsigned short * );
++	int (*set_notify_led)( unsigned char mode, unsigned char duration, 
++			       unsigned char ontime, unsigned char offtime );
++	int (*read_light_sensor)( unsigned char *result );
++	int (*get_battery)( struct simpad_battery * );
++	int (*spi_read)( unsigned short address, unsigned char *data, unsigned short len );
++	int (*spi_write)( unsigned short address, unsigned char *data, unsigned short len );
++	int (*codec_control)( unsigned char, unsigned char );
++	int (*get_option_detect)( int *result );
++	int (*audio_clock)( long samplerate );
++	int (*audio_power)( long samplerate );
++	int (*audio_mute)( int mute );
++	int (*asset_read)( struct simpad_asset *asset );
++	int (*set_ebat)( void );
++
++	/* Functions indirectly provided by the underlying hardware */
++	int (*backlight_control)( enum flite_pwr power, unsigned char level );
++	int (*contrast_control)( unsigned char level );
++
++        /* for module use counting */ 
++        struct module *owner;
++};
++
++/* Used by the device-specific hardware module to register itself */
++extern int  simpad_hal_register_interface( struct simpad_hal_ops *ops );
++extern void simpad_hal_unregister_interface( struct simpad_hal_ops *ops );
++
++/* 
++ * Calls into HAL from the device-specific hardware module
++ * These run at interrupt time 
++ */
++extern void simpad_hal_keypress( unsigned char key );
++extern void simpad_hal_touchpanel( unsigned short x, unsigned short y, int down );
++extern void simpad_hal_option_detect( int present );
++
++/* Callbacks registered by device drivers */
++struct simpad_driver_ops {
++	void (*keypress)( unsigned char key );
++	void (*touchpanel)( unsigned short x, unsigned short y, int down );
++	void (*option_detect)( int present );
++};
++
++extern int  simpad_hal_register_driver( struct simpad_driver_ops * );
++extern void simpad_hal_unregister_driver( struct simpad_driver_ops * );
++
++
++/* Calls into HAL from device drivers and other kernel modules */
++extern void simpad_get_flite( struct simpad_ts_backlight *bl );
++extern void simpad_get_contrast( unsigned char *contrast );
++extern int  simpad_set_flite( enum flite_pwr pwr, unsigned char brightness );
++extern int  simpad_set_contrast( unsigned char contrast );
++extern int  simpad_toggle_frontlight( void );
++
++extern int simpad_apm_get_power_status(unsigned char *ac_line_status, unsigned char *battery_status, 
++				      unsigned char *battery_flag, unsigned char *battery_percentage, 
++				      unsigned short *battery_life);
++
++extern struct simpad_hal_ops *simpad_hal_ops;
++
++/* Do not use this macro in driver files - instead, use the inline functions defined below */
++#define CALL_HAL( f, args... ) \
++        { int __result = -EIO;                             \
++          if ( simpad_hal_ops && simpad_hal_ops->f ) {       \
++                __MOD_INC_USE_COUNT(simpad_hal_ops->owner); \
++                __result = simpad_hal_ops->f(args);         \
++                __MOD_DEC_USE_COUNT(simpad_hal_ops->owner); \
++          }                                                \
++          return __result; }
++
++#define HFUNC  static __inline__ int
++
++/* The eeprom_read/write address + len has a maximum value of 512.  Both must be even numbers */
++HFUNC simpad_eeprom_read( u16 addr, u8 *data, u16 len )  CALL_HAL(eeprom_read,addr,data,len)
++HFUNC simpad_eeprom_write( u16 addr, u8 *data, u16 len)  CALL_HAL(eeprom_write,addr,data,len)
++HFUNC simpad_spi_read( u8 addr, u8 *data, u16 len) 	CALL_HAL(spi_read,addr,data,len)
++HFUNC simpad_spi_write( u8 addr, u8 *data, u16 len) 	CALL_HAL(spi_write,addr,data,len)
++HFUNC simpad_get_version( struct simpad_ts_version *v )   CALL_HAL(get_version,v)
++HFUNC simpad_get_thermal_sensor( u16 *thermal ) 	        CALL_HAL(get_thermal_sensor,thermal)
++HFUNC simpad_set_led( u8 mode, u8 dur, u8 ont, u8 offt ) CALL_HAL(set_notify_led, mode, dur, ont, offt)
++HFUNC simpad_get_light_sensor( u8 *result ) 	        CALL_HAL(read_light_sensor,result)
++HFUNC simpad_get_battery( struct simpad_battery *bat )	CALL_HAL(get_battery,bat)
++HFUNC simpad_get_option_detect( int *result)             CALL_HAL(get_option_detect,result)
++HFUNC simpad_audio_clock( long samplerate )              CALL_HAL(audio_clock,samplerate)
++HFUNC simpad_audio_power( long samplerate )              CALL_HAL(audio_power,samplerate)
++HFUNC simpad_audio_mute( int mute )                      CALL_HAL(audio_mute,mute)
++HFUNC simpad_asset_read( struct simpad_asset *asset )     CALL_HAL(asset_read,asset)
++HFUNC simpad_set_ebat( void )                            CALL_HAL(set_ebat)
++
++/* Don't use these functions directly - rather, call {get,set}_{flite,contrast} */
++	/* Functions indirectly provided by the underlying hardware */
++HFUNC simpad_backlight_control( enum flite_pwr p, u8 v ) CALL_HAL(backlight_control,p,v)
++HFUNC simpad_contrast_control( u8 level )                CALL_HAL(contrast_control,level)
++
++#endif
++#endif
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-cs3-simpad.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-cs3-simpad.patch
index 6d6c373271..cfb9aad906 100644
--- a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-cs3-simpad.patch
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-cs3-simpad.patch
@@ -1,6 +1,6 @@
 diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/Makefile linux-2.6.21/arch/arm/mach-sa1100/Makefile
---- linux-2.6.21.vanilla/arch/arm/mach-sa1100/Makefile	2007-05-01 16:40:44.000000000 +0200
-+++ linux-2.6.21/arch/arm/mach-sa1100/Makefile	2007-05-01 16:52:10.000000000 +0200
+--- linux-2.6.21.vanilla/arch/arm/mach-sa1100/Makefile	2007-05-29 21:34:59.000000000 +0200
++++ linux-2.6.21/arch/arm/mach-sa1100/Makefile	2007-05-30 17:44:04.000000000 +0200
 @@ -40,6 +40,7 @@
  obj-$(CONFIG_SA1100_SHANNON)		+= shannon.o
  
@@ -11,10 +11,10 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/Makefile linux-2.6.21/arch/a
  # LEDs support
 diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/cs3-simpad.c linux-2.6.21/arch/arm/mach-sa1100/cs3-simpad.c
 --- linux-2.6.21.vanilla/arch/arm/mach-sa1100/cs3-simpad.c	1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.21/arch/arm/mach-sa1100/cs3-simpad.c	2007-05-01 16:52:10.000000000 +0200
-@@ -0,0 +1,300 @@
++++ linux-2.6.21/arch/arm/mach-sa1100/cs3-simpad.c	2007-05-30 17:45:51.000000000 +0200
+@@ -0,0 +1,169 @@
 +/*
-+ *  cs3-simpad.c
++ *  simpad-cs3.c
 + *
 + *  This driver shows the GPIO states of the cs3 latch. You can also
 + *  switch some GPIOS.
@@ -25,6 +25,9 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/cs3-simpad.c linux-2.6.21/ar
 + *
 + *  Some parts are based on battery.c
 + *
++ *  mrdata: -added cs3_ro support 
++ *          -added preprocessor stuff
++ *
 + */
 +
 +#include <linux/module.h>
@@ -34,245 +37,97 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/cs3-simpad.c linux-2.6.21/ar
 +
 +#include <asm/arch/simpad.h>
 +
++extern long get_cs3_ro(void);
 +extern long get_cs3_shadow(void);
 +extern void set_cs3_bit(int value);
 +extern void clear_cs3_bit(int value);
 +
 +struct cs3 {
-+	struct class_device class_dev;
-+	const char *name;
-+	char *id;
-+	int type;
++ struct class_device class_dev;
++ const char *name;
++ char *id;
++ int type;
 +};
 +
 +struct cs3 cs3 ={
 +        .name = "latch_cs3",
 +};
 +
-+static ssize_t get_VCC_5V_EN (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & VCC_5V_EN ) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_VCC_3V_EN (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & VCC_3V_EN) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_EN1 (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & EN1) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_EN0 (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & EN0) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_DISPLAY_ON (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & DISPLAY_ON) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_PCMCIA_BUFF_DIS (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & PCMCIA_BUFF_DIS) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_MQ_RESET (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & MQ_RESET) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_PCMCIA_RESET (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & PCMCIA_RESET) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+}
-+
-+static ssize_t get_DECT_POWER_ON (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & DECT_POWER_ON) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_IRDA_SD (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & IRDA_SD) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_RS232_ON (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & RS232_ON) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_SD_MEDIAQ (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & SD_MEDIAQ) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+}
-+
-+static ssize_t get_LED2_ON (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & LED2_ON) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_IRDA_MODE (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & IRDA_MODE) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+}
-+
-+static ssize_t get_ENABLE_5V (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & ENABLE_5V) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+} 
-+
-+static ssize_t get_RESET_SIMCARD (struct class_device *class_dev, char *buf) {
-+    if (get_cs3_shadow() & RESET_SIMCARD) 
-+        return sprintf(buf, "1\n");
-+    else 
-+        return sprintf(buf, "0\n");
-+}
-+
-+
-+static ssize_t write_DISPLAY_ON (struct class_device *cdev, const char * buf, size_t count){
-+    char val;
-+        if (sscanf(buf, "%c",&val) !=1)
-+            return -EINVAL;
-+        if (val=='1')
-+            set_cs3_bit(DISPLAY_ON);
-+        else if (val=='0')
-+            clear_cs3_bit(DISPLAY_ON);
-+        return strlen(buf);
-+}
-+
-+static ssize_t write_DECT_POWER_ON (struct class_device *cdev, const char * buf, size_t count){
-+    char val;
-+        if (sscanf(buf, "%c",&val) !=1)
-+            return -EINVAL;
-+        if (val=='1')
-+            set_cs3_bit(DECT_POWER_ON);
-+        else if (val=='0')
-+            clear_cs3_bit(DECT_POWER_ON);
-+        return strlen(buf);
-+}
-+
-+static ssize_t write_IRDA_SD (struct class_device *cdev, const char * buf, size_t count){
-+    char val;
-+        if (sscanf(buf, "%c",&val) !=1)
-+            return -EINVAL;
-+        if (val=='1')
-+            set_cs3_bit(IRDA_SD);
-+        else if (val=='0')
-+            clear_cs3_bit(IRDA_SD);
-+        return strlen(buf);
-+}
-+
-+static ssize_t write_SD_MEDIAQ (struct class_device *cdev, const char * buf, size_t count){
-+    char val;
-+        if (sscanf(buf, "%c",&val) !=1)
-+            return -EINVAL;
-+        if (val=='1')
-+            set_cs3_bit(SD_MEDIAQ);
-+        else if (val=='0')
-+            clear_cs3_bit(SD_MEDIAQ);
-+        return strlen(buf);
-+}
-+
-+static ssize_t write_LED2_ON (struct class_device *cdev, const char * buf, size_t count){
-+    char val;
-+        if (sscanf(buf, "%c",&val) !=1)
-+            return -EINVAL;
-+        if (val=='1')
-+            set_cs3_bit(LED2_ON);
-+        else if (val=='0')
-+            clear_cs3_bit(LED2_ON);
-+        return strlen(buf);
-+}
-+
-+static ssize_t write_IRDA_MODE (struct class_device *cdev, const char * buf, size_t count){
-+    char val;
-+        if (sscanf(buf, "%c",&val) !=1)
-+            return -EINVAL;
-+        if (val=='1')
-+            set_cs3_bit(IRDA_MODE);
-+        else if (val=='0')
-+            clear_cs3_bit(IRDA_MODE);
-+        return strlen(buf);
-+}
 +
-+static ssize_t write_RESET_SIMCARD (struct class_device *cdev, const char * buf, size_t count){
-+    char val;
-+        if (sscanf(buf, "%c",&val) !=1)
-+            return -EINVAL;
-+        if (val=='1')
-+            set_cs3_bit(RESET_SIMCARD);
-+        else if (val=='0')
-+            clear_cs3_bit(RESET_SIMCARD);
-+        return strlen(buf);
++#define CS3_STORE_ATTR(namek,nameg) 								\
++static ssize_t namek##_store (struct class_device *cdev, const char * buf, size_t count) 	\
++{ 												\
++    char val; 											\
++        if (sscanf(buf, "%c",&val) != 1) 							\
++            return -EINVAL; 									\
++        if (val == '1') 									\
++            set_cs3_bit(nameg); 								\
++        else if (val == '0') 									\
++            clear_cs3_bit(nameg); 								\
++        return strlen(buf); 									\
 +}
 +
-+static CLASS_DEVICE_ATTR(vcc_5v_en, 0444, get_VCC_5V_EN, NULL);
-+static CLASS_DEVICE_ATTR(vcc_3v_en, 0444, get_VCC_3V_EN, NULL);
-+static CLASS_DEVICE_ATTR(en1, 0444, get_EN1, NULL);
-+static CLASS_DEVICE_ATTR(en0, 0444, get_EN0, NULL);
-+static CLASS_DEVICE_ATTR(display_on, 0664, get_DISPLAY_ON, write_DISPLAY_ON);
-+static CLASS_DEVICE_ATTR(pcmcia_buff_dis, 0444, get_PCMCIA_BUFF_DIS, NULL);
-+static CLASS_DEVICE_ATTR(mq_reset, 0444, get_MQ_RESET, NULL);
-+static CLASS_DEVICE_ATTR(pcmcia_reset, 0444, get_PCMCIA_RESET, NULL);
-+static CLASS_DEVICE_ATTR(dect_power_on, 0664, get_DECT_POWER_ON, write_DECT_POWER_ON);
-+static CLASS_DEVICE_ATTR(irda_sd, 0664, get_IRDA_SD, write_IRDA_SD);
-+static CLASS_DEVICE_ATTR(rs232_on, 0444, get_RS232_ON, NULL);
-+static CLASS_DEVICE_ATTR(sd_mediaq, 0664, get_SD_MEDIAQ, write_SD_MEDIAQ);
-+static CLASS_DEVICE_ATTR(led2_on, 0664, get_LED2_ON, write_LED2_ON);
-+static CLASS_DEVICE_ATTR(irda_mode, 0664, get_IRDA_MODE, write_IRDA_MODE);
-+static CLASS_DEVICE_ATTR(enable_5v, 0444, get_ENABLE_5V, NULL);
-+static CLASS_DEVICE_ATTR(reset_simcard, 0664, get_RESET_SIMCARD, write_RESET_SIMCARD);
++CS3_STORE_ATTR(display_on, DISPLAY_ON);
++CS3_STORE_ATTR(dect_power_on, DECT_POWER_ON);
++CS3_STORE_ATTR(irda_sd, IRDA_SD);
++CS3_STORE_ATTR(sd_mediaq, SD_MEDIAQ);
++CS3_STORE_ATTR(led2_on, LED2_ON);
++CS3_STORE_ATTR(irda_mode, IRDA_MODE);
++CS3_STORE_ATTR(reset_simcard, RESET_SIMCARD);
++
++
++#define CS3_ATTR(shadro,namek,nameg,mode,store) 			\
++static ssize_t namek##_show(struct class_device *class_dev, char *buf) 	\
++{ 									\
++    if (get_cs3_##shadro() & nameg ) 					\
++        return sprintf(buf, "1\n"); 					\
++    else 								\
++        return sprintf(buf, "0\n"); 					\
++} 									\
++static CLASS_DEVICE_ATTR(namek, mode, namek##_show, store)
++
++CS3_ATTR(shadow, vcc_5v_en, VCC_5V_EN, 0444, NULL);
++CS3_ATTR(shadow, vcc_3v_en, VCC_3V_EN, 0444, NULL);
++CS3_ATTR(shadow, en1, EN1, 0444, NULL);
++CS3_ATTR(shadow, en0, EN0, 0444, NULL);
++CS3_ATTR(shadow, display_on, DISPLAY_ON, 0664, display_on_store);
++CS3_ATTR(shadow, pcmcia_buff_dis, PCMCIA_BUFF_DIS, 0444, NULL);
++CS3_ATTR(shadow, mq_reset, MQ_RESET, 0444, NULL);
++CS3_ATTR(shadow, pcmcia_reset, PCMCIA_RESET, 0444, NULL);
++CS3_ATTR(shadow, dect_power_on, DECT_POWER_ON, 0664, dect_power_on_store);
++CS3_ATTR(shadow, irda_sd, IRDA_SD, 0664, irda_sd_store);
++CS3_ATTR(shadow, rs232_on, RS232_ON, 0444, NULL);
++CS3_ATTR(shadow, sd_mediaq, SD_MEDIAQ, 0664, sd_mediaq_store);
++CS3_ATTR(shadow, led2_on, LED2_ON, 0664, led2_on_store);
++CS3_ATTR(shadow, irda_mode, IRDA_MODE, 0664, irda_mode_store);
++CS3_ATTR(shadow, enable_5v, ENABLE_5V, 0444, NULL);
++CS3_ATTR(shadow, reset_simcard, RESET_SIMCARD, 0664, reset_simcard_store);
++CS3_ATTR(ro, pcmcia_bvd1, PCMCIA_BVD1, 0444, NULL);
++CS3_ATTR(ro, pcmcia_bvd2, PCMCIA_BVD2, 0444, NULL);
++CS3_ATTR(ro, pcmcia_vs1, PCMCIA_VS1, 0444, NULL);
++CS3_ATTR(ro, pcmcia_vs2, PCMCIA_VS2, 0444, NULL);
++CS3_ATTR(ro, lock_ind, LOCK_IND, 0444, NULL);
++CS3_ATTR(ro, charging_state, CHARGING_STATE, 0444, NULL);
++CS3_ATTR(ro, pcmcia_short, PCMCIA_SHORT, 0444, NULL);
 +
 +static struct class simpad_gpios_class = {
-+        .name = "simpad"
++        .name = "simpad",
 +};
 +
-+#define create_entry_conditional(name) \
-+	rc = class_device_create_file(&cs3->class_dev, &class_device_attr_##name); \
-+	if (rc) goto out; \
++#define create_entry_conditional(namek) 					\
++    rc = class_device_create_file(&cs3->class_dev, &class_device_attr_##namek); \
++    if (rc) goto out; 								\
 +
-+static int register_cs3_latch(struct cs3 *cs3){
++static int register_cs3_latch(struct cs3 *cs3)
++{
 +    int rc = 0;
-+	cs3->class_dev.class = &simpad_gpios_class;
-+	strcpy(cs3->class_dev.class_id, cs3->name);
-+	rc = class_device_register(&cs3->class_dev);
-+	if(rc)
-+		goto out;
++    cs3->class_dev.class = &simpad_gpios_class;
++    strcpy(cs3->class_dev.class_id, cs3->name);
++    rc = class_device_register(&cs3->class_dev);
++    if(rc)
++         goto out;
 +
-+	create_entry_conditional(vcc_5v_en);
++    create_entry_conditional(vcc_5v_en);
 +    create_entry_conditional(vcc_3v_en);
 +    create_entry_conditional(en1);
 +    create_entry_conditional(en0);
@@ -288,28 +143,42 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/cs3-simpad.c linux-2.6.21/ar
 +    create_entry_conditional(irda_mode);
 +    create_entry_conditional(enable_5v);
 +    create_entry_conditional(reset_simcard);
-+    
++    create_entry_conditional(pcmcia_bvd1);
++    create_entry_conditional(pcmcia_bvd2);
++    create_entry_conditional(pcmcia_vs1);
++    create_entry_conditional(pcmcia_vs2);
++    create_entry_conditional(lock_ind);
++    create_entry_conditional(charging_state);
++    create_entry_conditional(pcmcia_short);
++
 +out:
 +    return rc;
 +}
 +
 +static int __init simpad_gpios_class_init(void)
 +{
-+    if (class_register(&simpad_gpios_class) != 0)
-+    printk(KERN_ERR "cs3 latch class failed "
-+                    "to register properly\n");
-+    register_cs3_latch(&cs3);
-+	return 0;
++    int rc = 0;
++    
++    rc = class_register(&simpad_gpios_class);
++    
++    if(rc != 0)
++    {
++        printk(KERN_ERR "cs3 latch class failed to register properly\n");
++        return rc;
++    }
++    
++    rc = register_cs3_latch(&cs3);
++    return rc;
 +}
 +
 +static void __exit simpad_gpios_class_exit(void)
 +{
-+	class_unregister(&simpad_gpios_class);
++    class_unregister(&simpad_gpios_class);
 +}
 +
 +module_init(simpad_gpios_class_init);
 +module_exit(simpad_gpios_class_exit);
-+                                                                                
-+MODULE_DESCRIPTION("CS3_latch driver");
++
 +MODULE_AUTHOR("Bernhard Guillon");
++MODULE_DESCRIPTION("CS3_latch driver");
 +MODULE_LICENSE("GPL");
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-net-shared-irq.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-net-shared-irq.patch
new file mode 100644
index 0000000000..e925781ccd
--- /dev/null
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-net-shared-irq.patch
@@ -0,0 +1,63 @@
+diff -uNr linux-2.6.21.vanilla/drivers/net/pcmcia/pcnet_cs.c linux-2.6.21/drivers/net/pcmcia/pcnet_cs.c
+--- linux-2.6.21.vanilla/drivers/net/pcmcia/pcnet_cs.c	2007-05-29 21:35:00.000000000 +0200
++++ linux-2.6.21/drivers/net/pcmcia/pcnet_cs.c	2007-05-30 17:51:21.000000000 +0200
+@@ -26,6 +26,8 @@
+     CCAE support.  Drivers merged back together, and shared-memory
+     Socket EA support added, by Ken Raeburn, September 1995.
+ 
++    mrdata: -added shared irq
++
+ ======================================================================*/
+ 
+ #include <linux/kernel.h>
+@@ -254,7 +256,7 @@
+     info->p_dev = link;
+     link->priv = dev;
+ 
+-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
++    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
+     link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+     link->conf.Attributes = CONF_ENABLE_IRQ;
+     link->conf.IntType = INT_MEMORY_AND_IO;
+diff -uNr linux-2.6.21.vanilla/drivers/net/wireless/hostap/hostap_cs.c linux-2.6.21/drivers/net/wireless/hostap/hostap_cs.c
+--- linux-2.6.21.vanilla/drivers/net/wireless/hostap/hostap_cs.c	2007-05-29 21:35:00.000000000 +0200
++++ linux-2.6.21/drivers/net/wireless/hostap/hostap_cs.c	2007-05-30 17:53:20.000000000 +0200
+@@ -1,3 +1,8 @@
++/*
++ *
++ * mrdata: -added shared irq
++ */
++
+ #define PRISM2_PCCARD
+ 
+ #include <linux/module.h>
+@@ -695,7 +700,7 @@
+ 	 * irq structure is initialized.
+ 	 */
+ 	if (link->conf.Attributes & CONF_ENABLE_IRQ) {
+-		link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
++		link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_FIRST_SHARED | IRQ_HANDLE_PRESENT;
+ 		link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+ 		link->irq.Handler = prism2_interrupt;
+ 		link->irq.Instance = dev;
+diff -uNr linux-2.6.21.vanilla/drivers/net/wireless/orinoco_cs.c linux-2.6.21/drivers/net/wireless/orinoco_cs.c
+--- linux-2.6.21.vanilla/drivers/net/wireless/orinoco_cs.c	2007-05-29 21:35:00.000000000 +0200
++++ linux-2.6.21/drivers/net/wireless/orinoco_cs.c	2007-05-30 17:52:19.000000000 +0200
+@@ -8,6 +8,8 @@
+  * cards such as the 3Com AirConnect and Ericsson WLAN.
+  * 
+  * Copyright notice & release notes in file orinoco.c
++ *
++ * mrdata: added shared irq
+  */
+ 
+ #define DRIVER_NAME "orinoco_cs"
+@@ -120,7 +122,7 @@
+ 	link->priv = dev;
+ 
+ 	/* Interrupt setup */
+-	link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
++	link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_FIRST_SHARED | IRQ_HANDLE_PRESENT;
+ 	link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+ 	link->irq.Handler = orinoco_interrupt;
+ 	link->irq.Instance = dev; 
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-pcmcia.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-pcmcia.patch
new file mode 100644
index 0000000000..6ff5e37dcf
--- /dev/null
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-pcmcia.patch
@@ -0,0 +1,162 @@
+diff -uNr linux-2.6.21.vanilla/drivers/pcmcia/cs.c linux-2.6.21/drivers/pcmcia/cs.c
+--- linux-2.6.21.vanilla/drivers/pcmcia/cs.c	2007-05-30 18:00:30.000000000 +0200
++++ linux-2.6.21/drivers/pcmcia/cs.c	2007-05-30 18:10:20.000000000 +0200
+@@ -10,6 +10,8 @@
+  * are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
+  *
+  * (C) 1999		David A. Hinds
++ *
++ * mrdata: -added suspend fix
+  */
+ 
+ #include <linux/module.h>
+@@ -60,6 +62,10 @@
+ INT_MODULE_PARM(unreset_delay,	10);		/* centiseconds */
+ INT_MODULE_PARM(unreset_check,	10);		/* centiseconds */
+ INT_MODULE_PARM(unreset_limit,	30);		/* unreset_check's */
++// INT_MODULE_PARM(unreset_delay,	20);		/* centiseconds */
++// INT_MODULE_PARM(unreset_check,	100);		/* centiseconds */
++// INT_MODULE_PARM(unreset_limit,	300);		/* unreset_check's */
++
+ 
+ /* Access speed for attribute memory windows */
+ INT_MODULE_PARM(cis_speed,	300);		/* ns */
+@@ -365,6 +371,7 @@
+ 	skt->ops->set_socket(skt, &skt->socket);
+ 
+ 	msleep(unreset_delay * 10);
++	
+ 	for (i = 0; i < unreset_limit; i++) {
+ 		skt->ops->get_status(skt, &status);
+ 
+@@ -430,7 +437,7 @@
+ 
+ 	msleep(initial_delay * 10);
+ 
+-	for (i = 0; i < 100; i++) {
++	for (i = 0; i < 100; i++) {	
+ 		skt->ops->get_status(skt, &status);
+ 		if (!(status & SS_DETECT))
+ 			return CS_NO_CARD;
+diff -uNr linux-2.6.21.vanilla/drivers/pcmcia/sa1100_generic.c linux-2.6.21/drivers/pcmcia/sa1100_generic.c
+--- linux-2.6.21.vanilla/drivers/pcmcia/sa1100_generic.c	2007-05-30 18:00:30.000000000 +0200
++++ linux-2.6.21/drivers/pcmcia/sa1100_generic.c	2007-05-30 18:00:40.000000000 +0200
+@@ -28,6 +28,9 @@
+     the provisions above, a recipient may use your version of this
+     file under either the MPL or the GPL.
+     
++    2007 mrnice: added thesings changes from device_driver
++            to platform_driver - many thx to thesing
++
+ ======================================================================*/
+ 
+ #include <linux/module.h>
+@@ -81,13 +84,15 @@
+ 	return ret;
+ }
+ 
+-static struct device_driver sa11x0_pcmcia_driver = {
+-	.probe		= sa11x0_drv_pcmcia_probe,
+-	.remove		= soc_common_drv_pcmcia_remove,
+-	.name		= "sa11x0-pcmcia",
+-	.bus		= &platform_bus_type,
+-	.suspend 	= pcmcia_socket_dev_suspend,
+-	.resume 	= pcmcia_socket_dev_resume,
++static struct platform_driver sa11x0_pcmcia_driver = {
++       .driver        = {
++              .name   = "sa11x0-pcmcia",
++              .probe = sa11x0_drv_pcmcia_probe,
++              .remove        = soc_common_drv_pcmcia_remove,
++              .suspend= pcmcia_socket_dev_suspend,
++              .resume        = pcmcia_socket_dev_resume,
++              //.bus = &platform_bus_type,
++       },
+ };
+ 
+ /* sa11x0_pcmcia_init()
+@@ -100,7 +105,7 @@
+  */
+ static int __init sa11x0_pcmcia_init(void)
+ {
+-	return driver_register(&sa11x0_pcmcia_driver);
++        return platform_driver_register(&sa11x0_pcmcia_driver);
+ }
+ 
+ /* sa11x0_pcmcia_exit()
+@@ -110,7 +115,7 @@
+  */
+ static void __exit sa11x0_pcmcia_exit(void)
+ {
+-	driver_unregister(&sa11x0_pcmcia_driver);
++        platform_driver_unregister(&sa11x0_pcmcia_driver);
+ }
+ 
+ MODULE_AUTHOR("John Dorsey <john+@cs.cmu.edu>");
+diff -uNr linux-2.6.21.vanilla/drivers/pcmcia/sa1100_simpad.c linux-2.6.21/drivers/pcmcia/sa1100_simpad.c
+--- linux-2.6.21.vanilla/drivers/pcmcia/sa1100_simpad.c	2007-05-30 18:00:30.000000000 +0200
++++ linux-2.6.21/drivers/pcmcia/sa1100_simpad.c	2007-05-30 18:08:53.000000000 +0200
+@@ -3,6 +3,8 @@
+  *
+  * PCMCIA implementation routines for simpad
+  *
++ * mrdata: -added cs3_ro stuff to get fix voltage issue 
++ *
+  */
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+@@ -14,7 +16,8 @@
+ #include <asm/irq.h>
+ #include <asm/arch/simpad.h>
+ #include "sa1100_generic.h"
+- 
++
++extern long get_cs3_ro(void); 
+ extern long get_cs3_shadow(void);
+ extern void set_cs3_bit(int value); 
+ extern void clear_cs3_bit(int value);
+@@ -25,7 +28,6 @@
+ 
+ static int simpad_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
+ {
+-
+ 	clear_cs3_bit(VCC_3V_EN|VCC_5V_EN|EN0|EN1);
+ 
+ 	skt->irq = IRQ_GPIO_CF_IRQ;
+@@ -47,21 +49,15 @@
+ 			   struct pcmcia_state *state)
+ {
+ 	unsigned long levels = GPLR;
+-	long cs3reg = get_cs3_shadow();
++	long cs3_ro_reg = get_cs3_ro();
+ 
+-	state->detect=((levels & GPIO_CF_CD)==0)?1:0;
+-	state->ready=(levels & GPIO_CF_IRQ)?1:0;
+-	state->bvd1=1; /* Not available on Simpad. */
+-	state->bvd2=1; /* Not available on Simpad. */
+-	state->wrprot=0; /* Not available on Simpad. */
+-  
+-	if((cs3reg & 0x0c) == 0x0c) {
+-		state->vs_3v=0;
+-		state->vs_Xv=0;
+-	} else {
+-		state->vs_3v=1;
+-		state->vs_Xv=0;
+-	}
++	state->detect = ((levels & GPIO_CF_CD) == 0) ? 1 : 0 ;
++	state->ready  = (levels & GPIO_CF_IRQ) ? 1 : 0 ;
++	state->bvd1   = (cs3_ro_reg & PCMCIA_BVD1) ? 1 : 0 ; /* alt: =1 Not available on Simpad. */
++	state->bvd2   = (cs3_ro_reg & PCMCIA_BVD2) ? 1 : 0 ; /* alt: =1 Not available on Simpad. */
++	state->wrprot = 0 ; /* Not available on Simpad. */  
++	state->vs_3v = (cs3_ro_reg & PCMCIA_VS1) ? 0 : 1 ;
++	state->vs_Xv = (cs3_ro_reg & PCMCIA_VS2) ? 0 : 1 ;
+ }
+ 
+ static int
+@@ -104,6 +100,7 @@
+ 
+ static void simpad_pcmcia_socket_init(struct soc_pcmcia_socket *skt)
+ {
++	clear_cs3_bit(PCMCIA_RESET);
+ 	soc_pcmcia_enable_irqs(skt, irqs, ARRAY_SIZE(irqs));
+ }
+ 
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-serial-and-gpio_keys.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-serial-gpio_keys-and-cs3-ro.patch
index 90ce4cb009..081afc8936 100644
--- a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-serial-and-gpio_keys.patch
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-serial-gpio_keys-and-cs3-ro.patch
@@ -1,7 +1,7 @@
 diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/arm/mach-sa1100/simpad.c
---- linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c	2007-05-01 16:40:44.000000000 +0200
-+++ linux-2.6.21/arch/arm/mach-sa1100/simpad.c	2007-05-01 19:23:29.000000000 +0200
-@@ -1,5 +1,14 @@
+--- linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c	2007-05-30 18:00:29.000000000 +0200
++++ linux-2.6.21/arch/arm/mach-sa1100/simpad.c	2007-05-30 18:02:15.000000000 +0200
+@@ -1,5 +1,15 @@
  /*
   * linux/arch/arm/mach-sa1100/simpad.c
 + *
@@ -10,13 +10,24 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/a
 + *                     simpad_uart_get_mctrl()
 + *            - internal RS232/DECT/Bluetooth
 + *              works again (based on 2.4 simpad-serial.patch)
++ *            - added cs3_ro
 + *
 + * 2007/04/12 Bernhard Guillon: 
 + *            -added gpio_keys (based on h3000.c from hh.org)
   */
  
  #include <linux/module.h>
-@@ -27,6 +36,8 @@
+@@ -9,6 +19,9 @@
+ #include <linux/proc_fs.h>
+ #include <linux/string.h> 
+ #include <linux/pm.h>
++
++#include <linux/apm-emulation.h>
++
+ #include <linux/platform_device.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
+@@ -27,12 +40,21 @@
  
  #include <linux/serial_core.h>
  #include <linux/ioport.h>
@@ -25,15 +36,33 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/a
  #include <asm/io.h>
  
  #include "generic.h"
-@@ -55,6 +66,7 @@
+ 
++long cs3_ro;
+ long cs3_shadow;
+ 
++long get_cs3_ro(void)
++{
++	cs3_ro = *(CS3BUSTYPE *)(CS3_BASE);
++	return cs3_ro;
++}
++
+ long get_cs3_shadow(void)
+ {
+ 	return cs3_shadow;
+@@ -55,9 +77,12 @@
  	*(CS3BUSTYPE *)(CS3_BASE) = cs3_shadow;
  }
  
++EXPORT_SYMBOL(get_cs3_ro);
 +EXPORT_SYMBOL(get_cs3_shadow);
  EXPORT_SYMBOL(set_cs3_bit);
  EXPORT_SYMBOL(clear_cs3_bit);
  
-@@ -73,23 +85,71 @@
++
+ static struct map_desc simpad_io_desc[] __initdata = {
+ 	{	/* MQ200 */
+ 		.virtual	=  0xf2800000,
+@@ -73,23 +98,71 @@
  };
  
  
@@ -117,7 +146,22 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/a
  };
  
  
-@@ -150,7 +210,7 @@
+@@ -135,7 +208,6 @@
+ };
+ 
+ 
+-
+ static void __init simpad_map_io(void)
+ {
+ 	sa1100_map_io();
+@@ -144,13 +216,12 @@
+ 
+ 	set_cs3_bit (EN1 | EN0 | LED2_ON | DISPLAY_ON | RS232_ON |
+ 		      ENABLE_5V | RESET_SIMCARD | DECT_POWER_ON);
+-
+-
++		      
+         sa1100_register_uart_fns(&simpad_port_fns);
  	sa1100_register_uart(0, 3);  /* serial interface */
  	sa1100_register_uart(1, 1);  /* DECT             */
  
@@ -126,8 +170,19 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/a
  	GAFR |= GPIO_UART_TXD | GPIO_UART_RXD;
  	GPDR |= GPIO_UART_TXD | GPIO_LDD13 | GPIO_LDD15;
  	GPDR &= ~GPIO_UART_RXD;
-@@ -173,7 +233,7 @@
+@@ -160,7 +231,6 @@
+ 	 * Set up registers for sleep mode.
+ 	 */
+ 
+-
+ 	PWER = PWER_GPIO0| PWER_RTC;
+ 	PGSR = 0x818;
+ 	PCFR = 0;
+@@ -171,9 +241,10 @@
+ 	sa11x0_set_mcp_data(&simpad_mcp_data);
+ }
  
++
  static void simpad_power_off(void)
  {
 -	local_irq_disable(); // was cli
@@ -135,15 +190,20 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/a
  	set_cs3(0x800);        /* only SD_MEDIAQ */
  
  	/* disable internal oscillator, float CS lines */
-@@ -197,19 +257,42 @@
+@@ -191,31 +262,52 @@
+ 	while(1);
  
+ 	local_irq_enable(); /* we won't ever call it */
++}
  
- /*
+ 
+-}
++/*
 + * gpio_keys
 +*/
 +
 +static struct gpio_keys_button simpad_button_table[] = {
-+	{ KEY_POWER, IRQ_GPIO_POWER_BUTTON, 0, "power button" },
++	{ KEY_POWER, IRQ_GPIO_POWER_BUTTON, 1, "power button" },
 +};
 +
 +static struct gpio_keys_platform_data simpad_keys_data = {
@@ -157,9 +217,9 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/a
 +		.platform_data = &simpad_keys_data,
 +	},
 +};
-+
-+
-+/*
+ 
+ 
+ /*
   * MediaQ Video Device
   */
 +
@@ -172,7 +232,7 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/a
  static struct platform_device *devices[] __initdata = {
 -	&simpad_mq200fb
 +	&simpad_keys,
-+    &simpad_mq200fb,
++	&simpad_mq200fb,
  };
  
  
@@ -180,10 +240,17 @@ diff -uNr linux-2.6.21.vanilla/arch/arm/mach-sa1100/simpad.c linux-2.6.21/arch/a
  static int __init simpad_init(void)
  {
  	int ret;
+ 
+ 	pm_power_off = simpad_power_off;
+-
++	
+ 	ret = platform_add_devices(devices, ARRAY_SIZE(devices));
+ 	if(ret)
+ 		printk(KERN_WARNING "simpad: Unable to register mq200 framebuffer device");
 diff -uNr linux-2.6.21.vanilla/include/asm-arm/arch-sa1100/simpad.h linux-2.6.21/include/asm-arm/arch-sa1100/simpad.h
---- linux-2.6.21.vanilla/include/asm-arm/arch-sa1100/simpad.h	2007-05-01 16:40:51.000000000 +0200
-+++ linux-2.6.21/include/asm-arm/arch-sa1100/simpad.h	2007-05-01 19:22:45.000000000 +0200
-@@ -12,7 +12,7 @@
+--- linux-2.6.21.vanilla/include/asm-arm/arch-sa1100/simpad.h	2007-05-30 18:00:30.000000000 +0200
++++ linux-2.6.21/include/asm-arm/arch-sa1100/simpad.h	2007-05-30 18:02:56.000000000 +0200
+@@ -12,11 +12,12 @@
  #define __ASM_ARCH_SIMPAD_H
  
  
@@ -192,3 +259,74 @@ diff -uNr linux-2.6.21.vanilla/include/asm-arm/arch-sa1100/simpad.h linux-2.6.21
  #define GPIO_UART1_DTR	GPIO_GPIO7
  #define GPIO_UART1_CTS	GPIO_GPIO8
  #define GPIO_UART1_DCD	GPIO_GPIO23
+ #define GPIO_UART1_DSR	GPIO_GPIO6
++#define GPIO_UART1_RI	GPIO_GPIO19
+ 
+ #define GPIO_UART3_RTS	GPIO_GPIO12
+ #define GPIO_UART3_DTR	GPIO_GPIO16
+@@ -48,9 +49,9 @@
+ #define GPIO_SMART_CARD		GPIO_GPIO10
+ #define IRQ_GPIO_SMARD_CARD	IRQ_GPIO10
+ 
+-// CS3 Latch is write only, a shadow is necessary
++// CS3 Latch is write only 16-bit , a shadow is necessary
+ 
+-#define CS3BUSTYPE unsigned volatile long
++#define CS3BUSTYPE      unsigned volatile long
+ #define CS3_BASE        0xf1000000
+ 
+ #define VCC_5V_EN       0x0001 // For 5V PCMCIA
+@@ -70,43 +71,17 @@
+ #define ENABLE_5V       0x4000 // Enable 5V circuit
+ #define RESET_SIMCARD   0x8000
+ 
+-#define RS232_ENABLE    0x0440
+-#define PCMCIAMASK      0x402f
++// CS3 Latch is readable only 8-bit interest
+ 
++#define PCMCIA_BVD1     0x0001
++#define PCMCIA_BVD2     0x0002
++#define PCMCIA_VS1      0x0004   // PCMCIA card voltage select
++#define PCMCIA_VS2      0x0008   // PCMCIA card voltage select, if both are in high state -> 5V PCMCIA card
++#define LOCK_IND        0x0010
++#define CHARGING_STATE  0x0020   // Ladestatus
++#define PCMCIA_SHORT    0x0040   // low active
+ 
+-struct simpad_battery {
+-	unsigned char ac_status;	/* line connected yes/no */
+-	unsigned char status;		/* battery loading yes/no */
+-	unsigned char percentage;	/* percentage loaded */
+-	unsigned short life;		/* life till empty */
+-};
+-
+-/* These should match the apm_bios.h definitions */
+-#define SIMPAD_AC_STATUS_AC_OFFLINE      0x00
+-#define SIMPAD_AC_STATUS_AC_ONLINE       0x01
+-#define SIMPAD_AC_STATUS_AC_BACKUP       0x02   /* What does this mean? */
+-#define SIMPAD_AC_STATUS_AC_UNKNOWN      0xff
+-
+-/* These bitfields are rarely "or'd" together */
+-#define SIMPAD_BATT_STATUS_HIGH          0x01
+-#define SIMPAD_BATT_STATUS_LOW           0x02
+-#define SIMPAD_BATT_STATUS_CRITICAL      0x04
+-#define SIMPAD_BATT_STATUS_CHARGING      0x08
+-#define SIMPAD_BATT_STATUS_CHARGE_MAIN   0x10
+-#define SIMPAD_BATT_STATUS_DEAD          0x20   /* Battery will not charge */
+-#define SIMPAD_BATT_NOT_INSTALLED        0x20   /* For expansion pack batteries */
+-#define SIMPAD_BATT_STATUS_FULL          0x40   /* Battery fully charged (and connected to AC) */
+-#define SIMPAD_BATT_STATUS_NOBATT        0x80
+-#define SIMPAD_BATT_STATUS_UNKNOWN       0xff
+-
+-extern int simpad_get_battery(struct simpad_battery* );
++#define RS232_ENABLE    0x0440
++#define PCMCIAMASK      0x402f
+ 
+ #endif // __ASM_ARCH_SIMPAD_H
+-
+-
+-
+-
+-
+-
+-
+-
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-ucb1x00-switches.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-ucb1x00-switches.patch
index ff2f50566c..552bb8b223 100644
--- a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-ucb1x00-switches.patch
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-ucb1x00-switches.patch
@@ -1,6 +1,6 @@
 diff -uNr linux-2.6.21.vanilla/drivers/mfd/Kconfig linux-2.6.21/drivers/mfd/Kconfig
---- linux-2.6.21.vanilla/drivers/mfd/Kconfig	2007-05-01 16:40:45.000000000 +0200
-+++ linux-2.6.21/drivers/mfd/Kconfig	2007-05-01 16:55:38.000000000 +0200
+--- linux-2.6.21.vanilla/drivers/mfd/Kconfig	2007-04-26 05:08:32.000000000 +0200
++++ linux-2.6.21/drivers/mfd/Kconfig	2007-05-29 12:56:32.000000000 +0200
 @@ -37,4 +37,7 @@
  	tristate "Touchscreen interface support"
  	depends on MCP_UCB1200 && INPUT
@@ -10,8 +10,8 @@ diff -uNr linux-2.6.21.vanilla/drivers/mfd/Kconfig linux-2.6.21/drivers/mfd/Kcon
 +        depends on MCP_UCB1200 && INPUT
  endmenu
 diff -uNr linux-2.6.21.vanilla/drivers/mfd/Makefile linux-2.6.21/drivers/mfd/Makefile
---- linux-2.6.21.vanilla/drivers/mfd/Makefile	2007-05-01 16:40:45.000000000 +0200
-+++ linux-2.6.21/drivers/mfd/Makefile	2007-05-01 16:55:38.000000000 +0200
+--- linux-2.6.21.vanilla/drivers/mfd/Makefile	2007-04-26 05:08:32.000000000 +0200
++++ linux-2.6.21/drivers/mfd/Makefile	2007-05-29 12:56:32.000000000 +0200
 @@ -8,7 +8,7 @@
  obj-$(CONFIG_MCP_SA11X0)	+= mcp-sa11x0.o
  obj-$(CONFIG_MCP_UCB1200)	+= ucb1x00-core.o
@@ -21,10 +21,10 @@ diff -uNr linux-2.6.21.vanilla/drivers/mfd/Makefile linux-2.6.21/drivers/mfd/Mak
  ifeq ($(CONFIG_SA1100_ASSABET),y)
  obj-$(CONFIG_MCP_UCB1200)	+= ucb1x00-assabet.o
  endif
-diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-switches.c linux-2.6.21/drivers/mfd/ucb1x00-switches.c
---- linux-2.6.21.vanilla/drivers/mfd/ucb1x00-switches.c	1970-01-01 01:00:00.000000000 +0100
-+++ linux-2.6.21/drivers/mfd/ucb1x00-switches.c	2007-05-01 16:55:38.000000000 +0200
-@@ -0,0 +1,162 @@
+diff -Naur linux-2.6.21/drivers/mfd.old/ucb1x00-switches.c linux-2.6.21/drivers/mfd/ucb1x00-switches.c
+--- linux-2.6.21/drivers/mfd/ucb1x00-switches.c	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.21/drivers/mfd/ucb1x00-switches.c	2007-07-04 23:59:39.000000000 +0200
+@@ -0,0 +1,332 @@
 +/*
 + *  linux/drivers/mfd/ucb1x00-switches.c
 + *
@@ -42,48 +42,166 @@ diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-switches.c linux-2.6.21/drive
 + *  This driver is based on the 2.4 ucb1x00-switches, the 2.6 ucb1x00-assabet
 + *  and the ucb1x00-ts driver.
 + *
++ *  2007/06/21 mrdata:
++ *             - create new thread kswd() to handle irq_events for ucb1300-gpio's
++ *             - found out, that not every key-press or key-release
++ *               generate a irq_event
++ *               -> establish key_state handling 
++ *                  key_state, key_state_last <-> KEY_PRESS, KEY_RELEASE
++ *               -> after irq_event polling the ucb1300-gpio's till all keys
++ *                  in key_state = KEY_RELEASE 
++ *
 + */
 +#include <linux/module.h>
 +#include <linux/init.h>
 +#include <linux/input.h>
 +#include <linux/device.h>
++#include <linux/sched.h>
++#include <linux/freezer.h>
++#include <linux/kthread.h>
 +
 +#include <asm/dma.h>
 +
 +#include "ucb1x00.h"
 +
++#define KEY_PRESS 1
++#define KEY_RELEASE 0
++
 +static int key [6] = { KEY_PROG1,KEY_PROG2,KEY_UP,KEY_DOWN,KEY_LEFT,KEY_RIGHT };
 +
++static unsigned short int key_state [6] = { 0, 0, 0, 0, 0, 0};
++static unsigned short int key_state_last [6] = { 1, 1, 1, 1, 1, 1};
++
 +struct ucb1x00_switches {
 +	struct input_dev	*idev;
 +	struct ucb1x00		*ucb;
++	
++	wait_queue_head_t	irq_wait;
++	struct task_struct	*rtask;
++	
++	int 			idx;
++		
++	unsigned int		valid:1;
 +};
 +
-+static void ucb1x00_dev_irq(int idx, void *id)
++static int ucb1x00_thread(void *_switches_id)
 +{
-+	static unsigned short int last;
-+	unsigned short int this;	
-+	struct ucb1x00_switches *switches = id;
++	unsigned short int this;
++	int idx_tmp;
++	int i;
++	struct ucb1x00_switches *switches = _switches_id;
 +	struct input_dev *idev = switches->idev;
++	struct task_struct *tsk = current;
++	DECLARE_WAITQUEUE(wait, tsk);
 +	
-+	ucb1x00_enable(switches->ucb);
++	add_wait_queue(&switches->irq_wait, &wait);
 +	
-+	this=~ucb1x00_io_read(switches->ucb);
-+	if (this==last) {
-+		 return;
-+	}
++	while (!kthread_should_stop())
++	{
++		signed long timeout;
++
++		if ((switches->idx >= 0) && (switches->idx <= 5) && (switches->valid == 1))
++		{
++			switches->valid = 0;
++						
++			idx_tmp = switches->idx;
++			
++			ucb1x00_enable(switches->ucb);
++	
++			this = ~ucb1x00_io_read(switches->ucb);
 +
-+	last=this;
++			ucb1x00_disable(switches->ucb);
++					
++			if (key_state[idx_tmp] == KEY_RELEASE)
++			{
++				key_state_last[idx_tmp] = KEY_RELEASE;
++				key_state[idx_tmp] = KEY_PRESS;
 +	
-+	if ((idx >=0) && (idx <=5)) {
-+		if ((this & (1<<idx)) != 0) input_report_key(idev, key[idx], 1);
-+			else input_report_key(idev, key[idx], 0);
++				input_report_key(idev, key[idx_tmp], KEY_PRESS);
++				input_sync(idev);							
++			}
++			
++			for (i = 0; i < 6; i++)
++			{
++				if ((key_state[i] == KEY_RELEASE) && (((this & (1 << i)) ? 1 : 0) == KEY_PRESS))
++				{
++					key_state_last[i] = KEY_RELEASE;
++					key_state[i] = KEY_PRESS;
++							
++					input_report_key(idev, key[i], KEY_PRESS);
++					input_sync(idev);
++				}
++			}
++										
++			for(;;)
++			{			    
++				ucb1x00_enable(switches->ucb);
++				this = ~ucb1x00_io_read(switches->ucb);
++				ucb1x00_disable(switches->ucb);
++															
++				for (i = 0; i < 6; i++)
++				{						
++					if ((key_state[i] == KEY_PRESS) && (((this & (1 << i)) ? 1 : 0) == KEY_RELEASE))
++					{
++						key_state_last[i] = KEY_PRESS;
++						key_state[i] = KEY_RELEASE;
++							
++						input_report_key(idev, key[i], KEY_RELEASE);
++						input_sync(idev);
++					}
++						
++					if ((key_state[i] == KEY_RELEASE) && (((this & (1 << i)) ? 1 : 0) == KEY_PRESS))
++					{
++						key_state_last[i] = KEY_RELEASE;
++						key_state[i] = KEY_PRESS;
++							
++						input_report_key(idev, key[i], KEY_PRESS);
++						input_sync(idev);
++					}
++						
++				}
++				
++				// left loop, if no key press detect	
++				if ((this | 0xff80) == 0xff80)
++				{
++					break;
++				}
++											
++				set_task_state(tsk, TASK_INTERRUPTIBLE);
++					
++				try_to_freeze();
++					
++				timeout = HZ / 100;
++					
++				schedule_timeout(timeout);
++			}					
++		}
++				
++		set_task_state(tsk, TASK_INTERRUPTIBLE);
++		
++		try_to_freeze();
++		
++		timeout = MAX_SCHEDULE_TIMEOUT;
++		
++		schedule_timeout(timeout);
 +	}
-+	else {
-+		printk(KERN_DEBUG "switches-ucb1x00 is BUGGY!!! \n");
-+		return;
-+	}	
 +	
++	remove_wait_queue(&switches->irq_wait, &wait);
++	
++	switches->rtask = NULL;
++	
++	return 0;
++}
++
++
++static void ucb1x00_dev_irq(int idx, void *id)
++{
++	struct ucb1x00_switches *switches = id;
++
++	switches->idx = idx;
++	switches->valid = 1;	
++	
++	wake_up(&switches->irq_wait);
 +}
 +
 +static int ucb1x00_switches_add(struct ucb1x00_dev *dev)
@@ -121,6 +239,10 @@ diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-switches.c linux-2.6.21/drive
 +	switches->idev = idev;
 +	dev->priv = switches;
 +	
++	BUG_ON(switches->rtask);
++	
++	init_waitqueue_head(&switches->irq_wait);
++	
 +	ucb1x00_enable(switches->ucb);
 +
 +	ucb1x00_io_set_dir(switches->ucb,
@@ -132,14 +254,37 @@ diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-switches.c linux-2.6.21/drive
 +	
 +	for (i = 0; i < 6; ++i) {
 +		ucb1x00_enable_irq(switches->ucb, i, UCB_RISING | UCB_FALLING);
++
 +		if (ucb1x00_hook_irq(switches->ucb, i, ucb1x00_dev_irq, switches) < 0) {
 +			printk(KERN_ERR "unable to hook IRQ for "
 +			       "UCB1300 SWITCH_%d\n", i);
 +			return -EBUSY;
 +		}
 +	}
++	
++	switches->rtask = kthread_run(ucb1x00_thread, switches, "kswd");
++	if (!IS_ERR(switches->rtask))
++	{
++	    return 0;
++	}
++	else
++	{
++		input_unregister_device(switches->idev);
 +		
-+	return 0;
++		for (i = 5; i >= 0; --i) {
++			ucb1x00_disable_irq(switches->ucb, i, UCB_RISING | UCB_FALLING);
++
++			/* Only error conditions are ENOENT and EINVAL; silently
++			 * ignore:
++			 */
++			ucb1x00_free_irq(switches->ucb, i, NULL);
++		}
++		switches->rtask = NULL;
++		ucb1x00_disable(switches->ucb);
++		kfree(switches);
++		
++		return -EFAULT;
++	}
 +
 +fail:
 +	input_free_device(idev);
@@ -152,6 +297,12 @@ diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-switches.c linux-2.6.21/drive
 +{
 +	int i;
 +	struct ucb1x00_switches *switches = dev->priv;
++	
++	if (switches->rtask)
++		kthread_stop(switches->rtask);
++		
++	switches->rtask = NULL;
++		
 +	input_unregister_device(switches->idev);
 +		
 +	for (i = 5; i >= 0; --i) {
@@ -166,9 +317,28 @@ diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-switches.c linux-2.6.21/drive
 +	kfree(switches);
 +}
 +
++#ifdef CONFIG_PM
++static int ucb1x00_switches_resume(struct ucb1x00_dev *dev)
++{
++	struct ucb1x00_switches *switches = dev->priv;
++	
++	if (switches->rtask != NULL)
++	{
++		switches->valid = 0;
++		wake_up(&switches->irq_wait);
++		
++		printk(KERN_DEBUG "ucb1x00-switches.c -> _switches_resume() kswd - restart *DONE*\n");
++	}
++	return 0;
++}
++#else
++#define ucb1x00_switches_resume NULL
++#endif
++
 +static struct ucb1x00_driver ucb1x00_switches_driver = {
 +	.add	= ucb1x00_switches_add,
 +	.remove	= ucb1x00_switches_remove,
++	.resume = ucb1x00_switches_resume,
 +};
 +
 +static int __init ucb1x00_switches_init(void)
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-ucb1x00-ts-supend-and-accuracy.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-ucb1x00-ts-supend-and-accuracy.patch
new file mode 100644
index 0000000000..8c2c89235f
--- /dev/null
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-ucb1x00-ts-supend-and-accuracy.patch
@@ -0,0 +1,121 @@
+diff -uNr linux-2.6.21.vanilla/drivers/mfd/ucb1x00-ts.c linux-2.6.21/drivers/mfd/ucb1x00-ts.c
+--- linux-2.6.21.vanilla/drivers/mfd/ucb1x00-ts.c	2007-05-30 18:00:30.000000000 +0200
++++ linux-2.6.21/drivers/mfd/ucb1x00-ts.c	2007-05-30 18:14:42.000000000 +0200
+@@ -16,6 +16,10 @@
+  * It is important to note that the signal connected to the ADCSYNC
+  * pin should provide pulses even when the LCD is blanked, otherwise
+  * a pen touch needed to unblank the LCD will never be read.
++ *
++ * mrdata: -added some accuracy improvement based on thesings collie patch
++ *         -added suspend fix 
++ *
+  */
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+@@ -105,6 +109,8 @@
+ 				  UCB_TS_CR_TSMY_GND | UCB_TS_CR_TSPY_GND |
+ 				  UCB_TS_CR_MODE_PRES | UCB_TS_CR_BIAS_ENA);
+ 
++		udelay(55);
++
+ 		return ucb1x00_adc_read(ts->ucb, UCB_ADC_INP_TSPY, ts->adcsync);
+ 	}
+ }
+@@ -131,7 +137,7 @@
+ 			UCB_TS_CR_TSMX_GND | UCB_TS_CR_TSPX_POW |
+ 			UCB_TS_CR_MODE_POS | UCB_TS_CR_BIAS_ENA);
+ 
+-	udelay(55);
++	udelay(165);
+ 
+ 	return ucb1x00_adc_read(ts->ucb, UCB_ADC_INP_TSPY, ts->adcsync);
+ }
+@@ -159,7 +165,7 @@
+ 			UCB_TS_CR_TSMY_GND | UCB_TS_CR_TSPY_POW |
+ 			UCB_TS_CR_MODE_POS | UCB_TS_CR_BIAS_ENA);
+ 
+-	udelay(55);
++	udelay(165);
+ 
+ 	return ucb1x00_adc_read(ts->ucb, UCB_ADC_INP_TSPX, ts->adcsync);
+ }
+@@ -225,13 +231,17 @@
+ 		signed long timeout;
+ 
+ 		ts->restart = 0;
+-
++		
+ 		ucb1x00_adc_enable(ts->ucb);
+ 
+ 		x = ucb1x00_ts_read_xpos(ts);
++		ucb1x00_adc_disable(ts->ucb);		
++		ucb1x00_adc_enable(ts->ucb);
+ 		y = ucb1x00_ts_read_ypos(ts);
++		ucb1x00_adc_disable(ts->ucb);		
++		ucb1x00_adc_enable(ts->ucb);		
+ 		p = ucb1x00_ts_read_pressure(ts);
+-
++		
+ 		/*
+ 		 * Switch back to interrupt mode.
+ 		 */
+@@ -240,15 +250,19 @@
+ 
+ 		msleep(10);
+ 
++		if ((x < 60) || (y < 60)) {
++			p = 0;
++		} 
++		
+ 		ucb1x00_enable(ts->ucb);
+ 
+-
+ 		if (ucb1x00_ts_pen_down(ts)) {
++		
+ 			set_task_state(tsk, TASK_INTERRUPTIBLE);
+ 
+ 			ucb1x00_enable_irq(ts->ucb, UCB_IRQ_TSPX, machine_is_collie() ? UCB_RISING : UCB_FALLING);
+ 			ucb1x00_disable(ts->ucb);
+-
++			
+ 			/*
+ 			 * If we spat out a valid sample set last time,
+ 			 * spit out a "pen off" sample here.
+@@ -259,7 +273,9 @@
+ 			}
+ 
+ 			timeout = MAX_SCHEDULE_TIMEOUT;
++			
+ 		} else {
++		
+ 			ucb1x00_disable(ts->ucb);
+ 
+ 			/*
+@@ -278,6 +294,14 @@
+ 
+ 		try_to_freeze();
+ 
++		/*
++		 * While suspend the ktsd-thread goes sleep -> try_to_freeze()
++		 * While resume the ktsd-thread do wakup and must rune one time
++		 * again to do a clean re-setup -> enable_irq: UCB_IRQ_TSPX
++		 */		
++		if(ts->restart)
++			timeout = HZ / 100;
++		
+ 		schedule_timeout(timeout);
+ 	}
+ 
+@@ -360,8 +384,12 @@
+ 		 * TS interrupt mode is set up again
+ 		 * after sleep.
+ 		 */
++
+ 		ts->restart = 1;
+ 		wake_up(&ts->irq_wait);
++				
++		printk(KERN_INFO "ucb1x00-ts.c -> ucb1x00_ts_resume() ktsd - restart *DONE*\n");
++				
+ 	}
+ 	return 0;
+ }
diff --git a/packages/linux/linux/simpad/linux-2.6.21-SIMpad-usb-gadget.patch b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-usb-gadget.patch
new file mode 100644
index 0000000000..00d062bd7d
--- /dev/null
+++ b/packages/linux/linux/simpad/linux-2.6.21-SIMpad-usb-gadget.patch
@@ -0,0 +1,3329 @@
+diff -uNr linux-2.6.21.vanilla/drivers/usb/gadget/Kconfig linux-2.6.21/drivers/usb/gadget/Kconfig
+--- linux-2.6.21.vanilla/drivers/usb/gadget/Kconfig	2007-04-26 05:08:32.000000000 +0200
++++ linux-2.6.21/drivers/usb/gadget/Kconfig	2007-06-05 11:58:28.000000000 +0200
+@@ -205,6 +205,21 @@
+ 	depends on USB_GADGET_AT91
+ 	default USB_GADGET
+ 
++config USB_GADGET_SA1100
++	boolean "SA1100 USB Device Port"
++	depends on ARCH_SA1100
++	select USB_GADGET_SELECTED
++	help
++
++	   Say "y" to link the driver statically, or "m" to build a
++	   dynamically linked module called "sa1100_udc" and force all
++	   gadget drivers to also be dynamically linked.
++
++config USB_SA1100
++	tristate
++	depends on USB_GADGET_SA1100
++	default USB_GADGET
++	
+ config USB_GADGET_DUMMY_HCD
+ 	boolean "Dummy HCD (DEVELOPMENT)"
+ 	depends on (USB=y || (USB=m && USB_GADGET=m)) && EXPERIMENTAL
+diff -uNr linux-2.6.21.vanilla/drivers/usb/gadget/Makefile linux-2.6.21/drivers/usb/gadget/Makefile
+--- linux-2.6.21.vanilla/drivers/usb/gadget/Makefile	2007-04-26 05:08:32.000000000 +0200
++++ linux-2.6.21/drivers/usb/gadget/Makefile	2007-06-05 11:58:28.000000000 +0200
+@@ -8,6 +8,7 @@
+ obj-$(CONFIG_USB_OMAP)		+= omap_udc.o
+ obj-$(CONFIG_USB_LH7A40X)	+= lh7a40x_udc.o
+ obj-$(CONFIG_USB_AT91)		+= at91_udc.o
++obj-$(CONFIG_USB_SA1100)	+= sa1100_udc.o
+ 
+ #
+ # USB gadget drivers
+diff -uNr linux-2.6.21.vanilla/drivers/usb/gadget/ether.c linux-2.6.21/drivers/usb/gadget/ether.c
+--- linux-2.6.21.vanilla/drivers/usb/gadget/ether.c	2007-04-26 05:08:32.000000000 +0200
++++ linux-2.6.21/drivers/usb/gadget/ether.c	2007-06-05 11:59:24.000000000 +0200
+@@ -1456,7 +1456,7 @@
+ 			goto done_set_intf;
+ 		}
+ 
+-#ifdef DEV_CONFIG_CDC
++//#ifdef DEV_CONFIG_CDC
+ 		switch (wIndex) {
+ 		case 0:		/* control/master intf */
+ 			if (wValue != 0)
+@@ -1498,12 +1498,12 @@
+ 			value = 0;
+ 			break;
+ 		}
+-#else
++//#else
+ 		/* FIXME this is wrong, as is the assumption that
+ 		 * all non-PXA hardware talks real CDC ...
+ 		 */
+-		dev_warn (&gadget->dev, "set_interface ignored!\n");
+-#endif /* DEV_CONFIG_CDC */
++//		dev_warn (&gadget->dev, "set_interface ignored!\n");
++//#endif /* DEV_CONFIG_CDC */
+ 
+ done_set_intf:
+ 		spin_unlock (&dev->lock);
+diff -uNr linux-2.6.21.vanilla/drivers/usb/gadget/sa1100_udc.c linux-2.6.21/drivers/usb/gadget/sa1100_udc.c
+--- linux-2.6.21.vanilla/drivers/usb/gadget/sa1100_udc.c	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.21/drivers/usb/gadget/sa1100_udc.c	2007-06-05 11:58:29.000000000 +0200
+@@ -0,0 +1,2591 @@
++/*
++ * SA1100 USB Device Controller (UDC) driver.
++ *
++ * Copyright (C) Compaq Computer Corporation, 1998, 1999
++ * Copyright (C) Extenex Corporation, 2001
++ * Copyright (C) David Brownell, 2003
++ * Copyright (C) Nick Bane, 2005, 2006
++ *   Many fragments from pxa2xx_udc.c and mach-sa1100 driver with various 
++ *   GPL Copyright authors incl Russel king and Nicolas Pitre
++ *   Port to 2.6.12 by N C Bane
++ *
++ * This file provides interrupt routing and overall coordination for the
++ * sa1100 USB endpoints: ep0, ep1out-bulk, ep2out-bulk, as well as device
++ * initialization and some parts of USB "Chapter 9" device behavior.
++ *
++ * It implements the "USB gadget controller" API, abstracting most hardware
++ * details so that drivers running on top of this API are mostly independent
++ * of hardware.  A key exception is that ep0 logic needs to understand which
++ * endpoints a given controller has, and their capabilities.  Also, hardware
++ * that doesn't fully support USB (like sa1100) may need workarounds in the
++ * protocols implemented by device functions.
++ *
++ * See linux/Documentation/arm/SA1100/SA1100_USB for more info, or the
++ * kerneldoc for the API exposed to gadget drivers.
++ *
++ */
++#define DEBUG	1
++#define	VERBOSE	1
++
++//#define SA1100_USB_DEBUG
++#ifdef SA1100_USB_DEBUG
++static int sa1100_usb_debug=0;
++#endif
++
++#define NCB_DMA_FIX
++#ifdef NCB_DMA_FIX
++#include <linux/slab.h>
++#define SEND_BUFFER_SIZE 4096	/* this is probably a bit big */
++#define RECEIVE_BUFFER_SIZE 256	/* 64 may be all that is necessary */
++static char *send_buffer=NULL;
++static char *receive_buffer=NULL;
++#endif
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/delay.h>
++#include <linux/ioport.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
++#include <linux/smp_lock.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/timer.h>
++#include <linux/list.h>
++#include <linux/interrupt.h>
++#include <linux/version.h>
++#include <linux/device.h>
++#include <linux/platform_device.h>
++
++#include <asm/byteorder.h>
++#include <asm/io.h>
++#include <asm/irq.h>
++#include <asm/dma.h>
++#include <asm/system.h>
++#include <asm/mach-types.h>
++#include <asm/unaligned.h>
++
++#include <linux/usb.h>

++#include <linux/usb_ch9.h>
++#include <linux/usb_gadget.h>
++
++#if CONFIG_PROC_FS

++#include <linux/proc_fs.h>
++#endif
++
++#if defined(CONFIG_SA1100_BALLOON)
++#include <asm/arch/balloon.h>
++#endif
++
++#define	DRIVER_VERSION		__DATE__
++
++#define	DMA_ADDR_INVALID (~(dma_addr_t)0)
++
++
++static const char driver_name [] = "sa1100_udc";
++static const char driver_desc [] = "SA-1110 USB Device Controller";
++
++static const char ep0name [] = "ep0";
++
++#ifdef	DEBUG
++static char *type_string (u8 bmAttributes)
++{
++	switch ( (bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
++	case USB_ENDPOINT_XFER_BULK:	return "bulk";
++	//case USB_ENDPOINT_XFER_ISOC:	return "iso";
++	case USB_ENDPOINT_XFER_INT:	return "intr";
++	};
++	return "control";
++}
++#endif
++
++#include <linux/dma-mapping.h>
++struct usb_stats_t {
++	 unsigned long ep0_fifo_write_failures;
++	 unsigned long ep0_bytes_written;
++	 unsigned long ep0_fifo_read_failures;
++	 unsigned long ep0_bytes_read;
++};
++
++struct usb_info_t
++{
++	dma_regs_t *dmaregs_tx, *dmaregs_rx;
++	int state;
++	unsigned char address;
++	struct usb_stats_t stats;
++};
++
++enum { kError=-1, kEvSuspend=0, kEvReset=1,
++	   kEvResume=2, kEvAddress=3, kEvConfig=4, kEvDeConfig=5 };
++int usbctl_next_state_on_event( int event ) {
++    return 0;
++}
++static struct usb_info_t usbd_info;
++
++/* receiver */
++void ep1_reset(void);
++void ep1_stall(void);
++int sa1100_usb_recv (struct usb_request *req, void (*callback) (int,int));
++
++/* xmitter */
++void ep2_reset(void);
++void ep2_stall(void);
++int sa1100_usb_send (struct usb_request *req, void (*callback) (int,int));
++
++/* UDC register utility functions */
++#define UDC_write(reg, val) { \
++	int i = 10000; \
++	do { \
++	  	(reg) = (val); \
++		if (i-- <= 0) { \
++			printk( "%s [%d]: write %#x to %p (%#x) failed\n", \
++				__FUNCTION__, __LINE__, (val), &(reg), (reg)); \
++			break; \
++		} \
++	} while((reg) != (val)); \
++}
++
++#define UDC_set(reg, val) { \
++	int i = 10000; \
++	do { \
++		(reg) |= (val); \
++		if (i-- <= 0) { \
++			printk( "%s [%d]: set %#x of %p (%#x) failed\n", \
++				__FUNCTION__, __LINE__, (val), &(reg), (reg)); \
++			break; \
++		} \
++	} while(!((reg) & (val))); \
++}
++
++#define UDC_clear(reg, val) { \
++	int i = 10000; \
++	do { \
++		(reg) &= ~(val); \
++		if (i-- <= 0) { \
++			printk( "%s [%d]: clear %#x of %p (%#x) failed\n", \
++				__FUNCTION__, __LINE__, (val), &(reg), (reg)); \
++			break; \
++		} \
++	} while((reg) & (val)); \
++}
++
++#define UDC_flip(reg, val) { \
++	int i = 10000; \
++	(reg) = (val); \
++	do { \
++		(reg) = (val); \
++		if (i-- <= 0) { \
++			printk( "%s [%d]: flip %#x of %p (%#x) failed\n", \
++				__FUNCTION__, __LINE__, (val), &(reg), (reg)); \
++			break; \
++		} \
++	} while(((reg) & (val))); \
++}
++
++#include "sa1100_udc.h"
++
++static struct sa1100_udc	*the_controller;
++static void nuke (struct sa1100_ep *, int status);
++static void done (struct sa1100_ep *ep, struct sa1100_request *req, int status);
++static inline void ep0_idle (struct sa1100_udc *dev)
++{
++	dev->ep0state = EP0_IDLE;
++}
++
++// ep0 handlers
++
++// 1 == lots of trace noise,  0 = only "important' stuff
++//#define VERBOSITY 1
++
++#ifndef MIN
++#define MIN( a, b ) ((a)<(b)?(a):(b))
++#endif
++
++#if 1 && !defined( ASSERT )
++#  define ASSERT(expr) \
++          if(!(expr)) { \
++          printk( "Assertion failed! %s,%s,%s,line=%d\n",\
++          #expr,__FILE__,__FUNCTION__,__LINE__); \
++          }
++#else
++#  define ASSERT(expr)
++#endif
++
++#if VERBOSITY
++#define PRINTKD(fmt, args...) printk( fmt , ## args)
++#else
++#define PRINTKD(fmt, args...)
++#endif
++
++/* USB Device Requests */
++typedef struct
++{
++    __u8 bmRequestType;
++    __u8 bRequest;
++    __u16 wValue;
++    __u16 wIndex;
++    __u16 wLength;
++} usb_dev_request_t  __attribute__ ((packed));
++
++/* other subroutines */
++unsigned int (*wrint)(void);
++void	ep0_int_hndlr( void );
++static void ep0_queue(void *buf, unsigned int req, unsigned int act);
++static void write_fifo( void );
++static int read_fifo( struct usb_ctrlrequest * p );
++
++/* some voodo helpers  01Mar01ww */
++static void set_cs_bits( __u32 set_bits );
++static void set_de( void );
++static void set_ipr( void );
++static void set_ipr_and_de( void );
++static bool clear_opr( void );
++
++/***************************************************************************
++Inline Helpers
++***************************************************************************/
++
++/* Data extraction from usb_request_t fields */
++enum { kTargetDevice=0, kTargetInterface=1, kTargetEndpoint=2 };
++static inline int request_target( __u8 b ) { return (int) ( b & 0x0F); }
++
++static inline int windex_to_ep_num( __u16 w ) { return (int) ( w & 0x000F); }
++inline int type_code_from_request( __u8 by ) { return (( by >> 4 ) & 3); }
++
++/* following is hook for self-powered flag in GET_STATUS. Some devices
++   .. might like to override and return real info */
++static inline bool self_powered_hook( void ) { return true; }
++
++#if VERBOSITY
++/* "pcs" == "print control status" */
++static inline void pcs( void )
++{
++	 __u32 foo = Ser0UDCCS0;
++	 printk( "%8.8X: %s %s %s %s\n",
++			 foo,
++			 foo & UDCCS0_SE ? "SE" : "",
++			 foo & UDCCS0_OPR ? "OPR" : "",
++			 foo & UDCCS0_IPR ? "IPR" : "",
++			 foo & UDCCS0_SST ? "SST" : ""
++	 );
++}
++static inline void preq( struct usb_ctrlrequest * pReq )
++{
++	 static char * tnames[] = { "dev", "intf", "ep", "oth" };
++	 static char * rnames[] = { "std", "class", "vendor", "???" };
++	 char * psz;
++	 switch( pReq->bRequest ) {
++	 case USB_REQ_GET_STATUS: psz = "get stat"; break;
++	 case USB_REQ_CLEAR_FEATURE: psz = "clr feat"; break;
++	 case USB_REQ_SET_FEATURE: psz = "set feat"; break;
++	 case USB_REQ_SET_ADDRESS: psz = "set addr"; break;
++	 case USB_REQ_GET_DESCRIPTOR: psz = "get desc"; break;
++	 case USB_REQ_SET_DESCRIPTOR: psz = "set desc"; break;
++	 case USB_REQ_GET_CONFIGURATION: psz = "get cfg"; break;
++	 case USB_REQ_SET_CONFIGURATION: psz = "set cfg"; break;
++	 case USB_REQ_GET_INTERFACE: psz = "get intf"; break;
++	 case USB_REQ_SET_INTERFACE: psz = "set intf"; break;
++	 default: psz = "unknown"; break;
++	 }
++	 printk( "- [%s: %s req to %s. dir=%s]\n", psz,
++			 rnames[ (pReq->bRequestType >> 5) & 3 ],
++			 tnames[ pReq->bRequestType & 3 ],
++			 ( pReq->bRequestType & 0x80 ) ? "in" : "out" );
++}
++
++static inline void usbctl_dump_request(const char *prefix, const struct usb_ctrlrequest *req)
++{
++	printk("%s: bRequestType=0x%02x bRequest=0x%02x "
++		"wValue=0x%04x wIndex=0x%04x wLength=0x%04x\n",
++		prefix, req->bRequestType, req->bRequest,
++		le16_to_cpu(req->wValue), le16_to_cpu(req->wIndex),
++		le16_to_cpu(req->wLength));
++}
++#else
++static inline void pcs( void ){}
++//static inline void preq( void ){}
++static inline void preq( void *x ){}
++static inline void usbctl_dump_request(const char *prefix, const struct usb_ctrlrequest *req) {}
++#endif
++
++/***************************************************************************
++Globals
++***************************************************************************/
++static const char pszMe[] = "usbep0: ";
++
++
++/* global write struct to keep write
++   ..state around across interrupts */
++static struct {
++		unsigned char *p;
++		int bytes_left;
++} wr;
++
++/***************************************************************************
++Public Interface
++***************************************************************************/
++
++/* reset received from HUB (or controller just went nuts and reset by itself!)
++  so udc core has been reset, track this state here  */
++void
++ep0_reset(void)
++{
++	 /* reset state machine */
++	 wr.p = NULL;
++	 wr.bytes_left = 0;
++	 usbd_info.address=0;
++// needed?  Ser0UDCAR = 0;
++}
++
++
++/* handle interrupt for endpoint zero */
++
++inline void ep0_clear_write(void) {
++	wr.p=NULL;
++	wr.bytes_left=0;
++}
++
++/* this is a config packet parser based on that from the updated HH 2.6 udc */
++static void
++ep0_read_packet( void )
++{
++	 unsigned char status_buf[2];  /* returned in GET_STATUS */
++	 struct usb_ctrlrequest req;
++	 int request_type;
++	 int n;
++	 __u32 address;
++
++	 /* reset previous count */
++	 the_controller->ep0_req_len=-1;
++
++	 /* read the setup request */
++	 n = read_fifo( &req );
++	 usbctl_dump_request("ep0_read_packet",&req);
++
++	 if ( n != sizeof( req ) ) {
++		  printk( "%ssetup begin: fifo READ ERROR wanted %d bytes got %d. "
++				  " Stalling out...\n",
++				  pszMe, sizeof( req ), n );
++		  /* force stall, serviced out */
++		  set_cs_bits( UDCCS0_FST | UDCCS0_SO  );
++		  goto sh_sb_end;
++	 }
++
++	 /* Is it a standard request? (not vendor or class request) */
++	 request_type = type_code_from_request( req.bRequestType );
++	 if ( request_type != 0 ) {
++		  printk( "%ssetup begin: unsupported bRequestType: %d ignored\n",
++				  pszMe, request_type );
++		  set_cs_bits( UDCCS0_DE | UDCCS0_SO );
++		  goto sh_sb_end;
++	 }
++
++	/* save requested reply size */
++	the_controller->ep0_req_len=le16_to_cpu(req.wLength);
++	PRINTKD("%s: request length is %d\n",__FUNCTION__,the_controller->ep0_req_len);
++
++#if VERBOSITY
++	 {
++	 unsigned char * pdb = (unsigned char *) &req;
++	 PRINTKD( "%2.2X %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X %2.2X ",
++			 pdb[0], pdb[1], pdb[2], pdb[3], pdb[4], pdb[5], pdb[6], pdb[7]
++		  );
++	 preq( &req );
++	 }
++#endif
++
++	 /* Handle it */
++	 switch( req.bRequest ) {
++
++		  /* This first bunch have no data phase */
++
++	 case USB_REQ_SET_ADDRESS:
++		  address = (__u32) (req.wValue & 0x7F);
++		  /* when SO and DE sent, UDC will enter status phase and ack,
++			 ..propagating new address to udc core. Next control transfer
++			 ..will be on the new address. You can't see the change in a
++			 ..read back of CAR until then. (about 250us later, on my box).
++			 ..The original Intel driver sets S0 and DE and code to check
++			 ..that address has propagated here. I tried this, but it
++			 ..would only work sometimes! The rest of the time it would
++			 ..never propagate and we'd spin forever. So now I just set
++			 ..it and pray...
++		  */
++		  Ser0UDCAR = address;
++		  usbd_info.address = address;
++		  usbctl_next_state_on_event( kEvAddress );
++		  set_cs_bits( UDCCS0_SO | UDCCS0_DE );  /* no data phase */
++		  printk( "%sI have been assigned address: %d\n", pszMe, address );
++		  break;
++
++
++	 case USB_REQ_SET_CONFIGURATION:
++		  if ( req.wValue == 1 ) {
++			   /* configured */
++			   if (usbctl_next_state_on_event( kEvConfig ) != kError) {
++				/* (re)set the out and in max packet sizes */
++				PRINTKD( "%s: calling the_controller.driver->setup with SET_CONFIGURATION\n", __FUNCTION__ );
++				the_controller->driver->setup(&the_controller->gadget, &req);
++					__u32 in  = __le16_to_cpu( the_controller->ep[1].ep.maxpacket );
++					__u32 out = __le16_to_cpu( the_controller->ep[2].ep.maxpacket );
++					Ser0UDCOMP = ( out - 1 );
++					Ser0UDCIMP = ( in - 1 );
++				// we are configured
++				usbd_info.state = USB_STATE_CONFIGURED;
++				// enable rx and tx interrupts
++				Ser0UDCCR &= ~(UDCCR_RIM | UDCCR_TIM);
++
++				printk( "%sConfigured (OMP=%8.8X IMP=%8.8X)\n", pszMe, out, in );
++				break;
++			   }
++		  } else if ( req.wValue == 0 ) {
++			   /* de-configured */
++			   if (usbctl_next_state_on_event( kEvDeConfig ) != kError )
++					printk( "%sDe-Configured\n", pszMe );
++			usbd_info.state = 0;
++			Ser0UDCCR |= UDCCR_RIM | UDCCR_TIM;
++			ep1_reset ();
++			ep2_reset ();
++			printk("%s: de-configured. Tx and Rx interrupts disabled. ep1 and ep2 reset\n",__FUNCTION__);
++		  } else {
++			   printk( "%ssetup phase: Unknown "
++					   "\"set configuration\" data %d\n",
++					   pszMe, req.wValue );
++		  }
++		  set_cs_bits( UDCCS0_SO | UDCCS0_DE );  /* no data phase */
++		  break;
++
++	 case USB_REQ_CLEAR_FEATURE:
++		  /* could check data length, direction...26Jan01ww */
++		  if ( req.wValue == 0 ) { /* clearing ENDPOINT_HALT/STALL */
++			   int ep = windex_to_ep_num( req.wIndex );
++			   if ( ep == 1 ) {
++					printk( "%sclear feature \"endpoint halt\" "
++							" on receiver\n", pszMe );
++					ep1_reset();
++			   }
++			   else if ( ep == 2 ) {
++					printk( "%sclear feature \"endpoint halt\" "
++							"on xmitter\n", pszMe );
++					ep2_reset();
++			   } else {
++					printk( "%sclear feature \"endpoint halt\" "
++							"on unsupported ep # %d\n",
++							pszMe, ep );
++			   }
++		  } else {
++			   printk( "%sUnsupported feature selector (%d) "
++					   "in clear feature. Ignored.\n" ,
++					   pszMe, req.wValue );
++		  }
++		  set_cs_bits( UDCCS0_SO | UDCCS0_DE );  /* no data phase */
++		  break;
++
++	 case USB_REQ_SET_FEATURE:
++		  if ( req.wValue == 0 ) { /* setting ENDPOINT_HALT/STALL */
++			   int ep = windex_to_ep_num( req.wValue );
++			   if ( ep == 1 ) {
++					printk( "%set feature \"endpoint halt\" "
++							"on receiver\n", pszMe );
++					ep1_stall();
++			   }
++			   else if ( ep == 2 ) {
++					printk( "%sset feature \"endpoint halt\" "
++							" on xmitter\n", pszMe );
++					ep2_stall();
++			   } else {
++					printk( "%sset feature \"endpoint halt\" "
++							"on unsupported ep # %d\n",
++							pszMe, ep );
++			   }
++		  }
++		  else {
++			   printk( "%sUnsupported feature selector "
++					   "(%d) in set feature\n",
++					   pszMe, req.wValue );
++		  }
++		  set_cs_bits( UDCCS0_SO | UDCCS0_DE );  /* no data phase */
++		  break;
++
++		  /* The rest have a data phase that writes back to the host */
++	 case USB_REQ_GET_STATUS:
++		  /* return status bit flags */
++		  status_buf[0] = status_buf[1] = 0;
++		  n = request_target(req.bRequestType);
++		  switch( n ) {
++		  case kTargetDevice:
++			   if ( self_powered_hook() )
++					status_buf[0] |= 1;
++			   break;
++		  case kTargetInterface:
++			   break;
++		  case kTargetEndpoint:
++			   /* return stalled bit */
++			   n = windex_to_ep_num( req.wIndex );
++			   if ( n == 1 )
++					status_buf[0] |= (Ser0UDCCS1 & UDCCS1_FST) >> 4;
++			   else if ( n == 2 )
++					status_buf[0] |= (Ser0UDCCS2 & UDCCS2_FST) >> 5;
++			   else {
++					printk( "%sUnknown endpoint (%d) "
++							"in GET_STATUS\n", pszMe, n );
++			   }
++			   break;
++		  default:
++			   printk( "%sUnknown target (%d) in GET_STATUS\n",
++					   pszMe, n );
++			   /* fall thru */
++			   break;
++		  }
++		  PRINTKD("%s: GET_STATUS writing %d\n",__FUNCTION__,req.wLength);
++		  ep0_queue( status_buf, req.wLength, sizeof( status_buf ));
++		  break;
++	 case USB_REQ_GET_DESCRIPTOR:
++		  PRINTKD( "%s: calling the_controller.driver->setup with GET_DESCRIPTOR\n", __FUNCTION__ );
++		  the_controller->driver->setup(&the_controller->gadget, &req);
++		  break;
++	 case USB_REQ_GET_CONFIGURATION:
++		  PRINTKD( "%s: calling the_controller.driver->setup with GET_CONFIGURATION\n", __FUNCTION__ );
++		  the_controller->driver->setup(&the_controller->gadget, &req);
++		  break;
++	 case USB_REQ_GET_INTERFACE:
++		  PRINTKD( "%s: calling the_controller->driver->setup with GET_INTERFACE\n", __FUNCTION__ );
++		  the_controller->driver->setup(&the_controller->gadget, &req);
++		  break;
++	 case USB_REQ_SET_INTERFACE:
++		  PRINTKD( "%s: calling the_controller->driver->setup with SET_INTERFACE\n", __FUNCTION__ );
++		  the_controller->driver->setup(&the_controller->gadget, &req);
++		  break;
++	 default :
++		  printk("%sunknown request 0x%x\n", pszMe, req.bRequest);
++		  break;
++	 } /* switch( bRequest ) */
++
++sh_sb_end:
++	 return;
++
++}
++
++void
++ep0_int_hndlr( void )
++{
++	u32 cs_reg_in;
++
++	pcs();
++
++	cs_reg_in = Ser0UDCCS0;
++
++
++	/*
++	 * If "setup end" has been set, the usb controller has terminated
++	 * a setup transaction before we set DE. This happens during
++	 * enumeration with some hosts. For example, the host will ask for
++	 * our device descriptor and specify a return of 64 bytes. When we
++	 * hand back the first 8, the host will know our max packet size
++	 * and turn around and issue a new setup immediately. This causes
++	 * the UDC to auto-ack the new setup and set SE. We must then
++	 * "unload" (process) the new setup, which is what will happen
++	 * after this preamble is finished executing.
++	 */
++	if (cs_reg_in & UDCCS0_SE) {
++		PRINTKD("UDC: early termination of setup\n");
++
++		/*
++		 * Clear setup end
++		 */
++		set_cs_bits(UDCCS0_SSE);
++
++		/*
++		 * Clear any pending write.
++		 */
++		ep0_clear_write();
++	}
++
++	/*
++	 * UDC sent a stall due to a protocol violation.
++	 */
++	if (cs_reg_in & UDCCS0_SST) {
++//		usb->ep0_stall_sent++;
++
++		PRINTKD("UDC: write_preamble: UDC sent stall\n");
++
++		/*
++		 * Clear sent stall
++		 */
++		set_cs_bits(UDCCS0_SST);
++
++		/*
++		 * Clear any pending write.
++		 */
++		ep0_clear_write();
++	}
++
++	switch (cs_reg_in & (UDCCS0_OPR | UDCCS0_IPR)) {
++	case UDCCS0_OPR | UDCCS0_IPR:
++		PRINTKD("UDC: write_preamble: see OPR. Stopping write to "
++			"handle new SETUP\n");
++
++		/*
++		 * very rarely, you can get OPR and
++		 * leftover IPR. Try to clear
++		 */
++		UDC_clear(Ser0UDCCS0, UDCCS0_IPR);
++
++		/*
++		 * Clear any pending write.
++		 */
++		ep0_clear_write();
++
++		/*FALLTHROUGH*/
++	case UDCCS0_OPR:
++		/*
++		 * A new setup request is pending.  Handle
++		 * it. Note that we don't try to read a
++		 * packet if SE was set and OPR is clear.
++		 */
++		ep0_read_packet();
++		break;
++
++	case 0:
++		// if data pending ...
++		if (wr.p) {
++			unsigned int cs_bits = 0;
++			if (wr.bytes_left != 0) {
++				/*
++				 * More data to go
++				 */
++				write_fifo();
++				// packet ready
++				cs_bits |= UDCCS0_IPR;
++			}
++
++			if (wr.bytes_left == 0) {
++				/*
++				 * All data sent.
++				 */
++				cs_bits |= wrint();
++				// a null packet may be following
++				if (!wrint)
++				    ep0_clear_write();				
++			}
++			set_cs_bits(cs_bits);
++		}
++		else
++		    PRINTKD("%s: No data - probably an ACK\n",__FUNCTION__);
++		break;
++
++	case UDCCS0_IPR:
++		PRINTKD("UDC: IPR set, not writing\n");
++//		usb->ep0_early_irqs++;
++		break;
++	}
++
++	pcs();
++	PRINTKD( "-end-\n" );
++}
++
++static unsigned int ep0_sh_write_data(void)
++{
++	/*
++	 * If bytes left is zero, we are coming in on the
++	 * interrupt after the last packet went out. And
++	 * we know we don't have to empty packet this
++	 * transfer so just set DE and we are done
++	 */
++	PRINTKD("UDC: normal packet ended\n");
++	wrint=NULL;
++	return UDCCS0_DE;
++}
++
++static unsigned int ep0_sh_write_with_empty_packet(void)
++{
++	/*
++	 * If bytes left is zero, we are coming in on the
++	 * interrupt after the last packet went out.
++	 * We must do short packet suff, so set DE and IPR
++	 */
++	PRINTKD("UDC: short packet sent\n");
++	wrint=NULL;
++	return UDCCS0_IPR | UDCCS0_DE;
++}
++
++static unsigned int ep0_sh_write_data_then_empty_packet(void)
++{
++	PRINTKD("UDC: last packet full. Send empty packet next\n");
++	wrint=ep0_sh_write_with_empty_packet;
++	return 0;
++}
++
++static void ep0_queue(void *buf, unsigned int len, unsigned int req_len)
++{
++	__u32 cs_reg_bits = UDCCS0_IPR;
++
++	PRINTKD("a=%d r=%d\n", len, req_len);
++
++	if (len == 0) {
++	    // no output packet to wait for
++	    printk("%s: zero byte packet being queued. Setting DE and OPR end exiting\n",__FUNCTION__);
++	    set_cs_bits(UDCCS0_DE | UDCCS0_SO);
++	    return;
++	}
++	
++	/*
++	 * thou shalt not enter data phase until
++	 * Out Packet Ready is clear
++	 */
++	if (!clear_opr()) {
++		printk("UDC: SO did not clear OPR\n");
++		set_cs_bits(UDCCS0_DE | UDCCS0_SO);
++		return;
++	}
++
++	// note data to xmit stored
++	wr.p=buf;
++	wr.bytes_left=min(len, req_len);
++
++	// write the first block
++	write_fifo();
++
++	// done already?
++	if (wr.bytes_left == 0) {
++		/*
++		 * out in one, so data end
++		 */
++		cs_reg_bits |= UDCCS0_DE;
++		ep0_clear_write();
++	// rest is a shorter than expected reply?
++	} else if (len < req_len) {
++		/*
++		 * we are going to short-change host
++		 * so need nul to not stall
++		 */
++		 if (len % 8) {
++		    PRINTKD("%s: %d more to go ending in a short packet.\n",__FUNCTION__,wr.bytes_left);
++		    wrint=ep0_sh_write_with_empty_packet;
++		}
++		// unless we are on a packet boundary. Then send full packet plus null packet.
++		else {
++		    PRINTKD("%s: %d more to go then add empty packet.\n",__FUNCTION__,wr.bytes_left);
++		    wrint=ep0_sh_write_data_then_empty_packet;
++		}
++	} else {
++		/*
++		 * we have as much or more than requested
++		 */
++		PRINTKD("%s: %d more to go.\n",__FUNCTION__,wr.bytes_left);
++		wrint=ep0_sh_write_data;
++	}
++
++	/*
++	 * note: IPR was set uncondtionally at start of routine
++	 */
++	set_cs_bits(cs_reg_bits);
++}
++
++/*
++ * write_fifo()
++ * Stick bytes in the 8 bytes endpoint zero FIFO.
++ * This version uses a variety of tricks to make sure the bytes
++ * are written correctly. 1. The count register is checked to
++ * see if the byte went in, and the write is attempted again
++ * if not. 2. An overall counter is used to break out so we
++ * don't hang in those (rare) cases where the UDC reverses
++ * direction of the FIFO underneath us without notification
++ * (in response to host aborting a setup transaction early).
++ *
++ */
++static void write_fifo( void )
++{
++	int bytes_this_time = MIN( wr.bytes_left, 8 );
++	int bytes_written = 0;
++
++	PRINTKD( "WF=%d: ", bytes_this_time );
++
++	while( bytes_this_time-- ) {
++		unsigned int cwc;
++		int i;
++		 PRINTKD( "%2.2X ", *wr.p );
++		cwc = Ser0UDCWC & 15;
++		 i = 10;
++		 do {
++			  Ser0UDCD0 = *wr.p;
++			  udelay( 20 );  /* voodo 28Feb01ww */
++		 } while( (Ser0UDCWC &15) == cwc && --i );
++		 
++		 if ( i == 0 ) {
++			  printk( "%swrite_fifo: write failure\n", pszMe );
++			  usbd_info.stats.ep0_fifo_write_failures++;
++		 }
++
++		 wr.p++;
++		 bytes_written++;
++	}
++	wr.bytes_left -= bytes_written;
++
++	/* following propagation voodo so maybe caller writing IPR in
++	   ..a moment might actually get it to stick 28Feb01ww */
++	udelay( 300 );
++
++	usbd_info.stats.ep0_bytes_written += bytes_written;
++	PRINTKD( "L=%d WCR=%8.8X\n", wr.bytes_left, Ser0UDCWC );
++}
++/*
++ * read_fifo()
++ * Read 1-8 bytes out of FIFO and put in request.
++ * Called to do the initial read of setup requests
++ * from the host. Return number of bytes read.
++ *
++ * Like write fifo above, this driver uses multiple
++ * reads checked agains the count register with an
++ * overall timeout.
++ *
++ */
++static int
++read_fifo( struct usb_ctrlrequest * request )
++{
++	int bytes_read = 0;
++	int fifo_count;
++
++	unsigned char * pOut = (unsigned char*) request;
++
++	fifo_count = ( Ser0UDCWC & 0xFF );
++
++	ASSERT( fifo_count <= 8 );
++	PRINTKD( "RF=%d ", fifo_count );
++
++	while( fifo_count-- ) {
++		unsigned int cwc;
++		int i;
++		
++		cwc = Ser0UDCWC & 15;
++		
++		 i = 10;
++		 do {
++			  *pOut = (unsigned char) Ser0UDCD0;
++			  udelay( 20 );
++		 } while( ( Ser0UDCWC & 15 ) == cwc && --i );
++		 
++		 if ( i == 0 ) {
++			  printk( "%sread_fifo(): read failure\n", pszMe );
++			  usbd_info.stats.ep0_fifo_read_failures++;
++		 }
++		 pOut++;
++		 bytes_read++;
++	}
++
++	PRINTKD( "fc=%d\n", bytes_read );
++	usbd_info.stats.ep0_bytes_read++;
++	return bytes_read;
++}
++
++/* some voodo I am adding, since the vanilla macros just aren't doing it  1Mar01ww */
++
++#define ABORT_BITS ( UDCCS0_SST | UDCCS0_SE )
++#define OK_TO_WRITE (!( Ser0UDCCS0 & ABORT_BITS ))
++#define BOTH_BITS (UDCCS0_IPR | UDCCS0_DE)
++
++static void set_cs_bits( __u32 bits )
++{
++	 if ( bits & ( UDCCS0_SO | UDCCS0_SSE | UDCCS0_FST | UDCCS0_SST) )
++		  Ser0UDCCS0 = bits;
++	 else if ( (bits & BOTH_BITS) == BOTH_BITS )
++		  set_ipr_and_de();
++	 else if ( bits & UDCCS0_IPR )
++		  set_ipr();
++	 else if ( bits & UDCCS0_DE )
++		  set_de();
++}
++
++static void set_de( void )
++{
++	 int i = 1;
++	 while( 1 ) {
++		  if ( OK_TO_WRITE ) {
++				Ser0UDCCS0 |= UDCCS0_DE;
++		  } else {
++			   PRINTKD( "%sQuitting set DE because SST or SE set\n", pszMe );
++			   break;
++		  }
++		  if ( Ser0UDCCS0 & UDCCS0_DE )
++			   break;
++		  udelay( i );
++		  if ( ++i == 50  ) {
++			   printk( "%sDangnabbbit! Cannot set DE! (DE=%8.8X CCS0=%8.8X)\n",
++					   pszMe, UDCCS0_DE, Ser0UDCCS0 );
++			   break;
++		  }
++	 }
++}
++
++static void set_ipr( void )
++{
++	 int i = 1;
++	 while( 1 ) {
++		  if ( OK_TO_WRITE ) {
++				Ser0UDCCS0 |= UDCCS0_IPR;
++		  } else {
++			   PRINTKD( "%sQuitting set IPR because SST or SE set\n", pszMe );
++			   break;
++		  }
++		  if ( Ser0UDCCS0 & UDCCS0_IPR )
++			   break;
++		  udelay( i );
++		  if ( ++i == 50  ) {
++			   printk( "%sDangnabbbit! Cannot set IPR! (IPR=%8.8X CCS0=%8.8X)\n",
++					   pszMe, UDCCS0_IPR, Ser0UDCCS0 );
++			   break;
++		  }
++	 }
++}
++
++static void set_ipr_and_de( void )
++{
++	 int i = 1;
++	 while( 1 ) {
++		  if ( OK_TO_WRITE ) {
++			   Ser0UDCCS0 |= BOTH_BITS;
++		  } else {
++			   PRINTKD( "%sQuitting set IPR/DE because SST or SE set\n", pszMe );
++			   break;
++		  }
++		  if ( (Ser0UDCCS0 & BOTH_BITS) == BOTH_BITS)
++			   break;
++		  udelay( i );
++		  if ( ++i == 50  ) {
++			   printk( "%sDangnabbbit! Cannot set DE/IPR! (DE=%8.8X IPR=%8.8X CCS0=%8.8X)\n",
++					   pszMe, UDCCS0_DE, UDCCS0_IPR, Ser0UDCCS0 );
++			   break;
++		  }
++	 }
++}
++
++static bool clear_opr( void )
++{
++	 int i = 10000;
++	 bool is_clear;
++	 do {
++		  Ser0UDCCS0 = UDCCS0_SO;
++		  is_clear  = ! ( Ser0UDCCS0 & UDCCS0_OPR );
++		  if ( i-- <= 0 ) {
++			   printk( "%sclear_opr(): failed\n", pszMe );
++			   break;
++		  }
++	 } while( ! is_clear );
++	 return is_clear;
++}
++
++
++
++// ep1 handlers
++
++static char *ep1_buf;
++static int ep1_len;
++static void (*ep1_callback)(int flag, int size);
++static char *ep1_curdmabuf;
++static dma_addr_t ep1_curdmapos;
++static int ep1_curdmalen;
++static int ep1_remain;
++static int ep1_used;
++
++static dma_regs_t *dmaregs_rx = NULL;
++static int rx_pktsize;
++
++static int naking;
++
++static void
++ep1_start(void)
++{
++	sa1100_reset_dma(dmaregs_rx);
++	if (!ep1_curdmalen) {
++	  	ep1_curdmalen = rx_pktsize;
++		if (ep1_curdmalen > ep1_remain)
++			ep1_curdmalen = ep1_remain;
++		ep1_curdmapos = dma_map_single(NULL, ep1_curdmabuf, ep1_curdmalen,
++					       DMA_FROM_DEVICE);
++	}
++
++	UDC_write( Ser0UDCOMP, ep1_curdmalen-1 );
++	
++	sa1100_start_dma(dmaregs_rx, ep1_curdmapos, ep1_curdmalen);
++
++	if ( naking ) {
++		/* turn off NAK of OUT packets, if set */
++		UDC_flip( Ser0UDCCS1, UDCCS1_RPC );
++		naking = 0;
++	}
++}
++
++static void
++ep1_done(int flag)
++{
++	int size = ep1_len - ep1_remain;
++
++	if (!ep1_len)
++		return;
++	if (ep1_curdmalen)
++		dma_unmap_single(NULL, ep1_curdmapos, ep1_curdmalen,
++				 DMA_FROM_DEVICE);
++	ep1_len = ep1_curdmalen = 0;
++	if (ep1_callback)
++		ep1_callback(flag, size);
++}
++
++void
++ep1_state_change_notify( int new_state )
++{
++
++}
++
++void
++ep1_stall( void )
++{
++	/* SET_FEATURE force stall at UDC */
++	UDC_set( Ser0UDCCS1, UDCCS1_FST );
++}
++
++int
++ep1_init(dma_regs_t *dmaregs)
++{
++	dmaregs_rx = dmaregs;
++	sa1100_reset_dma(dmaregs_rx);
++	ep1_done(-EAGAIN);
++	return 0;
++}
++
++void
++ep1_reset(void)
++{
++	if (dmaregs_rx)
++	    sa1100_reset_dma(dmaregs_rx);
++	UDC_clear(Ser0UDCCS1, UDCCS1_FST);
++	ep1_done(-EINTR);
++}
++
++void
++ep1_int_hndlr(int udcsr)
++{
++	dma_addr_t dma_addr;
++	unsigned int len;
++	int status = Ser0UDCCS1;
++
++	if ( naking ) printk( "%sEh? in ISR but naking = %d\n", "usbrx: ", naking );
++
++	if (status & UDCCS1_RPC) {
++
++		if (!ep1_curdmalen) {
++			printk("usb_recv: RPC for non-existent buffer\n");
++			naking=1;
++			return;
++		}
++
++		sa1100_stop_dma(dmaregs_rx);
++
++		if (status & UDCCS1_SST) {
++			printk("usb_recv: stall sent OMP=%d\n",Ser0UDCOMP);
++			UDC_flip(Ser0UDCCS1, UDCCS1_SST);
++			ep1_done(-EIO); // UDC aborted current transfer, so we do
++			return;
++		}
++
++		if (status & UDCCS1_RPE) {
++			printk("usb_recv: RPError %x\n", status);
++			UDC_flip(Ser0UDCCS1, UDCCS1_RPC);
++			ep1_done(-EIO);
++			return;
++		}
++
++		dma_addr=sa1100_get_dma_pos(dmaregs_rx);
++		dma_unmap_single(NULL, ep1_curdmapos, ep1_curdmalen,
++				 DMA_FROM_DEVICE);
++		len = dma_addr - ep1_curdmapos;
++#ifdef SA1100_USB_DEBUG
++		if (sa1100_usb_debug) {
++		    int i;
++		    printk("usb rx %d :\n  ",len);
++		    if (sa1100_usb_debug>1) {
++			for (i=0; i<len; i++) {
++			    if ((i % 32)==31)
++				printk("\n  ");
++//			    printk("%2.2x ",((char *)ep1_buf)[ep1_used+i]);
++			    printk("%2.2x ",((char *)ep1_curdmapos)[i]);
++			}
++		    }
++		    printk("\n");
++		}
++#endif
++		if (len < ep1_curdmalen) {
++			char *buf = ep1_curdmabuf + len;
++			while (Ser0UDCCS1 & UDCCS1_RNE) {
++				if (len >= ep1_curdmalen) {
++					printk("usb_recv: too much data in fifo\n");
++					break;
++				}
++				*buf++ = Ser0UDCDR;
++				len++;
++			}
++		} else if (Ser0UDCCS1 & UDCCS1_RNE) {
++			printk("usb_recv: fifo screwed, shouldn't contain data\n");
++			len = 0;
++		}
++
++#if defined(NCB_DMA_FIX)
++//		if (len && (ep1_buf != ep1_curdmabuf))
++//		    memcpy(ep1_buf,ep1_curdmabuf,len);
++		if (len)
++		    memcpy(&(((unsigned char *)ep1_buf)[ep1_used]),ep1_curdmabuf,len);
++#endif
++
++		ep1_curdmalen = 0;  /* dma unmap already done */
++		ep1_remain -= len;
++		ep1_used += len;
++//		ep1_curdmabuf += len;	// use same buffer again
++		naking = 1;
++//printk("%s: received %d, %d remaining\n",__FUNCTION__,len,ep1_remain);
++		if (len && (len == rx_pktsize))
++		    ep1_start();
++		else
++		ep1_done((len) ? 0 : -EPIPE);
++	}
++	/* else, you can get here if we are holding NAK */
++}
++
++int
++sa1100_usb_recv(struct usb_request *req, void (*callback)(int flag, int size))
++{
++	unsigned long flags;
++	char *buf=req->buf;
++	int len=req->length;
++
++	if (ep1_len)
++		return -EBUSY;
++
++	local_irq_save(flags);
++	ep1_buf = buf;
++	ep1_len = len;
++	ep1_callback = callback;
++	ep1_remain = len;
++	ep1_used = 0;
++#ifdef NCB_DMA_FIX
++//	if (((size_t)buf)&3)
++ 	if (1)
++	    ep1_curdmabuf = receive_buffer;
++	else
++#else
++	ep1_curdmabuf = buf;
++#endif
++	ep1_curdmalen = 0;
++	ep1_start();
++	local_irq_restore(flags);
++
++	return 0;
++}
++
++// ep2 handlers
++
++static char *ep2_buf;
++static int ep2_len;
++static void (*ep2_callback)(int status, int size);
++static dma_addr_t ep2_dma;
++static dma_addr_t ep2_curdmapos;
++static int ep2_curdmalen;
++static int ep2_remain;
++static dma_regs_t *dmaregs_tx = NULL;
++static int tx_pktsize;
++
++/* device state is changing, async */
++void
++ep2_state_change_notify( int new_state )
++{
++}
++
++/* set feature stall executing, async */
++void
++ep2_stall( void )
++{
++	UDC_set( Ser0UDCCS2, UDCCS2_FST );  /* force stall at UDC */
++}
++
++static void
++ep2_start(void)
++{
++	if (!ep2_len)
++		return;
++		
++	ep2_curdmalen = tx_pktsize;
++	if (ep2_curdmalen > ep2_remain)
++		ep2_curdmalen = ep2_remain;
++
++	/* must do this _before_ queue buffer.. */
++	UDC_flip( Ser0UDCCS2,UDCCS2_TPC );  /* stop NAKing IN tokens */
++	UDC_write( Ser0UDCIMP, ep2_curdmalen-1 );
++
++#if 0
++	/* Remove if never seen...8Mar01ww */
++	{
++		 int massive_attack = 20;
++		 while ( Ser0UDCIMP != ep2_curdmalen-1 && massive_attack-- ) {
++			  printk( "usbsnd: Oh no you don't! Let me spin..." );
++			  udelay( 500 );
++			  printk( "and try again...\n" );
++			  UDC_write( Ser0UDCIMP, ep2_curdmalen-1 );
++		 }
++		 if ( massive_attack != 20 ) {
++			  if ( Ser0UDCIMP != ep2_curdmalen-1 )
++				   printk( "usbsnd: Massive attack FAILED :-( %d\n",
++						   20 - massive_attack );
++			  else
++				   printk( "usbsnd: Massive attack WORKED :-) %d\n",
++						   20 - massive_attack );
++		 }
++	}
++	/* End remove if never seen... 8Mar01ww */
++#endif
++
++	Ser0UDCAR = usbd_info.address; // fighting stupid silicon bug
++	sa1100_start_dma(dmaregs_tx, ep2_curdmapos, ep2_curdmalen);
++}
++
++static void
++ep2_done(int flag)
++{
++	int size = ep2_len - ep2_remain;
++	if (ep2_len) {
++		dma_unmap_single(NULL, ep2_dma, ep2_len, DMA_TO_DEVICE);
++		ep2_len = 0;
++		if (ep2_callback)
++			ep2_callback(flag, size);
++	}
++}
++
++int
++ep2_init(dma_regs_t *dmaregs)
++{
++	dmaregs_tx = dmaregs;
++	sa1100_reset_dma(dmaregs_tx);
++	ep2_done(-EAGAIN);
++	return 0;
++}
++
++void
++ep2_reset(void)
++{
++	UDC_clear(Ser0UDCCS2, UDCCS2_FST);
++	if (dmaregs_tx)
++	    sa1100_reset_dma(dmaregs_tx);
++	ep2_done(-EINTR);
++}
++
++void
++ep2_int_hndlr(int udcsr)
++{
++	int status = Ser0UDCCS2;
++
++	if (Ser0UDCAR != usbd_info.address) // check for stupid silicon bug.
++		Ser0UDCAR = usbd_info.address;
++
++	if (status & UDCCS2_TPC) {
++
++		UDC_flip(Ser0UDCCS2, UDCCS2_SST);
++
++		sa1100_reset_dma(dmaregs_tx);
++
++		if (status & (UDCCS2_TPE | UDCCS2_TUR)) {
++			printk("usb_send: transmit error %x\n", status);
++			ep2_done(-EIO);
++		} else {
++#if 1 // 22Feb01ww/Oleg
++			ep2_curdmapos += ep2_curdmalen;
++			ep2_remain -= ep2_curdmalen;
++#else
++			ep2_curdmapos += Ser0UDCIMP + 1; // this is workaround
++			ep2_remain -= Ser0UDCIMP + 1;    // for case when setting of Ser0UDCIMP was failed
++#endif
++
++			if (ep2_remain != 0)
++				ep2_start();
++			else
++				ep2_done(0);
++		}
++	} else {
++		printk("usb_send: Not TPC: UDCCS2 = %x\n", status);
++	}
++}
++
++int
++sa1100_usb_send(struct usb_request *req, void (*callback)(int status, int size))
++{
++	char *buf=req->buf;
++	int len=req->length;
++	unsigned long flags;
++
++	if (usbd_info.state != USB_STATE_CONFIGURED) {
++		PRINTKD("%s: return -ENODEV\n",__FUNCTION__);
++		return -ENODEV;
++	}
++
++	if (ep2_len) {
++		PRINTKD("%s: return -EBUSY\n",__FUNCTION__);
++		return -EBUSY;
++	}
++
++	local_irq_save(flags);
++#ifdef NCB_DMA_FIX
++	// if misaligned, copy to aligned buffer
++//	if (((size_t)buf)&3) {
++	if (1) {
++	    PRINTKD("%s: copying %d bytes to send_buffer\n",__FUNCTION__,len);
++	    memcpy(send_buffer,buf,len);
++	    ep2_buf = send_buffer;
++	}
++	else 
++#endif
++	ep2_buf = buf;
++		
++	ep2_len = len;
++	ep2_dma = dma_map_single(NULL, ep2_buf, len,DMA_TO_DEVICE);
++	PRINTKD("%s: mapped dma to buffer(%p0\n",__FUNCTION__,buf);
++
++	ep2_callback = callback;
++	ep2_remain = len;
++	ep2_curdmapos = ep2_dma;
++
++	PRINTKD("%s: calling ep2_start\n",__FUNCTION__);
++	ep2_start();
++	local_irq_restore(flags);
++
++	return 0;
++}
++/*-------------------------------------------------------------------------*/
++
++static int
++sa1100_enable (struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
++{
++	struct sa1100_udc	*dev;
++	struct sa1100_ep	*ep;
++	u32			max;
++	int			type;
++
++	ep = container_of (_ep, struct sa1100_ep, ep);
++	if (!_ep || !desc || ep->desc || _ep->name == ep0name
++			|| desc->bDescriptorType != USB_DT_ENDPOINT)
 {
++		PRINTKD("%s: _ep = %p, desc = %p\n",__FUNCTION__,_ep,desc);
++		if (_ep && desc)
++		    PRINTKD("%s: ep->desc = %p, _ep->name = %s desc->bDescriptorType = %s\n",__FUNCTION__,ep->desc,_ep->name, 
++			(desc->bDescriptorType == USB_DT_ENDPOINT) ? "USB_DT_ENDPOINT":"bad!!");
++		return -EINVAL;
++	}
++
++	dev = ep->dev;
++	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
 
++		return -ESHUTDOWN;
++
++	type = desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
++	max = le16_to_cpu (desc->wMaxPacketSize);
++	switch (max) {
++	case 64: case 32:
++	/* note:  maxpacket > 16 means DMA might overrun/underrun */
++	case 16: case 8:
++		break;
++	default:
++		if (type == USB_ENDPOINT_XFER_INT && max < 64)
++			break;
++		return -EDOM;
++	}
++
++	switch (type) {
++	case USB_ENDPOINT_XFER_BULK:
++	case USB_ENDPOINT_XFER_INT:
++		if (ep == &dev->ep[2]) {
++			if (desc->bEndpointAddress != (USB_DIR_IN|2)
) {
++				PRINTKD("%s: ep[2] has invalid endpoint\n",__FUNCTION__);
++				return -EINVAL;
++			}
++			tx_pktsize = max;
++			Ser0UDCOMP = max - 1;
++			PRINTKD("%s: ep2 max packet size is %d\n",__FUNCTION__,max);
++			break;
++		} else if (ep == &dev->ep[1]) {
++			if (desc->bEndpointAddress != (USB_DIR_OUT|1))
 {
++				PRINTKD("%s: ep[1] has invalid endpoint\n",__FUNCTION__);
++				return -EINVAL;
++			}
++			rx_pktsize = max;
++			Ser0UDCIMP = max - 1;
++			PRINTKD("%s: ep1 max packet size is %d\n",__FUNCTION__,max);
++			break;
++		}
++		// FALLTHROUGH
++	default:
++		PRINTKD("%s: Invalid endpoint\n",__FUNCTION__);
++		return -EINVAL;
++	}
++
++	_ep->maxpacket = max;
++	ep->desc = desc;
++
++	DEBUG (dev, "enabled %s %s max %04x\n", _ep->name,
++		type_string (desc->bmAttributes), max);
++
++	return 0;
++}
++
++static int sa1100_disable (struct usb_ep *_ep)
++{
++	struct sa1100_ep	*ep;
++
++	ep = container_of (_ep, struct sa1100_ep, ep);
++	if (!_ep || !ep->desc || _ep->name == ep0name)
++		return -EINVAL;
++
++	nuke (ep, -ESHUTDOWN);
++
++	DEBUG (ep->dev, "disabled %s\n", _ep->name);
++
++	ep->desc = NULL;
++	ep->stopped = 1;
++	return 0;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static struct usb_request *
++sa1100_alloc_request (struct usb_ep *_ep, int gfp_flags)
++{
++	struct sa1100_request	*req;
++
++	if (!_ep)
++		return 0;
++
++	req = kmalloc (sizeof *req, gfp_flags);
++	if (!req)
++		return 0;
++
++	memset (req, 0, sizeof *req);
++	req->req.dma = DMA_ADDR_INVALID;
++	INIT_LIST_HEAD (&req->queue);
++	return &req->req;
++}
++
++static void
++sa1100_free_request (struct usb_ep *_ep, struct usb_request *_req)
++{
++	struct sa1100_request	*req;
++
++#if 0 // NCB
++	struct sa1100_ep	*ep;
++	ep = container_of (_ep, struct sa1100_ep, ep);
++	if (!ep || !_req || (!ep->desc && _ep->name != ep0name))
++		return;
++
#endif
++
++	req = container_of (_req, struct sa1100_request, req);
++	WARN_ON (!list_empty (&req->queue));
++	kfree(req);	//NCB - see pxa2xx_udc
++}
++
++/*-------------------------------------------------------------------------*/
++
++/* allocate buffers this way to eliminate per-io buffer copies  */
++
++static void *
++sa1100_alloc_buffer (
++	struct usb_ep		*_ep,
++	unsigned		bytes,
++	dma_addr_t		*dma,
++	int			gfp_flags
++)
++{
++	void			*retval;
++#if 1 // NCB see pxa2xx_udc
++	retval = kmalloc (bytes, gfp_flags & ~(__GFP_DMA|__GFP_HIGHMEM));
++	if (retval)
++// used in pxa ..		*dma = virt_to_bus (retval);
++		*dma = virt_to_phys (retval);
++#else
++	struct sa1100_ep	*ep;
++
++	ep = container_of (_ep, struct sa1100_ep, ep);
++	if (!ep || (!ep->desc && _ep->name != ep0name))
++		return 0;
++
++	*dma = DMA_ADDR_INVALID;
++	retval = kmalloc (bytes, GFP_DMA | gfp_flags);
++	if (retval)
++		*dma = virt_to_phys (retval);
++
#endif
++	return retval;
++}
++
++static void
++sa1100_free_buffer (
++	struct usb_ep *_ep,
++	void *buf,
++	dma_addr_t dma,
++	unsigned bytes
++) {
++	kfree (buf);
++}
++
++/*-------------------------------------------------------------------------*/
++
++static void
++done (struct sa1100_ep *ep, struct sa1100_request *req, int status)
++{
++	unsigned		stopped = ep->stopped;
++
++
++	list_del_init (&req->queue);
++
++	if (req->req.status == -EINPROGRESS)
++		req->req.status = status;
++	else
++		status = req->req.status;
++
++	if (status && status != -ESHUTDOWN)
++		VDEBUG (ep->dev, "complete %s req %p stat %d len %u/%u\n",
++			ep->ep.name, &req->req, status,
++			req->req.actual, req->req.length);
++
++	/* don't modify queue heads during completion callback */
++	ep->stopped = 1;
++	PRINTKD("%s: calling complete on req\n",__FUNCTION__);
++	req->req.complete (&ep->ep, &req->req);
++	ep->stopped = stopped;
++}
++
++#if 0 // NCB
++void control_done (int value)
++{
++	struct list_head	*entry, *tmp;
++	struct sa1100_request	*req;
++
++	list_for_each_safe (entry, tmp, &the_controller.ep[0].queue) {
++		req = list_entry (entry, struct sa1100_request, queue);
++
++		/* HACK -- assume no control errors */
++		if (value == 0)
++			req->req.actual = req->req.length;
++#if 1
++		PRINTKD("%s: calling done with ep=%p, req=%p\n",__FUNCTION__,&the_udc.ep[0],req);
++		done (&the_udc.ep[0], req, value);
++#else
++		done (&the_udc.ep0, req, value);
++#endif
++		value = -EPROTO;
++	}
++}
++#endif
++
++/*-------------------------------------------------------------------------*/
++
++/* FIXME move away from the old non-queued api.
++ * - forces extra work on us
++ * - stores request state twice
++ * - doesn't let gadget driver handle dma mapping
++ * - status codes need mapping
++ */
++
++static int map_status (int status)
++{
++	switch (status) {
++	case 0:
++	case -EIO:	/* ep[12]_int_handler */
++		return status;
++	case -EPIPE:	/* ep1_int_handler */
++		return 0;
++	//  case -EAGAIN: 	/* ep[12]_init */
++	//  case -EINTR:	/* ep[12]_reset */
++	default:
++		return -ESHUTDOWN;
++	}
++}
++
++static void tx_callback (int status, int size)
++{
++	struct sa1100_ep	*ep = &the_controller->ep[2];
++	struct sa1100_request	*req;
++
++//	PRINTKD("%s: doing ...\n",__FUNCTION__);
++PRINTKD("%s: doing ... status=%d size=%d\n",__FUNCTION__,status,size);
++//PRINTKD("%s: doing ... status=%d\n",__FUNCTION__,status);
++	if (list_empty (&ep->queue)) {
++		if (status != -EAGAIN)
++			DEBUG (ep->dev, "%s, bogus tx callback %d/%d\n",
++				ep->ep.name, status, size);
++//			DEBUG (ep->dev, "%s, bogus tx callback %d\n",
++//				ep->ep.name, status);
++else
++PRINTKD("%s: list empty.\n",__FUNCTION__);
++		return;
++	}
++	req = list_entry (ep->queue.next, struct sa1100_request, queue);
++	req->req.actual = size;
++	done (ep, req, map_status (status));
++
++PRINTKD("%s: ep->stopped=%s\n",__FUNCTION__,ep->stopped ? "true":"false");
++	if (ep->stopped || list_empty (&ep->queue))
++		return;
++	req = list_entry (ep->queue.next, struct sa1100_request, queue);
++PRINTKD("%s: calling sa1100_usb_send\n",__FUNCTION__);
++	sa1100_usb_send (&req->req, tx_callback);
++}
++
++static void rx_callback (int status, int size)
++{
++	struct sa1100_ep	*ep = &the_controller->ep[1];
++	struct sa1100_request	*req;
++
++//	PRINTKD("%s: doing ...\n",__FUNCTION__);
++PRINTKD("%s: doing ... status=%d\n",__FUNCTION__,status);
++	if (list_empty (&ep->queue)) {
++		if (status != -EAGAIN)
++			DEBUG (ep->dev, "%s, bogus tx callback %d/%d\n",
++				ep->ep.name, status, size);
++		return;
++	}
++	req = list_entry (ep->queue.next, struct sa1100_request, queue);
++	req->req.actual = size;
++	done (ep, req, map_status (status));
++
++	if (ep->stopped || list_empty (&ep->queue))
++		return;
++	req = list_entry (ep->queue.next, struct sa1100_request, queue);
++	sa1100_usb_recv (&req->req, rx_callback);
++}
++
++
++static int
++sa1100_queue (struct usb_ep *_ep, struct usb_request *_req, int gfp_flags)
++{
++	struct sa1100_request	*req;
++	struct sa1100_ep	*ep;
++	struct sa1100_udc	*dev;
++	unsigned long		flags;
++
++	req = container_of (_req, struct sa1100_request, req);
++	if (!_req || !_req->complete || !_req->buf
++			|| !list_empty (&req->queue))
++		return -EINVAL;
++
++	ep = container_of (_ep, struct sa1100_ep, ep);
++	if (!_ep || (!ep->desc && _ep->name != ep0name))
++		return -EINVAL;
++	dev = ep->dev;
++
++	// handle ep0
++	if (_ep->name == ep0name)
 {
++	    ep0_queue( _req->buf, _req->length, dev->ep0_req_len >=0 ? dev->ep0_req_len: _req->length );
++	    return 0;
++	} 
++	
++	if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
++		return -ESHUTDOWN;
++
++	/* sa1100 udc can't write zlps */
++	if (ep == &dev->ep[2] && _req->length == 0)
++		return -ERANGE;
++
++	/* the old sa1100 api doesn't use 'unsigned' for lengths */
++	if (_req->length > INT_MAX)
++		return -ERANGE;
++
++#if 0
++	VDEBUG (dev, "%s queue req %p, len %d buf %p\n",
++			_ep->name, _req, _req->length, _req->buf);
++#endif
++
++	local_irq_save (flags);
++
++	_req->status = -EINPROGRESS;
++	_req->actual = 0;
++
++// NCB	if (list_empty) {
++	if (list_empty (&ep->queue) && !ep->stopped) {
++		/* FIXME this does DMA mapping wrong.  caller is allowed
++		 * to provide buffers that don't need mapping, but this
++		 * doesn't use them.
++		 */
++		if (ep == &ep->dev->ep[2])
 {
++			PRINTKD("%s: sa1100_usb_send buf %p length %d\n",__FUNCTION__,_req->buf,_req->length);
++			sa1100_usb_send (_req, tx_callback);
++		}
++		else if (ep == &ep->dev->ep[1])
 {
++			PRINTKD("%s: sa1100_usb_recv buf %p length %d\n",__FUNCTION__,_req->buf,_req->length);
++			sa1100_usb_recv (_req, rx_callback);
++		}
++		/* ep0 rx/tx is handled separately */
++	}
++	list_add_tail (&req->queue, &ep->queue);
++
++	local_irq_restore (flags);
++
++	return 0;
++}
++
++/* dequeue ALL requests */
++static void nuke (struct sa1100_ep *ep, int status)
++{
++	struct sa1100_request	*req;
++
++	/* called with irqs blocked */
++	ep->stopped = 1;
++	if (ep == &ep->dev->ep[1])
++		ep1_reset ();
++	else if (ep == &ep->dev->ep[2])
++		ep2_reset ();
++	while (!list_empty (&ep->queue)) {
++		req = list_entry (ep->queue.next,
++				struct sa1100_request,
++				queue);
++		done (ep, req, status);
++	}
++}
++
++/* dequeue JUST ONE request */
++static int sa1100_dequeue (struct usb_ep *_ep, struct usb_request *_req)
++{
++	struct sa1100_ep	*ep;
++	struct sa1100_request	*req;
++	unsigned long		flags;
++
++	ep = container_of (_ep, struct sa1100_ep, ep);
++	req = container_of (_req, struct sa1100_request, req);
++	if (!_ep || (!ep->desc && _ep->name != ep0name) || !_req)
++		return -EINVAL;
++
++	local_irq_save (flags);
++
++	/* make sure it's actually queued on this endpoint */
++	list_for_each_entry (req, &ep->queue, queue) {
++		if (&req->req == _req)
++			break;
++	}
++	if (&req->req != _req) {
++		local_irq_restore(flags);
++		return -EINVAL;
++	}
++
++#if 0
++//#ifdef	USE_DMA
++	if (ep->dma >= 0 && ep->queue.next == &req->queue && !ep->stopped) {
++		cancel_dma(ep);
++		done(ep, req, -ECONNRESET);
++		/* restart i/o */
++		if (!list_empty(&ep->queue)) {
++			req = list_entry(ep->queue.next,
++					struct pxa2xx_request, queue);
++			kick_dma(ep, req);
++		}
++	} else
++//#endif
++#endif
++	done(ep, req, -ECONNRESET);
++
++	local_irq_restore(flags);
++
++	return 0;
++}
++
++/*-------------------------------------------------------------------------*/
++
++static int
++sa1100_set_halt (struct usb_ep *_ep, int value)
++{
++	struct sa1100_ep	*ep;
++
++	ep = container_of (_ep, struct sa1100_ep, ep);
++	if (!_ep || (!ep->desc && _ep->name != ep0name))
++		return -EINVAL;
++	if (!ep->dev->driver || ep->dev->gadget.speed == USB_SPEED_UNKNOWN)
++		return -ESHUTDOWN;
++	if ( (ep->desc->bmAttributes & 0x03) == USB_ENDPOINT_XFER_ISOC)
++		return -EINVAL;
++
++	VDEBUG (ep->dev, "%s %s halt\n", _ep->name, value ? "set" : "clear");
++
++	/* set/clear, then synch memory views with the device */
++	if (value) {
++		if (ep == &ep->dev->ep[1])
++			ep1_stall ();
++		else
++			ep2_stall ();
++	} else {
++		if (ep == &ep->dev->ep[1])
++			ep1_reset ();
++		else
++			ep2_reset ();
++	}
++
++	return 0;
++}
++
++static struct usb_ep_ops sa1100_ep_ops = {
++	.enable		= sa1100_enable,
++	.disable	= sa1100_disable,
++
++	.alloc_request	= sa1100_alloc_request,
++	.free_request	= sa1100_free_request,
++
++	.alloc_buffer	= sa1100_alloc_buffer,
++	.free_buffer	= sa1100_free_buffer,
++
++	.queue		= sa1100_queue,
++	.dequeue	= sa1100_dequeue,
++
++	.set_halt	= sa1100_set_halt,
++	// .fifo_status	= sa1100_fifo_status,
++	// .fifo_flush	= sa1100_fifo_flush,
++};
++
++/*-------------------------------------------------------------------------*/
++
++static int sa1100_get_frame (struct usb_gadget *_gadget)
++{
++	return -EOPNOTSUPP;
++}
++
++static int sa1100_wakeup (struct usb_gadget *_gadget)
++{
++	struct sa1100_udc	*dev;
++
++	if (!_gadget)
++		return 0;
++	dev = container_of (_gadget, struct sa1100_udc, gadget);
++
++	// FIXME
++
++	return 0;
++}
++
++static const struct usb_gadget_ops sa1100_ops = {
++	.get_frame	= sa1100_get_frame,
++	.wakeup		= sa1100_wakeup,
++
++	// .set_selfpowered = sa1100_set_selfpowered,
++};
++
++/*-------------------------------------------------------------------------*/
++
++static inline void enable_resume_mask_suspend (void)
++{
++	 int i = 0;
++
++	 while (1) {
++		  Ser0UDCCR |= UDCCR_SUSIM; // mask future suspend events
++		  udelay (i);
++		  if ( (Ser0UDCCR & UDCCR_SUSIM) || (Ser0UDCSR & UDCSR_RSTIR))
++			   break;
++		  if (++i == 50) {
++			   WARN (&the_controller, "%s Could not set SUSIM %8.8X\n",
++			   		__FUNCTION__, Ser0UDCCR);
++			   break;
++		  }
++	 }
++
++	 i = 0;
++	 while (1) {
++		  Ser0UDCCR &= ~UDCCR_RESIM;
++		  udelay (i);
++		  if ( (Ser0UDCCR & UDCCR_RESIM) == 0
++			   	|| (Ser0UDCSR & UDCSR_RSTIR))
++			   break;
++		  if (++i == 50) {
++			   WARN (&the_controller, "%s Could not clear RESIM %8.8X\n",
++			   		__FUNCTION__, Ser0UDCCR);
++			   break;
++		  }
++	 }
++}
++
++static inline void enable_suspend_mask_resume (void)
++{
++	 int i = 0;
++	 while (1) {
++		  Ser0UDCCR |= UDCCR_RESIM; // mask future resume events
++		  udelay (i);
++		  if (Ser0UDCCR & UDCCR_RESIM || (Ser0UDCSR & UDCSR_RSTIR))
++			   break;
++		  if (++i == 50) {
++			   WARN (&the_controller, "%s could not set RESIM %8.8X\n",
++			   		__FUNCTION__, Ser0UDCCR);
++			   break;
++		  }
++	 }
++	 i = 0;
++	 while (1) {
++		  Ser0UDCCR &= ~UDCCR_SUSIM;
++		  udelay (i);
++		  if ( (Ser0UDCCR & UDCCR_SUSIM) == 0
++			   	|| (Ser0UDCSR & UDCSR_RSTIR))
++			   break;
++		  if (++i == 50) {
++			   WARN (&the_controller, "%s Could not clear SUSIM %8.8X\n",
++			   		__FUNCTION__, Ser0UDCCR);
++			   break;
++		  }
++	 }
++}
++
++// HACK DEBUG  3Mar01ww
++// Well, maybe not, it really seems to help!  08Mar01ww
++static void core_kicker (void)
++{
++	u32 car = Ser0UDCAR;
++	u32 imp = Ser0UDCIMP;
++	u32 omp = Ser0UDCOMP;
++
++	UDC_set (Ser0UDCCR, UDCCR_UDD);
++	udelay (300);
++	UDC_clear (Ser0UDCCR, UDCCR_UDD);
++
++	Ser0UDCAR = car;
++	Ser0UDCIMP = imp;
++	Ser0UDCOMP = omp;
++}
++
++// NCB static void
++static irqreturn_t
++udc_int_hndlr (int irq, void *_dev, struct pt_regs *regs)
++{
++	struct sa1100_udc	*dev = _dev;
++  	u32			status = Ser0UDCSR;
++
++  	u32			control = Ser0UDCCR;
++	
PRINTKD("%s: status = 0x%x and control = 0x%x\n",__FUNCTION__,status,control);
++	/* ReSeT Interrupt Request - UDC has been reset */
++	if (status & UDCSR_RSTIR) {
++	PRINTKD("%s: processing UDCSR_RSTIR\n",__FUNCTION__);
++		if (usbctl_next_state_on_event (kEvReset) != kError) {
++			/* starting 20ms or so reset sequence now... */
++			INFO (dev, "Resetting\n");
++			ep0_reset ();  // just set state to idle
++			ep1_reset ();  // flush dma, clear false stall
++			ep2_reset ();  // flush dma, clear false stall
++		}
++		// mask reset ints, they flood during sequence, enable
++		// suspend and resume
++		Ser0UDCCR |= UDCCR_REM;    // mask reset
++		Ser0UDCCR &= ~ (UDCCR_SUSIM | UDCCR_RESIM); // enable suspend and resume
++		UDC_flip ( Ser0UDCSR, status);	// clear all pending sources
++		PRINTKD("%s: setting USB_FULL_SPEED\n",__FUNCTION__);
++		dev->gadget.speed = USB_SPEED_FULL;
++		return IRQ_HANDLED;	// NCB
++	}
++
++	/* else we have done something other than reset,
++	 * so be sure reset enabled
++	 */
++	UDC_clear (Ser0UDCCR, UDCCR_REM);
++
++	/* RESume Interrupt Request */
++	if (status & UDCSR_RESIR) {
++		struct usb_gadget_driver	*driver = dev->driver;
++
++		PRINTKD("%s: processing UDCSR_RESIR\n",__FUNCTION__);
++		if (driver->resume)
++			driver->resume (&dev->gadget);
++		core_kicker ();
++		enable_suspend_mask_resume ();
++	}
++
++	/* SUSpend Interrupt Request */
++	if (status & UDCSR_SUSIR) {
++		struct usb_gadget_driver	*driver = dev->driver;
++
++		PRINTKD("%s: processing UDCSR_SUSIR\n",__FUNCTION__);
++		if (driver->suspend)
++			driver->suspend (&dev->gadget);
++		enable_resume_mask_suspend ();
++	}
++
++	UDC_flip (Ser0UDCSR, status); // clear all pending sources
++
++	if (status & UDCSR_EIR)

++		 ep0_int_hndlr ();
++
++
++	if (status & UDCSR_RIR)
 {
++		PRINTKD("%s: processing ep1_int_hndlr\n",__FUNCTION__);
++		ep1_int_hndlr (status);
++	}
++	if (status & UDCSR_TIR)
 {
++		PRINTKD("%s: processing ep2_int_hndlr\n",__FUNCTION__);
++		ep2_int_hndlr (status);
++	}
++		
++	return IRQ_HANDLED;	// NCB
++		
++}
++
++/* soft_connect_hook ()
++ * Some devices have platform-specific circuitry to make USB
++ * not seem to be plugged in, even when it is. This allows
++ * software to control when a device 'appears' on the USB bus
++ * (after Linux has booted and this driver has loaded, for
++ * example). If you have such a circuit, control it here.
++ */
++#ifdef CONFIG_SA1100_EXTENEX1
++static void soft_connect_hook (int enable)
++{
++	if (machine_is_extenex1 ()) {
++		if (enable) {
++			PPDR |= PPC_USB_SOFT_CON;
++			PPSR |= PPC_USB_SOFT_CON;
++		} else {
++			PPSR &= ~PPC_USB_SOFT_CON;
++			PPDR &= ~PPC_USB_SOFT_CON;
++		}
++	}
++}
++#elif defined(CONFIG_SA1100_BALLOON)
++static void soft_connect_hook (int enable)
++{
++	if (machine_is_balloon()) {
++	    if (enable)
++		balloon_udc_connect();
++	    else
++		balloon_udc_disconnect();
++	}
++}
++#else
++#define soft_connect_hook(x) do { } while (0);
++#endif
++
++/* "function" sysfs attribute */
++static ssize_t
++show_function (struct device *_dev, char *buf)
++{
++	struct sa1100_udc	*dev = dev_get_drvdata (_dev);
++
++	if (!dev->driver
++			|| !dev->driver->function
++			|| strlen (dev->driver->function) > PAGE_SIZE)
++		return 0;
++	return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
++}
++static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
++
++/* disable the UDC at the source */
++static void udc_disable (struct sa1100_udc *dev)
++{
++	soft_connect_hook (0);
++	UDC_set (Ser0UDCCR, UDCCR_UDD);
++	dev->gadget.speed = USB_SPEED_UNKNOWN;
++	ep0_idle(dev);
++}
++
++static void udc_reinit(struct sa1100_udc *dev) {
++    
++	u32	i;
++
++	/* Initialize the gadget controller data structure */
++	INIT_LIST_HEAD (&dev->gadget.ep_list);
++	INIT_LIST_HEAD (&dev->gadget.ep0->ep_list);
++	ep0_idle(dev);
++	for ( i = 0 ; i < 3 ; i++) {
++		struct sa1100_ep *ep = &dev->ep[i];
++		if (i != 0) 
++			list_add_tail(&ep->ep.ep_list, &dev->gadget.ep_list);
++		ep->desc     = NULL;
++		ep->stopped  = 0;
++		INIT_LIST_HEAD(&ep->queue);
++	}
++}
++
++/*  enable the udc at the source */
++static void udc_enable (struct sa1100_udc *dev)
++{
++	UDC_clear (Ser0UDCCR, UDCCR_UDD);
++	ep0_idle(dev);
++}
++
++static void ep0_start (struct sa1100_udc *dev)
++{
++	udc_enable (dev);
++	udelay (100);
++
++	/* clear stall - receiver seems to start stalled? 19Jan01ww */
++	/* also clear other stuff just to be thurough 22Feb01ww */
++	UDC_clear(Ser0UDCCS1, UDCCS1_FST | UDCCS1_RPE | UDCCS1_RPC );
++	UDC_clear(Ser0UDCCS2, UDCCS2_FST | UDCCS2_TPE | UDCCS2_TPC );
++
++	/* mask everything */
++	Ser0UDCCR = 0xFC;
++
++	/* flush DMA and fire through some -EAGAINs */
++	ep1_init (dev->ep[1].dmaregs);
++	ep2_init (dev->ep[2].dmaregs);
++
++	/* enable any platform specific hardware */
++	soft_connect_hook (1);
++
++	/* clear all top-level sources */
++	Ser0UDCSR = UDCSR_RSTIR | UDCSR_RESIR | UDCSR_EIR   |
++		         UDCSR_RIR   | UDCSR_TIR   | UDCSR_SUSIR ;
++
++	/* EXERIMENT - a short line in the spec says toggling this
++	 * bit diddles the internal state machine in the udc to
++	 * expect a suspend
++	 */
++	Ser0UDCCR  |= UDCCR_RESIM;
++	/* END EXPERIMENT 10Feb01ww */
++
++	/* enable any platform specific hardware */
++	soft_connect_hook (1);
++
++	/* Enable interrupts. If you are unplugged you will immediately
++	 * get a suspend interrupt. If you are plugged and have a soft
++	 * connect-circuit, you will get a reset.  If you are plugged
++	 * without a soft-connect, I think you also get suspend. In short,
++	 * start with suspend masked and everything else enabled
++	 */
++	UDC_write( Ser0UDCCR, UDCCR_SUSIM );
++}
++
++
++/* when a driver is successfully registered, it will receive
++ * control requests including set_configuration (), which enables
++ * non-control requests.  then usb traffic follows until a
++ * disconnect is reported.  then a host may connect again, or
++ * the driver might get unbound.
++ */
++int usb_gadget_register_driver (struct usb_gadget_driver *driver)
++{
++	struct sa1100_udc	*dev = the_controller;
++	int			retval;
++
++	if (!driver
++			|| !driver->bind
++			|| !driver->unbind
++			|| !driver->setup)
++		return -EINVAL;
++	if (!dev)
++		return -ENODEV;
++	if (dev->driver)
++		return -EBUSY;
++
++	/* hook up the driver ... */
++	dev->driver = driver;
++	dev->gadget.dev.driver = &driver->driver;
++	
++//	device_add (&dev->gadget.dev);
++	retval = driver->bind (&dev->gadget);
++	if (retval) {
++		DEBUG (dev, "bind to driver %s --> %d\n",
++				driver->driver.name, retval);
++		device_del(&dev->gadget.dev);
++		dev->driver = NULL;
++		dev->gadget.dev.driver = NULL;
++		return retval;
++	}
++
	device_create_file(dev->dev, &dev_attr_function);
++
++	/* ... then enable host detection and ep0; and we're ready
++	 * for set_configuration as well as eventual disconnect.
++	 */
++	ep0_start (dev);
++
++	DEBUG (dev, "%s ready\n", driver->driver.name);
++
++	return 0;
++}
++EXPORT_SYMBOL (usb_gadget_register_driver);
++
++static void
++stop_activity (struct sa1100_udc *dev, struct usb_gadget_driver *driver)
++{
++	int i;
++
++	/* don't disconnect if it's not connected */
++	if (dev->gadget.speed == USB_SPEED_UNKNOWN)
++		driver = NULL;
++
	dev->gadget.speed = USB_SPEED_UNKNOWN;
++
++	/* mask everything */
++	Ser0UDCCR = 0xFC;
++
++	/* stop hardware; prevent new request submissions;
++	 * and kill any outstanding requests.
++	 */
++	for (i = 0; i < 3; i++) {
++		struct sa1100_ep *ep = &dev->ep[i];
++
++		ep->stopped = 1;
++		nuke(ep, -ESHUTDOWN);
++	}
++	udc_disable (dev);
++
++	/* report disconnect; the driver is already quiesced */
++	if (driver) {
++//		spin_unlock (&dev->lock);
++		driver->disconnect (&dev->gadget);
++//		spin_lock (&dev->lock);
++	}
++	/* re-init driver-visible data structures */
++	udc_reinit(dev);
++}
++
++int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
++{
++	struct sa1100_udc	*dev = the_controller;
++
++	if (!dev)
++		return -ENODEV;
++	if (!driver || driver != dev->driver)
++		return -EINVAL;
++
++	local_irq_disable();
++	stop_activity (dev, driver);
++	local_irq_enable();
++	driver->unbind (&dev->gadget);
++	dev->driver = 0;
++
++//printk("%s: deleting device\n",__FUNCTION__);
++//	device_del (&dev->gadget.dev);
++	device_remove_file(dev->dev, &dev_attr_function);
++
++	DEBUG (dev, "unregistered driver '%s'\n", driver->driver.name);
++	return 0;
++}
++EXPORT_SYMBOL (usb_gadget_unregister_driver);
++
++
++/*-------------------------------------------------------------------------*/
++
++/*-------------------------------------------------------------------------*/
++
++//////////////////////////////////////////////////////////////////////////////
++// Proc Filesystem Support
++//////////////////////////////////////////////////////////////////////////////
++
++#if CONFIG_PROC_FS
++
++#define SAY(fmt,args...)  p += sprintf (p, fmt, ## args)
++#define SAYV(num)         p += sprintf (p, num_fmt, "Value", num)
++#define SAYC(label,yn)    p += sprintf (p, yn_fmt, label, yn)
++#define SAYS(label,v)     p += sprintf (p, cnt_fmt, label, v)
++
++static int usbctl_read_proc (char *page, char **start, off_t off,
++			    int count, int *eof, void *data)
++{
++	 const char * num_fmt   = "%25.25s: %8.8lX\n";
++	 const char * cnt_fmt   = "%25.25s: %lu\n";
++	 const char * yn_fmt    = "%25.25s: %s\n";
++	 const char * yes       = "YES";
++	 const char * no        = "NO";
++	 unsigned long v;
++	 char * p = page;
++	 int len;
++
++ 	 SAY ("SA1100 USB Controller Core\n");
++
++	 SAYS ("ep0 bytes read", usbd_info.stats.ep0_bytes_read);
++	 SAYS ("ep0 bytes written", usbd_info.stats.ep0_bytes_written);
++	 SAYS ("ep0 FIFO read failures", usbd_info.stats.ep0_fifo_read_failures);
++	 SAYS ("ep0 FIFO write failures", usbd_info.stats.ep0_fifo_write_failures);
++
++	 SAY ("\n");
++
++	 v = Ser0UDCAR;
++	 SAY ("%25.25s: 0x%8.8lX - %ld\n", "Address Register", v, v);
++	 v = Ser0UDCIMP;
++	 SAY ("%25.25s: %ld (%8.8lX)\n", "IN  max packet size", v+1, v);
++	 v = Ser0UDCOMP;
++	 SAY ("%25.25s: %ld (%8.8lX)\n", "OUT max packet size", v+1, v);
++
++	 v = Ser0UDCCR;
++	 SAY ("\nUDC Mask Register\n");
++	 SAYV (v);
++	 SAYC ("UDC Active", (v & UDCCR_UDA) ? yes : no);
++	 SAYC ("Suspend interrupts masked", (v & UDCCR_SUSIM) ? yes : no);
++	 SAYC ("Resume interrupts masked", (v & UDCCR_RESIM) ? yes : no);
++	 SAYC ("Reset interrupts masked", (v & UDCCR_REM) ? yes : no);
++
++	 v = Ser0UDCSR;
++	 SAY ("\nUDC Interrupt Request Register\n");
++	 SAYV (v);
++	 SAYC ("Reset pending", (v & UDCSR_RSTIR) ? yes : no);
++	 SAYC ("Suspend pending", (v & UDCSR_SUSIR) ? yes : no);
++	 SAYC ("Resume pending", (v & UDCSR_RESIR) ? yes : no);
++	 SAYC ("ep0 pending", (v & UDCSR_EIR)   ? yes : no);
++	 SAYC ("receiver pending", (v & UDCSR_RIR)   ? yes : no);
++	 SAYC ("tramsitter pending", (v & UDCSR_TIR)   ? yes : no);
++
++#ifdef CONFIG_SA1100_EXTENEX1
++	 SAYC ("\nSoft connect", (PPSR & PPC_USB_SOFT_CON) ? "Visible" : "Hidden");
++#endif
++
++#if 1
++	 SAY ("\nDMA Tx registers\n");
++	 {
++	 dma_regs_t *r=the_controller->ep[2].dmaregs;
++	 SAY (" DDAR");
++	 SAYV(r->DDAR);
++	 SAY (" DCSR");
++	 SAYV(r->RdDCSR);
++	 SAY (" DBSA (address buf A) ");
++	 SAYV(r->DBSA);
++	 SAY (" DBTA (transfer count A) ");
++	 SAYV(r->DBTA);
++	 SAY (" DBSB (address buf B) ");
++	 SAYV(r->DBSB);
++	 SAY (" DBTB (transfer count B) ");
++	 SAYV(r->DBTB);
++	 
++	 }
++	 SAY ("\nDMA Rx registers\n");
++	 {
++	 dma_regs_t *r=the_controller->ep[1].dmaregs;
++	 SAY (" DDAR");
++	 SAYV(r->DDAR);
++	 SAY (" DCSR");
++	 SAYV(r->RdDCSR);
++	 SAY (" DBSA (address buf A) ");
++	 SAYV(r->DBSA);
++	 SAY (" DBTA (transfer count A) ");
++	 SAYV(r->DBTA);
++	 SAY (" DBSB (address buf B) ");
++	 SAYV(r->DBSB);
++	 SAY (" DBTB (transfer count B) ");
++	 SAYV(r->DBTB);
++	 
++	 }
++#endif
++#if 1
++	 v = Ser0UDCCS0;
++	 SAY ("\nUDC Endpoint Zero Status Register\n");
++	 SAYV (v);
++	 SAYC ("Out Packet Ready", (v & UDCCS0_OPR) ? yes : no);
++	 SAYC ("In Packet Ready", (v & UDCCS0_IPR) ? yes : no);
++	 SAYC ("Sent Stall", (v & UDCCS0_SST) ? yes : no);
++	 SAYC ("Force Stall", (v & UDCCS0_FST) ? yes : no);
++	 SAYC ("Data End", (v & UDCCS0_DE)  ? yes : no);
++	 SAYC ("Data Setup End", (v & UDCCS0_SE)  ? yes : no);
++	 SAYC ("Serviced (SO)", (v & UDCCS0_SO)  ? yes : no);
++
++	 v = Ser0UDCCS1;
++	 SAY ("\nUDC Receiver Status Register\n");
++	 SAYV (v);
++	 SAYC ("Receive Packet Complete", (v & UDCCS1_RPC) ? yes : no);
++	 SAYC ("Sent Stall", (v & UDCCS1_SST) ? yes : no);
++	 SAYC ("Force Stall", (v & UDCCS1_FST) ? yes : no);
++	 SAYC ("Receive Packet Error", (v & UDCCS1_RPE) ? yes : no);
++	 SAYC ("Receive FIFO not empty", (v & UDCCS1_RNE) ? yes : no);
++
++	 v = Ser0UDCCS2;
++	 SAY ("\nUDC Transmitter Status Register\n");
++	 SAYV (v);
++	 SAYC ("FIFO has < 8 of 16 chars", (v & UDCCS2_TFS) ? yes : no);
++	 SAYC ("Transmit Packet Complete", (v & UDCCS2_TPC) ? yes : no);
++	 SAYC ("Transmit FIFO underrun", (v & UDCCS2_TUR) ? yes : no);
++	 SAYC ("Transmit Packet Error", (v & UDCCS2_TPE) ? yes : no);
++	 SAYC ("Sent Stall", (v & UDCCS2_SST) ? yes : no);
++	 SAYC ("Force Stall", (v & UDCCS2_FST) ? yes : no);
++#endif
++
++	 len = (p - page) - off;
++	 if (len < 0)
++		  len = 0;
++	 *eof = (len <=count) ? 1 : 0;
++	 *start = page + off;
++	 return len;
++}
++
++static inline void register_proc_entry (void)
++{
++	create_proc_read_entry (driver_name, 0, NULL,
++		usbctl_read_proc, NULL);
++}
++
++static inline void unregister_proc_entry (void)
++{
++	remove_proc_entry (driver_name, NULL);
++}
++
++#else
++
++#define register_proc_entry() do {} while (0)
++#define unregister_proc_entry() do {} while (0)
++
++#endif  /* CONFIG_PROC_FS */
++
++/*-------------------------------------------------------------------------*/
++
++MODULE_DESCRIPTION ("sa1100_udc");
++MODULE_AUTHOR ("Various");
++MODULE_LICENSE ("GPL");
++
++static struct sa1100_udc memory = {
++	.gadget = {
++		.ops		= &sa1100_ops,
++		.ep0		= &memory.ep[0].ep,
++		.name		= driver_name,
++/*
++		.dev = {
++			.bus_id		= "gadget",
++			.release	= nop_release,
++		},
++*/
++	},
++
++	/* control endpoint */
++	.ep[0] = {
++		.ep = {
++			.name		= ep0name,
++			.ops		= &sa1100_ep_ops,
++			.maxpacket	= EP0_FIFO_SIZE,
++//			.maxpacket	= 8,
++		},
++		.dev		= &memory,
++/*
++		.reg_udccs	= &UDCCS0,
++		.reg_uddr	= &UDDR0,
++*/
++	},
++
++	/* first group of endpoints */
++	.ep[1] = {
++		.ep = {
++			.name		= "ep1out-bulk",
++			.ops		= &sa1100_ep_ops,
++			.maxpacket	= BULK_FIFO_SIZE,
++//			.maxpacket	= 64,
++		},
++		.dev		= &memory,
++/*
++		.fifo_size	= BULK_FIFO_SIZE,
++		.bEndpointAddress = USB_DIR_IN | 1,
++		.bmAttributes	= USB_ENDPOINT_XFER_BULK,
++		.reg_udccs	= &UDCCS1,
++		.reg_uddr	= &UDDR1,
++		drcmr (25)
++*/
++	},
++	.ep[2] = {
++		.ep = {
++			.name		= "ep2in-bulk",
++			.ops		= &sa1100_ep_ops,
++			.maxpacket	= BULK_FIFO_SIZE,
++//			.maxpacket	= 64,
++		},
++		.dev		= &memory,
++/*
++		.fifo_size	= BULK_FIFO_SIZE,
++		.bEndpointAddress = 2,
++		.bmAttributes	= USB_ENDPOINT_XFER_BULK,
++		.reg_udccs	= &UDCCS2,
++		.reg_ubcr	= &UBCR2,
++		.reg_uddr	= &UDDR2,
++		drcmr (26)
++*/
++	}
++};
++

++static int __init sa1100_udc_probe ( struct device *_dev)
++{
++	struct sa1100_udc *dev=&memory;
++	int retval = 0;
++
++	/* setup dev */
++	dev->dev = _dev;
++//	dev->mach = _dev->platform_data;
++
++	device_initialize(&dev->gadget.dev);
++	dev->gadget.dev.parent = _dev;
++	dev->gadget.dev.dma_mask = _dev->dma_mask;
++
++	the_controller = dev;
++	dev_set_drvdata(_dev, dev);
++
++	/* controller stays disabled until gadget driver is bound */
++	udc_disable (dev);
++	udc_reinit(dev);
++
++//	spin_lock_init(&the_udc.lock);
++	register_proc_entry ();
++
++	/* setup dma channels and IRQ */
++	retval = sa1100_request_dma(DMA_Ser0UDCRd, "USB receive",
++				    NULL, NULL, &dev->ep[1].dmaregs);
++	if (retval) {
++		ERROR (dev, "couldn't get rx dma, err %d\n", retval);
++		goto err_rx_dma;
++	}
++	retval = sa1100_request_dma(DMA_Ser0UDCWr, "USB transmit",
++				    NULL, NULL, &dev->ep[2].dmaregs);
++	if (retval) {
++		ERROR (dev, "couldn't get tx dma, err %d\n", retval);
++		goto err_tx_dma;
++	}
++	retval = request_irq (IRQ_Ser0UDC, udc_int_hndlr, SA_INTERRUPT,
++		driver_name, dev);
++	if (retval) {
++		ERROR (dev, "couldn't get irq, err %d\n", retval);
++		goto err_irq;
++	}
++
++	INFO (dev, "initialized, rx %p tx %p irq %d\n",
++		dev->ep[1].dmaregs, dev->ep[2].dmaregs, IRQ_Ser0UDC);
++	return 0;
++
++err_irq:
++	sa1100_free_dma (dev->ep[2].dmaregs);
++	usbd_info.dmaregs_rx = 0;
++err_tx_dma:
++	sa1100_free_dma (dev->ep[1].dmaregs);
++	usbd_info.dmaregs_tx = 0;
++err_rx_dma:
++	return retval;
++}
++
++static int __exit sa1100_udc_remove (struct device *_dev)
++{
++	struct sa1100_udc *dev = dev_get_drvdata(_dev);
++	
++	udc_disable (dev);
++	unregister_proc_entry ();
++	usb_gadget_unregister_driver (dev->driver);
++	sa1100_free_dma (dev->ep[1].dmaregs);
++	sa1100_free_dma (dev->ep[2].dmaregs);
++	free_irq (IRQ_Ser0UDC, dev);
++	dev_set_drvdata(_dev,NULL);
++	the_controller = NULL;
++	return 0;
++}
++
++static struct device_driver udc_driver = {
++	.name		= "sa11x0-udc",
++	.bus		= &platform_bus_type,
++	.probe		= sa1100_udc_probe,
++	.remove		= __exit_p(sa1100_udc_remove),
++//	.suspend	= sa1100_udc_suspend,
++//	.resume		= sa1100_udc_resume,
++};
++
++static int __init udc_init(void)
++{
++	printk(KERN_INFO "%s: version %s\n", driver_name, DRIVER_VERSION);
++#ifdef NCB_DMA_FIX
++	send_buffer = (char*) kmalloc( SEND_BUFFER_SIZE, GFP_KERNEL | GFP_DMA );
++	receive_buffer = (char*) kmalloc( RECEIVE_BUFFER_SIZE, GFP_KERNEL | GFP_DMA );
++#endif
++	return driver_register(&udc_driver);
++}
++module_init(udc_init);
++
++static void __exit udc_exit(void)
++{
++#ifdef NCB_DMA_FIX
++	if (send_buffer) {
++	    kfree(send_buffer);
++	    send_buffer=NULL;
++	}
++	if (receive_buffer) {
++	    kfree(receive_buffer);
++	    receive_buffer=NULL;
++	}
++#endif
++	driver_unregister(&udc_driver);
++}
++module_exit(udc_exit);
++
+diff -uNr linux-2.6.21.vanilla/drivers/usb/gadget/sa1100_udc.h linux-2.6.21/drivers/usb/gadget/sa1100_udc.h
+--- linux-2.6.21.vanilla/drivers/usb/gadget/sa1100_udc.h	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.21/drivers/usb/gadget/sa1100_udc.h	2007-06-05 11:58:29.000000000 +0200
+@@ -0,0 +1,107 @@
++/*

++ * internals of "new style" UDC controller

++ * <linux/usb_gadget.h> replaces ARM-specific "sa1100_usb.h".

++ */

++

++struct sa1100_ep {

++	struct usb_ep				ep;

++	struct sa1100_udc			*dev;

++	//unsigned long				irqs;

++

++	const struct usb_endpoint_descriptor	*desc;

++	struct list_head			queue;

++	dma_regs_t 				*dmaregs;
++	unsigned 				stopped : 1;

++};

++

++struct sa1100_request {

++	struct usb_request			req;

++	struct list_head			queue;

++// NCB	unsigned				mapped : 1;

++};

++

++enum ep0_state { 
++	EP0_IDLE,
++	EP0_IN_DATA_PHASE,
++	EP0_OUT_DATA_PHASE,
++	EP0_END_XFER,
++	EP0_STALL,
++};
++
++//#define EP0_FIFO_SIZE	((unsigned)16)
++#define EP0_FIFO_SIZE	((unsigned)8)
++#define BULK_FIFO_SIZE	((unsigned)64)
++//#define ISO_FIFO_SIZE	((unsigned)256)
++//#define INT_FIFO_SIZE	((unsigned)8)
++
++struct udc_stats {
++	struct ep0stats {
++		unsigned long		ops;
++		unsigned long		bytes;
++	} read, write;
++	unsigned long			irqs;
++};
++
++struct sa1100_udc {

++	struct usb_gadget			gadget;

++	struct usb_gadget_driver 		*driver;
++	struct device				*dev;
++	enum ep0_state				ep0state;
++	struct udc_stats			stats;
++// NCB	spinlock_t				lock;

++// NCB	dma_regs_t 				*dmaregs_tx, *dmaregs_rx;

++	unsigned				got_irq : 1,
++						vbus : 1,
++						pullup : 1,
++						has_cfr : 1,
++						req_pending : 1,
++						req_std : 1,
++						req_config : 1;
++
++#define start_watchdog(dev) mod_timer(&dev->timer, jiffies + (HZ/200))
++	struct timer_list			timer;
++	u64 dma_mask;
++	unsigned char				address;

++	struct sa1100_ep			ep[3];
++	int					ep0_req_len;
++};

++

++/*-------------------------------------------------------------------------*/

++

++#define xprintk(dev,level,fmt,args...) \

++	printk(level "%s: " fmt , driver_name , ## args)

++

++#ifdef DEBUG

++#undef DEBUG

++#define DEBUG(dev,fmt,args...) \

++	xprintk(dev , KERN_DEBUG , fmt , ## args)

++#else

++#define DEBUG(dev,fmt,args...) \

++	do { } while (0)

++#endif /* DEBUG */

++

++#ifdef VERBOSE

++#define VDEBUG DEBUG

++#else

++#define VDEBUG(dev,fmt,args...) \

++	do { } while (0)

++#endif	/* VERBOSE */

++

++#define ERROR(dev,fmt,args...) \

++	xprintk(dev , KERN_ERR , fmt , ## args)

++#define WARN(dev,fmt,args...) \

++	xprintk(dev , KERN_WARNING , fmt , ## args)

++#define INFO(dev,fmt,args...) \

++	xprintk(dev , KERN_INFO , fmt , ## args)

++

++/*-------------------------------------------------------------------------*/

++

++#ifndef	container_of

++#define container_of list_entry

++#endif

++

++#ifndef WARN_ON

++#define	WARN_ON(x)	do { } while (0)

++#endif

++

++

+diff -uNr linux-2.6.21.vanilla/include/linux/usb_ch9.h linux-2.6.21/include/linux/usb_ch9.h
+--- linux-2.6.21.vanilla/include/linux/usb_ch9.h	1970-01-01 01:00:00.000000000 +0100
++++ linux-2.6.21/include/linux/usb_ch9.h	2007-06-05 11:58:29.000000000 +0200
+@@ -0,0 +1,555 @@
++/*
++ * This file holds USB constants and structures that are needed for USB
++ * device APIs.  These are used by the USB device model, which is defined
++ * in chapter 9 of the USB 2.0 specification.  Linux has several APIs in C
++ * that need these:
++ *
++ * - the master/host side Linux-USB kernel driver API;
++ * - the "usbfs" user space API; and
++ * - the Linux "gadget" slave/device/peripheral side driver API.
++ *
++ * USB 2.0 adds an additional "On The Go" (OTG) mode, which lets systems
++ * act either as a USB master/host or as a USB slave/device.  That means
++ * the master and slave side APIs benefit from working well together.
++ *
++ * There's also "Wireless USB", using low power short range radios for
++ * peripheral interconnection but otherwise building on the USB framework.
++ */
++
++#ifndef __LINUX_USB_CH9_H
++#define __LINUX_USB_CH9_H
++
++#include <linux/types.h>	/* __u8 etc */
++
++/*-------------------------------------------------------------------------*/
++
++/* CONTROL REQUEST SUPPORT */
++
++/*
++ * USB directions
++ *
++ * This bit flag is used in endpoint descriptors' bEndpointAddress field.
++ * It's also one of three fields in control requests bRequestType.
++ */
++#define USB_DIR_OUT			0		/* to device */
++#define USB_DIR_IN			0x80		/* to host */
++
++/*
++ * USB types, the second of three bRequestType fields
++ */
++#define USB_TYPE_MASK			(0x03 << 5)
++#define USB_TYPE_STANDARD		(0x00 << 5)
++#define USB_TYPE_CLASS			(0x01 << 5)
++#define USB_TYPE_VENDOR			(0x02 << 5)
++#define USB_TYPE_RESERVED		(0x03 << 5)
++
++/*
++ * USB recipients, the third of three bRequestType fields
++ */
++#define USB_RECIP_MASK			0x1f
++#define USB_RECIP_DEVICE		0x00
++#define USB_RECIP_INTERFACE		0x01
++#define USB_RECIP_ENDPOINT		0x02
++#define USB_RECIP_OTHER			0x03
++
++/*
++ * Standard requests, for the bRequest field of a SETUP packet.
++ *
++ * These are qualified by the bRequestType field, so that for example
++ * TYPE_CLASS or TYPE_VENDOR specific feature flags could be retrieved
++ * by a GET_STATUS request.
++ */
++#define USB_REQ_GET_STATUS		0x00
++#define USB_REQ_CLEAR_FEATURE		0x01
++#define USB_REQ_SET_FEATURE		0x03
++#define USB_REQ_SET_ADDRESS		0x05
++#define USB_REQ_GET_DESCRIPTOR		0x06
++#define USB_REQ_SET_DESCRIPTOR		0x07
++#define USB_REQ_GET_CONFIGURATION	0x08
++#define USB_REQ_SET_CONFIGURATION	0x09
++#define USB_REQ_GET_INTERFACE		0x0A
++#define USB_REQ_SET_INTERFACE		0x0B
++#define USB_REQ_SYNCH_FRAME		0x0C
++
++#define USB_REQ_SET_ENCRYPTION		0x0D	/* Wireless USB */
++#define USB_REQ_GET_ENCRYPTION		0x0E
++#define USB_REQ_SET_HANDSHAKE		0x0F
++#define USB_REQ_GET_HANDSHAKE		0x10
++#define USB_REQ_SET_CONNECTION		0x11
++#define USB_REQ_SET_SECURITY_DATA	0x12
++#define USB_REQ_GET_SECURITY_DATA	0x13
++#define USB_REQ_SET_WUSB_DATA		0x14
++#define USB_REQ_LOOPBACK_DATA_WRITE	0x15
++#define USB_REQ_LOOPBACK_DATA_READ	0x16
++#define USB_REQ_SET_INTERFACE_DS	0x17
++
++/*
++ * USB feature flags are written using USB_REQ_{CLEAR,SET}_FEATURE, and
++ * are read as a bit array returned by USB_REQ_GET_STATUS.  (So there
++ * are at most sixteen features of each type.)
++ */
++#define USB_DEVICE_SELF_POWERED		0	/* (read only) */
++#define USB_DEVICE_REMOTE_WAKEUP	1	/* dev may initiate wakeup */
++#define USB_DEVICE_TEST_MODE		2	/* (wired high speed only) */
++#define USB_DEVICE_BATTERY		2	/* (wireless) */
++#define USB_DEVICE_B_HNP_ENABLE		3	/* (otg) dev may initiate HNP */
++#define USB_DEVICE_WUSB_DEVICE		3	/* (wireless)*/
++#define USB_DEVICE_A_HNP_SUPPORT	4	/* (otg) RH port supports HNP */
++#define USB_DEVICE_A_ALT_HNP_SUPPORT	5	/* (otg) other RH port does */
++#define USB_DEVICE_DEBUG_MODE		6	/* (special devices only) */
++
++#define USB_ENDPOINT_HALT		0	/* IN/OUT will STALL */
++
++
++/**
++ * struct usb_ctrlrequest - SETUP data for a USB device control request
++ * @bRequestType: matches the USB bmRequestType field
++ * @bRequest: matches the USB bRequest field
++ * @wValue: matches the USB wValue field (le16 byte order)
++ * @wIndex: matches the USB wIndex field (le16 byte order)
++ * @wLength: matches the USB wLength field (le16 byte order)
++ *
++ * This structure is used to send control requests to a USB device.  It matches
++ * the different fields of the USB 2.0 Spec section 9.3, table 9-2.  See the
++ * USB spec for a fuller description of the different fields, and what they are
++ * used for.
++ *
++ * Note that the driver for any interface can issue control requests.
++ * For most devices, interfaces don't coordinate with each other, so
++ * such requests may be made at any time.
++ */
++struct usb_ctrlrequest {
++	__u8 bRequestType;
++	__u8 bRequest;
++	__le16 wValue;
++	__le16 wIndex;
++	__le16 wLength;
++} __attribute__ ((packed));
++
++/*-------------------------------------------------------------------------*/
++
++/*
++ * STANDARD DESCRIPTORS ... as returned by GET_DESCRIPTOR, or
++ * (rarely) accepted by SET_DESCRIPTOR.
++ *
++ * Note that all multi-byte values here are encoded in little endian
++ * byte order "on the wire".  But when exposed through Linux-USB APIs,
++ * they've been converted to cpu byte order.
++ */
++
++/*
++ * Descriptor types ... USB 2.0 spec table 9.5
++ */
++#define USB_DT_DEVICE			0x01
++#define USB_DT_CONFIG			0x02
++#define USB_DT_STRING			0x03
++#define USB_DT_INTERFACE		0x04
++#define USB_DT_ENDPOINT			0x05
++#define USB_DT_DEVICE_QUALIFIER		0x06
++#define USB_DT_OTHER_SPEED_CONFIG	0x07
++#define USB_DT_INTERFACE_POWER		0x08
++/* these are from a minor usb 2.0 revision (ECN) */
++#define USB_DT_OTG			0x09
++#define USB_DT_DEBUG			0x0a
++#define USB_DT_INTERFACE_ASSOCIATION	0x0b
++/* these are from the Wireless USB spec */
++#define USB_DT_SECURITY			0x0c
++#define USB_DT_KEY			0x0d
++#define USB_DT_ENCRYPTION_TYPE		0x0e
++#define USB_DT_BOS			0x0f
++#define USB_DT_DEVICE_CAPABILITY	0x10
++#define USB_DT_WIRELESS_ENDPOINT_COMP	0x11
++
++/* conventional codes for class-specific descriptors */
++#define USB_DT_CS_DEVICE		0x21
++#define USB_DT_CS_CONFIG		0x22
++#define USB_DT_CS_STRING		0x23
++#define USB_DT_CS_INTERFACE		0x24
++#define USB_DT_CS_ENDPOINT		0x25
++
++/* All standard descriptors have these 2 fields at the beginning */
++struct usb_descriptor_header {
++	__u8  bLength;
++	__u8  bDescriptorType;
++} __attribute__ ((packed));
++
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_DEVICE: Device descriptor */
++struct usb_device_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__le16 bcdUSB;
++	__u8  bDeviceClass;
++	__u8  bDeviceSubClass;
++	__u8  bDeviceProtocol;
++	__u8  bMaxPacketSize0;
++	__le16 idVendor;
++	__le16 idProduct;
++	__le16 bcdDevice;
++	__u8  iManufacturer;
++	__u8  iProduct;
++	__u8  iSerialNumber;
++	__u8  bNumConfigurations;
++} __attribute__ ((packed));
++
++#define USB_DT_DEVICE_SIZE		18
++
++
++/*
++ * Device and/or Interface Class codes
++ * as found in bDeviceClass or bInterfaceClass
++ * and defined by www.usb.org documents
++ */
++#define USB_CLASS_PER_INTERFACE		0	/* for DeviceClass */
++#define USB_CLASS_AUDIO			1
++#define USB_CLASS_COMM			2
++#define USB_CLASS_HID			3
++#define USB_CLASS_PHYSICAL		5
++#define USB_CLASS_STILL_IMAGE		6
++#define USB_CLASS_PRINTER		7
++#define USB_CLASS_MASS_STORAGE		8
++#define USB_CLASS_HUB			9
++#define USB_CLASS_CDC_DATA		0x0a
++#define USB_CLASS_CSCID			0x0b	/* chip+ smart card */
++#define USB_CLASS_CONTENT_SEC		0x0d	/* content security */
++#define USB_CLASS_VIDEO			0x0e
++#define USB_CLASS_WIRELESS_CONTROLLER	0xe0
++#define USB_CLASS_APP_SPEC		0xfe
++#define USB_CLASS_VENDOR_SPEC		0xff
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_CONFIG: Configuration descriptor information.
++ *
++ * USB_DT_OTHER_SPEED_CONFIG is the same descriptor, except that the
++ * descriptor type is different.  Highspeed-capable devices can look
++ * different depending on what speed they're currently running.  Only
++ * devices with a USB_DT_DEVICE_QUALIFIER have any OTHER_SPEED_CONFIG
++ * descriptors.
++ */
++struct usb_config_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__le16 wTotalLength;
++	__u8  bNumInterfaces;
++	__u8  bConfigurationValue;
++	__u8  iConfiguration;
++	__u8  bmAttributes;
++	__u8  bMaxPower;
++} __attribute__ ((packed));
++
++#define USB_DT_CONFIG_SIZE		9
++
++/* from config descriptor bmAttributes */
++#define USB_CONFIG_ATT_ONE		(1 << 7)	/* must be set */
++#define USB_CONFIG_ATT_SELFPOWER	(1 << 6)	/* self powered */
++#define USB_CONFIG_ATT_WAKEUP		(1 << 5)	/* can wakeup */
++#define USB_CONFIG_ATT_BATTERY		(1 << 4)	/* battery powered */
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_STRING: String descriptor */
++struct usb_string_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__le16 wData[1];		/* UTF-16LE encoded */
++} __attribute__ ((packed));
++
++/* note that "string" zero is special, it holds language codes that
++ * the device supports, not Unicode characters.
++ */
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_INTERFACE: Interface descriptor */
++struct usb_interface_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bInterfaceNumber;
++	__u8  bAlternateSetting;
++	__u8  bNumEndpoints;
++	__u8  bInterfaceClass;
++	__u8  bInterfaceSubClass;
++	__u8  bInterfaceProtocol;
++	__u8  iInterface;
++} __attribute__ ((packed));
++
++#define USB_DT_INTERFACE_SIZE		9
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_ENDPOINT: Endpoint descriptor */
++struct usb_endpoint_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bEndpointAddress;
++	__u8  bmAttributes;
++	__le16 wMaxPacketSize;
++	__u8  bInterval;
++
++	/* NOTE:  these two are _only_ in audio endpoints. */
++	/* use USB_DT_ENDPOINT*_SIZE in bLength, not sizeof. */
++	__u8  bRefresh;
++	__u8  bSynchAddress;
++} __attribute__ ((packed));
++
++#define USB_DT_ENDPOINT_SIZE		7
++#define USB_DT_ENDPOINT_AUDIO_SIZE	9	/* Audio extension */
++
++
++/*
++ * Endpoints
++ */
++#define USB_ENDPOINT_NUMBER_MASK	0x0f	/* in bEndpointAddress */
++#define USB_ENDPOINT_DIR_MASK		0x80
++
++#define USB_ENDPOINT_XFERTYPE_MASK	0x03	/* in bmAttributes */
++#define USB_ENDPOINT_XFER_CONTROL	0
++#define USB_ENDPOINT_XFER_ISOC		1
++#define USB_ENDPOINT_XFER_BULK		2
++#define USB_ENDPOINT_XFER_INT		3
++#define USB_ENDPOINT_MAX_ADJUSTABLE	0x80
++
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_DEVICE_QUALIFIER: Device Qualifier descriptor */
++struct usb_qualifier_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__le16 bcdUSB;
++	__u8  bDeviceClass;
++	__u8  bDeviceSubClass;
++	__u8  bDeviceProtocol;
++	__u8  bMaxPacketSize0;
++	__u8  bNumConfigurations;
++	__u8  bRESERVED;
++} __attribute__ ((packed));
++
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_OTG (from OTG 1.0a supplement) */
++struct usb_otg_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bmAttributes;	/* support for HNP, SRP, etc */
++} __attribute__ ((packed));
++
++/* from usb_otg_descriptor.bmAttributes */
++#define USB_OTG_SRP		(1 << 0)
++#define USB_OTG_HNP		(1 << 1)	/* swap host/device roles */
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_DEBUG:  for special highspeed devices, replacing serial console */
++struct usb_debug_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	/* bulk endpoints with 8 byte maxpacket */
++	__u8  bDebugInEndpoint;
++	__u8  bDebugOutEndpoint;
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_INTERFACE_ASSOCIATION: groups interfaces */
++struct usb_interface_assoc_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bFirstInterface;
++	__u8  bInterfaceCount;
++	__u8  bFunctionClass;
++	__u8  bFunctionSubClass;
++	__u8  bFunctionProtocol;
++	__u8  iFunction;
++} __attribute__ ((packed));
++
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_SECURITY:  group of wireless security descriptors, including
++ * encryption types available for setting up a CC/association.
++ */
++struct usb_security_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__le16 wTotalLength;
++	__u8  bNumEncryptionTypes;
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_KEY:  used with {GET,SET}_SECURITY_DATA; only public keys
++ * may be retrieved.
++ */
++struct usb_key_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  tTKID[3];
++	__u8  bReserved;
++	__u8  bKeyData[0];
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_ENCRYPTION_TYPE:  bundled in DT_SECURITY groups */
++struct usb_encryption_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bEncryptionType;
++#define	USB_ENC_TYPE_UNSECURE		0
++#define	USB_ENC_TYPE_WIRED		1	/* non-wireless mode */
++#define	USB_ENC_TYPE_CCM_1		2	/* aes128/cbc session */
++#define	USB_ENC_TYPE_RSA_1		3	/* rsa3072/sha1 auth */
++	__u8  bEncryptionValue;		/* use in SET_ENCRYPTION */
++	__u8  bAuthKeyIndex;
++};
++
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_BOS:  group of wireless capabilities */
++struct usb_bos_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__le16 wTotalLength;
++	__u8  bNumDeviceCaps;
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_DEVICE_CAPABILITY:  grouped with BOS */
++struct usb_dev_cap_header {
++	__u8  bLength;
++	__u8  bDescriptorType;
++	__u8  bDevCapabilityType;
++};
++
++#define	USB_CAP_TYPE_WIRELESS_USB	1
++
++struct usb_wireless_cap_descriptor {	/* Ultra Wide Band */
++	__u8  bLength;
++	__u8  bDescriptorType;
++	__u8  bDevCapabilityType;
++
++	__u8  bmAttributes;
++#define	USB_WIRELESS_P2P_DRD		(1 << 1)
++#define	USB_WIRELESS_BEACON_MASK	(3 << 2)
++#define	USB_WIRELESS_BEACON_SELF	(1 << 2)
++#define	USB_WIRELESS_BEACON_DIRECTED	(2 << 2)
++#define	USB_WIRELESS_BEACON_NONE	(3 << 2)
++	__le16 wPHYRates;	/* bit rates, Mbps */
++#define	USB_WIRELESS_PHY_53		(1 << 0)	/* always set */
++#define	USB_WIRELESS_PHY_80		(1 << 1)
++#define	USB_WIRELESS_PHY_107		(1 << 2)	/* always set */
++#define	USB_WIRELESS_PHY_160		(1 << 3)
++#define	USB_WIRELESS_PHY_200		(1 << 4)	/* always set */
++#define	USB_WIRELESS_PHY_320		(1 << 5)
++#define	USB_WIRELESS_PHY_400		(1 << 6)
++#define	USB_WIRELESS_PHY_480		(1 << 7)
++	__u8  bmTFITXPowerInfo;	/* TFI power levels */
++	__u8  bmFFITXPowerInfo;	/* FFI power levels */
++	__le16 bmBandGroup;
++	__u8  bReserved;
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_DT_WIRELESS_ENDPOINT_COMP:  companion descriptor associated with
++ * each endpoint descriptor for a wireless device
++ */
++struct usb_wireless_ep_comp_descriptor {
++	__u8  bLength;
++	__u8  bDescriptorType;
++
++	__u8  bMaxBurst;
++	__u8  bMaxSequence;
++	__le16 wMaxStreamDelay;
++	__le16 wOverTheAirPacketSize;
++	__u8  bOverTheAirInterval;
++	__u8  bmCompAttributes;
++#define USB_ENDPOINT_SWITCH_MASK	0x03	/* in bmCompAttributes */
++#define USB_ENDPOINT_SWITCH_NO		0
++#define USB_ENDPOINT_SWITCH_SWITCH	1
++#define USB_ENDPOINT_SWITCH_SCALE	2
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_REQ_SET_HANDSHAKE is a four-way handshake used between a wireless
++ * host and a device for connection set up, mutual authentication, and
++ * exchanging short lived session keys.  The handshake depends on a CC.
++ */
++struct usb_handshake {
++	__u8 bMessageNumber;
++	__u8 bStatus;
++	__u8 tTKID[3];
++	__u8 bReserved;
++	__u8 CDID[16];
++	__u8 nonce[16];
++	__u8 MIC[8];
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* USB_REQ_SET_CONNECTION modifies or revokes a connection context (CC).
++ * A CC may also be set up using non-wireless secure channels (including
++ * wired USB!), and some devices may support CCs with multiple hosts.
++ */
++struct usb_connection_context {
++	__u8 CHID[16];		/* persistent host id */
++	__u8 CDID[16];		/* device id (unique w/in host context) */
++	__u8 CK[16];		/* connection key */
++};
++
++/*-------------------------------------------------------------------------*/
++
++/* USB 2.0 defines three speeds, here's how Linux identifies them */
++
++enum usb_device_speed {
++	USB_SPEED_UNKNOWN = 0,			/* enumerating */
++	USB_SPEED_LOW, USB_SPEED_FULL,		/* usb 1.1 */
++	USB_SPEED_HIGH,				/* usb 2.0 */
++	USB_SPEED_VARIABLE,			/* wireless (usb 2.5) */
++};
++
++enum usb_device_state {
++	/* NOTATTACHED isn't in the USB spec, and this state acts
++	 * the same as ATTACHED ... but it's clearer this way.
++	 */
++	USB_STATE_NOTATTACHED = 0,
++
++	/* chapter 9 and authentication (wireless) device states */
++	USB_STATE_ATTACHED,
++	USB_STATE_POWERED,			/* wired */
++	USB_STATE_UNAUTHENTICATED,		/* auth */
++	USB_STATE_RECONNECTING,			/* auth */
++	USB_STATE_DEFAULT,			/* limited function */
++	USB_STATE_ADDRESS,
++	USB_STATE_CONFIGURED,			/* most functions */
++
++	USB_STATE_SUSPENDED
++
++	/* NOTE:  there are actually four different SUSPENDED
++	 * states, returning to POWERED, DEFAULT, ADDRESS, or
++	 * CONFIGURED respectively when SOF tokens flow again.
++	 */
++};
++
++#endif	/* __LINUX_USB_CH9_H */
diff --git a/packages/linux/linux/simpad/linux-2.6.21-pcmcia-device-to-platform-driver.patch b/packages/linux/linux/simpad/linux-2.6.21-pcmcia-device-to-platform-driver.patch
deleted file mode 100644
index e6233cbe30..0000000000
--- a/packages/linux/linux/simpad/linux-2.6.21-pcmcia-device-to-platform-driver.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-diff -uNr linux-2.6.21.vanilla/drivers/pcmcia/sa1100_generic.c linux-2.6.21/drivers/pcmcia/sa1100_generic.c
---- linux-2.6.21.vanilla/drivers/pcmcia/sa1100_generic.c	2007-05-01 16:40:46.000000000 +0200
-+++ linux-2.6.21/drivers/pcmcia/sa1100_generic.c	2007-05-01 19:38:05.000000000 +0200
-@@ -28,6 +28,9 @@
-     the provisions above, a recipient may use your version of this
-     file under either the MPL or the GPL.
-     
-+    2007 mrnice: added thesings changes from device_driver
-+            to platform_driver - many thx to thesing
-+
- ======================================================================*/
- 
- #include <linux/module.h>
-@@ -81,13 +84,15 @@
- 	return ret;
- }
- 
--static struct device_driver sa11x0_pcmcia_driver = {
--	.probe		= sa11x0_drv_pcmcia_probe,
--	.remove		= soc_common_drv_pcmcia_remove,
--	.name		= "sa11x0-pcmcia",
--	.bus		= &platform_bus_type,
--	.suspend 	= pcmcia_socket_dev_suspend,
--	.resume 	= pcmcia_socket_dev_resume,
-+static struct platform_driver sa11x0_pcmcia_driver = {
-+       .driver        = {
-+              .name   = "sa11x0-pcmcia",
-+              .probe = sa11x0_drv_pcmcia_probe,
-+              .remove        = soc_common_drv_pcmcia_remove,
-+              .suspend= pcmcia_socket_dev_suspend,
-+              .resume        = pcmcia_socket_dev_resume,
-+              //.bus = &platform_bus_type,
-+       },
- };
- 
- /* sa11x0_pcmcia_init()
-@@ -100,7 +105,7 @@
-  */
- static int __init sa11x0_pcmcia_init(void)
- {
--	return driver_register(&sa11x0_pcmcia_driver);
-+        return platform_driver_register(&sa11x0_pcmcia_driver);
- }
- 
- /* sa11x0_pcmcia_exit()
-@@ -110,7 +115,7 @@
-  */
- static void __exit sa11x0_pcmcia_exit(void)
- {
--	driver_unregister(&sa11x0_pcmcia_driver);
-+        platform_driver_unregister(&sa11x0_pcmcia_driver);
- }
- 
- MODULE_AUTHOR("John Dorsey <john+@cs.cmu.edu>");
diff --git a/packages/linux/linux_2.6.21.bb b/packages/linux/linux_2.6.21.bb
index fda06caaf1..37c8f9cce5 100644
--- a/packages/linux/linux_2.6.21.bb
+++ b/packages/linux/linux_2.6.21.bb
@@ -2,7 +2,7 @@ require linux.inc
 
 DEFAULT_PREFERENCE_at91sam9263ek = "-1"
 
-PR = "r4"
+PR = "r5"
 
 SRC_URI = "${KERNELORG_MIRROR}/pub/linux/kernel/v2.6/linux-${PV}.tar.bz2 \
            file://defconfig \
@@ -11,9 +11,14 @@ SRC_URI = "${KERNELORG_MIRROR}/pub/linux/kernel/v2.6/linux-${PV}.tar.bz2 \
 SRC_URI_append_simpad = "\
            file://linux-2.6.21-SIMpad-cs3-simpad.patch;patch=1 \
            file://linux-2.6.21-SIMpad-mq200.patch;patch=1 \
-           file://linux-2.6.21-SIMpad-serial-and-gpio_keys.patch;patch=1 \
+           file://linux-2.6.21-SIMpad-serial-gpio_keys-and-cs3-ro.patch;patch=1 \
            file://linux-2.6.21-SIMpad-ucb1x00-switches.patch;patch=1 \
-           file://linux-2.6.21-pcmcia-device-to-platform-driver.patch;patch=1 \
+	   file://linux-2.6.21-SIMpad-pcmcia.patch;patch=1 \
+	   file://linux-2.6.21-SIMpad-net-shared-irq.patch;patch=1 \
+	   file://linux-2.6.21-SIMpad-ucb1x00-ts-supend-and-accuracy.patch;patch=1 \
+           file://linux-2.6.21-SIMpad-GPIO-MMC-mod.patch;patch=1 \
+	   file://linux-2.6.21-SIMpad-battery-old-way-but-also-with-sysfs.patch;patch=1 \
+	   file://linux-2.6.21-SIMpad-usb-gadget.patch;patch=1 \
            "
 SRC_URI_append_kb9202 = " http://maxim.org.za/AT91RM9200/2.6/2.6.21-at91.patch.gz;patch=1 "
 SRC_URI_append_at91sam9263ek = " http://maxim.org.za/AT91RM9200/2.6/2.6.21-at91.patch.gz;patch=1 "
diff --git a/packages/openssl/openssl-0.9.7g/gnueabi-armeb.patch b/packages/openssl/openssl-0.9.7g/gnueabi-armeb.patch
new file mode 100644
index 0000000000..38f725b789
--- /dev/null
+++ b/packages/openssl/openssl-0.9.7g/gnueabi-armeb.patch
@@ -0,0 +1,10 @@
+--- openssl-0.9.7g/Configure~	2007-07-07 21:08:27.000000000 +0930
++++ openssl-0.9.7g/Configure	2007-07-07 21:13:41.000000000 +0930
+@@ -477,6 +477,7 @@
+ "linux-elf-arm","gcc:-DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ "linux-elf-armeb","gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ "linux-gnueabi-arm","gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-gnueabi-armeb","gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ 
+ # SCO/Caldera targets.
+ #
diff --git a/packages/openssl/openssl_0.9.7g.bb b/packages/openssl/openssl_0.9.7g.bb
index cc9162c1cf..d61a3a8297 100644
--- a/packages/openssl/openssl_0.9.7g.bb
+++ b/packages/openssl/openssl_0.9.7g.bb
@@ -2,8 +2,9 @@ inherit pkgconfig
 
 require openssl.inc
 
-PR = "r3"
+PR = "r4"
 
 SRC_URI += "file://debian.patch;patch=1 \
             file://armeb.patch;patch=1;pnum=0 \
-            file://gnueabi-arm.patch;patch=1"
+            file://gnueabi-arm.patch;patch=1 \
+            file://gnueabi-armeb.patch;patch=1"
diff --git a/packages/opie-icon-reload/opie-icon-reload.inc b/packages/opie-icon-reload/opie-icon-reload.inc
index 131f2cc58b..a83aa34f96 100644
--- a/packages/opie-icon-reload/opie-icon-reload.inc
+++ b/packages/opie-icon-reload/opie-icon-reload.inc
@@ -13,11 +13,12 @@ FILES_${PN} += "${palmtopdir}"
 
 do_install() {		
 	install -d ${D}${palmtopdir}/apps/Settings
-	install -d ${D}${palmtopdir}/bin
+	install -d ${D}${bindir}
 	install -d ${D}${palmtopdir}/pics
 	
 	install -m 0644 ${WORKDIR}/icon-reload.desktop ${D}${palmtopdir}/apps/Settings
-	install -m 0755 ${WORKDIR}/icon-reload.sh ${D}${palmtopdir}/bin
+	install -m 0755 ${WORKDIR}/icon-reload.sh ${D}${bindir}
+	sed -i -e 's,@bindir@,${bindir},g' ${D}${bindir}/icon-reload.sh
 	install -m 0644 ${WORKDIR}/reload.png ${D}${palmtopdir}/pics	
 }
 
diff --git a/packages/opie-icon-reload/opie-icon-reload/icon-reload.sh b/packages/opie-icon-reload/opie-icon-reload/icon-reload.sh
index 3df151c207..adeba397ee 100755
--- a/packages/opie-icon-reload/opie-icon-reload/icon-reload.sh
+++ b/packages/opie-icon-reload/opie-icon-reload/icon-reload.sh
@@ -1,4 +1,4 @@
 #!/bin/sh
 
-/opt/QtPalmtop/bin/qcop QPE/TaskBar "reloadInputMethods()"                                            
-/opt/QtPalmtop/bin/qcop QPE/System "linkChanged(QString)" 
+@bindir@/qcop QPE/TaskBar "reloadInputMethods()"                                            
+@bindir@/qcop QPE/System "linkChanged(QString)" 
diff --git a/packages/opie-icon-reload/opie-icon-reload_1.2.2.bb b/packages/opie-icon-reload/opie-icon-reload_1.2.2.bb
index a4897d0190..13a5942517 100644
--- a/packages/opie-icon-reload/opie-icon-reload_1.2.2.bb
+++ b/packages/opie-icon-reload/opie-icon-reload_1.2.2.bb
@@ -1,3 +1,3 @@
 require ${PN}.inc
 
-PR = "r1"
+PR = "r2"
diff --git a/packages/opie-taskbar/opie-taskbar-images.inc b/packages/opie-taskbar/opie-taskbar-images.inc
index f3cef44835..2e84210718 100644
--- a/packages/opie-taskbar/opie-taskbar-images.inc
+++ b/packages/opie-taskbar/opie-taskbar-images.inc
@@ -28,19 +28,23 @@ do_install() {
 	install -m 0644 ${WORKDIR}/pics/launcher/firstuse.jpg ${D}${palmtopdir}/pics/launcher/firstuse-240x320.jpg
 	install -m 0644 ${WORKDIR}/pics/launcher/opie-background.jpg ${D}${palmtopdir}/pics/launcher/opie-background-240x320.jpg
 
-	install -m 0644 ${WORKDIR}/pics/launcher/firstuse-480x640.jpg ${D}${palmtopdir}/pics/launcher/firstuse-480x640.jpg
-	install -m 0644 ${WORKDIR}/pics/launcher/opie-background-480x640.jpg ${D}${palmtopdir}/pics/launcher/opie-background-480x640.jpg
-
-	install -m 0644 ${WORKDIR}/pics/launcher/firstuse-640x480.jpg ${D}${palmtopdir}/pics/launcher/firstuse-640x480.jpg
-	install -m 0644 ${WORKDIR}/pics/launcher/opie-background-640x480.jpg ${D}${palmtopdir}/pics/launcher/opie-background-640x480.jpg
-
-	install -m 0644 ${WORKDIR}/pics/launcher/firstuse-800x600.jpg ${D}${palmtopdir}/pics/launcher/firstuse-800x600.jpg
-	install -m 0644 ${WORKDIR}/pics/launcher/opie-background-800x600.jpg ${D}${palmtopdir}/pics/launcher/opie-background-800x600.jpg
+        for res in 480x640 640x480 800x600 ; do
+         install -m 0644 ${WORKDIR}/pics/launcher/firstuse-${res}.jpg ${D}${palmtopdir}/pics/launcher/firstuse-${res}.jpg
+         install -m 0644 ${WORKDIR}/pics/launcher/opie-background-${res}.jpg ${D}${palmtopdir}/pics/launcher/opie-background-${res}.jpg
+        done
 }
 
-FILES_${PN}-240x320 += " ${palmtopdir}/pics/*/*-240x320.*"
-FILES_${PN}-480x640 += " ${palmtopdir}/pics/*/*-480x640.*"
-FILES_${PN}-640x480 += " ${palmtopdir}/pics/*/*-640x480.*"
-FILES_${PN}-800x600 += " ${palmtopdir}/pics/*/*-800x600.*"
+python do_package_prepend () {
+        reslist = ['240x320','480x640','640x480', '800x600']
+        dir = bb.data.expand('${palmtopdir}/pics/launcher/', d)
+        ft = bb.data.expand('${palmtopdir}/pics/*/*-%s.*', d)
+        pn = bb.data.getVar('PN', d, 1)
+        for res in reslist:
+         bb.data.setVar('FILES_%s-%s' % (pn,res), ft % res, d )
+         postinst = ''
+         postinst = 'update-alternatives --install %sfirstuse.jpg opie-firstuse-pixmap %sfirstuse-%s.jpg 50\n' % (dir,dir,res)
+         postinst += 'update-alternatives --install %sopie-background.jpg opie-background-pixmap %sopie-background-%s.jpg 50\n' % (dir,dir,res)
+         bb.data.setVar('pkg_postinst_%s-%s' % (pn,res),postinst, d)
+}
 
 PACKAGE_ARCH = "all"
diff --git a/packages/opie-taskbar/opie-taskbar-images_cvs.bb b/packages/opie-taskbar/opie-taskbar-images_cvs.bb
index 0566431474..718160cb4d 100644
--- a/packages/opie-taskbar/opie-taskbar-images_cvs.bb
+++ b/packages/opie-taskbar/opie-taskbar-images_cvs.bb
@@ -1,5 +1,5 @@
 require ${PN}.inc
 PV = "${OPIE_CVS_PV}"
-PR = "r3"
+PR = "r4"
 
 SRC_URI = "${HANDHELDS_CVS};module=opie/pics"
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/.mtn2git_empty b/packages/qemu/qemu-0.9.0+cvs20070701/.mtn2git_empty
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20070701/.mtn2git_empty
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/arm_nptl-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/arm_nptl-0.9.0.patch
new file mode 100644
index 0000000000..fe1f0945b6
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20070701/arm_nptl-0.9.0.patch
@@ -0,0 +1,853 @@
+diff -Naru qemu-snapshot-2007-06-24_05.orig/configure qemu-snapshot-2007-06-24_05/configure
+--- qemu-snapshot-2007-06-24_05.orig/configure	2007-06-24 16:31:54.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/configure	2007-06-24 16:33:58.000000000 +0200
+@@ -101,6 +101,7 @@
+ darwin_user="no"
+ build_docs="no"
+ uname_release=""
++nptl="yes"
+ 
+ # OS specific
+ targetos=`uname -s`
+@@ -287,6 +288,8 @@
+         *)     echo "undefined SPARC architecture. Exiting";exit 1;;
+       esac
+   ;;
++  --disable-nptl) nptl="no"
++  ;;
+   esac
+ done
+ 
+@@ -530,6 +533,23 @@
+ }
+ EOF
+ 
++# check NPTL support
++cat > $TMPC <<EOF
++#include <sched.h>
++void foo()
++{
++#ifndef CLONE_SETTLS
++#error bork
++#endif
++}
++EOF
++
++if $cc -c -o $TMPO $TMPC 2> /dev/null ; then
++  :
++else
++   nptl="no"
++fi
++
+ ##########################################
+ # SDL probe
+ 
+@@ -681,6 +701,7 @@
+     echo "Target Sparc Arch $sparc_cpu"
+ fi
+ echo "kqemu support     $kqemu"
++echo "NPTL support      $nptl"
+ echo "Documentation     $build_docs"
+ [ ! -z "$uname_release" ] && \
+ echo "uname -r          $uname_release"
+@@ -1063,6 +1084,14 @@
+             echo "SDL_CFLAGS=`$sdl_config --cflags`" >> $config_mak
+         fi
+     fi
++else
++    if test "$nptl" = "yes" ; then
++        case "$target_cpu" in
++          arm | armeb)
++            echo "#define USE_NPTL 1" >> $config_h
++          ;;
++        esac
++    fi
+ fi
+ 
+ if test "$cocoa" = "yes" ; then
+diff -Naru qemu-snapshot-2007-06-24_05.orig/exec-all.h qemu-snapshot-2007-06-24_05/exec-all.h
+--- qemu-snapshot-2007-06-24_05.orig/exec-all.h	2007-05-23 21:58:10.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/exec-all.h	2007-06-24 16:33:58.000000000 +0200
+@@ -360,170 +360,7 @@
+ extern CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
+ extern void *io_mem_opaque[IO_MEM_NB_ENTRIES];
+ 
+-#if defined(__powerpc__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-    __asm__ __volatile__ (
+-                          "0:    lwarx %0,0,%1\n"
+-                          "      xor. %0,%3,%0\n"
+-                          "      bne 1f\n"
+-                          "      stwcx. %2,0,%1\n"
+-                          "      bne- 0b\n"
+-                          "1:    "
+-                          : "=&r" (ret)
+-                          : "r" (p), "r" (1), "r" (0)
+-                          : "cr0", "memory");
+-    return ret;
+-}
+-#elif defined(__i386__)
+-static inline int testandset (int *p)
+-{
+-    long int readval = 0;
+-    
+-    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
+-                          : "+m" (*p), "+a" (readval)
+-                          : "r" (1)
+-                          : "cc");
+-    return readval;
+-}
+-#elif defined(__x86_64__)
+-static inline int testandset (int *p)
+-{
+-    long int readval = 0;
+-    
+-    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
+-                          : "+m" (*p), "+a" (readval)
+-                          : "r" (1)
+-                          : "cc");
+-    return readval;
+-}
+-#elif defined(__s390__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-
+-    __asm__ __volatile__ ("0: cs    %0,%1,0(%2)\n"
+-			  "   jl    0b"
+-			  : "=&d" (ret)
+-			  : "r" (1), "a" (p), "0" (*p) 
+-			  : "cc", "memory" );
+-    return ret;
+-}
+-#elif defined(__alpha__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-    unsigned long one;
+-
+-    __asm__ __volatile__ ("0:	mov 1,%2\n"
+-			  "	ldl_l %0,%1\n"
+-			  "	stl_c %2,%1\n"
+-			  "	beq %2,1f\n"
+-			  ".subsection 2\n"
+-			  "1:	br 0b\n"
+-			  ".previous"
+-			  : "=r" (ret), "=m" (*p), "=r" (one)
+-			  : "m" (*p));
+-    return ret;
+-}
+-#elif defined(__sparc__)
+-static inline int testandset (int *p)
+-{
+-	int ret;
+-
+-	__asm__ __volatile__("ldstub	[%1], %0"
+-			     : "=r" (ret)
+-			     : "r" (p)
+-			     : "memory");
+-
+-	return (ret ? 1 : 0);
+-}
+-#elif defined(__arm__)
+-static inline int testandset (int *spinlock)
+-{
+-    register unsigned int ret;
+-    __asm__ __volatile__("swp %0, %1, [%2]"
+-                         : "=r"(ret)
+-                         : "0"(1), "r"(spinlock));
+-    
+-    return ret;
+-}
+-#elif defined(__mc68000)
+-static inline int testandset (int *p)
+-{
+-    char ret;
+-    __asm__ __volatile__("tas %1; sne %0"
+-                         : "=r" (ret)
+-                         : "m" (p)
+-                         : "cc","memory");
+-    return ret;
+-}
+-#elif defined(__ia64)
+-
+-#include <ia64intrin.h>
+-
+-static inline int testandset (int *p)
+-{
+-    return __sync_lock_test_and_set (p, 1);
+-}
+-#elif defined(__mips__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-
+-    __asm__ __volatile__ (
+-	"	.set push		\n"
+-	"	.set noat		\n"
+-	"	.set mips2		\n"
+-	"1:	li	$1, 1		\n"
+-	"	ll	%0, %1		\n"
+-	"	sc	$1, %1		\n"
+-	"	beqz	$1, 1b		\n"
+-	"	.set pop		"
+-	: "=r" (ret), "+R" (*p)
+-	:
+-	: "memory");
+-
+-    return ret;
+-}
+-#else
+-#error unimplemented CPU support
+-#endif
+-
+-typedef int spinlock_t;
+-
+-#define SPIN_LOCK_UNLOCKED 0
+-
+-#if defined(CONFIG_USER_ONLY)
+-static inline void spin_lock(spinlock_t *lock)
+-{
+-    while (testandset(lock));
+-}
+-
+-static inline void spin_unlock(spinlock_t *lock)
+-{
+-    *lock = 0;
+-}
+-
+-static inline int spin_trylock(spinlock_t *lock)
+-{
+-    return !testandset(lock);
+-}
+-#else
+-static inline void spin_lock(spinlock_t *lock)
+-{
+-}
+-
+-static inline void spin_unlock(spinlock_t *lock)
+-{
+-}
+-
+-static inline int spin_trylock(spinlock_t *lock)
+-{
+-    return 1;
+-}
+-#endif
++#include "qemu_spinlock.h"
+ 
+ extern spinlock_t tb_lock;
+ 
+diff -Naru qemu-snapshot-2007-06-24_05.orig/linux-user/arm/syscall.h qemu-snapshot-2007-06-24_05/linux-user/arm/syscall.h
+--- qemu-snapshot-2007-06-24_05.orig/linux-user/arm/syscall.h	2005-04-27 22:11:21.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/linux-user/arm/syscall.h	2007-06-24 16:33:58.000000000 +0200
+@@ -28,7 +28,9 @@
+ #define ARM_SYSCALL_BASE	0x900000
+ #define ARM_THUMB_SYSCALL	0
+ 
+-#define ARM_NR_cacheflush (ARM_SYSCALL_BASE + 0xf0000 + 2)
++#define ARM_NR_BASE	  0xf0000
++#define ARM_NR_cacheflush (ARM_NR_BASE + 2)
++#define ARM_NR_set_tls	  (ARM_NR_BASE + 5)
+ 
+ #define ARM_NR_semihosting	  0x123456
+ #define ARM_NR_thumb_semihosting  0xAB
+diff -Naru qemu-snapshot-2007-06-24_05.orig/linux-user/main.c qemu-snapshot-2007-06-24_05/linux-user/main.c
+--- qemu-snapshot-2007-06-24_05.orig/linux-user/main.c	2007-06-22 00:55:02.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/linux-user/main.c	2007-06-24 16:33:58.000000000 +0200
+@@ -325,6 +325,50 @@
+     }
+ }
+ 
++/* Handle a jump to the kernel code page.  */
++static int
++do_kernel_trap(CPUARMState *env)
++{
++    uint32_t addr;
++    uint32_t *ptr;
++    uint32_t cpsr;
++
++    switch (env->regs[15]) {
++    case 0xffff0fc0: /* __kernel_cmpxchg */
++        /* XXX: This only works between threads, not between processes.
++           Use native atomic operations.  */
++        /* ??? This probably breaks horribly if the access segfaults.  */
++        cpu_lock();
++        ptr = (uint32_t *)env->regs[2];
++        cpsr = cpsr_read(env);
++        if (*ptr == env->regs[0]) {
++            *ptr = env->regs[1];
++            env->regs[0] = 0;
++            cpsr |= CPSR_C;
++        } else {
++            env->regs[0] = -1;
++            cpsr &= ~CPSR_C;
++        }
++        cpsr_write(env, cpsr, CPSR_C);
++        cpu_unlock();
++        break;
++    case 0xffff0fe0: /* __kernel_get_tls */
++        env->regs[0] = env->cp15.c13_tls;
++        break;
++    default:
++        return 1;
++    }
++    /* Jump back to the caller.  */
++    addr = env->regs[14];
++    if (addr & 1) {
++        env->thumb = 1;
++        addr &= ~1;
++    }
++    env->regs[15] = addr;
++
++    return 0;
++}
++
+ void cpu_loop(CPUARMState *env)
+ {
+     int trapnr;
+@@ -381,10 +425,8 @@
+                     }
+                 }
+ 
+-                if (n == ARM_NR_cacheflush) {
+-                    arm_cache_flush(env->regs[0], env->regs[1]);
+-                } else if (n == ARM_NR_semihosting
+-                           || n == ARM_NR_thumb_semihosting) {
++                if (n == ARM_NR_semihosting
++                    || n == ARM_NR_thumb_semihosting) {
+                     env->regs[0] = do_arm_semihosting (env);
+                 } else if (n == 0 || n >= ARM_SYSCALL_BASE
+                            || (env->thumb && n == ARM_THUMB_SYSCALL)) {
+@@ -395,14 +437,34 @@
+                         n -= ARM_SYSCALL_BASE;
+                         env->eabi = 0;
+                     }
+-                    env->regs[0] = do_syscall(env, 
+-                                              n, 
+-                                              env->regs[0],
+-                                              env->regs[1],
+-                                              env->regs[2],
+-                                              env->regs[3],
+-                                              env->regs[4],
+-                                              env->regs[5]);
++                    if ( n > ARM_NR_BASE) {
++                        switch (n)
++                          {
++                          case ARM_NR_cacheflush:
++                              arm_cache_flush(env->regs[0], env->regs[1]);
++                              break;
++#ifdef USE_NPTL
++                          case ARM_NR_set_tls:
++                              cpu_set_tls(env, env->regs[0]);
++                              env->regs[0] = 0;
++                              break;
++#endif
++                          default:
++                              printf ("Error: Bad syscall: %x\n", n);
++                              goto error;
++                          }
++                      }
++                    else
++                      {
++                        env->regs[0] = do_syscall(env, 
++                                                  n, 
++                                                  env->regs[0],
++                                                  env->regs[1],
++                                                  env->regs[2],
++                                                  env->regs[3],
++                                                  env->regs[4],
++                                                  env->regs[5]);
++                      }
+                 } else {
+                     goto error;
+                 }
+@@ -441,6 +503,10 @@
+                   }
+             }
+             break;
++        case EXCP_KERNEL_TRAP:
++            if (do_kernel_trap(env))
++              goto error;
++            break;
+         default:
+         error:
+             fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n", 
+@@ -2074,6 +2140,10 @@
+     ts->heap_base = info->brk;
+     /* This will be filled in on the first SYS_HEAPINFO call.  */
+     ts->heap_limit = 0;
++    /* Register the magic kernel code page.  The cpu will generate a
++       special exception when it tries to execute code here.  We can't
++       put real code here because it may be in use by the host kernel.  */
++    page_set_flags(0xffff0000, 0xffff0fff, 0);
+ #endif
+ 
+     if (gdbstub_port) {
+diff -Naru qemu-snapshot-2007-06-24_05.orig/linux-user/qemu.h qemu-snapshot-2007-06-24_05/linux-user/qemu.h
+--- qemu-snapshot-2007-06-24_05.orig/linux-user/qemu.h	2007-05-26 17:09:38.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/linux-user/qemu.h	2007-06-24 16:33:58.000000000 +0200
+@@ -81,6 +81,9 @@
+     uint32_t heap_limit;
+ #endif
+     int used; /* non zero if used */
++#ifdef USE_NPTL
++    uint32_t *child_tidptr;
++#endif
+     struct image_info *info;
+     uint8_t stack[0];
+ } __attribute__((aligned(16))) TaskState;
+diff -Naru qemu-snapshot-2007-06-24_05.orig/linux-user/syscall.c qemu-snapshot-2007-06-24_05/linux-user/syscall.c
+--- qemu-snapshot-2007-06-24_05.orig/linux-user/syscall.c	2007-06-21 23:57:11.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/linux-user/syscall.c	2007-06-24 16:33:58.000000000 +0200
+@@ -70,9 +70,18 @@
+ #include <linux/kd.h>
+ 
+ #include "qemu.h"
++#include "qemu_spinlock.h"
+ 
+ //#define DEBUG
+ 
++#ifdef USE_NPTL
++#define CLONE_NPTL_FLAGS2 (CLONE_SETTLS | \
++    CLONE_PARENT_SETTID | CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID)
++#else
++/* XXX: Hardcode the above values.  */
++#define CLONE_NPTL_FLAGS2 0
++#endif
++
+ #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC) \
+     || defined(TARGET_M68K) || defined(TARGET_SH4)
+ /* 16 bit uid wrappers emulation */
+@@ -2121,20 +2130,38 @@
+    thread/process */
+ #define NEW_STACK_SIZE 8192
+ 
++#ifdef USE_NPTL
++static spinlock_t nptl_lock = SPIN_LOCK_UNLOCKED;
++#endif
++
+ static int clone_func(void *arg)
+ {
+     CPUState *env = arg;
++#ifdef HAVE_NPTL
++    /* Wait until the parent has finshed initializing the tls state.  */
++    while (!spin_trylock(&nptl_lock))
++        usleep(1);
++    spin_unlock(&nptl_lock);
++#endif
+     cpu_loop(env);
+     /* never exits */
+     return 0;
+ }
+ 
+-int do_fork(CPUState *env, unsigned int flags, unsigned long newsp)
++int do_fork(CPUState *env, unsigned int flags, unsigned long newsp,
++            uint32_t *parent_tidptr, void *newtls,
++            uint32_t *child_tidptr)
+ {
+     int ret;
+     TaskState *ts;
+     uint8_t *new_stack;
+     CPUState *new_env;
++#ifdef USE_NPTL
++    unsigned int nptl_flags;
++
++    if (flags & CLONE_PARENT_SETTID)
++        *parent_tidptr = gettid();
++#endif
+     
+     if (flags & CLONE_VM) {
+         ts = malloc(sizeof(TaskState) + NEW_STACK_SIZE);
+@@ -2201,16 +2228,60 @@
+ #error unsupported target CPU
+ #endif
+         new_env->opaque = ts;
++#ifdef USE_NPTL
++     nptl_flags = flags;
++     flags &= ~CLONE_NPTL_FLAGS2;
++     if (nptl_flags & CLONE_CHILD_CLEARTID) {
++          ts->child_tidptr = child_tidptr;
++     }
++     if (nptl_flags & CLONE_SETTLS)
++         cpu_set_tls (new_env, newtls);
++     /* Grab the global cpu lock so that the thread setup appears
++        atomic.  */
++     if (nptl_flags & CLONE_CHILD_SETTID)
++         spin_lock(&nptl_lock);
++#else
++     if (flags & CLONE_NPTL_FLAGS2)
++         return -EINVAL;
++#endif
++
+ #ifdef __ia64__
+         ret = __clone2(clone_func, new_stack + NEW_STACK_SIZE, flags, new_env);
+ #else
+ 	ret = clone(clone_func, new_stack + NEW_STACK_SIZE, flags, new_env);
+ #endif
++#ifdef USE_NPTL
++     if (ret != -1) {
++         if (nptl_flags & CLONE_CHILD_SETTID)
++             *child_tidptr = ret;
++     }
++     /* Allow the child to continue.  */
++     if (nptl_flags & CLONE_CHILD_SETTID)
++         spin_unlock(&nptl_lock);
++#endif
+     } else {
+-        /* if no CLONE_VM, we consider it is a fork */
+-        if ((flags & ~CSIGNAL) != 0)
+-            return -EINVAL;
+-        ret = fork();
++    /* if no CLONE_VM, we consider it is a fork */
++    if ((flags & ~(CSIGNAL | CLONE_NPTL_FLAGS2)) != 0)
++          return -EINVAL;
++      ret = fork();
++#ifdef USE_NPTL
++     /* There is a race condition here.  The parent process could
++        theoretically read the TID in the child process before the child
++        tid is set.  This would require using either ptrace
++        (not implemented) or having *_tidptr to point at a shared memory
++        mapping.  We can't repeat the spinlock hack used above because
++        the child process gets its own copy of the lock.  */
++     if (ret == 0) {
++         /* Child Process.  */
++         if (flags & CLONE_CHILD_SETTID)
++             *child_tidptr = gettid();
++         ts = (TaskState *)env->opaque;
++         if (flags & CLONE_CHILD_CLEARTID)
++             ts->child_tidptr = child_tidptr;
++         if (flags & CLONE_SETTLS)
++             cpu_set_tls (env, newtls);
++     }
++#endif
+     }
+     return ret;
+ }
+@@ -2487,7 +2558,7 @@
+         ret = do_brk(arg1);
+         break;
+     case TARGET_NR_fork:
+-        ret = get_errno(do_fork(cpu_env, SIGCHLD, 0));
++        ret = get_errno(do_fork(cpu_env, SIGCHLD, 0, NULL, NULL, NULL));
+         break;
+ #ifdef TARGET_NR_waitpid
+     case TARGET_NR_waitpid:
+@@ -3651,7 +3722,8 @@
+         ret = get_errno(fsync(arg1));
+         break;
+     case TARGET_NR_clone:
+-        ret = get_errno(do_fork(cpu_env, arg1, arg2));
++        ret = get_errno(do_fork(cpu_env, arg1, arg2, (uint32_t *)arg3,
++                        (void *)arg4, (uint32_t *)arg5));
+         break;
+ #ifdef __NR_exit_group
+         /* new thread calls */
+@@ -4039,7 +4111,8 @@
+ #endif
+ #ifdef TARGET_NR_vfork
+     case TARGET_NR_vfork:
+-        ret = get_errno(do_fork(cpu_env, CLONE_VFORK | CLONE_VM | SIGCHLD, 0));
++        ret = get_errno(do_fork(cpu_env, CLONE_VFORK | CLONE_VM | SIGCHLD, 0,
++                                NULL, NULL, NULL));
+         break;
+ #endif
+ #ifdef TARGET_NR_ugetrlimit
+@@ -4632,4 +4705,3 @@
+ #endif
+     return ret;
+ }
+-
+diff -Naru qemu-snapshot-2007-06-24_05.orig/qemu_spinlock.h qemu-snapshot-2007-06-24_05/qemu_spinlock.h
+--- qemu-snapshot-2007-06-24_05.orig/qemu_spinlock.h	1970-01-01 01:00:00.000000000 +0100
++++ qemu-snapshot-2007-06-24_05/qemu_spinlock.h	2007-06-24 16:33:58.000000000 +0200
+@@ -0,0 +1,182 @@
++/*
++ * internal execution defines for qemu
++ *
++ *  Copyright (c) 2003 Fabrice Bellard
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
++ */
++
++#ifndef _QEMU_SPINLOCK_H
++#define _QEMU_SPINLOCK_H
++
++#ifdef __powerpc__
++static inline int testandset (int *p)
++{
++    int ret;
++    __asm__ __volatile__ (
++                          "0:    lwarx %0,0,%1\n"
++                          "      xor. %0,%3,%0\n"
++                          "      bne 1f\n"
++                          "      stwcx. %2,0,%1\n"
++                          "      bne- 0b\n"
++                          "1:    "
++                          : "=&r" (ret)
++                          : "r" (p), "r" (1), "r" (0)
++                          : "cr0", "memory");
++    return ret;
++}
++#endif
++
++#ifdef __i386__
++static inline int testandset (int *p)
++{
++    long int readval = 0;
++
++    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
++                          : "+m" (*p), "+a" (readval)
++                          : "r" (1)
++                          : "cc");
++    return readval;
++}
++#endif
++
++#ifdef __x86_64__
++static inline int testandset (int *p)
++{
++    long int readval = 0;
++
++    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
++                          : "+m" (*p), "+a" (readval)
++                          : "r" (1)
++                          : "cc");
++    return readval;
++}
++#endif
++
++#ifdef __s390__
++static inline int testandset (int *p)
++{
++    int ret;
++
++    __asm__ __volatile__ ("0: cs    %0,%1,0(%2)\n"
++                         "   jl    0b"
++                         : "=&d" (ret)
++                         : "r" (1), "a" (p), "0" (*p)
++                         : "cc", "memory" );
++    return ret;
++}
++#endif
++
++#ifdef __alpha__
++static inline int testandset (int *p)
++{
++    int ret;
++    unsigned long one;
++
++    __asm__ __volatile__ ("0:  mov 1,%2\n"
++                         "     ldl_l %0,%1\n"
++                         "     stl_c %2,%1\n"
++                         "     beq %2,1f\n"
++                         ".subsection 2\n"
++                         "1:   br 0b\n"
++                         ".previous"
++                         : "=r" (ret), "=m" (*p), "=r" (one)
++                         : "m" (*p));
++    return ret;
++}
++#endif
++
++#ifdef __sparc__
++static inline int testandset (int *p)
++{
++       int ret;
++
++       __asm__ __volatile__("ldstub    [%1], %0"
++                            : "=r" (ret)
++                            : "r" (p)
++                            : "memory");
++
++       return (ret ? 1 : 0);
++}
++#endif
++
++#ifdef __arm__
++static inline int testandset (int *spinlock)
++{
++    register unsigned int ret;
++    __asm__ __volatile__("swp %0, %1, [%2]"
++                         : "=r"(ret)
++                         : "0"(1), "r"(spinlock));
++
++    return ret;
++}
++#endif
++
++#ifdef __mc68000
++static inline int testandset (int *p)
++{
++    char ret;
++    __asm__ __volatile__("tas %1; sne %0"
++                         : "=r" (ret)
++                         : "m" (p)
++                         : "cc","memory");
++    return ret;
++}
++#endif
++
++#ifdef __ia64
++#include <ia64intrin.h>
++
++static inline int testandset (int *p)
++{
++    return __sync_lock_test_and_set (p, 1);
++}
++#endif
++
++typedef int spinlock_t;
++
++#define SPIN_LOCK_UNLOCKED 0
++
++#if defined(CONFIG_USER_ONLY)
++static inline void spin_lock(spinlock_t *lock)
++{
++    while (testandset(lock));
++}
++
++static inline void spin_unlock(spinlock_t *lock)
++{
++    *lock = 0;
++}
++
++static inline int spin_trylock(spinlock_t *lock)
++{
++    return !testandset(lock);
++}
++#else
++static inline void spin_lock(spinlock_t *lock)
++{
++}
++
++static inline void spin_unlock(spinlock_t *lock)
++{
++}
++
++static inline int spin_trylock(spinlock_t *lock)
++{
++    return 1;
++}
++#endif
++
++#endif /* ! _QEMU_SPINLOCK_H */
+diff -Naru qemu-snapshot-2007-06-24_05.orig/target-arm/cpu.h qemu-snapshot-2007-06-24_05/target-arm/cpu.h
+--- qemu-snapshot-2007-06-24_05.orig/target-arm/cpu.h	2007-06-03 23:02:37.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/target-arm/cpu.h	2007-06-24 16:33:58.000000000 +0200
+@@ -37,6 +37,9 @@
+ #define EXCP_IRQ             5
+ #define EXCP_FIQ             6
+ #define EXCP_BKPT            7
++#define EXCP_KERNEL_TRAP     8   /* Jumped to kernel code page.  */
++
++
+ 
+ typedef void ARMWriteCPFunc(void *opaque, int cp_info,
+                             int srcreg, int operand, uint32_t value);
+@@ -97,6 +100,7 @@
+         uint32_t c9_data;
+         uint32_t c13_fcse; /* FCSE PID.  */
+         uint32_t c13_context; /* Context ID.  */
++	uint32_t c13_tls; /* Paul Brook told me to just add this ;) */
+         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
+     } cp15;
+ 
+@@ -169,6 +173,15 @@
+ int cpu_arm_signal_handler(int host_signum, void *pinfo, 
+                            void *puc);
+ 
++void cpu_lock(void);
++void cpu_unlock(void);
++#if defined(USE_NPTL)
++static inline void cpu_set_tls(CPUARMState *env, void *newtls)
++{
++  env->cp15.c13_tls = (uint32_t)newtls;
++}
++#endif
++
+ #define CPSR_M (0x1f)
+ #define CPSR_T (1 << 5)
+ #define CPSR_F (1 << 6)
+@@ -180,7 +193,11 @@
+ #define CPSR_J (1 << 24)
+ #define CPSR_IT_0_1 (3 << 25)
+ #define CPSR_Q (1 << 27)
+-#define CPSR_NZCV (0xf << 28)
++#define CPSR_V (1 << 28)
++#define CPSR_C (1 << 29)
++#define CPSR_Z (1 << 30)
++#define CPSR_N (1 << 31)
++#define CPSR_NZCV (CPSR_N | CPSR_Z | CPSR_C | CPSR_V)
+ 
+ #define CACHED_CPSR_BITS (CPSR_T | CPSR_Q | CPSR_NZCV)
+ /* Return the current CPSR value.  */
+diff -Naru qemu-snapshot-2007-06-24_05.orig/target-arm/exec.h qemu-snapshot-2007-06-24_05/target-arm/exec.h
+--- qemu-snapshot-2007-06-24_05.orig/target-arm/exec.h	2007-06-03 19:44:36.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/target-arm/exec.h	2007-06-24 16:33:58.000000000 +0200
+@@ -68,8 +68,6 @@
+ 
+ /* In op_helper.c */
+ 
+-void cpu_lock(void);
+-void cpu_unlock(void);
+ void helper_set_cp(CPUState *, uint32_t, uint32_t);
+ uint32_t helper_get_cp(CPUState *, uint32_t);
+ void helper_set_cp15(CPUState *, uint32_t, uint32_t);
+diff -Naru qemu-snapshot-2007-06-24_05.orig/target-arm/op.c qemu-snapshot-2007-06-24_05/target-arm/op.c
+--- qemu-snapshot-2007-06-24_05.orig/target-arm/op.c	2007-05-21 19:48:01.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/target-arm/op.c	2007-06-24 16:33:58.000000000 +0200
+@@ -891,6 +891,12 @@
+     cpu_loop_exit();
+ }
+ 
++void OPPROTO op_kernel_trap(void)
++{
++    env->exception_index = EXCP_KERNEL_TRAP;
++    cpu_loop_exit();
++}
++
+ /* VFP support.  We follow the convention used for VFP instrunctions:
+    Single precition routines have a "s" suffix, double precision a
+    "d" suffix.  */
+diff -Naru qemu-snapshot-2007-06-24_05.orig/target-arm/translate.c qemu-snapshot-2007-06-24_05/target-arm/translate.c
+--- qemu-snapshot-2007-06-24_05.orig/target-arm/translate.c	2007-06-11 20:59:35.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/target-arm/translate.c	2007-06-24 16:33:58.000000000 +0200
+@@ -3513,6 +3513,7 @@
+     s->is_jmp = DISAS_JUMP;
+ }
+ 
++
+ /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
+    basic block 'tb'. If search_pc is TRUE, also generate PC
+    information for each intermediate instruction. */
+@@ -3548,6 +3549,15 @@
+     nb_gen_labels = 0;
+     lj = -1;
+     do {
++#ifdef CONFIG_USER_ONLY
++        /* Intercept jump to the magic kernel page.  */
++        if (dc->pc > 0xffff0000) {
++            gen_op_kernel_trap();
++            dc->is_jmp = DISAS_UPDATE;
++            break;
++        }
++#endif
++
+         if (env->nb_breakpoints > 0) {
+             for(j = 0; j < env->nb_breakpoints; j++) {
+                 if (env->breakpoints[j] == dc->pc) {
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/configure-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/configure-0.9.0.patch
new file mode 100644
index 0000000000..d92f6a8264
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20070701/configure-0.9.0.patch
@@ -0,0 +1,12 @@
+diff -Naru qemu-snapshot-2007-06-24_05.orig/configure qemu-snapshot-2007-06-24_05/configure
+--- qemu-snapshot-2007-06-24_05.orig/configure	2007-06-23 18:03:35.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/configure	2007-06-24 16:30:32.000000000 +0200
+@@ -711,7 +711,7 @@
+ echo "CC=$cc" >> $config_mak
+ echo "HOST_CC=$host_cc" >> $config_mak
+ echo "AR=$ar" >> $config_mak
+-echo "STRIP=$strip -s -R .comment -R .note" >> $config_mak
++echo "STRIP=$strip" >> $config_mak
+ echo "OS_CFLAGS=$OS_CFLAGS" >> $config_mak
+ echo "OS_LDFLAGS=$OS_LDFLAGS" >> $config_mak
+ echo "ARCH_CFLAGS=$ARCH_CFLAGS" >> $config_mak
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/pl110_rgb-r0-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/pl110_rgb-r0-0.9.0.patch
new file mode 100644
index 0000000000..3ad4115e73
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20070701/pl110_rgb-r0-0.9.0.patch
@@ -0,0 +1,217 @@
+diff -Naru qemu-neo1973.orig/hw/pl110.c qemu-neo1973/hw/pl110.c
+--- qemu-neo1973.orig/hw/pl110.c	2007-06-24 13:56:37.000000000 +0200
++++ qemu-neo1973/hw/pl110.c	2007-06-24 14:12:09.000000000 +0200
+@@ -10,6 +10,7 @@
+ #include "vl.h"
+ 
+ #define PL110_CR_EN   0x001
++#define PL110_CR_BGR  0x100
+ #define PL110_CR_BEBO 0x200
+ #define PL110_CR_BEPO 0x400
+ #define PL110_CR_PWR  0x800
+@@ -114,6 +115,7 @@
+     int first, last = 0;
+     int dirty, new_dirty;
+     int i;
++    int bpp_offset;
+ 
+     if (!pl110_enabled(s))
+         return;
+@@ -145,12 +147,17 @@
+         fprintf(stderr, "pl110: Bad color depth\n");
+         exit(1);
+     }
++    if (s->cr & PL110_CR_BGR)
++	bpp_offset = 0;
++    else
++	bpp_offset = 18;
++
+     if (s->cr & PL110_CR_BEBO)
+-      fn = fntable[s->bpp + 6];
++      fn = fntable[s->bpp + 6 + bpp_offset];
+     else if (s->cr & PL110_CR_BEPO)
+-      fn = fntable[s->bpp + 12];
++      fn = fntable[s->bpp + 12 + bpp_offset];
+     else
+-      fn = fntable[s->bpp];
++      fn = fntable[s->bpp + bpp_offset];
+     
+     src_width = s->cols;
+     switch (s->bpp) {
+diff -Naru qemu-neo1973.orig/hw/pl110_template.h qemu-neo1973/hw/pl110_template.h
+--- qemu-neo1973.orig/hw/pl110_template.h	2007-06-24 13:56:37.000000000 +0200
++++ qemu-neo1973/hw/pl110_template.h	2007-06-24 14:12:09.000000000 +0200
+@@ -24,6 +24,16 @@
+ #error unknown bit depth
+ #endif
+ 
++#undef RGB
++#define BORDER bgr
++#define ORDER 0
++#include "pl110_template.h"
++#define ORDER 1
++#include "pl110_template.h"
++#define ORDER 2
++#include "pl110_template.h"
++#define RGB
++#define BORDER rgb
+ #define ORDER 0
+ #include "pl110_template.h"
+ #define ORDER 1
+@@ -33,26 +43,47 @@
+ 
+ static drawfn glue(pl110_draw_fn_,BITS)[18] =
+ {
+-    glue(pl110_draw_line1_lblp,BITS),
+-    glue(pl110_draw_line2_lblp,BITS),
+-    glue(pl110_draw_line4_lblp,BITS),
+-    glue(pl110_draw_line8_lblp,BITS),
+-    glue(pl110_draw_line16_lblp,BITS),
+-    glue(pl110_draw_line32_lblp,BITS),
+-
+-    glue(pl110_draw_line1_bbbp,BITS),
+-    glue(pl110_draw_line2_bbbp,BITS),
+-    glue(pl110_draw_line4_bbbp,BITS),
+-    glue(pl110_draw_line8_bbbp,BITS),
+-    glue(pl110_draw_line16_bbbp,BITS),
+-    glue(pl110_draw_line32_bbbp,BITS),
+-
+-    glue(pl110_draw_line1_lbbp,BITS),
+-    glue(pl110_draw_line2_lbbp,BITS),
+-    glue(pl110_draw_line4_lbbp,BITS),
+-    glue(pl110_draw_line8_lbbp,BITS),
+-    glue(pl110_draw_line16_lbbp,BITS),
+-    glue(pl110_draw_line32_lbbp,BITS)
++    glue(pl110_draw_line1_lblp_bgr,BITS),
++    glue(pl110_draw_line2_lblp_bgr,BITS),
++    glue(pl110_draw_line4_lblp_bgr,BITS),
++    glue(pl110_draw_line8_lblp_bgr,BITS),
++    glue(pl110_draw_line16_lblp_bgr,BITS),
++    glue(pl110_draw_line32_lblp_bgr,BITS),
++
++    glue(pl110_draw_line1_bbbp_bgr,BITS),
++    glue(pl110_draw_line2_bbbp_bgr,BITS),
++    glue(pl110_draw_line4_bbbp_bgr,BITS),
++    glue(pl110_draw_line8_bbbp_bgr,BITS),
++    glue(pl110_draw_line16_bbbp_bgr,BITS),
++    glue(pl110_draw_line32_bbbp_bgr,BITS),
++
++    glue(pl110_draw_line1_lbbp_bgr,BITS),
++    glue(pl110_draw_line2_lbbp_bgr,BITS),
++    glue(pl110_draw_line4_lbbp_bgr,BITS),
++    glue(pl110_draw_line8_lbbp_bgr,BITS),
++    glue(pl110_draw_line16_lbbp_bgr,BITS),
++    glue(pl110_draw_line32_lbbp_bgr,BITS),
++
++    glue(pl110_draw_line1_lblp_rgb,BITS),
++    glue(pl110_draw_line2_lblp_rgb,BITS),
++    glue(pl110_draw_line4_lblp_rgb,BITS),
++    glue(pl110_draw_line8_lblp_rgb,BITS),
++    glue(pl110_draw_line16_lblp_rgb,BITS),
++    glue(pl110_draw_line32_lblp_rgb,BITS),
++
++    glue(pl110_draw_line1_bbbp_rgb,BITS),
++    glue(pl110_draw_line2_bbbp_rgb,BITS),
++    glue(pl110_draw_line4_bbbp_rgb,BITS),
++    glue(pl110_draw_line8_bbbp_rgb,BITS),
++    glue(pl110_draw_line16_bbbp_rgb,BITS),
++    glue(pl110_draw_line32_bbbp_rgb,BITS),
++
++    glue(pl110_draw_line1_lbbp_rgb,BITS),
++    glue(pl110_draw_line2_lbbp_rgb,BITS),
++    glue(pl110_draw_line4_lbbp_rgb,BITS),
++    glue(pl110_draw_line8_lbbp_rgb,BITS),
++    glue(pl110_draw_line16_lbbp_rgb,BITS),
++    glue(pl110_draw_line32_lbbp_rgb,BITS),
+ };
+ 
+ #undef BITS
+@@ -61,18 +92,18 @@
+ #else
+ 
+ #if ORDER == 0
+-#define NAME glue(lblp, BITS)
++#define NAME glue(glue(lblp_, BORDER), BITS)
+ #ifdef WORDS_BIGENDIAN
+ #define SWAP_WORDS 1
+ #endif
+ #elif ORDER == 1
+-#define NAME glue(bbbp, BITS)
++#define NAME glue(glue(bbbp_, BORDER), BITS)
+ #ifndef WORDS_BIGENDIAN
+ #define SWAP_WORDS 1
+ #endif
+ #else
+ #define SWAP_PIXELS 1
+-#define NAME glue(lbbp, BITS)
++#define NAME glue(glue(lbbp_, BORDER), BITS)
+ #ifdef WORDS_BIGENDIAN
+ #define SWAP_WORDS 1
+ #endif
+@@ -195,27 +226,34 @@
+ #ifdef SWAP_WORDS
+         data = bswap32(data);
+ #endif
++#ifdef RGB
++#define LSB r
++#define MSB b
++#else
++#define LSB b
++#define MSB r
++#endif
+ #if 0
+-        r = data & 0x1f;
++        LSB = data & 0x1f;
+         data >>= 5;
+         g = data & 0x3f;
+         data >>= 6;
+-        b = data & 0x1f;
++        MSB = data & 0x1f;
+         data >>= 5;
+ #else
+-        r = (data & 0x1f) << 3;
++        LSB = (data & 0x1f) << 3;
+         data >>= 5;
+         g = (data & 0x3f) << 2;
+         data >>= 6;
+-        b = (data & 0x1f) << 3;
++        MSB = (data & 0x1f) << 3;
+         data >>= 5;
+ #endif
+         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+-        r = (data & 0x1f) << 3;
++        LSB = (data & 0x1f) << 3;
+         data >>= 5;
+         g = (data & 0x3f) << 2;
+         data >>= 6;
+-        b = (data & 0x1f) << 3;
++        MSB = (data & 0x1f) << 3;
+         data >>= 5;
+         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+         width -= 2;
+@@ -229,14 +267,21 @@
+     unsigned int r, g, b;
+     while (width > 0) {
+         data = *(uint32_t *)src;
++#ifdef RGB
++#define LSB r
++#define MSB b
++#else
++#define LSB b
++#define MSB r
++#endif
+ #ifdef SWAP_WORDS
+-        r = data & 0xff;
++        LSB = data & 0xff;
+         g = (data >> 8) & 0xff;
+-        b = (data >> 16) & 0xff;
++        MSB = (data >> 16) & 0xff;
+ #else
+-        r = (data >> 24) & 0xff;
++        LSB = (data >> 24) & 0xff;
+         g = (data >> 16) & 0xff;
+-        b = (data >> 8) & 0xff;
++        MSB = (data >> 8) & 0xff;
+ #endif
+         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
+         width--;
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-0.9.0-gcc4.patch b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-0.9.0-gcc4.patch
new file mode 100644
index 0000000000..189cd09b67
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-0.9.0-gcc4.patch
@@ -0,0 +1,881 @@
+diff -Naru qemu-neo1973.orig/dyngen.c qemu-neo1973/dyngen.c
+--- qemu-neo1973.orig/dyngen.c	2007-06-24 13:56:38.000000000 +0200
++++ qemu-neo1973/dyngen.c	2007-06-24 14:33:11.000000000 +0200
+@@ -32,6 +32,8 @@
+ 
+ #include "config-host.h"
+ 
++//#define DEBUG_OP
++
+ /* NOTE: we test CONFIG_WIN32 instead of _WIN32 to enabled cross
+    compilation */
+ #if defined(CONFIG_WIN32)
+@@ -1429,6 +1431,644 @@
+ #endif
+ 
+ 
++#if defined(HOST_I386) || defined(HOST_X86_64)
++
++/* This byte is the first byte of an instruction.  */
++#define FLAG_INSN     (1 << 0)
++/* This byte has been processed as part of an instruction.  */
++#define FLAG_SCANNED  (1 << 1)
++/* This instruction is a return instruction.  Gcc cometimes generates prefix
++   bytes, so may be more than one byte long.  */
++#define FLAG_RET      (1 << 2)
++/* This is either the target of a jump, or the preceeding instruction uses
++   a pc-relative offset.  */
++#define FLAG_TARGET   (1 << 3)
++/* This is a magic instruction that needs fixing up.  */
++#define FLAG_EXIT     (1 << 4)
++#define MAX_EXITS     5
++
++static void
++bad_opcode(const char *name, uint32_t op)
++{
++    error("Unsupported opcode %0*x in %s", (op > 0xff) ? 4 : 2, op, name);
++}
++
++/* Mark len bytes as scanned,  Returns insn_size + len.  Reports an error
++   if these bytes have already been scanned.  */
++static int
++eat_bytes(const char *name, char *flags, int insn, int insn_size, int len)
++{
++    while (len > 0) {
++        /* This should never occur in sane code.  */
++        if (flags[insn + insn_size] & FLAG_SCANNED)
++            error ("Overlapping instructions in %s", name);
++        flags[insn + insn_size] |= FLAG_SCANNED;
++        insn_size++;
++        len--;
++    }
++    return insn_size;
++}
++
++static void
++trace_i386_insn (const char *name, uint8_t *start_p, char *flags, int insn,
++                 int len)
++{
++    uint8_t *ptr;
++    uint8_t op;
++    int modrm;
++    int is_prefix;
++    int op_size;
++    int addr_size;
++    int insn_size;
++    int is_ret;
++    int is_condjmp;
++    int is_jmp;
++    int is_exit;
++    int is_pcrel;
++    int immed;
++    int seen_rexw;
++    int32_t disp;
++
++    ptr = start_p + insn;
++    /* nonzero if this insn has a ModR/M byte.  */
++    modrm = 1;
++    /* The size of the immediate value in this instruction.  */
++    immed = 0;
++    /* The operand size.  */
++    op_size = 4;
++    /* The address size */
++    addr_size = 4;
++    /* The total length of this instruction.  */
++    insn_size = 0;
++    is_prefix = 1;
++    is_ret = 0;
++    is_condjmp = 0;
++    is_jmp = 0;
++    is_exit = 0;
++    seen_rexw = 0;
++    is_pcrel = 0;
++
++    while (is_prefix) {
++        op = ptr[insn_size];
++        insn_size = eat_bytes(name, flags, insn, insn_size, 1);
++        is_prefix = 0;
++        switch (op >> 4) {
++        case 0:
++        case 1:
++        case 2:
++        case 3:
++            if (op == 0x0f) {
++                /* two-byte opcode.  */
++                op = ptr[insn_size];
++                insn_size = eat_bytes(name, flags, insn, insn_size, 1);
++                switch (op >> 4) {
++                case 0:
++                    if ((op & 0xf) > 3)
++                      modrm = 0;
++                    break;
++                case 1: /* vector move or prefetch */
++                case 2: /* various moves and vector compares.  */
++                case 4: /* cmov */
++                case 5: /* vector instructions */
++                case 6:
++                case 13:
++                case 14:
++                case 15:
++                    break;
++                case 7: /* mmx */
++                    if (op & 0x77) /* emms */
++                      modrm = 0;
++                    break;
++                case 3: /* wrmsr, rdtsc, rdmsr, rdpmc, sysenter, sysexit */
++                    modrm = 0;
++                    break;
++                case 8: /* long conditional jump */
++                    is_condjmp = 1;
++                    immed = op_size;
++                    modrm = 0;
++                    break;
++                case 9: /* setcc */
++                    break;
++                case 10:
++                    switch (op & 0x7) {
++                    case 0: /* push fs/gs */
++                    case 1: /* pop fs/gs */
++                    case 2: /* cpuid/rsm */
++                        modrm = 0;
++                        break;
++                    case 4: /* shld/shrd immediate */
++                        immed = 1;
++                        break;
++                    default: /* Normal instructions with a ModR/M byte.  */
++                        break;
++                    }
++                    break;
++                case 11:
++                    switch (op & 0xf) {
++                    case 10: /* bt, bts, btr, btc */
++                        immed = 1;
++                        break;
++                    default:
++                        /* cmpxchg, lss, btr, lfs, lgs, movzx, btc, bsf, bsr
++                           undefined, and movsx */
++                        break;
++                    }
++                    break;
++                case 12:
++                    if (op & 8) {
++                        /* bswap */
++                        modrm = 0;
++                    } else {
++                        switch (op & 0x7) {
++                        case 2:
++                        case 4:
++                        case 5:
++                        case 6:
++                            immed = 1;
++                            break;
++                        default:
++                            break;
++                        }
++                    }
++                    break;
++                }
++            } else if ((op & 0x07) <= 0x3) {
++                /* General arithmentic ax.  */
++            } else if ((op & 0x07) <= 0x5) {
++                /* General arithmetic ax, immediate.  */
++                if (op & 0x01)
++                    immed = op_size;
++                else
++                    immed = 1;
++                modrm = 0;
++            } else if ((op & 0x23) == 0x22) {
++                /* Segment prefix.  */
++                is_prefix = 1;
++            } else {
++                /* Segment register push/pop or DAA/AAA/DAS/AAS.  */
++                modrm = 0;
++            }
++            break;
++
++#if defined(HOST_X86_64)
++        case 4: /* rex prefix.  */
++            is_prefix = 1;
++            /* The address/operand size is actually 64-bit, but the immediate
++               values in the instruction are still 32-bit.  */
++            op_size = 4;
++            addr_size = 4;
++            if (op & 8)
++                seen_rexw = 1;
++            break;
++#else
++        case 4: /* inc/dec register.  */
++#endif
++        case 5: /* push/pop general register.  */
++            modrm = 0;
++            break;
++
++        case 6:
++            switch (op & 0x0f) {
++            case 0: /* pusha */
++            case 1: /* popa */
++                modrm = 0;
++                break;
++            case 2: /* bound */
++            case 3: /* arpl */
++                break;
++            case 4: /* FS */
++            case 5: /* GS */
++                is_prefix = 1;
++                break;
++            case 6: /* opcode size prefix.  */
++                op_size = 2;
++                is_prefix = 1;
++                break;
++            case 7: /* Address size prefix.  */
++                addr_size = 2;
++                is_prefix = 1;
++                break;
++            case 8: /* push immediate */
++                immed = op_size;
++                modrm = 0;
++                break;
++            case 10: /* push 8-bit immediate */
++                immed = 1;
++                modrm = 0;
++                break;
++            case 9: /* imul immediate */
++                immed = op_size;
++                break;
++            case 11: /* imul 8-bit immediate */
++                immed = 1;
++                break;
++            case 12: /* insb */
++            case 13: /* insw */
++            case 14: /* outsb */
++            case 15: /* outsw */
++                modrm = 0;
++                break;
++            }
++            break;
++
++        case 7: /* Short conditional jump.  */
++            is_condjmp = 1;
++            immed = 1;
++            modrm = 0;
++            break;
++          
++        case 8:
++            if ((op & 0xf) <= 3) {
++                /* arithmetic immediate.  */
++                if ((op & 3) == 1)
++                    immed = op_size;
++                else
++                    immed = 1;
++            }
++            /* else test, xchg, mov, lea or pop general.  */
++            break;
++
++        case 9:
++            /* Various single-byte opcodes with no modrm byte.  */
++            modrm = 0;
++            if (op == 10) {
++                /* Call */
++                immed = 4;
++            }
++            break;
++
++        case 10:
++            switch ((op & 0xe) >> 1) {
++            case 0: /* mov absoliute immediate.  */
++            case 1:
++                if (seen_rexw)
++                    immed = 8;
++                else
++                    immed = addr_size;
++                break;
++            case 4: /* test immediate.  */
++                if (op & 1)
++                    immed = op_size;
++                else
++                    immed = 1;
++                break;
++            default: /* Various string ops.  */
++                break;
++            }
++            modrm = 0;
++            break;
++
++        case 11: /* move immediate to register */
++            if (op & 8) {
++                if (seen_rexw)
++                    immed = 8;
++                else
++                    immed = op_size;
++            } else {
++                immed = 1;
++            }
++            modrm = 0;
++            break;
++
++          case 12:
++            switch (op & 0xf) {
++            case 0: /* shift immediate */
++            case 1:
++                immed = 1;
++                break;
++            case 2: /* ret immediate */
++                immed = 2;
++                modrm = 0;
++                bad_opcode(name, op);
++                break;
++            case 3: /* ret */
++                modrm = 0;
++                is_ret = 1;
++            case 4: /* les */
++            case 5: /* lds */
++                break;
++            case 6: /* mov immediate byte */
++                immed = 1;
++                break;
++            case 7: /* mov immediate */
++                immed = op_size;
++                break;
++            case 8: /* enter */
++                /* TODO: Is this right?  */
++                immed = 3;
++                modrm = 0;
++                break;
++            case 10: /* retf immediate */
++                immed = 2;
++                modrm = 0;
++                bad_opcode(name, op);
++                break;
++            case 13: /* int */
++                immed = 1;
++                modrm = 0;
++                break;
++            case 11: /* retf */
++            case 15: /* iret */
++                modrm = 0;
++                bad_opcode(name, op);
++                break;
++            default: /* leave, int3 or into */
++                modrm = 0;
++                break;
++            }
++            break;
++
++        case 13:
++            if ((op & 0xf) >= 8) {
++                /* Coprocessor escape.  For our purposes this is just a normal
++                   instruction with a ModR/M byte.  */
++            } else if ((op & 0xf) >= 4) {
++                /* AAM, AAD or XLAT */
++                modrm = 0;
++            }
++            /* else shift instruction */
++            break;
++
++        case 14:
++            switch ((op & 0xc) >> 2) {
++            case 0: /* loop or jcxz */
++                is_condjmp = 1;
++                immed = 1;
++                break;
++            case 1: /* in/out immed */
++                immed = 1;
++                break;
++            case 2: /* call or jmp */
++                switch (op & 3) {
++                case 0: /* call */
++                    immed = op_size;
++                    break;
++                case 1: /* long jump */
++                    immed = 4;
++                    is_jmp = 1;
++                    break;
++                case 2: /* far jmp */
++                    bad_opcode(name, op);
++                    break;
++                case 3: /* short jmp */
++                    immed = 1;
++                    is_jmp = 1;
++                    break;
++                }
++                break;
++            case 3: /* in/out register */
++                break;
++            }
++            modrm = 0;
++            break;
++
++        case 15:
++            switch ((op & 0xe) >> 1) {
++            case 0:
++            case 1:
++                is_prefix = 1;
++                break;
++            case 2:
++            case 4:
++            case 5:
++            case 6:
++                modrm = 0;
++                /* Some privileged insns are used as markers.  */
++                switch (op) {
++                case 0xf4: /* hlt: Exit translation block.  */
++                    is_exit = 1;
++                    break;
++                case 0xfa: /* cli: Jump to label.  */
++                    is_exit = 1;
++                    immed = 4;
++                    break;
++                case 0xfb: /* sti: TB patch jump.  */
++                    /* Mark the insn for patching, but continue sscanning.  */
++                    flags[insn] |= FLAG_EXIT;
++                    immed = 4;
++                    break;
++                }
++                break;
++            case 3: /* unary grp3 */
++                if ((ptr[insn_size] & 0x38) == 0) {
++                    if (op == 0xf7)
++                        immed = op_size;
++                    else
++                        immed = 1; /* test immediate */
++                }
++                break;
++            case 7: /* inc/dec grp4/5 */
++                /* TODO: This includes indirect jumps.  We should fail if we
++                   encounter one of these. */
++                break;
++            }
++            break;
++        }
++    }
++
++    if (modrm) {
++        if (addr_size != 4)
++            error("16-bit addressing mode used in %s", name);
++
++        disp = 0;
++        modrm = ptr[insn_size];
++        insn_size = eat_bytes(name, flags, insn, insn_size, 1);
++        modrm &= 0xc7;
++        switch ((modrm & 0xc0) >> 6) {
++        case 0:
++            if (modrm == 5)
++              disp = 4;
++            break;
++        case 1:
++            disp = 1;
++            break;
++        case 2:
++            disp = 4;
++            break;
++        }
++        if ((modrm & 0xc0) != 0xc0 && (modrm & 0x7) == 4) {
++            /* SIB byte */
++            if (modrm == 4 && (ptr[insn_size] & 0x7) == 5) {
++                disp = 4;
++                is_pcrel = 1;
++            }
++            insn_size = eat_bytes(name, flags, insn, insn_size, 1);
++        }
++        insn_size = eat_bytes(name, flags, insn, insn_size, disp);
++    }
++    insn_size = eat_bytes(name, flags, insn, insn_size, immed);
++    if (is_condjmp || is_jmp) {
++        if (immed == 1) {
++            disp = (int8_t)*(ptr + insn_size - 1);
++        } else {
++            disp = (((int32_t)*(ptr + insn_size - 1)) << 24)
++                   | (((int32_t)*(ptr + insn_size - 2)) << 16)
++                   | (((int32_t)*(ptr + insn_size - 3)) << 8)
++                   | *(ptr + insn_size - 4);
++        }
++        disp += insn_size;
++        /* Jumps to external symbols point to the address of the offset
++           before relocation.  */
++        /* ??? These are probably a tailcall.  We could fix them up by
++           replacing them with jmp to EOB + call, but it's easier to just
++           prevent the compiler generating them.  */
++        if (disp == 1)
++            error("Unconditional jump (sibcall?) in %s", name);
++        disp += insn;
++        if (disp < 0 || disp > len)
++            error("Jump outside instruction in %s", name);
++
++        if ((flags[disp] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_SCANNED)
++            error("Overlapping instructions in %s", name);
++
++        flags[disp] |= (FLAG_INSN | FLAG_TARGET);
++        is_pcrel = 1; 
++    }
++    if (is_pcrel) {
++        /* Mark the following insn as a jump target.  This will stop
++           this instruction being moved.  */
++        flags[insn + insn_size] |= FLAG_TARGET;
++    }
++    if (is_ret)
++      flags[insn] |= FLAG_RET;
++
++    if (is_exit)
++      flags[insn] |= FLAG_EXIT;
++
++    if (!(is_jmp || is_ret || is_exit))
++      flags[insn + insn_size] |= FLAG_INSN;
++}
++
++/* Scan a function body.  Returns the position of the return sequence.
++   Sets *patch_bytes to the number of bytes that need to be copied from that
++   location.  If no patching is required (ie. the return is the last insn)
++   *patch_bytes will be set to -1.  *plen is the number of code bytes to copy.
++ */
++static int trace_i386_op(const char * name, uint8_t *start_p, int *plen,
++                         int *patch_bytes, int *exit_addrs)
++{
++    char *flags;
++    int more;
++    int insn;
++    int retpos;
++    int bytes;
++    int num_exits;
++    int len;
++    int last_insn;
++
++    len = *plen;
++    flags = malloc(len + 1);
++    memset(flags, 0, len + 1);
++    flags[0] |= FLAG_INSN;
++    more = 1;
++    while (more) {
++        more = 0;
++        for (insn = 0; insn < len; insn++) {
++            if ((flags[insn] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_INSN) {
++                trace_i386_insn(name, start_p, flags, insn, len);
++                more = 1;
++            }
++        }
++    }
++
++    /* Strip any unused code at the end of the function.  */
++    while (len > 0 && flags[len - 1] == 0)
++      len--;
++
++    retpos = -1;
++    num_exits = 0;
++    last_insn = 0;
++    for (insn = 0; insn < len; insn++) {
++        if (flags[insn] & FLAG_RET) {
++            /* ??? In theory it should be possible to handle multiple return
++               points.  In practice it's not worth the effort.  */
++            if (retpos != -1)
++                error("Multiple return instructions in %s", name);
++            retpos = insn;
++        }
++        if (flags[insn] & FLAG_EXIT) {
++            if (num_exits == MAX_EXITS)
++                error("Too many block exits in %s", name);
++            exit_addrs[num_exits] = insn;
++            num_exits++;
++        }
++        if (flags[insn] & FLAG_INSN)
++            last_insn = insn;
++    }
++
++    exit_addrs[num_exits] = -1;
++    if (retpos == -1) {
++        if (num_exits == 0) {
++            error ("No return instruction found in %s", name);
++        } else {
++            retpos = len;
++            last_insn = len;
++        }
++    }
++    
++    /* If the return instruction is the last instruction we can just 
++       remove it.  */
++    if (retpos == last_insn)
++        *patch_bytes = -1;
++    else
++        *patch_bytes = 0;
++
++    /* Back up over any nop instructions.  */
++    while (retpos > 0
++           && (flags[retpos] & FLAG_TARGET) == 0
++           && (flags[retpos - 1] & FLAG_INSN) != 0
++           && start_p[retpos - 1] == 0x90) {
++        retpos--;
++    }
++
++    if (*patch_bytes == -1) {
++        *plen = retpos;
++        free (flags);
++        return retpos;
++    }
++    *plen = len;
++
++    /* The ret is in the middle of the function.  Find four more bytes that
++       so the ret can be replaced by a jmp. */
++    /* ??? Use a short jump where possible. */
++    bytes = 4;
++    insn = retpos + 1;
++    /* We can clobber everything up to the next jump target.  */
++    while (insn < len && bytes > 0 && (flags[insn] & FLAG_TARGET) == 0) {
++        insn++;
++        bytes--;
++    }
++    if (bytes > 0) {
++        /* ???: Strip out nop blocks.  */
++        /* We can't do the replacement without clobbering anything important.
++           Copy preceeding instructions(s) to give us some space.  */
++        while (retpos > 0) {
++            /* If this byte is the target of a jmp we can't move it.  */
++            if (flags[retpos] & FLAG_TARGET)
++                break;
++
++            (*patch_bytes)++;
++            bytes--;
++            retpos--;
++
++            /* Break out of the loop if we have enough space and this is either 
++               the first byte of an instruction or a pad byte.  */
++            if ((flags[retpos] & (FLAG_INSN | FLAG_SCANNED)) != FLAG_SCANNED
++                && bytes <= 0) {
++                break;
++            }
++        }
++    }
++
++    if (bytes > 0)
++        error("Unable to replace ret with jmp in %s\n", name);
++
++    free(flags);
++    return retpos;
++}
++
++#endif
++
+ #define MAX_ARGS 3
+ 
+ /* generate op code */
+@@ -1442,6 +2082,11 @@
+     uint8_t args_present[MAX_ARGS];
+     const char *sym_name, *p;
+     EXE_RELOC *rel;
++#if defined(HOST_I386) || defined(HOST_X86_64)
++    int patch_bytes;
++    int retpos;
++    int exit_addrs[MAX_EXITS];
++#endif
+ 
+     /* Compute exact size excluding prologue and epilogue instructions.
+      * Increment start_offset to skip epilogue instructions, then compute
+@@ -1452,33 +2097,12 @@
+     p_end = p_start + size;
+     start_offset = offset;
+ #if defined(HOST_I386) || defined(HOST_X86_64)
+-#ifdef CONFIG_FORMAT_COFF
+-    {
+-        uint8_t *p;
+-        p = p_end - 1;
+-        if (p == p_start)
+-            error("empty code for %s", name);
+-        while (*p != 0xc3) {
+-            p--;
+-            if (p <= p_start)
+-                error("ret or jmp expected at the end of %s", name);
+-        }
+-        copy_size = p - p_start;
+-    }
+-#else
+     {
+         int len;
+         len = p_end - p_start;
+-        if (len == 0)
+-            error("empty code for %s", name);
+-        if (p_end[-1] == 0xc3) {
+-            len--;
+-        } else {
+-            error("ret or jmp expected at the end of %s", name);
+-        }
++        retpos = trace_i386_op(name, p_start, &len, &patch_bytes, exit_addrs);
+         copy_size = len;
+     }
+-#endif    
+ #elif defined(HOST_PPC)
+     {
+         uint8_t *p;
+@@ -1710,6 +2334,13 @@
+     }
+ 
+     if (gen_switch == 2) {
++#if defined(HOST_I386) || defined(HOST_X86_64)
++        if (patch_bytes != -1)
++            copy_size += patch_bytes;
++#ifdef DEBUG_OP
++        copy_size += 2;
++#endif
++#endif
+         fprintf(outfile, "DEF(%s, %d, %d)\n", name + 3, nb_args, copy_size);
+     } else if (gen_switch == 1) {
+ 
+@@ -1915,7 +2546,43 @@
+ #error unsupport object format
+ #endif
+                 }
++               }
++                /* Replace the marker instructions with the actual opcodes.  */
++                for (i = 0; exit_addrs[i] != -1; i++) {
++                    int op;
++                    switch (p_start[exit_addrs[i]])
++                      {
++                      case 0xf4: op = 0xc3; break; /* hlt -> ret */
++                      case 0xfa: op = 0xe9; break; /* cli -> jmp */
++                      case 0xfb: op = 0xe9; break; /* sti -> jmp */
++                      default: error("Internal error");
++                      }
++                    fprintf(outfile, 
++                            "    *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
++                            exit_addrs[i], op);
+                 }
++                /* Fix up the return instruction.  */
++                if (patch_bytes != -1) {
++                    if (patch_bytes) {
++                        fprintf(outfile, "    memcpy(gen_code_ptr + %d,"
++                                "gen_code_ptr + %d, %d);\n",
++                                copy_size, retpos, patch_bytes);
++                    }
++                    fprintf(outfile,
++                            "    *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
++                            retpos);
++                    fprintf(outfile,
++                            "    *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
++                            retpos + 1, copy_size - (retpos + 5));
++                    
++                    copy_size += patch_bytes;
++                }
++#ifdef DEBUG_OP
++                fprintf(outfile,
++                        "    *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
++                        copy_size);
++                copy_size += 2;
++#endif
+             }
+ #elif defined(HOST_X86_64)
+             {
+@@ -1949,6 +2616,42 @@
+                     }
+                 }
+                 }
++                /* Replace the marker instructions with the actual opcodes.  */
++                for (i = 0; exit_addrs[i] != -1; i++) {
++                    int op;
++                    switch (p_start[exit_addrs[i]])
++                      {
++                      case 0xf4: op = 0xc3; break; /* hlt -> ret */
++                      case 0xfa: op = 0xe9; break; /* cli -> jmp */
++                      case 0xfb: op = 0xe9; break; /* sti -> jmp */
++                      default: error("Internal error");
++                      }
++                    fprintf(outfile, 
++                            "    *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
++                            exit_addrs[i], op);
++                }
++                /* Fix up the return instruction.  */
++                if (patch_bytes != -1) {
++                    if (patch_bytes) {
++                        fprintf(outfile, "    memcpy(gen_code_ptr + %d,"
++                                "gen_code_ptr + %d, %d);\n",
++                                copy_size, retpos, patch_bytes);
++                    }
++                    fprintf(outfile,
++                            "    *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
++                            retpos);
++                    fprintf(outfile,
++                            "    *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
++                            retpos + 1, copy_size - (retpos + 5));
++                    
++                    copy_size += patch_bytes;
++                }
++#ifdef DEBUG_OP
++                fprintf(outfile,
++                        "    *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
++                        copy_size);
++                copy_size += 2;
++#endif
+             }
+ #elif defined(HOST_PPC)
+             {
+diff -Naru qemu-neo1973.orig/dyngen-exec.h qemu-neo1973/dyngen-exec.h
+--- qemu-neo1973.orig/dyngen-exec.h	2007-06-24 13:56:38.000000000 +0200
++++ qemu-neo1973/dyngen-exec.h	2007-06-24 14:35:52.000000000 +0200
+@@ -194,7 +194,12 @@
+ #endif
+ 
+ /* force GCC to generate only one epilog at the end of the function */
++#if defined(__i386__) || defined(__x86_64__)
++/* Also add 4 bytes of padding so that we can replace the ret with a jmp.  */
++#define FORCE_RET() asm volatile ("nop;nop;nop;nop");
++#else
+ #define FORCE_RET() __asm__ __volatile__("" : : : "memory");
++#endif
+ 
+ #ifndef OPPROTO
+ #define OPPROTO
+@@ -244,11 +249,18 @@
+ #endif
+ 
+ #if defined(__i386__)
+-#define EXIT_TB() asm volatile ("ret")
+-#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
++/* Dyngen will replace hlt instructions with a ret instruction.  Inserting a
++   ret directly would confuse dyngen.  */
++#define EXIT_TB() asm volatile ("hlt")
++/* Dyngen will replace cli with 0x9e (jmp).
++   We generate the offset manually.  */
++#define GOTO_LABEL_PARAM(n) \
++    asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
+ #elif defined(__x86_64__)
+-#define EXIT_TB() asm volatile ("ret")
+-#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
++/* The same as i386.  */
++#define EXIT_TB() asm volatile ("hlt")
++#define GOTO_LABEL_PARAM(n) \
++    asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
+ #elif defined(__powerpc__)
+ #define EXIT_TB() asm volatile ("blr")
+ #define GOTO_LABEL_PARAM(n) asm volatile ("b " ASM_NAME(__op_gen_label) #n)
+diff -Naru qemu-neo1973.orig/exec-all.h qemu-neo1973/exec-all.h
+--- qemu-neo1973.orig/exec-all.h	2007-06-24 14:31:58.000000000 +0200
++++ qemu-neo1973/exec-all.h	2007-06-24 14:33:11.000000000 +0200
+@@ -329,14 +329,15 @@
+ 
+ #elif defined(__i386__) && defined(USE_DIRECT_JUMP)
+ 
+-/* we patch the jump instruction directly */
++/* we patch the jump instruction directly.  Use sti in place of the actual
++   jmp instruction so that dyngen can patch in the correct result.  */
+ #define GOTO_TB(opname, tbparam, n)\
+ do {\
+     asm volatile (".section .data\n"\
+ 		  ASM_OP_LABEL_NAME(n, opname) ":\n"\
+ 		  ".long 1f\n"\
+ 		  ASM_PREVIOUS_SECTION \
+-                  "jmp " ASM_NAME(__op_jmp) #n "\n"\
++                  "sti;.long " ASM_NAME(__op_jmp) #n " - 1f\n"\
+ 		  "1:\n");\
+ } while (0)
+ 
+diff -Naru qemu-neo1973.orig/target-ppc/exec.h qemu-neo1973/target-ppc/exec.h
+--- qemu-neo1973.orig/target-ppc/exec.h	2007-06-24 13:56:32.000000000 +0200
++++ qemu-neo1973/target-ppc/exec.h	2007-06-24 14:33:11.000000000 +0200
+@@ -66,11 +66,7 @@
+ #define FT1 (env->ft1)
+ #define FT2 (env->ft2)
+ 
+-#if defined (DEBUG_OP)
+-# define RETURN() __asm__ __volatile__("nop" : : : "memory");
+-#else
+-# define RETURN() __asm__ __volatile__("" : : : "memory");
+-#endif
++#define RETURN() FORCE_RET()
+ 
+ static inline target_ulong rotl8 (target_ulong i, int n)
+ {
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-amd64-32b-mapping-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-amd64-32b-mapping-0.9.0.patch
new file mode 100644
index 0000000000..8f5e9d8b4b
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-amd64-32b-mapping-0.9.0.patch
@@ -0,0 +1,21 @@
+diff -Naru qemu-snapshot-2007-07-01_05.orig/linux-user/mmap.c qemu-snapshot-2007-07-01_05/linux-user/mmap.c
+--- qemu-snapshot-2007-07-01_05.orig/linux-user/mmap.c	2007-06-03 17:31:32.000000000 +0200
++++ qemu-snapshot-2007-07-01_05/linux-user/mmap.c	2007-07-02 14:00:30.000000000 +0200
+@@ -234,7 +234,7 @@
+             host_offset = offset & qemu_host_page_mask;
+             host_len = len + offset - host_offset;
+             host_start = (long)mmap(real_start ? g2h(real_start) : NULL,
+-                                    host_len, prot, flags, fd, host_offset);
++                                    host_len, prot, (flags | MAP_32BIT), fd, host_offset);
+             if (host_start == -1)
+                 return host_start;
+             /* update start so that it points to the file position at 'offset' */
+@@ -388,7 +388,7 @@
+     int prot;
+ 
+     /* XXX: use 5 args syscall */
+-    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags);
++    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, (flags | MAP_32BIT));
+     if (new_addr == -1)
+         return new_addr;
+     new_addr = h2g(new_addr);
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-sdl-cursor-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-sdl-cursor-0.9.0.patch
new file mode 100644
index 0000000000..08d5513f36
--- /dev/null
+++ b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-sdl-cursor-0.9.0.patch
@@ -0,0 +1,12 @@
+diff -Naru qemu-snapshot-2007-06-24_05.orig/sdl.c qemu-snapshot-2007-06-24_05/sdl.c
+--- qemu-snapshot-2007-06-24_05.orig/sdl.c	2007-06-21 23:08:02.000000000 +0200
++++ qemu-snapshot-2007-06-24_05/sdl.c	2007-06-24 16:33:20.000000000 +0200
+@@ -245,7 +245,7 @@
+ 
+     if (kbd_mouse_is_absolute()) {
+         SDL_ShowCursor(1);
+-        SDL_SetCursor(sdl_cursor_hidden);
++        /* SDL_SetCursor(sdl_cursor_hidden); */
+     } else {
+         SDL_ShowCursor(0);
+     }
diff --git a/packages/qemu/qemu-native_0.9.0+cvs.bb b/packages/qemu/qemu-native_0.9.0+cvs.bb
new file mode 100644
index 0000000000..65a7908a5c
--- /dev/null
+++ b/packages/qemu/qemu-native_0.9.0+cvs.bb
@@ -0,0 +1,3 @@
+require qemu_0.9.0+cvs.bb
+inherit native
+require qemu-native.inc
diff --git a/packages/qemu/qemu_0.9.0+cvs.bb b/packages/qemu/qemu_0.9.0+cvs.bb
new file mode 100644
index 0000000000..8a89b805a2
--- /dev/null
+++ b/packages/qemu/qemu_0.9.0+cvs.bb
@@ -0,0 +1,22 @@
+DESCRIPTION = "Qemu is an open source processor emulator."
+HOMEPAGE = "http://fabrice.bellard.free.fr/qemu/"
+SECTION = "devel"
+LICENSE = "GPL"
+SRCDATE="20070701"
+PV = "0.9.0+cvs${SRCDATE}"
+PR = "r1"
+
+SRC_URI = "cvs://anonymous@cvs.savannah.nongnu.org/sources/qemu;method=pserver;rsh=ssh;module=qemu;date=${SRCDATE} \
+           file://configure-0.9.0.patch;patch=1 \
+           file://qemu-sdl-cursor-0.9.0.patch;patch=1 \
+           file://arm_nptl-0.9.0.patch;patch=1 \
+           file://pl110_rgb-r0-0.9.0.patch;patch=1 \
+           file://qemu-0.9.0-gcc4.patch;patch=1 \
+	   file://qemu-amd64-32b-mapping-0.9.0.patch;patch=1"
+S = "${WORKDIR}/qemu"
+
+EXTRA_OECONF="--disable-gcc-check"
+
+inherit autotools
+
+DEFAULT_PREFERENCE = "-1"