## Automatically generated incremental diff
## From:   linux-2.4.22-bk42
## To:     linux-2.4.22-bk43
## Robot:  $Id: make-incremental-diff,v 1.11 2002/02/20 02:59:33 hpa Exp $

diff -urN linux-2.4.22-bk42/Makefile linux-2.4.22-bk43/Makefile
--- linux-2.4.22-bk42/Makefile	2003-10-28 02:49:42.000000000 -0800
+++ linux-2.4.22-bk43/Makefile	2003-10-28 02:49:46.000000000 -0800
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 22
-EXTRAVERSION = -bk42
+EXTRAVERSION = -bk43
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 
diff -urN linux-2.4.22-bk42/drivers/bluetooth/Config.in linux-2.4.22-bk43/drivers/bluetooth/Config.in
--- linux-2.4.22-bk42/drivers/bluetooth/Config.in	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/bluetooth/Config.in	2003-10-28 02:49:46.000000000 -0800
@@ -8,7 +8,6 @@
 dep_tristate 'HCI USB driver' CONFIG_BLUEZ_HCIUSB $CONFIG_BLUEZ $CONFIG_USB
 if [ "$CONFIG_BLUEZ_HCIUSB" != "n" ]; then
    bool '  SCO (voice) support'  CONFIG_BLUEZ_USB_SCO
-   bool '  USB zero packet support'  CONFIG_BLUEZ_USB_ZERO_PACKET
 fi
 
 dep_tristate 'HCI UART driver' CONFIG_BLUEZ_HCIUART $CONFIG_BLUEZ
diff -urN linux-2.4.22-bk42/drivers/bluetooth/hci_usb.c linux-2.4.22-bk43/drivers/bluetooth/hci_usb.c
--- linux-2.4.22-bk42/drivers/bluetooth/hci_usb.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/bluetooth/hci_usb.c	2003-10-28 02:49:47.000000000 -0800
@@ -70,12 +70,18 @@
 static struct usb_driver hci_usb_driver; 
 
 static struct usb_device_id bluetooth_ids[] = {
+	/* Digianswer device */
+	{ USB_DEVICE(0x08fd, 0x0001), driver_info: HCI_DIGIANSWER },
+
 	/* Generic Bluetooth USB device */
 	{ USB_DEVICE_INFO(HCI_DEV_CLASS, HCI_DEV_SUBCLASS, HCI_DEV_PROTOCOL) },
 
 	/* Ericsson with non-standard id */
 	{ USB_DEVICE(0x0bdb, 0x1002) },
 
+	/* ALPS Module with non-standard id */
+	{ USB_DEVICE(0x044e, 0x3002) },
+
 	/* Bluetooth Ultraport Module from IBM */
 	{ USB_DEVICE(0x04bf, 0x030a) },
 
@@ -302,7 +308,8 @@
 
 #ifdef CONFIG_BLUEZ_USB_SCO
 		if (husb->isoc_iface)
-			hci_usb_isoc_rx_submit(husb);
+			for (i = 0; i < HCI_MAX_ISOC_RX; i++)
+				hci_usb_isoc_rx_submit(husb);
 #endif
 	} else {
 		clear_bit(HCI_RUNNING, &hdev->flags);
@@ -427,7 +434,7 @@
 	} else
 		dr = (void *) _urb->urb.setup_packet;
 
-	dr->bRequestType = HCI_CTRL_REQ;
+	dr->bRequestType = husb->ctrl_req;
 	dr->bRequest = 0;
 	dr->wIndex   = 0;
 	dr->wValue   = 0;
@@ -522,7 +529,7 @@
 #ifdef CONFIG_BLUEZ_USB_SCO
 		/* Process SCO queue */
 		q = __transmit_q(husb, HCI_SCODATA_PKT);
-		if (!atomic_read(__pending_tx(husb, HCI_SCODATA_PKT)) &&
+		if (atomic_read(__pending_tx(husb, HCI_SCODATA_PKT)) < HCI_MAX_ISOC_TX &&
 				(skb = skb_dequeue(q))) {
 			if (hci_usb_send_isoc(husb, skb) < 0)
 				skb_queue_head(q, skb);
@@ -830,7 +837,7 @@
 
 #ifdef CONFIG_BLUEZ_USB_SCO
 				case USB_ENDPOINT_XFER_ISOC:
-					if (ep->wMaxPacketSize < size)
+					if (ep->wMaxPacketSize < size || a > 2)
 						break;
 					size = ep->wMaxPacketSize;
 
@@ -873,6 +880,11 @@
 	husb->bulk_in_ep  = bulk_in_ep[0];
 	husb->intr_in_ep  = intr_in_ep[0];
 
+	if (id->driver_info & HCI_DIGIANSWER)
+		husb->ctrl_req = HCI_DIGI_REQ;
+	else
+		husb->ctrl_req = HCI_CTRL_REQ;
+
 #ifdef CONFIG_BLUEZ_USB_SCO
 	if (isoc_iface) {
 		BT_DBG("isoc ifnum %d alts %d", isoc_ifnum, isoc_alts);
diff -urN linux-2.4.22-bk42/drivers/bluetooth/hci_usb.h linux-2.4.22-bk43/drivers/bluetooth/hci_usb.h
--- linux-2.4.22-bk42/drivers/bluetooth/hci_usb.h	2003-06-13 07:51:32.000000000 -0700
+++ linux-2.4.22-bk43/drivers/bluetooth/hci_usb.h	2003-10-28 02:49:47.000000000 -0800
@@ -35,12 +35,18 @@
 #define HCI_DEV_PROTOCOL     0x01	/* Bluetooth programming protocol */
 
 #define HCI_CTRL_REQ	     0x20
+#define HCI_DIGI_REQ	     0x40
+
+#define HCI_DIGIANSWER       0x01
 
 #define HCI_MAX_IFACE_NUM	3 
 
 #define HCI_MAX_BULK_TX     	4
 #define HCI_MAX_BULK_RX     	1
 
+#define HCI_MAX_ISOC_RX		2
+#define HCI_MAX_ISOC_TX		2
+
 #define HCI_MAX_ISOC_FRAMES     10
 
 struct _urb_queue {
@@ -119,6 +125,8 @@
 	struct usb_endpoint_descriptor	*isoc_out_ep;
 	struct usb_endpoint_descriptor	*isoc_in_ep;
 
+	__u8			ctrl_req;
+
 	struct sk_buff_head	transmit_q[4];
 	struct sk_buff		*reassembly[4]; // Reassembly buffers
 
diff -urN linux-2.4.22-bk42/drivers/char/sonypi.c linux-2.4.22-bk43/drivers/char/sonypi.c
--- linux-2.4.22-bk42/drivers/char/sonypi.c	2003-10-28 02:49:43.000000000 -0800
+++ linux-2.4.22-bk43/drivers/char/sonypi.c	2003-10-28 02:49:47.000000000 -0800
@@ -303,7 +303,7 @@
 }
 
 /* Interrupt handler: some event is available */
-void sonypi_irq(int irq, void *dev_id, struct pt_regs *regs) {
+static irqreturn_t sonypi_irq(int irq, void *dev_id, struct pt_regs *regs) {
 	u8 v1, v2, event = 0;
 	int i, j;
 
@@ -328,7 +328,10 @@
 	if (verbose)
 		printk(KERN_WARNING 
 		       "sonypi: unknown event port1=0x%02x,port2=0x%02x\n",v1,v2);
-	return;
+	/* We need to return IRQ_HANDLED here because there *are*
+	 * events belonging to the sonypi device we don't know about, 
+	 * but we still don't want those to pollute the logs... */
+	return IRQ_HANDLED;
 
 found:
 	if (verbose > 1)
@@ -351,6 +354,7 @@
 	}
 #endif /* SONYPI_USE_INPUT */
 	sonypi_pushq(event);
+	return IRQ_HANDLED;
 }
 
 /* External camera command (exported to the motion eye v4l driver) */
diff -urN linux-2.4.22-bk42/drivers/char/sonypi.h linux-2.4.22-bk43/drivers/char/sonypi.h
--- linux-2.4.22-bk42/drivers/char/sonypi.h	2003-10-28 02:49:43.000000000 -0800
+++ linux-2.4.22-bk43/drivers/char/sonypi.h	2003-10-28 02:49:47.000000000 -0800
@@ -37,7 +37,7 @@
 #ifdef __KERNEL__
 
 #define SONYPI_DRIVER_MAJORVERSION	 1
-#define SONYPI_DRIVER_MINORVERSION	20
+#define SONYPI_DRIVER_MINORVERSION	21
 
 #define SONYPI_DEVICE_MODEL_TYPE1	1
 #define SONYPI_DEVICE_MODEL_TYPE2	2
@@ -329,8 +329,8 @@
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x08, SONYPI_PKEY_MASK, sonypi_pkeyev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x11, SONYPI_BACK_MASK, sonypi_backev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x08, SONYPI_HELP_MASK, sonypi_helpev },
-	{ SONYPI_DEVICE_MODEL_TYPE2, 0x08, SONYPI_ZOOM_MASK, sonypi_zoomev },
-	{ SONYPI_DEVICE_MODEL_TYPE2, 0x08, SONYPI_THUMBPHRASE_MASK, sonypi_thumbphraseev },
+	{ SONYPI_DEVICE_MODEL_TYPE2, 0x21, SONYPI_ZOOM_MASK, sonypi_zoomev },
+	{ SONYPI_DEVICE_MODEL_TYPE2, 0x20, SONYPI_THUMBPHRASE_MASK, sonypi_thumbphraseev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x31, SONYPI_MEMORYSTICK_MASK, sonypi_memorystickev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x41, SONYPI_BATTERY_MASK, sonypi_batteryev },
 
diff -urN linux-2.4.22-bk42/drivers/ieee1394/cmp.c linux-2.4.22-bk43/drivers/ieee1394/cmp.c
--- linux-2.4.22-bk42/drivers/ieee1394/cmp.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/cmp.c	2003-10-28 02:49:47.000000000 -0800
@@ -158,7 +158,7 @@
 }
 
 static int pcr_read(struct hpsb_host *host, int nodeid, quadlet_t *buf,
-		    u64 addr, unsigned int length, u16 flags)
+		    u64 addr, size_t length, u16 flags)
 {
 	int csraddr = addr - CSR_REGISTER_BASE;
 	int plug;
diff -urN linux-2.4.22-bk42/drivers/ieee1394/csr.c linux-2.4.22-bk43/drivers/ieee1394/csr.c
--- linux-2.4.22-bk42/drivers/ieee1394/csr.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/csr.c	2003-10-28 02:49:47.000000000 -0800
@@ -20,6 +20,7 @@
 #include <linux/string.h>
 #include <linux/module.h> /* needed for MODULE_PARM */
 #include <linux/param.h>
+#include <linux/spinlock.h>
 
 #include "ieee1394_types.h"
 #include "hosts.h"
@@ -115,6 +116,8 @@
 
 	/* Just to keep from rounding low */
 	csr->expire++;
+
+	HPSB_VERBOSE("CSR: setting expire to %lu, HZ=%lu", csr->expire, HZ);
 }
 
 
@@ -187,7 +190,7 @@
 
 /* Read topology / speed maps and configuration ROM */
 static int read_maps(struct hpsb_host *host, int nodeid, quadlet_t *buffer,
-                     u64 addr, unsigned int length, u16 fl)
+                     u64 addr, size_t length, u16 fl)
 {
 	unsigned long flags;
         int csraddr = addr - CSR_REGISTER_BASE;
@@ -197,6 +200,7 @@
 
         if (csraddr < CSR_TOPOLOGY_MAP) {
                 if (csraddr + length > CSR_CONFIG_ROM + host->csr.rom_size) {
+                        spin_unlock_irqrestore(&host->csr.lock, flags);
                         return RCODE_ADDRESS_ERROR;
                 }
                 src = ((char *)host->csr.rom) + csraddr - CSR_CONFIG_ROM;
@@ -216,7 +220,7 @@
 #define out if (--length == 0) break
 
 static int read_regs(struct hpsb_host *host, int nodeid, quadlet_t *buf,
-                     u64 addr, unsigned int length, u16 flags)
+                     u64 addr, size_t length, u16 flags)
 {
         int csraddr = addr - CSR_REGISTER_BASE;
         int oldcycle;
@@ -330,7 +334,7 @@
 }
 
 static int write_regs(struct hpsb_host *host, int nodeid, int destid,
-		      quadlet_t *data, u64 addr, unsigned int length, u16 flags)
+		      quadlet_t *data, u64 addr, size_t length, u16 flags)
 {
         int csraddr = addr - CSR_REGISTER_BASE;
         
@@ -656,7 +660,7 @@
 }
 
 static int write_fcp(struct hpsb_host *host, int nodeid, int dest,
-		     quadlet_t *data, u64 addr, unsigned int length, u16 flags)
+		     quadlet_t *data, u64 addr, size_t length, u16 flags)
 {
         int csraddr = addr - CSR_REGISTER_BASE;
 
diff -urN linux-2.4.22-bk42/drivers/ieee1394/eth1394.c linux-2.4.22-bk43/drivers/ieee1394/eth1394.c
--- linux-2.4.22-bk42/drivers/ieee1394/eth1394.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/eth1394.c	2003-10-28 02:49:47.000000000 -0800
@@ -89,7 +89,7 @@
 #define TRACE() printk(KERN_ERR "%s:%s[%d] ---- TRACE\n", driver_name, __FUNCTION__, __LINE__)
 
 static char version[] __devinitdata =
-	"$Rev: 1010 $ Ben Collins <bcollins@debian.org>";
+	"$Rev: 1043 $ Ben Collins <bcollins@debian.org>";
 
 struct fragment_info {
 	struct list_head list;
@@ -130,7 +130,7 @@
 
 static const u16 eth1394_speedto_maxpayload[] = {
 /*     S100, S200, S400, S800, S1600, S3200 */
-	512, 1024, 2048, 4096,  8192, 16384
+	512, 1024, 2048, 4096,  4096,  4096
 };
 
 MODULE_AUTHOR("Ben Collins (bcollins@debian.org)");
@@ -1086,7 +1086,7 @@
 }
 
 static int ether1394_write(struct hpsb_host *host, int srcid, int destid,
-			   quadlet_t *data, u64 addr, unsigned int len, u16 flags)
+			   quadlet_t *data, u64 addr, size_t len, u16 flags)
 {
 	struct host_info *hi = hpsb_get_hostinfo(&eth1394_highlevel, host);
 
@@ -1283,7 +1283,7 @@
 	p->header_size = 16;
 	p->expect_response = 1;
 
-	if (hpsb_get_tlabel(p, !in_interrupt())) {
+	if (hpsb_get_tlabel(p)) {
 		ETH1394_PRINT_G(KERN_ERR, "No more tlabels left while sending "
 				"to node " NODE_BUS_FMT "\n", NODE_BUS_ARGS(host, node));
 		return -1;
@@ -1349,21 +1349,20 @@
 					       ptask->dest_node,
 					       ptask->addr, ptask->skb->data,
 					       tx_len)) {
-		goto fail;
+		free_hpsb_packet(packet);
+		return -1;
 	}
 
 	ptask->packet = packet;
 	hpsb_set_packet_complete_task(ptask->packet, ether1394_complete_cb,
 				      ptask);
 
-	if (hpsb_send_packet(packet))
-		return 0;
-
-fail:
-	if (packet)
+	if (!hpsb_send_packet(packet)) {
 		ether1394_free_packet(packet);
+		return -1;
+	}
 
-	return -1;
+	return 0;
 }
 
 
@@ -1600,7 +1599,7 @@
 		case ETHTOOL_GDRVINFO: {
 			struct ethtool_drvinfo info = { ETHTOOL_GDRVINFO };
 			strcpy (info.driver, driver_name);
-			strcpy (info.version, "$Rev: 1010 $");
+			strcpy (info.version, "$Rev: 1043 $");
 			/* FIXME XXX provide sane businfo */
 			strcpy (info.bus_info, "ieee1394");
 			if (copy_to_user (useraddr, &info, sizeof (info)))
diff -urN linux-2.4.22-bk42/drivers/ieee1394/eth1394.h linux-2.4.22-bk43/drivers/ieee1394/eth1394.h
--- linux-2.4.22-bk42/drivers/ieee1394/eth1394.h	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/eth1394.h	2003-10-28 02:49:47.000000000 -0800
@@ -26,9 +26,9 @@
 
 #include "ieee1394.h"
 
-/* Register for incoming packets. This is 8192 bytes, which supports up to
- * 1600mbs. We'll need to change this if that ever becomes "small" :)  */
-#define ETHER1394_REGION_ADDR_LEN	8192
+/* Register for incoming packets. This is 4096 bytes, which supports up to
+ * S3200 (per Table 16-3 of IEEE 1394b-2002). */
+#define ETHER1394_REGION_ADDR_LEN	4096
 #define ETHER1394_REGION_ADDR		0xfffff0200000ULL
 #define ETHER1394_REGION_ADDR_END	(ETHER1394_REGION_ADDR + ETHER1394_REGION_ADDR_LEN)
 
diff -urN linux-2.4.22-bk42/drivers/ieee1394/highlevel.c linux-2.4.22-bk43/drivers/ieee1394/highlevel.c
--- linux-2.4.22-bk42/drivers/ieee1394/highlevel.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/highlevel.c	2003-10-28 02:49:47.000000000 -0800
@@ -436,7 +436,7 @@
 }
 
 void highlevel_iso_receive(struct hpsb_host *host, void *data,
-                           unsigned int length)
+			   size_t length)
 {
         struct list_head *entry;
         struct hpsb_highlevel *hl;
@@ -456,7 +456,7 @@
 }
 
 void highlevel_fcp_request(struct hpsb_host *host, int nodeid, int direction,
-                           void *data, unsigned int length)
+			   void *data, size_t length)
 {
         struct list_head *entry;
         struct hpsb_highlevel *hl;
diff -urN linux-2.4.22-bk42/drivers/ieee1394/highlevel.h linux-2.4.22-bk43/drivers/ieee1394/highlevel.h
--- linux-2.4.22-bk42/drivers/ieee1394/highlevel.h	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/highlevel.h	2003-10-28 02:49:47.000000000 -0800
@@ -45,14 +45,14 @@
          * packet header (first quadlet, CRCs are missing).  You may get called
          * for channel/host combinations you did not request. */
         void (*iso_receive) (struct hpsb_host *host, int channel,
-                             quadlet_t *data, unsigned int length);
+                             quadlet_t *data, size_t length);
 
         /* A write request was received on either the FCP_COMMAND (direction =
          * 0) or the FCP_RESPONSE (direction = 1) register.  The cts arg
          * contains the cts field (first byte of data).
          */
         void (*fcp_request) (struct hpsb_host *host, int nodeid, int direction,
-                             int cts, u8 *data, unsigned int length);
+                             int cts, u8 *data, size_t length);
 
 
 	struct list_head hl_list;
@@ -78,9 +78,9 @@
            will send the response itself
         */
         int (*read) (struct hpsb_host *host, int nodeid, quadlet_t *buffer,
-                     u64 addr, unsigned int length, u16 flags);
+                     u64 addr, size_t length, u16 flags);
         int (*write) (struct hpsb_host *host, int nodeid, int destid,
-		      quadlet_t *data, u64 addr, unsigned int length, u16 flags);
+		      quadlet_t *data, u64 addr, size_t length, u16 flags);
 
         /* Lock transactions: write results of ext_tcode operation into
          * *store. */
@@ -116,9 +116,9 @@
                      u64 addr, octlet_t data, octlet_t arg, int ext_tcode, u16 flags);
 
 void highlevel_iso_receive(struct hpsb_host *host, void *data,
-                           unsigned int length);
+                           size_t length);
 void highlevel_fcp_request(struct hpsb_host *host, int nodeid, int direction,
-                           void *data, unsigned int length);
+                           void *data, size_t length);
 
 
 /*
diff -urN linux-2.4.22-bk42/drivers/ieee1394/ieee1394-ioctl.h linux-2.4.22-bk43/drivers/ieee1394/ieee1394-ioctl.h
--- linux-2.4.22-bk42/drivers/ieee1394/ieee1394-ioctl.h	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/ieee1394-ioctl.h	2003-10-28 02:49:47.000000000 -0800
@@ -60,9 +60,13 @@
 	_IOWR('#', 0x14, struct video1394_mmap)
 #define VIDEO1394_IOC_UNTALK_CHANNEL		\
 	_IOW ('#', 0x15, int)
+/*
+ * This one is broken: it really wanted
+ * "sizeof (struct video1394_wait) + sizeof (struct video1394_queue_variable)"
+ * but got just a "size_t"
+ */
 #define VIDEO1394_IOC_TALK_QUEUE_BUFFER 	\
-	_IOW ('#', 0x16, sizeof (struct video1394_wait) + \
-		sizeof (struct video1394_queue_variable))
+	_IOW ('#', 0x16, size_t)
 #define VIDEO1394_IOC_TALK_WAIT_BUFFER		\
 	_IOW ('#', 0x17, struct video1394_wait)
 #define VIDEO1394_IOC_LISTEN_POLL_BUFFER	\
diff -urN linux-2.4.22-bk42/drivers/ieee1394/ieee1394_core.c linux-2.4.22-bk43/drivers/ieee1394/ieee1394_core.c
--- linux-2.4.22-bk42/drivers/ieee1394/ieee1394_core.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/ieee1394_core.c	2003-10-28 02:49:47.000000000 -0800
@@ -59,19 +59,22 @@
 /* Some globals used */
 const char *hpsb_speedto_str[] = { "S100", "S200", "S400", "S800", "S1600", "S3200" };
 
+#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
 static void dump_packet(const char *text, quadlet_t *data, int size)
 {
-        int i;
+	int i;
 
-        size /= 4;
-        size = (size > 4 ? 4 : size);
+	size /= 4;
+	size = (size > 4 ? 4 : size);
 
-        printk(KERN_DEBUG "ieee1394: %s", text);
-        for (i = 0; i < size; i++) {
-                printk(" %8.8x", data[i]);
-        }
-        printk("\n");
+	printk(KERN_DEBUG "ieee1394: %s", text);
+	for (i = 0; i < size; i++)
+		printk(" %08x", data[i]);
+	printk("\n");
 }
+#else
+#define dump_packet(x,y,z)
+#endif
 
 static void run_packet_complete(struct hpsb_packet *packet)
 {
@@ -277,8 +280,8 @@
 
 static void build_speed_map(struct hpsb_host *host, int nodecount)
 {
-        char speedcap[nodecount];
-        char cldcnt[nodecount];
+	u8 speedcap[nodecount];
+        u8 cldcnt[nodecount];
         u8 *map = host->speed_map;
         struct selfid *sid;
         struct ext_selfid *esid;
@@ -329,7 +332,7 @@
         for (i = 1; i < nodecount; i++) {
                 for (j = cldcnt[i], n = i - 1; j > 0; j--) {
                         cldcnt[i] += cldcnt[n];
-                        speedcap[n] = MIN(speedcap[n], speedcap[i]);
+                        speedcap[n] = min(speedcap[n], speedcap[i]);
                         n -= cldcnt[n] + 1;
                 }
         }
@@ -338,11 +341,11 @@
                 for (i = n - cldcnt[n]; i <= n; i++) {
                         for (j = 0; j < (n - cldcnt[n]); j++) {
                                 map[j*64 + i] = map[i*64 + j] =
-                                        MIN(map[i*64 + j], speedcap[n]);
+                                        min(map[i*64 + j], speedcap[n]);
                         }
                         for (j = n + 1; j < nodecount; j++) {
                                 map[j*64 + i] = map[i*64 + j] =
-                                        MIN(map[i*64 + j], speedcap[n]);
+                                        min(map[i*64 + j], speedcap[n]);
                         }
                 }
         }
@@ -352,9 +355,7 @@
 void hpsb_selfid_received(struct hpsb_host *host, quadlet_t sid)
 {
         if (host->in_bus_reset) {
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-                HPSB_INFO("Including SelfID 0x%x", sid);
-#endif
+                HPSB_VERBOSE("Including SelfID 0x%x", sid);
                 host->topology_map[host->selfid_count++] = sid;
         } else {
                 HPSB_NOTICE("Spurious SelfID packet (0x%08x) received from bus %d",
@@ -388,10 +389,9 @@
                 build_speed_map(host, host->node_count);
         }
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-        HPSB_INFO("selfid_complete called with successful SelfID stage "
-		"... irm_id: 0x%X node_id: 0x%X",host->irm_id,host->node_id);
-#endif
+	HPSB_VERBOSE("selfid_complete called with successful SelfID stage "
+		     "... irm_id: 0x%X node_id: 0x%X",host->irm_id,host->node_id);
+
         /* irm_id is kept up to date by check_selfids() */
         if (host->irm_id == host->node_id) {
                 host->is_irm = 1;
@@ -549,10 +549,9 @@
                         }
                 }
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
                 dump_packet("send packet local:", packet->header,
                             packet->header_size);
-#endif
+
                 hpsb_packet_sent(host, packet,  packet->expect_response?ACK_PENDING:ACK_COMPLETE);
                 hpsb_packet_received(host, data, size, 0);
 
@@ -567,7 +566,6 @@
                                        + NODEID_TO_NODE(packet->node_id)];
         }
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
         switch (packet->speed_code) {
         case 2:
                 dump_packet("send packet 400:", packet->header,
@@ -581,7 +579,6 @@
                 dump_packet("send packet 100:", packet->header,
                             packet->header_size);
         }
-#endif
 
         return host->driver->transmit_packet(host, packet);
 }
@@ -616,7 +613,7 @@
         }
 
         if (lh == &host->pending_packets) {
-                HPSB_DEBUG("unsolicited response packet received - np");
+                HPSB_DEBUG("unsolicited response packet received - no tlabel match");
                 dump_packet("contents:", data, 16);
                 spin_unlock_irqrestore(&host->pending_pkt_lock, flags);
                 return;
@@ -640,7 +637,7 @@
 
         if (!tcode_match || (packet->tlabel != tlabel)
             || (packet->node_id != (data[1] >> 16))) {
-                HPSB_INFO("unsolicited response packet received");
+                HPSB_INFO("unsolicited response packet received - tcode mismatch");
                 dump_packet("contents:", data, 16);
 
                 spin_unlock_irqrestore(&host->pending_pkt_lock, flags);
@@ -822,6 +819,8 @@
                 if (rcode >= 0) {
                         fill_async_readblock_resp(packet, rcode, length);
                         send_packet_nocare(packet);
+                } else {
+                        free_hpsb_packet(packet);
                 }
                 break;
 
@@ -895,9 +894,7 @@
                 return;
         }
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
         dump_packet("received packet:", data, size);
-#endif
 
         tcode = (data[0] >> 4) & 0xf;
 
@@ -1276,6 +1273,7 @@
 EXPORT_SYMBOL(hpsb_free_tlabel);
 EXPORT_SYMBOL(hpsb_make_readpacket);
 EXPORT_SYMBOL(hpsb_make_writepacket);
+EXPORT_SYMBOL(hpsb_make_streampacket);
 EXPORT_SYMBOL(hpsb_make_lockpacket);
 EXPORT_SYMBOL(hpsb_make_lock64packet);
 EXPORT_SYMBOL(hpsb_make_phypacket);
diff -urN linux-2.4.22-bk42/drivers/ieee1394/ieee1394_transactions.c linux-2.4.22-bk43/drivers/ieee1394/ieee1394_transactions.c
--- linux-2.4.22-bk42/drivers/ieee1394/ieee1394_transactions.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/ieee1394_transactions.c	2003-10-28 02:49:47.000000000 -0800
@@ -102,7 +102,7 @@
 				     int channel, int tag, int sync)
 {
 	packet->header[0] = (length << 16) | (tag << 14) | (channel << 8)
-		| (TCODE_STREAM_DATA << 4) | sync;
+	                  | (TCODE_STREAM_DATA << 4) | sync;
 
 	packet->header_size = 4;
 	packet->data_size = length;
@@ -113,35 +113,33 @@
 /**
  * hpsb_get_tlabel - allocate a transaction label
  * @packet: the packet who's tlabel/tpool we set
- * @wait: whether to sleep if no tlabel is available
  *
- * Every asynchronous transaction on the 1394 bus needs a transaction label to
- * match the response to the request.  This label has to be different from any
- * other transaction label in an outstanding request to the same node to make
- * matching possible without ambiguity.
+ * Every asynchronous transaction on the 1394 bus needs a transaction
+ * label to match the response to the request.  This label has to be
+ * different from any other transaction label in an outstanding request to
+ * the same node to make matching possible without ambiguity.
  *
- * There are 64 different tlabels, so an allocated tlabel has to be freed with
- * hpsb_free_tlabel() after the transaction is complete (unless it's reused again for
- * the same target node).
- *
- * @wait cannot be set if in_interrupt()
+ * There are 64 different tlabels, so an allocated tlabel has to be freed
+ * with hpsb_free_tlabel() after the transaction is complete (unless it's
+ * reused again for the same target node).
  *
  * Return value: Zero on success, otherwise non-zero. A non-zero return
- * generally means there are no available tlabels.
+ * generally means there are no available tlabels. If this is called out
+ * of interrupt or atomic context, then it will sleep until can return a
+ * tlabel.
  */
-int hpsb_get_tlabel(struct hpsb_packet *packet, int wait)
+int hpsb_get_tlabel(struct hpsb_packet *packet)
 {
 	unsigned long flags;
 	struct hpsb_tlabel_pool *tp;
 
 	tp = &packet->host->tpool[packet->node_id & NODE_MASK];
 
-	if (wait) {
-		BUG_ON(in_interrupt());
-		down(&tp->count);
-	} else {
+	if (in_interrupt()) {
 		if (down_trylock(&tp->count))
 			return 1;
+	} else {
+		down(&tp->count);
 	}
 
 	spin_lock_irqsave(&tp->lock, flags);
@@ -270,7 +268,7 @@
 	packet->host = host;
 	packet->node_id = node;
 
-	if (hpsb_get_tlabel(packet, in_interrupt() ? 0 : 1)) {
+	if (hpsb_get_tlabel(packet)) {
 		free_hpsb_packet(packet);
 		return NULL;
 	}
@@ -301,7 +299,7 @@
 	packet->host = host;
 	packet->node_id = node;
 
-	if (hpsb_get_tlabel(packet, in_interrupt() ? 0 : 1)) {
+	if (hpsb_get_tlabel(packet)) {
 		free_hpsb_packet(packet);
 		return NULL;
 	}
@@ -317,6 +315,35 @@
 	return packet;
 }
 
+struct hpsb_packet *hpsb_make_streampacket(struct hpsb_host *host, u8 *buffer, int length,
+                                           int channel, int tag, int sync)
+{
+	struct hpsb_packet *packet;
+
+	if (length == 0)
+		return NULL;
+
+	packet = alloc_hpsb_packet(length + (length % 4 ? 4 - (length % 4) : 0));
+	if (!packet)
+		return NULL;
+
+	if (length % 4) { /* zero padding bytes */
+		packet->data[length >> 2] = 0;
+	}
+	packet->host = host;
+    
+	if (hpsb_get_tlabel(packet)) {
+		free_hpsb_packet(packet);
+		return NULL;
+	}
+
+	fill_async_stream_packet(packet, length, channel, tag, sync);
+	if (buffer)
+		memcpy(packet->data, buffer, length);
+
+	return packet;
+}
+
 struct hpsb_packet *hpsb_make_lockpacket(struct hpsb_host *host, nodeid_t node,
                                          u64 addr, int extcode, quadlet_t *data,
 					 quadlet_t arg)
@@ -329,7 +356,7 @@
 
 	p->host = host;
 	p->node_id = node;
-	if (hpsb_get_tlabel(p, in_interrupt() ? 0 : 1)) {
+	if (hpsb_get_tlabel(p)) {
 		free_hpsb_packet(p);
 		return NULL;
 	}
@@ -366,7 +393,7 @@
 
 	p->host = host;
 	p->node_id = node;
-	if (hpsb_get_tlabel(p, in_interrupt() ? 0 : 1)) {
+	if (hpsb_get_tlabel(p)) {
 		free_hpsb_packet(p);
 		return NULL;
 	}
@@ -580,27 +607,18 @@
 	u16 specifier_id_hi = (specifier_id & 0x00ffff00) >> 8;
 	u8 specifier_id_lo = specifier_id & 0xff;
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-	HPSB_DEBUG("Send GASP: channel = %d, length = %d", channel, length);
-#endif
+	HPSB_VERBOSE("Send GASP: channel = %d, length = %Zd", channel, length);
 
 	length += 8;
-
-	packet = alloc_hpsb_packet(length + (length % 4 ? 4 - (length % 4) : 0));
+    
+	packet = hpsb_make_streampacket(host, NULL, length, channel, 3, 0);
 	if (!packet)
 		return -ENOMEM;
 
-	if (length % 4) {
-		packet->data[length / 4] = 0;
-	}
-
-	packet->host = host;
-	fill_async_stream_packet(packet, length, channel, 3, 0);
-        
 	packet->data[0] = cpu_to_be32((host->node_id << 16) | specifier_id_hi);
 	packet->data[1] = cpu_to_be32((specifier_id_lo << 24) | (version & 0x00ffffff));
 
-	memcpy(&(packet->data[2]), buffer, length - 4);
+	memcpy(&(packet->data[2]), buffer, length - 8);
 
 	packet->generation = generation;
 
diff -urN linux-2.4.22-bk42/drivers/ieee1394/ieee1394_transactions.h linux-2.4.22-bk43/drivers/ieee1394/ieee1394_transactions.h
--- linux-2.4.22-bk42/drivers/ieee1394/ieee1394_transactions.h	2003-06-13 07:51:34.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/ieee1394_transactions.h	2003-10-28 02:49:47.000000000 -0800
@@ -7,7 +7,7 @@
 /*
  * Get and free transaction labels.
  */
-int hpsb_get_tlabel(struct hpsb_packet *packet, int wait);
+int hpsb_get_tlabel(struct hpsb_packet *packet);
 void hpsb_free_tlabel(struct hpsb_packet *packet);
 
 struct hpsb_packet *hpsb_make_readpacket(struct hpsb_host *host, nodeid_t node,
@@ -25,6 +25,8 @@
 					int tag, int sync);
 struct hpsb_packet *hpsb_make_writepacket (struct hpsb_host *host, nodeid_t node,
 					   u64 addr, quadlet_t *buffer, size_t length);
+struct hpsb_packet *hpsb_make_streampacket(struct hpsb_host *host, u8 *buffer,
+                                           int length, int channel, int tag, int sync);
 
 /*
  * hpsb_packet_success - Make sense of the ack and reply codes and
diff -urN linux-2.4.22-bk42/drivers/ieee1394/ieee1394_types.h linux-2.4.22-bk43/drivers/ieee1394/ieee1394_types.h
--- linux-2.4.22-bk42/drivers/ieee1394/ieee1394_types.h	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/ieee1394_types.h	2003-10-28 02:49:47.000000000 -0800
@@ -7,18 +7,11 @@
 #include <linux/version.h>
 #include <linux/list.h>
 #include <linux/init.h>
+#include <linux/spinlock.h>
 #include <asm/semaphore.h>
 #include <asm/byteorder.h>
 
 
-#ifndef MIN
-#define MIN(a,b) ((a) < (b) ? (a) : (b))
-#endif
-
-#ifndef MAX
-#define MAX(a,b) ((a) > (b) ? (a) : (b))
-#endif
-
 #ifndef BITS_TO_LONGS	/* < 2.4.21-pre6 */
 #define BITS_TO_LONGS(bits) \
 	(((bits)+BITS_PER_LONG-1)/BITS_PER_LONG)
@@ -78,6 +71,12 @@
 #define HPSB_WARN(fmt, args...) HPSB_PRINT(KERN_WARNING, fmt , ## args)
 #define HPSB_ERR(fmt, args...) HPSB_PRINT(KERN_ERR, fmt , ## args)
 
+#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
+#define HPSB_VERBOSE(fmt, args...) HPSB_PRINT(KERN_DEBUG, fmt , ## args)
+#else
+#define HPSB_VERBOSE(fmt, args...)
+#endif
+
 #define HPSB_PANIC(fmt, args...) panic("ieee1394: " fmt "\n" , ## args)
 
 #define HPSB_TRACE() HPSB_PRINT(KERN_INFO, "TRACE - %s, %s(), line %d", __FILE__, __FUNCTION__, __LINE__)
diff -urN linux-2.4.22-bk42/drivers/ieee1394/nodemgr.c linux-2.4.22-bk43/drivers/ieee1394/nodemgr.c
--- linux-2.4.22-bk42/drivers/ieee1394/nodemgr.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/nodemgr.c	2003-10-28 02:49:47.000000000 -0800
@@ -785,9 +785,8 @@
 	envp[i++] = 0;
 
 	/* NOTE: user mode daemons can call the agents too */
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-	HPSB_DEBUG("NodeMgr: %s %s %016Lx", argv[0], verb, (long long unsigned)ud->ne->guid);
-#endif
+	HPSB_VERBOSE("NodeMgr: %s %s %016Lx", argv[0], verb, (long long unsigned)ud->ne->guid);
+
 	value = call_usermodehelper(argv[0], argv, envp);
 	kfree(buf);
 	kfree(envp);
@@ -800,9 +799,7 @@
 static inline void
 nodemgr_call_policy(char *verb, struct unit_directory *ud)
 {
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-	HPSB_DEBUG("NodeMgr: nodemgr_call_policy(): hotplug not enabled");
-#endif
+	HPSB_VERBOSE("NodeMgr: nodemgr_call_policy(): hotplug not enabled");
 	return;
 } 
 
@@ -992,14 +989,12 @@
 	ne->busopt.generation	= (busoptions >> 4) & 0xf;
 	ne->busopt.lnkspd	= busoptions & 0x7;
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-	HPSB_DEBUG("NodeMgr: raw=0x%08x irmc=%d cmc=%d isc=%d bmc=%d pmc=%d "
-		   "cyc_clk_acc=%d max_rec=%d gen=%d lspd=%d",
-		   busoptions, ne->busopt.irmc, ne->busopt.cmc,
-		   ne->busopt.isc, ne->busopt.bmc, ne->busopt.pmc,
-		   ne->busopt.cyc_clk_acc, ne->busopt.max_rec,
-		   ne->busopt.generation, ne->busopt.lnkspd);
-#endif
+	HPSB_VERBOSE("NodeMgr: raw=0x%08x irmc=%d cmc=%d isc=%d bmc=%d pmc=%d "
+		     "cyc_clk_acc=%d max_rec=%d gen=%d lspd=%d",
+		     busoptions, ne->busopt.irmc, ne->busopt.cmc,
+		     ne->busopt.isc, ne->busopt.bmc, ne->busopt.pmc,
+		     ne->busopt.cyc_clk_acc, ne->busopt.max_rec,
+		     ne->busopt.generation, ne->busopt.lnkspd);
 
 	/*
 	 * When the config rom changes we disconnect all drivers and
@@ -1058,10 +1053,9 @@
 	 * work though, and we are forced to doing quadlet sized
 	 * reads.  */
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-	HPSB_INFO("Initiating ConfigROM request for node " NODE_BUS_FMT,
-		  NODE_BUS_ARGS(host, nodeid));
-#endif
+	HPSB_VERBOSE("Initiating ConfigROM request for node " NODE_BUS_FMT,
+		     NODE_BUS_ARGS(host, nodeid));
+
 	/* 
 	 * Must retry a few times if config rom read returns zero (how long?). Will
 	 * not normally occur, but we should do the right thing. For example, with
@@ -1317,8 +1311,10 @@
 		 * to make sure things settle down. */
 		for (i = 0; i < 4 ; i++) {
 			set_current_state(TASK_INTERRUPTIBLE);
-			if (schedule_timeout(HZ/16))
+			if (schedule_timeout(HZ/16)) {
+				up(&nodemgr_serialize);
 				goto caught_signal;
+			}
 
 			/* Now get the generation in which the node ID's we collect
 			 * are valid.  During the bus scan we will use this generation
@@ -1348,9 +1344,7 @@
 	}
 
 caught_signal:
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-	HPSB_DEBUG ("NodeMgr: Exiting thread");
-#endif
+	HPSB_VERBOSE("NodeMgr: Exiting thread");
 
 	complete_and_exit(&hi->exited, 0);
 }
@@ -1465,9 +1459,7 @@
 	struct host_info *hi = hpsb_get_hostinfo(&nodemgr_highlevel, host);
 
 	if (hi != NULL) {
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-		HPSB_DEBUG ("NodeMgr: Processing host reset for %s", hi->daemon_name);
-#endif
+		HPSB_VERBOSE("NodeMgr: Processing host reset for %s", hi->daemon_name);
 		up(&hi->reset_sem);
 	} else
 		HPSB_ERR ("NodeMgr: could not process reset of unused host");
diff -urN linux-2.4.22-bk42/drivers/ieee1394/ohci1394.c linux-2.4.22-bk43/drivers/ieee1394/ohci1394.c
--- linux-2.4.22-bk42/drivers/ieee1394/ohci1394.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/ohci1394.c	2003-10-28 02:49:47.000000000 -0800
@@ -165,7 +165,7 @@
 printk(level "%s_%d: " fmt "\n" , OHCI1394_DRIVER_NAME, card , ## args)
 
 static char version[] __devinitdata =
-	"$Rev: 1010 $ Ben Collins <bcollins@debian.org>";
+	"$Rev: 1045 $ Ben Collins <bcollins@debian.org>";
 
 /* Module Parameters */
 MODULE_PARM(phys_dma,"i");
@@ -1464,7 +1464,7 @@
 	if (sync != -1) {
 		/* set sync flag on first DMA descriptor */
 		struct dma_cmd *cmd = &recv->block[recv->block_dma];
-		cmd->control |= DMA_CTL_WAIT;
+		cmd->control |= cpu_to_le32(DMA_CTL_WAIT);
 
 		/* match sync field */
 		contextMatch |= (sync&0xf)<<8;
@@ -1688,10 +1688,10 @@
 		struct dma_cmd *im = &recv->block[recv->block_dma];
 		
 		/* check the DMA descriptor for new writes to xferStatus */
-		u16 xferstatus = im->status >> 16;
+		u16 xferstatus = le32_to_cpu(im->status) >> 16;
 		
 		/* rescount is the number of bytes *remaining to be written* in the block */
-		u16 rescount = im->status & 0xFFFF;
+		u16 rescount = le32_to_cpu(im->status) & 0xFFFF;
 
 		unsigned char event = xferstatus & 0x1F;
 
diff -urN linux-2.4.22-bk42/drivers/ieee1394/pcilynx.c linux-2.4.22-bk43/drivers/ieee1394/pcilynx.c
--- linux-2.4.22-bk42/drivers/ieee1394/pcilynx.c	2003-08-25 04:44:42.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/pcilynx.c	2003-10-28 02:49:47.000000000 -0800
@@ -1005,7 +1005,7 @@
         DECLARE_WAITQUEUE(wait, current);
 
         count &= ~3;
-        count = MIN(count, 53196);
+        count = min(count, 53196);
         retval = count;
 
         if (reg_read(md->lynx, DMA_CHAN_CTRL(CHANNEL_LOCALBUS))
@@ -1016,14 +1016,14 @@
         reg_write(md->lynx, LBUS_ADDR, md->type | offset);
 
         pcl = edit_pcl(md->lynx, md->lynx->dmem_pcl, &pcltmp);
-        pcl->buffer[0].control = PCL_CMD_LBUS_TO_PCI | MIN(count, 4092);
+        pcl->buffer[0].control = PCL_CMD_LBUS_TO_PCI | min(count, 4092);
         pcl->buffer[0].pointer = physbuf;
         count -= 4092;
 
         i = 0;
         while (count > 0) {
                 i++;
-                pcl->buffer[i].control = MIN(count, 4092);
+                pcl->buffer[i].control = min(count, 4092);
                 pcl->buffer[i].pointer = physbuf + i * 4092;
                 count -= 4092;
         }
@@ -1127,7 +1127,7 @@
         retval = copy_to_user(buffer, md->lynx->mem_dma_buffer, count);
         up(&md->lynx->mem_dma_mutex);
 
-        if (retval < 0) return retval;
+	if (retval) return -EFAULT;
         *offset += count;
         return count;
 }
@@ -1148,14 +1148,17 @@
         /* FIXME: dereferencing pointers to PCI mem doesn't work everywhere */
         switch (md->type) {
         case aux:
-                copy_from_user(md->lynx->aux_port+(*offset), buffer, count);
+		if (copy_from_user(md->lynx->aux_port+(*offset), buffer, count))
+			return -EFAULT;
                 break;
         case ram:
-                copy_from_user(md->lynx->local_ram+(*offset), buffer, count);
+		if (copy_from_user(md->lynx->local_ram+(*offset), buffer, count))
+			return -EFAULT;
                 break;
         case rom:
                 /* the ROM may be writeable */
-                copy_from_user(md->lynx->local_rom+(*offset), buffer, count);
+		if (copy_from_user(md->lynx->local_rom+(*offset), buffer, count))
+			return -EFAULT;
                 break;
         }
 
@@ -1805,9 +1808,8 @@
                 i2c_adapter.algo_data = &i2c_adapter_data;
                 i2c_adapter_data.data = lynx;
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-                PRINT(KERN_DEBUG, lynx->id,"original eeprom control: %d",reg_read(lynx,SERIAL_EEPROM_CONTROL));
-#endif
+		PRINTD(KERN_DEBUG, lynx->id,"original eeprom control: %d",
+		       reg_read(lynx, SERIAL_EEPROM_CONTROL));
 
         	/* reset hardware to sane state */
         	lynx->i2c_driven_state = 0x00000070;
@@ -1850,17 +1852,16 @@
                         if (i2c_transfer(&i2c_adapter, msg, 2) < 0) {
                                 PRINT(KERN_ERR, lynx->id, "unable to read bus info block from i2c");
                         } else {
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
                                 int i;
-#endif
-                                PRINT(KERN_INFO, lynx->id, "got bus info block from serial eeprom");
-                                /* FIXME: probably we shoud rewrite the max_rec, max_ROM(1394a), generation(1394a) and link_spd(1394a) field
-                                   and recalculate the CRC */
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-                                for (i=0; i < 5 ; i++)
-                                        PRINT(KERN_DEBUG, lynx->id, "Businfo block quadlet %i: %08x",i, be32_to_cpu(lynx->config_rom[i]));
-#endif
+                                PRINT(KERN_INFO, lynx->id, "got bus info block from serial eeprom");
+				/* FIXME: probably we shoud rewrite the max_rec, max_ROM(1394a),
+				 * generation(1394a) and link_spd(1394a) field and recalculate
+				 * the CRC */
+
+                                for (i = 0; i < 5 ; i++)
+                                        PRINTD(KERN_DEBUG, lynx->id, "Businfo block quadlet %i: %08x",
+					       i, be32_to_cpu(lynx->config_rom[i]));
 
                                 /* info_length, crc_length and 1394 magic number to check, if it is really a bus info block */
                                 if (((be32_to_cpu(lynx->config_rom[0]) & 0xffff0000) == 0x04040000) &&
diff -urN linux-2.4.22-bk42/drivers/ieee1394/raw1394.c linux-2.4.22-bk43/drivers/ieee1394/raw1394.c
--- linux-2.4.22-bk42/drivers/ieee1394/raw1394.c	2003-08-25 04:44:42.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/raw1394.c	2003-10-28 02:49:47.000000000 -0800
@@ -37,6 +37,7 @@
 #include <linux/init.h>
 #include <linux/version.h>
 #include <linux/smp_lock.h>
+#include <linux/vmalloc.h>
 #include <asm/uaccess.h>
 #include <asm/atomic.h>
 #include <linux/devfs_fs_kernel.h>
@@ -84,9 +85,9 @@
 static struct hpsb_highlevel raw1394_highlevel;
 
 static int arm_read (struct hpsb_host *host, int nodeid, quadlet_t *buffer,
-             u64 addr, unsigned int length, u16 flags);
+		     u64 addr, size_t length, u16 flags);
 static int arm_write (struct hpsb_host *host, int nodeid, int destid,
-              quadlet_t *data, u64 addr, unsigned int length, u16 flags);
+		      quadlet_t *data, u64 addr, size_t length, u16 flags);
 static int arm_lock (struct hpsb_host *host, int nodeid, quadlet_t *store,
              u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode, u16 flags);
 static int arm_lock64 (struct hpsb_host *host, int nodeid, octlet_t *store,
@@ -181,6 +182,7 @@
 
         if ((req->req.type == RAW1394_REQ_ASYNC_READ) ||
 	    (req->req.type == RAW1394_REQ_ASYNC_WRITE) ||
+	    (req->req.type == RAW1394_REQ_ASYNC_STREAM) ||
 	    (req->req.type == RAW1394_REQ_LOCK) ||
 	    (req->req.type == RAW1394_REQ_LOCK64))
                 hpsb_free_tlabel(packet);
@@ -294,7 +296,7 @@
 }
 
 static void iso_receive(struct hpsb_host *host, int channel, quadlet_t *data,
-                        unsigned int length)
+                        size_t length)
 {
         unsigned long flags;
         struct list_head *lh;
@@ -346,7 +348,7 @@
                         req->req.generation = get_hpsb_generation(host);
                         req->req.misc = 0;
                         req->req.recvb = ptr2int(fi->iso_buffer);
-                        req->req.length = MIN(length, fi->iso_buffer_length);
+                        req->req.length = min(length, fi->iso_buffer_length);
                         
                         list_add_tail(&req->list, &reqs);
                 }
@@ -363,7 +365,7 @@
 }
 
 static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
-                        int cts, u8 *data, unsigned int length)
+			int cts, u8 *data, size_t length)
 {
         unsigned long flags;
         struct list_head *lh;
@@ -539,9 +541,9 @@
 
                 if (khl != NULL) {
                         req->req.error = RAW1394_ERROR_NONE;
-                        req->req.length = MIN(req->req.length,
-                                              sizeof(struct raw1394_khost_list)
-                                              * req->req.misc);
+                        req->req.length = min(req->req.length,
+                                              (u32)(sizeof(struct raw1394_khost_list)
+                                              * req->req.misc));
                         req->free_data = 1;
                 } else {
                         return -ENOMEM;
@@ -690,6 +692,21 @@
 		req->req.length = 0;
 	    break;
 
+	case RAW1394_REQ_ASYNC_STREAM:
+		DBGMSG("stream_request called");
+
+		packet = hpsb_make_streampacket(fi->host, NULL, req->req.length, node & 0x3f/*channel*/,
+                                        (req->req.misc >> 16) & 0x3, req->req.misc & 0xf);
+		if (!packet)
+			return -ENOMEM;
+
+		if (copy_from_user(packet->data, int2ptr(req->req.sendb),
+		                   req->req.length))
+			req->req.error = RAW1394_ERROR_MEMFAULT;
+			
+		req->req.length = 0;
+		break;
+
         case RAW1394_REQ_LOCK:
                 DBGMSG("lock_request called");
                 if ((req->req.misc == EXTCODE_FETCH_ADD)
@@ -879,7 +896,7 @@
 }
 
 static int arm_read (struct hpsb_host *host, int nodeid, quadlet_t *buffer,
-             u64 addr, unsigned int length, u16 flags)
+		     u64 addr, size_t length, u16 flags)
 {
         struct pending_request *req;
         struct list_head *lh;
@@ -893,7 +910,7 @@
         struct arm_request_response *arm_req_resp = NULL;
 
         DBGMSG("arm_read  called by node: %X"
-              "addr: %4.4x %8.8x length: %u", nodeid,
+              "addr: %4.4x %8.8x length: %Zu", nodeid,
               (u16) ((addr >>32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
               length);
         spin_lock(&host_info_lock);
@@ -1015,7 +1032,7 @@
 }
 
 static int arm_write (struct hpsb_host *host, int nodeid, int destid,
-              quadlet_t *data, u64 addr, unsigned int length, u16 flags)
+		      quadlet_t *data, u64 addr, size_t length, u16 flags)
 {
         struct pending_request *req;
         struct list_head *lh;
@@ -1029,7 +1046,7 @@
         struct arm_request_response *arm_req_resp = NULL;
 
         DBGMSG("arm_write called by node: %X"
-              "addr: %4.4x %8.8x length: %u", nodeid,
+              "addr: %4.4x %8.8x length: %Zu", nodeid,
               (u16) ((addr >>32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
               length);
         spin_lock(&host_info_lock);
@@ -1567,8 +1584,8 @@
               req->req.length, ((req->req.misc >> 8) & 0xFF),
               (req->req.misc & 0xFF),((req->req.misc >> 16) & 0xFFFF));
         /* check addressrange */
-        if ((((req->req.address) & ~((u64)0xFFFFFFFFFFFFLL)) != 0) ||
-                (((req->req.address + req->req.length) & ~((u64)0xFFFFFFFFFFFFLL)) != 0)) {
+        if ((((req->req.address) & ~(0xFFFFFFFFFFFFULL)) != 0) ||
+                (((req->req.address + req->req.length) & ~(0xFFFFFFFFFFFFULL)) != 0)) {
                 req->req.length = 0;
                 return (-EINVAL);
         }
@@ -1579,7 +1596,7 @@
                 return (-ENOMEM);
         } 
         /* allocation of addr_space_buffer */
-        addr->addr_space_buffer = (u8 *)kmalloc(req->req.length,SLAB_KERNEL);
+        addr->addr_space_buffer = (u8 *)vmalloc(req->req.length);
         if (!(addr->addr_space_buffer)) {
                 kfree(addr);
                 req->req.length = 0;
@@ -1593,7 +1610,7 @@
                 /* init: user -> kernel */
                 if (copy_from_user(addr->addr_space_buffer,int2ptr(req->req.sendb),
                         req->req.length)) {
-                        kfree(addr->addr_space_buffer);
+                        vfree(addr->addr_space_buffer);
                         kfree(addr);
                         return (-EFAULT);
                 }
@@ -1634,7 +1651,7 @@
         }
         if (same_host) {
                 /* addressrange occupied by same host */
-                kfree(addr->addr_space_buffer);
+                vfree(addr->addr_space_buffer);
                 kfree(addr);
                 spin_unlock_irqrestore(&host_info_lock, flags);
                 return (-EALREADY);
@@ -1669,7 +1686,7 @@
                         int2ptr(&addr->start),sizeof(u64))) {
                         printk(KERN_ERR "raw1394: arm_register failed "
                               " address-range-entry is invalid -> EFAULT !!!\n");
-                        kfree(addr->addr_space_buffer);
+                        vfree(addr->addr_space_buffer);
                         kfree(addr);
                         spin_unlock_irqrestore(&host_info_lock, flags);
                         return (-EFAULT);
@@ -1687,7 +1704,7 @@
                list_add_tail(&addr->addr_list, &fi->addr_list);
         } else {
                 DBGMSG("arm_register failed errno: %d \n",retval);
-                kfree(addr->addr_space_buffer);
+                vfree(addr->addr_space_buffer);
                 kfree(addr);
                 spin_unlock_irqrestore(&host_info_lock, flags);
                 return (-EALREADY); 
@@ -1761,7 +1778,7 @@
         if (another_host) {
                 DBGMSG("delete entry from list -> success");
                 list_del(&addr->addr_list);
-                kfree(addr->addr_space_buffer);
+                vfree(addr->addr_space_buffer);
                 kfree(addr);
                 free_pending_request(req); /* immediate success or fail */
                 spin_unlock_irqrestore(&host_info_lock, flags);
@@ -1776,7 +1793,7 @@
         DBGMSG("delete entry from list -> success");
         list_del(&addr->addr_list);
         spin_unlock_irqrestore(&host_info_lock, flags);
-        kfree(addr->addr_space_buffer);
+        vfree(addr->addr_space_buffer);
         kfree(addr);
         free_pending_request(req); /* immediate success or fail */
         return sizeof(struct raw1394_request);
@@ -2080,6 +2097,9 @@
 {
 	struct raw1394_iso_status stat;
 
+	if (!fi->host)
+		return -EINVAL;
+
 	if (copy_from_user(&stat, uaddr, sizeof(stat)))
 		return -EFAULT;
 
@@ -2109,6 +2129,9 @@
 {
 	struct raw1394_iso_status stat;
 
+	if (!fi->host)
+		return -EINVAL;
+
 	if (copy_from_user(&stat, uaddr, sizeof(stat)))
 		return -EFAULT;
 
@@ -2435,7 +2458,7 @@
                 }
                 DBGMSG("raw1394_release: delete addr_entry from list");
                 list_del(&addr->addr_list);
-                kfree(addr->addr_space_buffer);
+                vfree(addr->addr_space_buffer);
                 kfree(addr);
         } /* while */
         spin_unlock_irq(&host_info_lock);
diff -urN linux-2.4.22-bk42/drivers/ieee1394/raw1394.h linux-2.4.22-bk43/drivers/ieee1394/raw1394.h
--- linux-2.4.22-bk42/drivers/ieee1394/raw1394.h	2003-06-13 07:51:34.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/raw1394.h	2003-10-28 02:49:47.000000000 -0800
@@ -19,6 +19,7 @@
 #define RAW1394_REQ_LOCK64          103
 #define RAW1394_REQ_ISO_SEND        104
 #define RAW1394_REQ_ASYNC_SEND      105
+#define RAW1394_REQ_ASYNC_STREAM    106
 
 #define RAW1394_REQ_ISO_LISTEN      200
 #define RAW1394_REQ_FCP_LISTEN      201
diff -urN linux-2.4.22-bk42/drivers/ieee1394/sbp2.c linux-2.4.22-bk43/drivers/ieee1394/sbp2.c
--- linux-2.4.22-bk42/drivers/ieee1394/sbp2.c	2003-08-25 04:44:42.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/sbp2.c	2003-10-28 02:49:47.000000000 -0800
@@ -89,7 +89,7 @@
 #include "sbp2.h"
 
 static char version[] __devinitdata =
-	"$Rev: 1010 $ Ben Collins <bcollins@debian.org>";
+	"$Rev: 1074 $ Ben Collins <bcollins@debian.org>";
 
 /*
  * Module load parameter definitions
@@ -389,7 +389,7 @@
 sbp2util_allocate_write_packet(struct sbp2scsi_host_info *hi,
 			       struct node_entry *ne, u64 addr,
 			       size_t data_size,
-			       quadlet_t *data)
+			       quadlet_t *data, int complete)
 {
 	struct hpsb_packet *packet;
 
@@ -399,8 +399,9 @@
         if (!packet)
                 return NULL;
 
-	hpsb_set_packet_complete_task(packet, (void (*)(void*))sbp2_free_packet,
-				      packet);
+	if (complete)
+		hpsb_set_packet_complete_task(packet,
+			(void (*)(void*))sbp2_free_packet, packet);
 
 	hpsb_node_fill_packet(ne, packet);
 
@@ -973,6 +974,15 @@
 		return -EBUSY;
 	}
 
+	/* Schedule a timeout here. The reason is that we may be so close
+	 * to a bus reset, that the device is not available for logins.
+	 * This can happen when the bus reset is caused by the host
+	 * connected to the sbp2 device being removed. That host would
+	 * have a certain amount of time to relogin before the sbp2 device
+	 * allows someone else to login instead. One second makes sense. */
+	set_current_state(TASK_INTERRUPTIBLE);
+	schedule_timeout(HZ);
+
 	/*
 	 * Login to the sbp-2 device
 	 */
@@ -1084,7 +1094,7 @@
  * physical dma in hardware). Mostly just here for debugging...
  */
 static int sbp2_handle_physdma_write(struct hpsb_host *host, int nodeid, int destid, quadlet_t *data,
-                                     u64 addr, unsigned int length, u16 flags)
+                                     u64 addr, size_t length, u16 flags)
 {
 
         /*
@@ -1100,7 +1110,7 @@
  * physical dma in hardware). Mostly just here for debugging...
  */
 static int sbp2_handle_physdma_read(struct hpsb_host *host, int nodeid, quadlet_t *data,
-                                    u64 addr, unsigned int length, u16 flags)
+                                    u64 addr, size_t length, u16 flags)
 {
 
         /*
@@ -1763,7 +1773,7 @@
 	packet = sbp2util_allocate_write_packet(hi, scsi_id->ne,
 						scsi_id->sbp2_command_block_agent_addr +
 						SBP2_AGENT_RESET_OFFSET,
-						4, &data);
+						4, &data, wait ? 0 : 1);
 
 	if (!packet) {
 		SBP2_ERR("sbp2util_allocate_write_packet failed");
@@ -1779,6 +1789,7 @@
 	if (wait) {
 		down(&packet->state_change);
 		down(&packet->state_change);
+		sbp2_free_packet(packet);
 	}
 
 	/*
@@ -2073,7 +2084,7 @@
 
 			packet = sbp2util_allocate_write_packet(hi, scsi_id->ne,
 								scsi_id->sbp2_command_block_agent_addr +
-								SBP2_ORB_POINTER_OFFSET, 8, NULL);
+								SBP2_ORB_POINTER_OFFSET, 8, NULL, 1);
 		
 			if (!packet) {
 				SBP2_ERR("sbp2util_allocate_write_packet failed");
@@ -2123,7 +2134,7 @@
 
 			packet = sbp2util_allocate_write_packet(hi, scsi_id->ne,
 					scsi_id->sbp2_command_block_agent_addr +
-					SBP2_DOORBELL_OFFSET, 4, &data);
+					SBP2_DOORBELL_OFFSET, 4, &data, 1);
 	
 			if (!packet) {
 				SBP2_ERR("sbp2util_allocate_write_packet failed");
@@ -2427,7 +2438,7 @@
  * This function deals with status writes from the SBP-2 device
  */
 static int sbp2_handle_status_write(struct hpsb_host *host, int nodeid, int destid,
-				    quadlet_t *data, u64 addr, unsigned int length, u16 fl)
+				    quadlet_t *data, u64 addr, size_t length, u16 fl)
 {
 	struct sbp2scsi_host_info *hi = NULL;
 	struct scsi_id_instance_data *scsi_id = NULL;
diff -urN linux-2.4.22-bk42/drivers/ieee1394/sbp2.h linux-2.4.22-bk43/drivers/ieee1394/sbp2.h
--- linux-2.4.22-bk42/drivers/ieee1394/sbp2.h	2003-08-25 04:44:42.000000000 -0700
+++ linux-2.4.22-bk43/drivers/ieee1394/sbp2.h	2003-10-28 02:49:47.000000000 -0800
@@ -482,9 +482,9 @@
 
 #ifdef CONFIG_IEEE1394_SBP2_PHYS_DMA
 static int sbp2_handle_physdma_write(struct hpsb_host *host, int nodeid, int destid, quadlet_t *data,
-                                     u64 addr, unsigned int length, u16 flags);
+                                     u64 addr, size_t length, u16 flags);
 static int sbp2_handle_physdma_read(struct hpsb_host *host, int nodeid, quadlet_t *data,
-                                    u64 addr, unsigned int length, u16 flags);
+                                    u64 addr, size_t length, u16 flags);
 #endif
 
 /*
@@ -495,7 +495,7 @@
 static int sbp2_reconnect_device(struct scsi_id_instance_data *scsi_id); 
 static int sbp2_logout_device(struct scsi_id_instance_data *scsi_id); 
 static int sbp2_handle_status_write(struct hpsb_host *host, int nodeid, int destid,
-				    quadlet_t *data, u64 addr, unsigned int length, u16 flags);
+				    quadlet_t *data, u64 addr, size_t length, u16 flags);
 static int sbp2_agent_reset(struct scsi_id_instance_data *scsi_id, int wait);
 static int sbp2_create_command_orb(struct scsi_id_instance_data *scsi_id,
 				   struct sbp2_command_info *command,
diff -urN linux-2.4.22-bk42/drivers/net/Makefile linux-2.4.22-bk43/drivers/net/Makefile
--- linux-2.4.22-bk42/drivers/net/Makefile	2003-10-28 02:49:44.000000000 -0800
+++ linux-2.4.22-bk43/drivers/net/Makefile	2003-10-28 02:49:47.000000000 -0800
@@ -242,6 +242,7 @@
 
 # non-drivers/net drivers who want mii lib
 obj-$(CONFIG_PCMCIA_SMC91C92) += mii.o
+obj-$(CONFIG_USB_USBNET) += mii.o
 
 ifeq ($(CONFIG_ARCH_ACORN),y)
 mod-subdirs	+= ../acorn/net
diff -urN linux-2.4.22-bk42/drivers/net/tg3.c linux-2.4.22-bk43/drivers/net/tg3.c
--- linux-2.4.22-bk42/drivers/net/tg3.c	2003-10-28 02:49:44.000000000 -0800
+++ linux-2.4.22-bk43/drivers/net/tg3.c	2003-10-28 02:49:48.000000000 -0800
@@ -7770,6 +7770,8 @@
 
 	tg3_netif_stop(tp);
 
+	del_timer_sync(&tp->timer);
+
 	spin_lock_irq(&tp->lock);
 	spin_lock(&tp->tx_lock);
 	tg3_disable_ints(tp);
@@ -7791,6 +7793,9 @@
 
 		tg3_init_hw(tp);
 
+		tp->timer.expires = jiffies + tp->timer_offset;
+		add_timer(&tp->timer);
+
 		spin_unlock(&tp->tx_lock);
 		spin_unlock_irq(&tp->lock);
 
@@ -7820,6 +7825,10 @@
 	spin_lock(&tp->tx_lock);
 
 	tg3_init_hw(tp);
+
+	tp->timer.expires = jiffies + tp->timer_offset;
+	add_timer(&tp->timer);
+
 	tg3_enable_ints(tp);
 
 	spin_unlock(&tp->tx_lock);
diff -urN linux-2.4.22-bk42/drivers/scsi/aic7xxx/aic7xxx_osm.c linux-2.4.22-bk43/drivers/scsi/aic7xxx/aic7xxx_osm.c
--- linux-2.4.22-bk42/drivers/scsi/aic7xxx/aic7xxx_osm.c	2003-08-25 04:44:42.000000000 -0700
+++ linux-2.4.22-bk43/drivers/scsi/aic7xxx/aic7xxx_osm.c	2003-10-28 02:49:48.000000000 -0800
@@ -1552,6 +1552,7 @@
 
 	/* Still equal.  Sort by BIOS address, ioport, or bus/slot/func. */
 	switch (rvalue) {
+#ifdef CONFIG_PCI
 	case AHC_PCI:
 	{
 		char primary_channel;
@@ -1584,6 +1585,8 @@
 			value = 1;
 		break;
 	}
+#endif
+#ifdef CONFIG_EISA
 	case AHC_EISA:
 		if ((rahc->flags & AHC_BIOS_ENABLED) != 0) {
 			value = rahc->platform_data->bios_address
@@ -1593,6 +1596,7 @@
 			      - lahc->bsh.ioport; 
 		}
 		break;
+#endif
 	default:
 		panic("ahc_softc_sort: invalid bus type");
 	}
diff -urN linux-2.4.22-bk42/include/net/bluetooth/rfcomm.h linux-2.4.22-bk43/include/net/bluetooth/rfcomm.h
--- linux-2.4.22-bk42/include/net/bluetooth/rfcomm.h	2003-08-25 04:44:44.000000000 -0700
+++ linux-2.4.22-bk43/include/net/bluetooth/rfcomm.h	2003-10-28 02:49:49.000000000 -0800
@@ -167,8 +167,8 @@
 	int              initiator;
 
 	/* Default DLC parameters */
+	int    cfc;
 	uint   mtu;
-	uint   credits;
 
 	struct list_head dlcs;
 };
@@ -190,7 +190,7 @@
 	u8            mscex;
 
 	uint          mtu;
-	uint          credits;
+	uint          cfc;
 	uint          rx_credits;
 	uint          tx_credits;
 
@@ -219,6 +219,11 @@
 #define RFCOMM_MSCEX_RX     2
 #define RFCOMM_MSCEX_OK     (RFCOMM_MSCEX_TX + RFCOMM_MSCEX_RX)
 
+/* CFC states */
+#define RFCOMM_CFC_UNKNOWN  -1
+#define RFCOMM_CFC_DISABLED 0
+#define RFCOMM_CFC_ENABLED  RFCOMM_MAX_CREDITS
+
 extern struct task_struct *rfcomm_thread;
 extern unsigned long rfcomm_event;
 
diff -urN linux-2.4.22-bk42/net/bluetooth/rfcomm/core.c linux-2.4.22-bk43/net/bluetooth/rfcomm/core.c
--- linux-2.4.22-bk42/net/bluetooth/rfcomm/core.c	2003-08-25 04:44:44.000000000 -0700
+++ linux-2.4.22-bk43/net/bluetooth/rfcomm/core.c	2003-10-28 02:49:49.000000000 -0800
@@ -51,7 +51,7 @@
 #include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/rfcomm.h>
 
-#define VERSION "1.0"
+#define VERSION "1.1"
 
 #ifndef CONFIG_BLUEZ_RFCOMM_DEBUG
 #undef  BT_DBG
@@ -202,7 +202,7 @@
 	d->mtu        = RFCOMM_DEFAULT_MTU;
 	d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 
-	d->credits    = RFCOMM_MAX_CREDITS;
+	d->cfc        = RFCOMM_CFC_DISABLED;
 	d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 }
 
@@ -309,8 +309,8 @@
 	d->state    = BT_CONFIG;
 	rfcomm_dlc_link(s, d);
 
-	d->mtu     = s->mtu;
-	d->credits = s->credits;
+	d->mtu = s->mtu;
+	d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 
 	if (s->state == BT_CONNECTED)
 		rfcomm_send_pn(s, 1, d);
@@ -410,7 +410,7 @@
 {
 	BT_DBG("dlc %p state %ld", d, d->state);
 
-	if (!d->credits) {
+	if (!d->cfc) {
 		d->v24_sig |= RFCOMM_V24_FC;
 		set_bit(RFCOMM_MSC_PENDING, &d->flags);
 	}
@@ -421,7 +421,7 @@
 {
 	BT_DBG("dlc %p state %ld", d, d->state);
 
-	if (!d->credits) {
+	if (!d->cfc) {
 		d->v24_sig &= ~RFCOMM_V24_FC;
 		set_bit(RFCOMM_MSC_PENDING, &d->flags);
 	}
@@ -474,8 +474,8 @@
 	s->state = state;
 	s->sock  = sock;
 
-	s->mtu     = RFCOMM_DEFAULT_MTU;
-	s->credits = RFCOMM_MAX_CREDITS;
+	s->mtu   = RFCOMM_DEFAULT_MTU;
+	s->cfc   = RFCOMM_CFC_UNKNOWN;
 	
 	list_add(&s->list, &session_list);
 
@@ -746,7 +746,7 @@
 	pn->ack_timer   = 0;
 	pn->max_retrans = 0;
 
-	if (d->credits) {
+	if (s->cfc) {
 		pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 		pn->credits = RFCOMM_DEFAULT_CREDITS;
 	} else {
@@ -853,6 +853,50 @@
 	return rfcomm_send_frame(s, buf, ptr - buf);
 }
 
+static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
+{
+	struct rfcomm_hdr *hdr;
+	struct rfcomm_mcc *mcc;
+	u8 buf[16], *ptr = buf;
+
+	BT_DBG("%p cr %d", s, cr);
+
+	hdr = (void *) ptr; ptr += sizeof(*hdr);
+	hdr->addr = __addr(s->initiator, 0);
+	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+	hdr->len  = __len8(sizeof(*mcc));
+
+	mcc = (void *) ptr; ptr += sizeof(*mcc);
+	mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
+	mcc->len  = __len8(0);
+
+	*ptr = __fcs(buf); ptr++;
+
+	return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
+{
+	struct rfcomm_hdr *hdr;
+	struct rfcomm_mcc *mcc;
+	u8 buf[16], *ptr = buf;
+
+	BT_DBG("%p cr %d", s, cr);
+
+	hdr = (void *) ptr; ptr += sizeof(*hdr);
+	hdr->addr = __addr(s->initiator, 0);
+	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+	hdr->len  = __len8(sizeof(*mcc));
+
+	mcc = (void *) ptr; ptr += sizeof(*mcc);
+	mcc->type = __mcc_type(cr, RFCOMM_FCON);
+	mcc->len  = __len8(0);
+
+	*ptr = __fcs(buf); ptr++;
+
+	return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
 {
 	struct socket *sock = s->sock;
@@ -1091,28 +1135,22 @@
 
 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
 {
+	struct rfcomm_session *s = d->session;
+
 	BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d", 
 			d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
 
-	if (cr) {
-		if (pn->flow_ctrl == 0xf0) {
-			d->tx_credits = pn->credits;
-		} else {
-			set_bit(RFCOMM_TX_THROTTLED, &d->flags);
-			d->credits = 0;
-		}
+	if (pn->flow_ctrl == 0xf0 || pn->flow_ctrl == 0xe0) {
+		d->cfc = s->cfc = RFCOMM_CFC_ENABLED;
+		d->tx_credits = pn->credits;
 	} else {
-		if (pn->flow_ctrl == 0xe0) {
-			d->tx_credits = pn->credits;
-		} else {
-			set_bit(RFCOMM_TX_THROTTLED, &d->flags);
-			d->credits = 0;
-		}
+		d->cfc = s->cfc = RFCOMM_CFC_DISABLED;
+		set_bit(RFCOMM_TX_THROTTLED, &d->flags);
 	}
 
 	d->priority = pn->priority;
 
-	d->mtu = btohs(pn->mtu);
+	d->mtu = s->mtu = btohs(pn->mtu);
 
 	return 0;
 }
@@ -1302,7 +1340,7 @@
 		return 0;
 
 	if (cr) {
-		if (msc->v24_sig & RFCOMM_V24_FC && !d->credits)
+		if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
 			set_bit(RFCOMM_TX_THROTTLED, &d->flags);
 		else
 			clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
@@ -1351,6 +1389,20 @@
 		rfcomm_recv_msc(s, cr, skb);
 		break;
 
+	case RFCOMM_FCOFF:
+		if (cr) {
+			set_bit(RFCOMM_TX_THROTTLED, &s->flags);
+			rfcomm_send_fcoff(s, 0);
+		}
+		break;
+
+	case RFCOMM_FCON:
+		if (cr) {
+			clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
+			rfcomm_send_fcon(s, 0);
+		}
+		break;
+
 	case RFCOMM_TEST:
 		if (cr)
 			rfcomm_send_test(s, 0, skb->data, skb->len);
@@ -1379,7 +1431,7 @@
 		goto drop;
 	}
 
-	if (pf && d->credits) {
+	if (pf && d->cfc) {
 		u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
 
 		d->tx_credits += credits;
@@ -1484,20 +1536,20 @@
 	struct sk_buff *skb;
 	int err;
 
-	BT_DBG("dlc %p state %ld credits %d rx_credits %d tx_credits %d", 
-			d, d->state, d->credits, d->rx_credits, d->tx_credits);
+	BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d", 
+			d, d->state, d->cfc, d->rx_credits, d->tx_credits);
 
 	/* Send pending MSC */
 	if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
 		rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
 	
-	if (d->credits) {
+	if (d->cfc) {
 		/* CFC enabled. 
 		 * Give them some credits */
 		if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
-			       	d->rx_credits <= (d->credits >> 2)) {
-			rfcomm_send_credits(d->session, d->addr, d->credits - d->rx_credits);
-			d->rx_credits = d->credits;
+			       	d->rx_credits <= (d->cfc >> 2)) {
+			rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
+			d->rx_credits = d->cfc;
 		}
 	} else {
 		/* CFC disabled. 
@@ -1518,7 +1570,7 @@
 		d->tx_credits--;
 	}
 
-	if (d->credits && !d->tx_credits) {
+	if (d->cfc && !d->tx_credits) {
 		/* We're out of TX credits.
 		 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
 		set_bit(RFCOMM_TX_THROTTLED, &d->flags);
@@ -1541,6 +1593,9 @@
 			continue;
 		}
 
+		if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
+			continue;
+
 		if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
 				d->mscex == RFCOMM_MSCEX_OK)
 			rfcomm_process_tx(d);
diff -urN linux-2.4.22-bk42/net/ipv4/netfilter/ipt_REDIRECT.c linux-2.4.22-bk43/net/ipv4/netfilter/ipt_REDIRECT.c
--- linux-2.4.22-bk42/net/ipv4/netfilter/ipt_REDIRECT.c	2002-02-25 11:38:14.000000000 -0800
+++ linux-2.4.22-bk43/net/ipv4/netfilter/ipt_REDIRECT.c	2003-10-28 02:49:49.000000000 -0800
@@ -79,7 +79,7 @@
 
 		/* Device might not have an associated in_device. */
 		indev = (struct in_device *)(*pskb)->dev->ip_ptr;
-		if (indev == NULL)
+		if (indev == NULL || indev->ifa_list == NULL)
 			return NF_DROP;
 
 		/* Grab first address on interface. */
diff -urN linux-2.4.22-bk42/net/ipv6/mcast.c linux-2.4.22-bk43/net/ipv6/mcast.c
--- linux-2.4.22-bk42/net/ipv6/mcast.c	2003-10-28 02:49:45.000000000 -0800
+++ linux-2.4.22-bk43/net/ipv6/mcast.c	2003-10-28 02:49:50.000000000 -0800
@@ -604,9 +604,9 @@
 			if (ipv6_addr_cmp(&psl->sl_addr[i], src_addr) == 0)
 				break;
 		}
-		if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count);
+		if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
 			rv = 0;
-		if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count);
+		if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
 			rv = 0;
 	}
 	read_unlock(&ipv6_sk_mc_lock);
diff -urN linux-2.4.22-bk42/net/irda/af_irda.c linux-2.4.22-bk43/net/irda/af_irda.c
--- linux-2.4.22-bk42/net/irda/af_irda.c	2003-10-28 02:49:45.000000000 -0800
+++ linux-2.4.22-bk43/net/irda/af_irda.c	2003-10-28 02:49:50.000000000 -0800
@@ -285,7 +285,7 @@
 		self->max_data_size = irttp_get_max_seg_size(self->tsap);
 	};
 
-	IRDA_DEBUG(2, "%s(), max_data_size=%d\n", __FUNCTION__
+	IRDA_DEBUG(2, "%s(), max_data_size=%d\n", __FUNCTION__,
 		   self->max_data_size);
 
 	memcpy(&self->qos_tx, qos, sizeof(struct qos_info));
@@ -384,7 +384,7 @@
 
 	/* Check if request succeeded */
 	if (result != IAS_SUCCESS) {
-		IRDA_DEBUG(1, "%s(), IAS query failed! (%d)\n", __FUNCTION__
+		IRDA_DEBUG(1, "%s(), IAS query failed! (%d)\n", __FUNCTION__,
 			   result);
 
 		self->errno = result;	/* We really need it later */
