Merge commit 'ieee1394/for-next'

52 files changed, 3619 insertions, 246 deletions

diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
index 418c18f07e9d..799f94424c8a 100644
--- a/drivers/firewire/fw-card.c
+++ b/drivers/firewire/fw-card.c
@@ -75,7 +75,7 @@ generate_config_rom(struct fw_card *card, size_t *config_rom_length)
 	 * controller, block reads to the config rom accesses the host
 	 * memory, but quadlet read access the hardware bus info block
 	 * registers.  That's just crack, but it means we should make
-	 * sure the contents of bus info block in host memory mathces
+	 * sure the contents of bus info block in host memory matches
 	 * the version stored in the OHCI registers.
 	 */
 
@@ -189,6 +189,17 @@ static const char gap_count_table[] = {
 	63, 5, 7, 8, 10, 13, 16, 18, 21, 24, 26, 29, 32, 35, 37, 40
 };
 
+void
+fw_schedule_bm_work(struct fw_card *card, unsigned long delay)
+{
+	int scheduled;
+
+	fw_card_get(card);
+	scheduled = schedule_delayed_work(&card->work, delay);
+	if (!scheduled)
+		fw_card_put(card);
+}
+
 static void
 fw_card_bm_work(struct work_struct *work)
 {
@@ -206,7 +217,7 @@ fw_card_bm_work(struct work_struct *work)
 
 	if (local_node == NULL) {
 		spin_unlock_irqrestore(&card->lock, flags);
-		return;
+		goto out_put_card;
 	}
 	fw_node_get(local_node);
 	fw_node_get(root_node);
@@ -280,7 +291,7 @@ fw_card_bm_work(struct work_struct *work)
 		 * this task 100ms from now.
 		 */
 		spin_unlock_irqrestore(&card->lock, flags);
-		schedule_delayed_work(&card->work, DIV_ROUND_UP(HZ, 10));
+		fw_schedule_bm_work(card, DIV_ROUND_UP(HZ, 10));
 		goto out;
 	}
 
@@ -355,6 +366,8 @@ fw_card_bm_work(struct work_struct *work)
 		fw_device_put(root_device);
 	fw_node_put(root_node);
 	fw_node_put(local_node);
+ out_put_card:
+	fw_card_put(card);
 }
 
 static void
@@ -510,7 +523,6 @@ fw_core_remove_card(struct fw_card *card)
 	fw_card_put(card);
 	wait_for_completion(&card->done);
 
-	cancel_delayed_work_sync(&card->work);
 	WARN_ON(!list_empty(&card->transaction_list));
 	del_timer_sync(&card->flush_timer);
 }
diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index ed03234cbea8..a320ab48edd6 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -24,9 +24,11 @@
 #include <linux/errno.h>
 #include <linux/device.h>
 #include <linux/vmalloc.h>
+#include <linux/mutex.h>
 #include <linux/poll.h>
 #include <linux/preempt.h>
 #include <linux/time.h>
+#include <linux/spinlock.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
 #include <linux/idr.h>
@@ -107,7 +109,6 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
 {
 	struct fw_device *device;
 	struct client *client;
-	unsigned long flags;
 
 	device = fw_device_get_by_devt(inode->i_rdev);
 	if (device == NULL)
@@ -132,9 +133,9 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
 
 	file->private_data = client;
 
-	spin_lock_irqsave(&device->card->lock, flags);
+	mutex_lock(&device->client_list_mutex);
 	list_add_tail(&client->link, &device->client_list);
-	spin_unlock_irqrestore(&device->card->lock, flags);
+	mutex_unlock(&device->client_list_mutex);
 
 	return 0;
 }
@@ -205,12 +206,14 @@ fw_device_op_read(struct file *file,
 	return dequeue_event(client, buffer, count);
 }
 
-/* caller must hold card->lock so that node pointers can be dereferenced here */
 static void
 fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
 		     struct client *client)
 {
 	struct fw_card *card = client->device->card;
+	unsigned long flags;
+
+	spin_lock_irqsave(&card->lock, flags);
 
 	event->closure	     = client->bus_reset_closure;
 	event->type          = FW_CDEV_EVENT_BUS_RESET;
@@ -220,22 +223,20 @@ fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
 	event->bm_node_id    = 0; /* FIXME: We don't track the BM. */
 	event->irm_node_id   = card->irm_node->node_id;
 	event->root_node_id  = card->root_node->node_id;
+
+	spin_unlock_irqrestore(&card->lock, flags);
 }
 
 static void
 for_each_client(struct fw_device *device,
 		void (*callback)(struct client *client))
 {
-	struct fw_card *card = device->card;
 	struct client *c;
-	unsigned long flags;
-
-	spin_lock_irqsave(&card->lock, flags);
 
+	mutex_lock(&device->client_list_mutex);
 	list_for_each_entry(c, &device->client_list, link)
 		callback(c);
-
-	spin_unlock_irqrestore(&card->lock, flags);
+	mutex_unlock(&device->client_list_mutex);
 }
 
 static void
@@ -243,7 +244,7 @@ queue_bus_reset_event(struct client *client)
 {
 	struct bus_reset *bus_reset;
 
-	bus_reset = kzalloc(sizeof(*bus_reset), GFP_ATOMIC);
+	bus_reset = kzalloc(sizeof(*bus_reset), GFP_KERNEL);
 	if (bus_reset == NULL) {
 		fw_notify("Out of memory when allocating bus reset event\n");
 		return;
@@ -274,11 +275,11 @@ static int ioctl_get_info(struct client *client, void *buffer)
 {
 	struct fw_cdev_get_info *get_info = buffer;
 	struct fw_cdev_event_bus_reset bus_reset;
-	struct fw_card *card = client->device->card;
 	unsigned long ret = 0;
 
 	client->version = get_info->version;
 	get_info->version = FW_CDEV_VERSION;
+	get_info->card = client->device->card->index;
 
 	down_read(&fw_device_rwsem);
 
@@ -300,18 +301,12 @@ static int ioctl_get_info(struct client *client, void *buffer)
 	client->bus_reset_closure = get_info->bus_reset_closure;
 	if (get_info->bus_reset != 0) {
 		void __user *uptr = u64_to_uptr(get_info->bus_reset);
-		unsigned long flags;
 
-		spin_lock_irqsave(&card->lock, flags);
 		fill_bus_reset_event(&bus_reset, client);
-		spin_unlock_irqrestore(&card->lock, flags);
-
 		if (copy_to_user(uptr, &bus_reset, sizeof(bus_reset)))
 			return -EFAULT;
 	}
 
-	get_info->card = card->index;
-
 	return 0;
 }
 
@@ -403,6 +398,7 @@ static int ioctl_send_request(struct client *client, void *buffer)
 	struct fw_device *device = client->device;
 	struct fw_cdev_send_request *request = buffer;
 	struct response *response;
+	int ret;
 
 	/* What is the biggest size we'll accept, really? */
 	if (request->length > 4096)
@@ -419,8 +415,26 @@ static int ioctl_send_request(struct client *client, void *buffer)
 	if (request->data &&
 	    copy_from_user(response->response.data,
 			   u64_to_uptr(request->data), request->length)) {
-		kfree(response);
-		return -EFAULT;
+		ret = -EFAULT;
+		goto err;
+	}
+
+	switch (request->tcode) {
+	case TCODE_WRITE_QUADLET_REQUEST:
+	case TCODE_WRITE_BLOCK_REQUEST:
+	case TCODE_READ_QUADLET_REQUEST:
+	case TCODE_READ_BLOCK_REQUEST:
+	case TCODE_LOCK_MASK_SWAP:
+	case TCODE_LOCK_COMPARE_SWAP:
+	case TCODE_LOCK_FETCH_ADD:
+	case TCODE_LOCK_LITTLE_ADD:
+	case TCODE_LOCK_BOUNDED_ADD:
+	case TCODE_LOCK_WRAP_ADD:
+	case TCODE_LOCK_VENDOR_DEPENDENT:
+		break;
+	default:
+		ret = -EINVAL;
+		goto err;
 	}
 
 	response->resource.release = release_transaction;
@@ -439,6 +453,10 @@ static int ioctl_send_request(struct client *client, void *buffer)
 		return sizeof(request) + request->length;
 	else
 		return sizeof(request);
+ err:
+	kfree(response);
+
+	return ret;
 }
 
 struct address_handler {
@@ -990,7 +1008,6 @@ static int fw_device_op_release(struct inode *inode, struct file *file)
 	struct client *client = file->private_data;
 	struct event *e, *next_e;
 	struct client_resource *r, *next_r;
-	unsigned long flags;
 
 	if (client->buffer.pages)
 		fw_iso_buffer_destroy(&client->buffer, client->device->card);
@@ -1009,9 +1026,9 @@ static int fw_device_op_release(struct inode *inode, struct file *file)
 	list_for_each_entry_safe(e, next_e, &client->event_list, link)
 		kfree(e);
 
-	spin_lock_irqsave(&client->device->card->lock, flags);
+	mutex_lock(&client->device->client_list_mutex);
 	list_del(&client->link);
-	spin_unlock_irqrestore(&client->device->card->lock, flags);
+	mutex_unlock(&client->device->client_list_mutex);
 
 	fw_device_put(client->device);
 	kfree(client);
diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
index 6b9be42c7b98..b8b7d3b9e192 100644
--- a/drivers/firewire/fw-device.c
+++ b/drivers/firewire/fw-device.c
@@ -26,8 +26,10 @@
 #include <linux/delay.h>
 #include <linux/idr.h>
 #include <linux/string.h>
+#include <linux/mutex.h>
 #include <linux/rwsem.h>
 #include <linux/semaphore.h>
+#include <linux/spinlock.h>
 #include <asm/system.h>
 #include <linux/ctype.h>
 #include "fw-transaction.h"
@@ -617,7 +619,7 @@ static int shutdown_unit(struct device *device, void *data)
  */
 DECLARE_RWSEM(fw_device_rwsem);
 
-static DEFINE_IDR(fw_device_idr);
+DEFINE_IDR(fw_device_idr);
 int fw_cdev_major;
 
 struct fw_device *fw_device_get_by_devt(dev_t devt)
@@ -689,7 +691,7 @@ static void fw_device_init(struct work_struct *work)
 			fw_notify("giving up on config rom for node id %x\n",
 				  device->node_id);
 			if (device->node == device->card->root_node)
-				schedule_delayed_work(&device->card->work, 0);
+				fw_schedule_bm_work(device->card, 0);
 			fw_device_release(&device->device);
 		}
 		return;
@@ -758,7 +760,7 @@ static void fw_device_init(struct work_struct *work)
 	 * pretty harmless.
 	 */
 	if (device->node == device->card->root_node)
-		schedule_delayed_work(&device->card->work, 0);
+		fw_schedule_bm_work(device->card, 0);
 
 	return;
 
@@ -892,7 +894,7 @@ static void fw_device_refresh(struct work_struct *work)
 	fw_device_shutdown(work);
  out:
 	if (node_id == card->root_node->node_id)
-		schedule_delayed_work(&card->work, 0);
+		fw_schedule_bm_work(card, 0);
 }
 
 void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
@@ -923,6 +925,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
 		device->node = fw_node_get(node);
 		device->node_id = node->node_id;
 		device->generation = card->generation;
+		mutex_init(&device->client_list_mutex);
 		INIT_LIST_HEAD(&device->client_list);
 
 		/*
diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
index 42305bbac72f..f8ef99566863 100644
--- a/drivers/firewire/fw-device.h
+++ b/drivers/firewire/fw-device.h
@@ -21,7 +21,9 @@
 
 #include <linux/fs.h>
 #include <linux/cdev.h>
+#include <linux/idr.h>
 #include <linux/rwsem.h>
+#include <linux/mutex.h>
 #include <asm/atomic.h>
 
 enum fw_device_state {
@@ -62,7 +64,10 @@ struct fw_device {
 	bool cmc;
 	struct fw_card *card;
 	struct device device;
+
+	struct mutex client_list_mutex;
 	struct list_head client_list;
+
 	u32 *config_rom;
 	size_t config_rom_length;
 	int config_rom_retries;
@@ -99,6 +104,7 @@ void fw_device_cdev_update(struct fw_device *device);
 void fw_device_cdev_remove(struct fw_device *device);
 
 extern struct rw_semaphore fw_device_rwsem;
+extern struct idr fw_device_idr;
 extern int fw_cdev_major;
 
 /*
diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
index ab9c01e462ef..a643576333ff 100644
--- a/drivers/firewire/fw-ohci.c
+++ b/drivers/firewire/fw-ohci.c
@@ -1765,6 +1765,28 @@ ohci_get_bus_time(struct fw_card *card)
 	return bus_time;
 }
 
+static void copy_iso_headers(struct iso_context *ctx, void *p)
+{
+	int i = ctx->header_length;
+
+	if (i + ctx->base.header_size > PAGE_SIZE)
+		return;
+
+	/*
+	 * The iso header is byteswapped to little endian by
+	 * the controller, but the remaining header quadlets
+	 * are big endian.  We want to present all the headers
+	 * as big endian, so we have to swap the first quadlet.
+	 */
+	if (ctx->base.header_size > 0)
+		*(u32 *) (ctx->header + i) = __swab32(*(u32 *) (p + 4));
+	if (ctx->base.header_size > 4)
+		*(u32 *) (ctx->header + i + 4) = __swab32(*(u32 *) p);
+	if (ctx->base.header_size > 8)
+		memcpy(ctx->header + i + 8, p + 8, ctx->base.header_size - 8);
+	ctx->header_length += ctx->base.header_size;
+}
+
 static int handle_ir_dualbuffer_packet(struct context *context,
 				       struct descriptor *d,
 				       struct descriptor *last)
@@ -1775,7 +1797,6 @@ static int handle_ir_dualbuffer_packet(struct context *context,
 	__le32 *ir_header;
 	size_t header_length;
 	void *p, *end;
-	int i;
 
 	if (db->first_res_count != 0 && db->second_res_count != 0) {
 		if (ctx->excess_bytes <= le16_to_cpu(db->second_req_count)) {
@@ -1788,25 +1809,14 @@ static int handle_ir_dualbuffer_packet(struct context *context,
 	header_length = le16_to_cpu(db->first_req_count) -
 		le16_to_cpu(db->first_res_count);
 
-	i = ctx->header_length;
 	p = db + 1;
 	end = p + header_length;
-	while (p < end && i + ctx->base.header_size <= PAGE_SIZE) {
-		/*
-		 * The iso header is byteswapped to little endian by
-		 * the controller, but the remaining header quadlets
-		 * are big endian.  We want to present all the headers
-		 * as big endian, so we have to swap the first
-		 * quadlet.
-		 */
-		*(u32 *) (ctx->header + i) = __swab32(*(u32 *) (p + 4));
-		memcpy(ctx->header + i + 4, p + 8, ctx->base.header_size - 4);
-		i += ctx->base.header_size;
+	while (p < end) {
+		copy_iso_headers(ctx, p);
 		ctx->excess_bytes +=
 			(le32_to_cpu(*(__le32 *)(p + 4)) >> 16) & 0xffff;
-		p += ctx->base.header_size + 4;
+		p += max(ctx->base.header_size, (size_t)8);
 	}
-	ctx->header_length = i;
 
 	ctx->excess_bytes -= le16_to_cpu(db->second_req_count) -
 		le16_to_cpu(db->second_res_count);
@@ -1832,7 +1842,6 @@ static int handle_ir_packet_per_buffer(struct context *context,
 	struct descriptor *pd;
 	__le32 *ir_header;
 	void *p;
-	int i;
 
 	for (pd = d; pd <= last; pd++) {
 		if (pd->transfer_status)
@@ -1842,21 +1851,8 @@ static int handle_ir_packet_per_buffer(struct context *context,
 		/* Descriptor(s) not done yet, stop iteration */
 		return 0;
 
-	i   = ctx->header_length;
-	p   = last + 1;
-
-	if (ctx->base.header_size > 0 &&
-			i + ctx->base.header_size <= PAGE_SIZE) {
-		/*
-		 * The iso header is byteswapped to little endian by
-		 * the controller, but the remaining header quadlets
-		 * are big endian.  We want to present all the headers
-		 * as big endian, so we have to swap the first quadlet.
-		 */
-		*(u32 *) (ctx->header + i) = __swab32(*(u32 *) (p + 4));
-		memcpy(ctx->header + i + 4, p + 8, ctx->base.header_size - 4);
-		ctx->header_length += ctx->base.header_size;
-	}
+	p = last + 1;
+	copy_iso_headers(ctx, p);
 
 	if (le16_to_cpu(last->control) & DESCRIPTOR_IRQ_ALWAYS) {
 		ir_header = (__le32 *) p;
@@ -2151,11 +2147,11 @@ ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
 	z = 2;
 
 	/*
-	 * The OHCI controller puts the status word in the header
-	 * buffer too, so we need 4 extra bytes per packet.
+	 * The OHCI controller puts the isochronous header and trailer in the
+	 * buffer, so we need at least 8 bytes.
 	 */
 	packet_count = p->header_length / ctx->base.header_size;
-	header_size = packet_count * (ctx->base.header_size + 4);
+	header_size = packet_count * max(ctx->base.header_size, (size_t)8);
 
 	/* Get header size in number of descriptors. */
 	header_z = DIV_ROUND_UP(header_size, sizeof(*d));
@@ -2173,7 +2169,8 @@ ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
 		db = (struct db_descriptor *) d;
 		db->control = cpu_to_le16(DESCRIPTOR_STATUS |
 					  DESCRIPTOR_BRANCH_ALWAYS);
-		db->first_size = cpu_to_le16(ctx->base.header_size + 4);
+		db->first_size =
+		    cpu_to_le16(max(ctx->base.header_size, (size_t)8));
 		if (p->skip && rest == p->payload_length) {
 			db->control |= cpu_to_le16(DESCRIPTOR_WAIT);
 			db->first_req_count = db->first_size;
@@ -2223,11 +2220,11 @@ ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
 	int page, offset, packet_count, header_size, payload_per_buffer;
 
 	/*
-	 * The OHCI controller puts the status word in the
-	 * buffer too, so we need 4 extra bytes per packet.
+	 * The OHCI controller puts the isochronous header and trailer in the
+	 * buffer, so we need at least 8 bytes.
 	 */
 	packet_count = p->header_length / ctx->base.header_size;
-	header_size  = ctx->base.header_size + 4;
+	header_size  = max(ctx->base.header_size, (size_t)8);
 
 	/* Get header size in number of descriptors. */
 	header_z = DIV_ROUND_UP(header_size, sizeof(*d));
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index e54403ee59e7..e88d5067448c 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -670,17 +670,6 @@ static void sbp2_agent_reset_no_wait(struct sbp2_logical_unit *lu)
 			&d, sizeof(d), complete_agent_reset_write_no_wait, t);
 }
 
-static void sbp2_set_generation(struct sbp2_logical_unit *lu, int generation)
-{
-	struct fw_card *card = fw_device(lu->tgt->unit->device.parent)->card;
-	unsigned long flags;
-
-	/* serialize with comparisons of lu->generation and card->generation */
-	spin_lock_irqsave(&card->lock, flags);
-	lu->generation = generation;
-	spin_unlock_irqrestore(&card->lock, flags);
-}
-
 static inline void sbp2_allow_block(struct sbp2_logical_unit *lu)
 {
 	/*
@@ -884,7 +873,7 @@ static void sbp2_login(struct work_struct *work)
 		goto out;
 
 	generation    = device->generation;
-	smp_rmb();    /* node_id must not be older than generation */
+	smp_rmb();    /* node IDs must not be older than generation */
 	node_id       = device->node_id;
 	local_node_id = device->card->node_id;
 
@@ -908,7 +897,8 @@ static void sbp2_login(struct work_struct *work)
 
 	tgt->node_id	  = node_id;
 	tgt->address_high = local_node_id << 16;
-	sbp2_set_generation(lu, generation);
+	smp_wmb();	  /* node IDs must not be older than generation */
+	lu->generation	  = generation;
 
 	lu->command_block_agent_address =
 		((u64)(be32_to_cpu(response.command_block_agent.high) & 0xffff)
@@ -1201,7 +1191,7 @@ static void sbp2_reconnect(struct work_struct *work)
 		goto out;
 
 	generation    = device->generation;
-	smp_rmb();    /* node_id must not be older than generation */
+	smp_rmb();    /* node IDs must not be older than generation */
 	node_id       = device->node_id;
 	local_node_id = device->card->node_id;
 
@@ -1228,7 +1218,8 @@ static void sbp2_reconnect(struct work_struct *work)
 
 	tgt->node_id      = node_id;
 	tgt->address_high = local_node_id << 16;
-	sbp2_set_generation(lu, generation);
+	smp_wmb();	  /* node IDs must not be older than generation */
+	lu->generation	  = generation;
 
 	fw_notify("%s: reconnected to LUN %04x (%d retries)\n",
 		  tgt->bus_id, lu->lun, lu->retries);
diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
index 5e204713002d..c9be6e6948c4 100644
--- a/drivers/firewire/fw-topology.c
+++ b/drivers/firewire/fw-topology.c
@@ -355,6 +355,9 @@ report_lost_node(struct fw_card *card,
 {
 	fw_node_event(card, node, FW_NODE_DESTROYED);
 	fw_node_put(node);
+
+	/* Topology has changed - reset bus manager retry counter */
+	card->bm_retries = 0;
 }
 
 static void
@@ -374,6 +377,9 @@ report_found_node(struct fw_card *card,
 	}
 
 	fw_node_event(card, node, FW_NODE_CREATED);
+
+	/* Topology has changed - reset bus manager retry counter */
+	card->bm_retries = 0;
 }
 
 void fw_destroy_nodes(struct fw_card *card)
@@ -514,14 +520,6 @@ fw_core_handle_bus_reset(struct fw_card *card,
 
 	spin_lock_irqsave(&card->lock, flags);
 
-	/*
-	 * If the new topology has a different self_id_count the topology
-	 * changed, either nodes were added or removed. In that case we
-	 * reset the IRM reset counter.
-	 */
-	if (card->self_id_count != self_id_count)
-		card->bm_retries = 0;
-
 	card->node_id = node_id;
 	/*
 	 * Update node_id before generation to prevent anybody from using
@@ -530,7 +528,7 @@ fw_core_handle_bus_reset(struct fw_card *card,
 	smp_wmb();
 	card->generation = generation;
 	card->reset_jiffies = jiffies;
-	schedule_delayed_work(&card->work, 0);
+	fw_schedule_bm_work(card, 0);
 
 	local_node = build_tree(card, self_ids, self_id_count);
 
diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c
index 2884f876397b..699ac041f39a 100644
--- a/drivers/firewire/fw-transaction.c
+++ b/drivers/firewire/fw-transaction.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/completion.h>
+#include <linux/idr.h>
 #include <linux/kernel.h>
 #include <linux/kref.h>
 #include <linux/module.h>
@@ -971,6 +972,7 @@ static void __exit fw_core_cleanup(void)
 {
 	unregister_chrdev(fw_cdev_major, "firewire");
 	bus_unregister(&fw_bus_type);
+	idr_destroy(&fw_device_idr);
 }
 
 module_init(fw_core_init);
diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
index 839466f0a795..c9ab12a15f6e 100644
--- a/drivers/firewire/fw-transaction.h
+++ b/drivers/firewire/fw-transaction.h
@@ -237,14 +237,6 @@ struct fw_card {
 	int link_speed;
 	int config_rom_generation;
 
-	/*
-	 * We need to store up to 4 self ID for a maximum of 63
-	 * devices plus 3 words for the topology map header.
-	 */
-	int self_id_count;
-	u32 topology_map[252 + 3];
-	u32 broadcast_channel;
-
 	spinlock_t lock; /* Take this lock when handling the lists in
 			  * this struct. */
 	struct fw_node *local_node;
@@ -262,6 +254,9 @@ struct fw_card {
 	struct delayed_work work;
 	int bm_retries;
 	int bm_generation;
+
+	u32 broadcast_channel;
+	u32 topology_map[(CSR_TOPOLOGY_MAP_END - CSR_TOPOLOGY_MAP) / 4];
 };
 
 static inline struct fw_card *fw_card_get(struct fw_card *card)
@@ -278,6 +273,8 @@ static inline void fw_card_put(struct fw_card *card)
 	kref_put(&card->kref, fw_card_release);
 }
 
+extern void fw_schedule_bm_work(struct fw_card *card, unsigned long delay);
+
 /*
  * The iso packet format allows for an immediate header/payload part
  * stored in 'header' immediately after the packet info plus an
diff --git a/drivers/ieee1394/csr.c b/drivers/ieee1394/csr.c
index c90be4070e40..31400c8ae051 100644
--- a/drivers/ieee1394/csr.c
+++ b/drivers/ieee1394/csr.c
@@ -68,22 +68,22 @@ static struct hpsb_highlevel csr_highlevel = {
 	.host_reset =	host_reset,
 };
 
-static struct hpsb_address_ops map_ops = {
+const static struct hpsb_address_ops map_ops = {
 	.read = read_maps,
 };
 
-static struct hpsb_address_ops fcp_ops = {
+const static struct hpsb_address_ops fcp_ops = {
 	.write = write_fcp,
 };
 
-static struct hpsb_address_ops reg_ops = {
+const static struct hpsb_address_ops reg_ops = {
 	.read = read_regs,
 	.write = write_regs,
 	.lock = lock_regs,
 	.lock64 = lock64_regs,
 };
 
-static struct hpsb_address_ops config_rom_ops = {
+const static struct hpsb_address_ops config_rom_ops = {
 	.read = read_config_rom,
 };
 
@@ -217,7 +217,7 @@ static void add_host(struct hpsb_host *host)
 
 	host->csr.generation = 2;
 
-	bus_info[1] = __constant_cpu_to_be32(0x31333934);
+	bus_info[1] = IEEE1394_BUSID_MAGIC;
 	bus_info[2] = cpu_to_be32((hpsb_disable_irm ? 0 : 1 << CSR_IRMC_SHIFT) |
 				  (1 << CSR_CMC_SHIFT) |
 				  (1 << CSR_ISC_SHIFT) |
@@ -250,7 +250,7 @@ static void remove_host(struct hpsb_host *host)
 {
 	quadlet_t bus_info[CSR_BUS_INFO_SIZE];
 
-	bus_info[1] = __constant_cpu_to_be32(0x31333934);
+	bus_info[1] = IEEE1394_BUSID_MAGIC;
 	bus_info[2] = cpu_to_be32((0 << CSR_IRMC_SHIFT) |
 				  (0 << CSR_CMC_SHIFT) |
 				  (0 << CSR_ISC_SHIFT) |
diff --git a/drivers/ieee1394/csr.h b/drivers/ieee1394/csr.h
index f11546550d84..90fb3f2192c3 100644
--- a/drivers/ieee1394/csr.h
+++ b/drivers/ieee1394/csr.h
@@ -50,11 +50,11 @@
 #define CSR_MAX_ROM_SHIFT		8
 #define CSR_GENERATION_SHIFT		4
 
-#define CSR_SET_BUS_INFO_GENERATION(csr, gen)				\
-	((csr)->bus_info_data[2] =					\
-		cpu_to_be32((be32_to_cpu((csr)->bus_info_data[2]) &	\
-			     ~(0xf << CSR_GENERATION_SHIFT)) |		\
-			    (gen) << CSR_GENERATION_SHIFT))
+static inline void csr_set_bus_info_generation(struct csr1212_csr *csr, u8 gen)
+{
+	csr->bus_info_data[2] &= ~cpu_to_be32(0xf << CSR_GENERATION_SHIFT);
+	csr->bus_info_data[2] |= cpu_to_be32((u32)gen << CSR_GENERATION_SHIFT);
+}
 
 struct csr_control {
 	spinlock_t lock;
diff --git a/drivers/ieee1394/csr1212.c b/drivers/ieee1394/csr1212.c
index 5e38a68b8af2..a6dfeb0b3372 100644
--- a/drivers/ieee1394/csr1212.c
+++ b/drivers/ieee1394/csr1212.c
@@ -1077,15 +1077,10 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr)
 	int i;
 	int ret;
 
-	/* IEEE 1212 says that the entire bus info block should be readable in
-	 * a single transaction regardless of the max_rom value.
-	 * Unfortunately, many IEEE 1394 devices do not abide by that, so the
-	 * bus info block will be read 1 quadlet at a time.  The rest of the
-	 * ConfigROM will be read according to the max_rom field. */
 	for (i = 0; i < csr->bus_info_len; i += sizeof(u32)) {
 		ret = csr->ops->bus_read(csr, CSR1212_CONFIG_ROM_SPACE_BASE + i,
-			sizeof(u32), &csr->cache_head->data[bytes_to_quads(i)],
-			csr->private);
+				&csr->cache_head->data[bytes_to_quads(i)],
+				csr->private);
 		if (ret != CSR1212_SUCCESS)
 			return ret;
 
@@ -1104,8 +1099,8 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr)
 	 * a time. */
 	for (i = csr->bus_info_len; i <= csr->crc_len; i += sizeof(u32)) {
 		ret = csr->ops->bus_read(csr, CSR1212_CONFIG_ROM_SPACE_BASE + i,
-			sizeof(u32), &csr->cache_head->data[bytes_to_quads(i)],
-			csr->private);
+				&csr->cache_head->data[bytes_to_quads(i)],
+				csr->private);
 		if (ret != CSR1212_SUCCESS)
 			return ret;
 	}
@@ -1289,7 +1284,7 @@ csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
 
 		if (csr->ops->bus_read(csr,
 				       CSR1212_REGISTER_SPACE_BASE + kv->offset,
-				       sizeof(u32), &q, csr->private))
+				       &q, csr->private))
 			return -EIO;
 
 		kv->value.leaf.len = be32_to_cpu(q) >> 16;
@@ -1372,17 +1367,8 @@ csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
 		addr = (CSR1212_CSR_ARCH_REG_SPACE_BASE + cache->offset +
 			cr->offset_end) & ~(csr->max_rom - 1);
 
-		if (csr->ops->bus_read(csr, addr, csr->max_rom, cache_ptr,
-				       csr->private)) {
-			if (csr->max_rom == 4)
-				/* We've got problems! */
-				return -EIO;
-
-			/* Apperently the max_rom value was a lie, set it to
-			 * do quadlet reads and try again. */
-			csr->max_rom = 4;
-			continue;
-		}
+		if (csr->ops->bus_read(csr, addr, cache_ptr, csr->private))
+			return -EIO;
 
 		cr->offset_end += csr->max_rom - (cr->offset_end &
 						  (csr->max_rom - 1));
@@ -1433,7 +1419,6 @@ csr1212_get_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
 
 int csr1212_parse_csr(struct csr1212_csr *csr)
 {
-	static const int mr_map[] = { 4, 64, 1024, 0 };
 	struct csr1212_dentry *dentry;
 	int ret;
 
@@ -1443,15 +1428,13 @@ int csr1212_parse_csr(struct csr1212_csr *csr)
 	if (ret != CSR1212_SUCCESS)
 		return ret;
 
-	if (!csr->ops->get_max_rom) {
-		csr->max_rom = mr_map[0];	/* default value */
-	} else {
-		int i = csr->ops->get_max_rom(csr->bus_info_data,
-					      csr->private);
-		if (i & ~0x3)
-			return -EINVAL;
-		csr->max_rom = mr_map[i];
-	}
+	/*
+	 * There has been a buggy firmware with bus_info_block.max_rom > 0
+	 * spotted which actually only supported quadlet read requests to the
+	 * config ROM.  Therefore read everything quadlet by quadlet regardless
+	 * of what the bus info block says.
+	 */
+	csr->max_rom = 4;
 
 	csr->cache_head->layout_head = csr->root_kv;
 	csr->cache_head->layout_tail = csr->root_kv;
diff --git a/drivers/ieee1394/csr1212.h b/drivers/ieee1394/csr1212.h
index 043039fc63ec..a892d922dbc9 100644
--- a/drivers/ieee1394/csr1212.h
+++ b/drivers/ieee1394/csr1212.h
@@ -181,7 +181,7 @@ struct csr1212_csr_rom_cache {
 struct csr1212_csr {
 	size_t bus_info_len;	/* bus info block length in bytes */
 	size_t crc_len;		/* crc length in bytes */
-	u32 *bus_info_data;	/* bus info data incl bus name and EUI */
+	__be32 *bus_info_data;	/* bus info data incl bus name and EUI */
 
 	void *private;		/* private, bus specific data */
 	struct csr1212_bus_ops *ops;
@@ -200,7 +200,7 @@ struct csr1212_bus_ops {
 	 * entries located in the Units Space.  Must return 0 on success
 	 * anything else indicates an error. */
 	int (*bus_read) (struct csr1212_csr *csr, u64 addr,
-			 u16 length, void *buffer, void *private);
+			 void *buffer, void *private);
 
 	/* This function is used by csr1212 to allocate a region in units space
 	 * in the event that Config ROM entries don't all fit in the predefined
@@ -211,11 +211,6 @@ struct csr1212_bus_ops {
 	/* This function is used by csr1212 to release a region in units space
 	 * that is no longer needed. */
 	void (*release_addr) (u64 addr, void *private);
-
-	/* This function is used by csr1212 to determine the max read request
-	 * supported by a remote node when reading the ConfigROM space.  Must
-	 * return 0, 1, or 2 per IEEE 1212.  */
-	int (*get_max_rom) (u32 *bus_info, void *private);
 };
 
 
diff --git a/drivers/ieee1394/dma.h b/drivers/ieee1394/dma.h
index 2727bcd24194..467373cab8e5 100644
--- a/drivers/ieee1394/dma.h
+++ b/drivers/ieee1394/dma.h
@@ -12,6 +12,7 @@
 
 #include <asm/types.h>
 
+struct file;
 struct pci_dev;
 struct scatterlist;
 struct vm_area_struct;
diff --git a/drivers/ieee1394/dv1394-private.h b/drivers/ieee1394/dv1394-private.h
index 7d1d2845b420..18b92cbf4a9f 100644
--- a/drivers/ieee1394/dv1394-private.h
+++ b/drivers/ieee1394/dv1394-private.h
@@ -77,11 +77,11 @@ static inline void fill_cip_header(struct CIP_header *cip,
    See the Texas Instruments OHCI 1394 chipset documentation.
 */
 
-struct output_more_immediate { u32 q[8]; };
-struct output_more { u32 q[4]; };
-struct output_last { u32 q[4]; };
-struct input_more { u32 q[4]; };
-struct input_last { u32 q[4]; };
+struct output_more_immediate { __le32 q[8]; };
+struct output_more { __le32 q[4]; };
+struct output_last { __le32 q[4]; };
+struct input_more { __le32 q[4]; };
+struct input_last { __le32 q[4]; };
 
 /* outputs */
 
@@ -92,9 +92,9 @@ static inline void fill_output_more_immediate(struct output_more_immediate *omi,
 					      unsigned int  payload_size)
 {
 	omi->q[0] = cpu_to_le32(0x02000000 | 8); /* OUTPUT_MORE_IMMEDIATE; 8 is the size of the IT header */
-	omi->q[1] = 0;
-	omi->q[2] = 0;
-	omi->q[3] = 0;
+	omi->q[1] = cpu_to_le32(0);
+	omi->q[2] = cpu_to_le32(0);
+	omi->q[3] = cpu_to_le32(0);
 
 	/* IT packet header */
 	omi->q[4] = cpu_to_le32(  (0x0 << 16)  /* IEEE1394_SPEED_100 */
@@ -106,8 +106,8 @@ static inline void fill_output_more_immediate(struct output_more_immediate *omi,
 	/* reserved field; mimic behavior of my Sony DSR-40 */
 	omi->q[5] = cpu_to_le32((payload_size << 16) | (0x7F << 8) | 0xA0);
 
-	omi->q[6] = 0;
-	omi->q[7] = 0;
+	omi->q[6] = cpu_to_le32(0);
+	omi->q[7] = cpu_to_le32(0);
 }
 
 static inline void fill_output_more(struct output_more *om,
@@ -116,8 +116,8 @@ static inline void fill_output_more(struct output_more *om,
 {
 	om->q[0] = cpu_to_le32(data_size);
 	om->q[1] = cpu_to_le32(data_phys_addr);
-	om->q[2] = 0;
-	om->q[3] = 0;
+	om->q[2] = cpu_to_le32(0);
+	om->q[3] = cpu_to_le32(0);
 }
 
 static inline void fill_output_last(struct output_last *ol,
@@ -140,8 +140,8 @@ static inline void fill_output_last(struct output_last *ol,
 
 	ol->q[0] = cpu_to_le32(temp);
 	ol->q[1] = cpu_to_le32(data_phys_addr);
-	ol->q[2] = 0;
-	ol->q[3] = 0;
+	ol->q[2] = cpu_to_le32(0);
+	ol->q[3] = cpu_to_le32(0);
 }
 
 /* inputs */
@@ -161,8 +161,8 @@ static inline void fill_input_more(struct input_more *im,
 
 	im->q[0] = cpu_to_le32(temp);
 	im->q[1] = cpu_to_le32(data_phys_addr);
-	im->q[2] = 0; /* branchAddress and Z not use in packet-per-buffer mode */
-	im->q[3] = 0; /* xferStatus & resCount, resCount must be initialize to data_size */
+	im->q[2] = cpu_to_le32(0); /* branchAddress and Z not use in packet-per-buffer mode */
+	im->q[3] = cpu_to_le32(0); /* xferStatus & resCount, resCount must be initialize to data_size */
 }
  
 static inline void fill_input_last(struct input_last *il,
@@ -331,7 +331,7 @@ struct frame {
 
 	/* points to status/timestamp field of first DMA packet */
 	/* (we'll check it later to monitor timestamp accuracy) */
-	u32 *frame_begin_timestamp;
+	__le32 *frame_begin_timestamp;
 
 	/* the timestamp we assigned to the first packet in the frame */
 	u32 assigned_timestamp;
@@ -348,15 +348,15 @@ struct frame {
 	   that can cause interrupts. We'll check these from the
 	   interrupt handler.
 	*/
-	u32 *mid_frame_timestamp;
-	u32 *frame_end_timestamp;
+	__le32 *mid_frame_timestamp;
+	__le32 *frame_end_timestamp;
 
 	/* branch address field of final packet. This is effectively
 	   the "tail" in the chain of DMA descriptor blocks.
 	   We will fill it with the address of the first DMA descriptor
 	   block in the subsequent frame, once it is ready.
 	*/
-	u32 *frame_end_branch;
+	__le32 *frame_end_branch;
 
 	/* the number of descriptors in the first descriptor block
 	   of the frame. Needed to start DMA */
@@ -365,10 +365,10 @@ struct frame {
 
 
 struct packet {
-	u16	timestamp;
+	__le16	timestamp;
 	u16	invalid;
 	u16	iso_header;
-	u16	data_length;
+	__le16	data_length;
 	u32	cip_h1;
 	u32	cip_h2;
 	unsigned char data[480];
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index c19f23267157..a329e6bd5d2d 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -265,7 +265,7 @@ static void frame_prepare(struct video_card *video, unsigned int this_frame)
 	/* these flags denote packets that need special attention */
 	int empty_packet, first_packet, last_packet, mid_packet;
 
-	u32 *branch_address, *last_branch_address = NULL;
+	__le32 *branch_address, *last_branch_address = NULL;
 	unsigned long data_p;
 	int first_packet_empty = 0;
 	u32 cycleTimer, ct_sec, ct_cyc, ct_off;
@@ -848,7 +848,7 @@ static void receive_packets(struct video_card *video)
 	dma_addr_t block_dma = 0;
 	struct packet *data = NULL;
 	dma_addr_t data_dma = 0;
-	u32 *last_branch_address = NULL;
+	__le32 *last_branch_address = NULL;
 	unsigned long irq_flags;
 	int want_interrupt = 0;
 	struct frame *f = NULL;
@@ -2110,17 +2110,17 @@ static void ir_tasklet_func(unsigned long data)
 			f = video->frames[next_i / MAX_PACKETS];
 			next = &(f->descriptor_pool[next_i % MAX_PACKETS]);
 			next_dma = ((unsigned long) block - (unsigned long) f->descriptor_pool) + f->descriptor_pool_dma;
-			next->u.in.il.q[0] |= 3 << 20; /* enable interrupt */
-			next->u.in.il.q[2] = 0; /* disable branch */
+			next->u.in.il.q[0] |= cpu_to_le32(3 << 20); /* enable interrupt */
+			next->u.in.il.q[2] = cpu_to_le32(0); /* disable branch */
 
 			/* link previous to next */
 			prev_i = (next_i == 0) ? (MAX_PACKETS * video->n_frames - 1) : (next_i - 1);
 			f = video->frames[prev_i / MAX_PACKETS];
 			prev = &(f->descriptor_pool[prev_i % MAX_PACKETS]);
 			if (prev_i % (MAX_PACKETS/2)) {
-				prev->u.in.il.q[0] &= ~(3 << 20); /* no interrupt */
+				prev->u.in.il.q[0] &= ~cpu_to_le32(3 << 20); /* no interrupt */
 			} else {
-				prev->u.in.il.q[0] |= 3 << 20; /* enable interrupt */
+				prev->u.in.il.q[0] |= cpu_to_le32(3 << 20); /* enable interrupt */
 			}
 			prev->u.in.il.q[2] = cpu_to_le32(next_dma | 1); /* set Z=1 */
 			wmb();
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index 20128692b339..a074bfd5f825 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -92,7 +92,7 @@ struct partial_datagram {
 	struct list_head list;
 	u16 dgl;
 	u16 dg_size;
-	u16 ether_type;
+	__be16 ether_type;
 	struct sk_buff *skb;
 	char *pbuf;
 	struct list_head frag_info;
@@ -181,7 +181,7 @@ static void ether1394_remove_host(struct hpsb_host *host);
 static void ether1394_host_reset(struct hpsb_host *host);
 
 /* Function for incoming 1394 packets */
-static struct hpsb_address_ops addr_ops = {
+const static struct hpsb_address_ops addr_ops = {
 	.write =	ether1394_write,
 };
 
@@ -767,7 +767,7 @@ static int ether1394_header_parse(const struct sk_buff *skb,
 static int ether1394_header_cache(const struct neighbour *neigh,
 				  struct hh_cache *hh)
 {
-	unsigned short type = hh->hh_type;
+	__be16 type = hh->hh_type;
 	struct net_device *dev = neigh->dev;
 	struct eth1394hdr *eth =
 		(struct eth1394hdr *)((u8 *)hh->hh_data + 16 - ETH1394_HLEN);
@@ -795,7 +795,7 @@ static void ether1394_header_cache_update(struct hh_cache *hh,
  ******************************************/
 
 /* Copied from net/ethernet/eth.c */
-static u16 ether1394_type_trans(struct sk_buff *skb, struct net_device *dev)
+static __be16 ether1394_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
 	struct eth1394hdr *eth;
 	unsigned char *rawp;
@@ -829,17 +829,17 @@ static u16 ether1394_type_trans(struct sk_buff *skb, struct net_device *dev)
 
 /* Parse an encapsulated IP1394 header into an ethernet frame packet.
  * We also perform ARP translation here, if need be.  */
-static u16 ether1394_parse_encap(struct sk_buff *skb, struct net_device *dev,
+static __be16 ether1394_parse_encap(struct sk_buff *skb, struct net_device *dev,
 				 nodeid_t srcid, nodeid_t destid,
-				 u16 ether_type)
+				 __be16 ether_type)
 {
 	struct eth1394_priv *priv = netdev_priv(dev);
-	u64 dest_hw;
-	unsigned short ret = 0;
+	__be64 dest_hw;
+	__be16 ret = 0;
 
 	/* Setup our hw addresses. We use these to build the ethernet header. */
 	if (destid == (LOCAL_BUS | ALL_NODES))
-		dest_hw = ~0ULL;  /* broadcast */
+		dest_hw = ~cpu_to_be64(0);  /* broadcast */
 	else
 		dest_hw = cpu_to_be64((u64)priv->host->csr.guid_hi << 32 |
 				      priv->host->csr.guid_lo);
@@ -873,7 +873,7 @@ static u16 ether1394_parse_encap(struct sk_buff *skb, struct net_device *dev,
 		node = eth1394_find_node_guid(&priv->ip_node_list,
 					      be64_to_cpu(guid));
 		if (!node)
-			return 0;
+			return cpu_to_be16(0);
 
 		node_info =
 		    (struct eth1394_node_info *)node->ud->device.driver_data;
@@ -1063,7 +1063,7 @@ static int ether1394_data_handler(struct net_device *dev, int srcid, int destid,
 	unsigned long flags;
 	struct eth1394_priv *priv = netdev_priv(dev);
 	union eth1394_hdr *hdr = (union eth1394_hdr *)buf;
-	u16 ether_type = 0;  /* initialized to clear warning */
+	__be16 ether_type = cpu_to_be16(0);  /* initialized to clear warning */
 	int hdr_len;
 	struct unit_directory *ud = priv->ud_list[NODEID_TO_NODE(srcid)];
 	struct eth1394_node_info *node_info;
@@ -1259,7 +1259,7 @@ static int ether1394_write(struct hpsb_host *host, int srcid, int destid,
 
 static void ether1394_iso(struct hpsb_iso *iso)
 {
-	quadlet_t *data;
+	__be32 *data;
 	char *buf;
 	struct eth1394_host_info *hi;
 	struct net_device *dev;
@@ -1283,7 +1283,7 @@ static void ether1394_iso(struct hpsb_iso *iso)
 	for (i = 0; i < nready; i++) {
 		struct hpsb_iso_packet_info *info =
 			&iso->infos[(iso->first_packet + i) % iso->buf_packets];
-		data = (quadlet_t *)(iso->data_buf.kvirt + info->offset);
+		data = (__be32 *)(iso->data_buf.kvirt + info->offset);
 
 		/* skip over GASP header */
 		buf = (char *)data + 8;
@@ -1614,7 +1614,7 @@ static int ether1394_tx(struct sk_buff *skb, struct net_device *dev)
 		if (max_payload < dg_size + hdr_type_len[ETH1394_HDR_LF_UF])
 			priv->bc_dgl++;
 	} else {
-		__be64 guid = get_unaligned((u64 *)hdr_buf.h_dest);
+		__be64 guid = get_unaligned((__be64 *)hdr_buf.h_dest);
 
 		node = eth1394_find_node_guid(&priv->ip_node_list,
 					      be64_to_cpu(guid));
diff --git a/drivers/ieee1394/eth1394.h b/drivers/ieee1394/eth1394.h
index 4f3e2dd46f00..e1b5ea80f623 100644
--- a/drivers/ieee1394/eth1394.h
+++ b/drivers/ieee1394/eth1394.h
@@ -82,7 +82,7 @@ struct eth1394_priv {
 
 struct eth1394hdr {
 	unsigned char	h_dest[ETH1394_ALEN];	/* destination eth1394 addr	*/
-	unsigned short	h_proto;		/* packet type ID field	*/
+	__be16		h_proto;		/* packet type ID field	*/
 }  __attribute__((packed));
 
 static inline struct eth1394hdr *eth1394_hdr(const struct sk_buff *skb)
@@ -99,13 +99,13 @@ typedef enum {ETH1394_GASP, ETH1394_WRREQ} eth1394_tx_type;
 struct eth1394_uf_hdr {
 	u16 lf:2;
 	u16 res:14;
-	u16 ether_type;		/* Ethernet packet type */
+	__be16 ether_type;		/* Ethernet packet type */
 } __attribute__((packed));
 #elif defined __LITTLE_ENDIAN_BITFIELD
 struct eth1394_uf_hdr {
 	u16 res:14;
 	u16 lf:2;
-	u16 ether_type;
+	__be16 ether_type;
 } __attribute__((packed));
 #else
 #error Unknown bit field type
@@ -117,7 +117,7 @@ struct eth1394_ff_hdr {
 	u16 lf:2;
 	u16 res1:2;
 	u16 dg_size:12;		/* Datagram size */
-	u16 ether_type;		/* Ethernet packet type */
+	__be16 ether_type;		/* Ethernet packet type */
 	u16 dgl;		/* Datagram label */
 	u16 res2;
 } __attribute__((packed));
@@ -126,7 +126,7 @@ struct eth1394_ff_hdr {
 	u16 dg_size:12;
 	u16 res1:2;
 	u16 lf:2;
-	u16 ether_type;
+	__be16 ether_type;
 	u16 dgl;
 	u16 res2;
 } __attribute__((packed));
@@ -207,11 +207,11 @@ struct eth1394_arp {
 	u16 opcode;		/* ARP Opcode	*/
 	/* Above is exactly the same format as struct arphdr */
 
-	u64 s_uniq_id;		/* Sender's 64bit EUI			*/
+	__be64 s_uniq_id;	/* Sender's 64bit EUI		*/
 	u8 max_rec;		/* Sender's max packet size		*/
 	u8 sspd;		/* Sender's max speed			*/
-	u16 fifo_hi;		/* hi 16bits of sender's FIFO addr	*/
-	u32 fifo_lo;		/* lo 32bits of sender's FIFO addr	*/
+	__be16 fifo_hi;		/* hi 16bits of sender's FIFO addr	*/
+	__be32 fifo_lo;		/* lo 32bits of sender's FIFO addr	*/
 	u32 sip;		/* Sender's IP Address			*/
 	u32 tip;		/* IP Address of requested hw addr	*/
 };
diff --git a/drivers/ieee1394/highlevel.c b/drivers/ieee1394/highlevel.c
index 272543a42a43..600e391c8fe7 100644
--- a/drivers/ieee1394/highlevel.c
+++ b/drivers/ieee1394/highlevel.c
@@ -320,7 +320,7 @@ void hpsb_unregister_highlevel(struct hpsb_highlevel *hl)
  */
 u64 hpsb_allocate_and_register_addrspace(struct hpsb_highlevel *hl,
 					 struct hpsb_host *host,
-					 struct hpsb_address_ops *ops,
+					 const struct hpsb_address_ops *ops,
 					 u64 size, u64 alignment,
 					 u64 start, u64 end)
 {
@@ -407,7 +407,8 @@ u64 hpsb_allocate_and_register_addrspace(struct hpsb_highlevel *hl,
  * are automatically deallocated together with the hpsb_highlevel @hl.
  */
 int hpsb_register_addrspace(struct hpsb_highlevel *hl, struct hpsb_host *host,
-			    struct hpsb_address_ops *ops, u64 start, u64 end)
+			    const struct hpsb_address_ops *ops,
+			    u64 start, u64 end)
 {
 	struct hpsb_address_serve *as;
 	struct list_head *lh;
@@ -420,7 +421,7 @@ int hpsb_register_addrspace(struct hpsb_highlevel *hl, struct hpsb_host *host,
 		return 0;
 	}
 
-	as = kmalloc(sizeof(*as), GFP_ATOMIC);
+	as = kmalloc(sizeof(*as), GFP_KERNEL);
 	if (!as)
 		return 0;
 
@@ -477,7 +478,7 @@ int hpsb_unregister_addrspace(struct hpsb_highlevel *hl, struct hpsb_host *host,
 	return retval;
 }
 
-static struct hpsb_address_ops dummy_ops;
+const static struct hpsb_address_ops dummy_ops;
 
 /* dummy address spaces as lower and upper bounds of the host's a.s. list */
 static void init_hpsb_highlevel(struct hpsb_host *host)
diff --git a/drivers/ieee1394/highlevel.h b/drivers/ieee1394/highlevel.h
index bc5d0854c17e..9dba89fc60ad 100644
--- a/drivers/ieee1394/highlevel.h
+++ b/drivers/ieee1394/highlevel.h
@@ -15,7 +15,7 @@ struct hpsb_host;
 struct hpsb_address_serve {
 	struct list_head host_list;	/* per host list */
 	struct list_head hl_list;	/* hpsb_highlevel list */
-	struct hpsb_address_ops *op;
+	const struct hpsb_address_ops *op;
 	struct hpsb_host *host;
 	u64 start;	/* first address handled, quadlet aligned */
 	u64 end;	/* first address behind, quadlet aligned */
@@ -119,11 +119,12 @@ void hpsb_unregister_highlevel(struct hpsb_highlevel *hl);
 
 u64 hpsb_allocate_and_register_addrspace(struct hpsb_highlevel *hl,
 					 struct hpsb_host *host,
-					 struct hpsb_address_ops *ops,
+					 const struct hpsb_address_ops *ops,
 					 u64 size, u64 alignment,
 					 u64 start, u64 end);
 int hpsb_register_addrspace(struct hpsb_highlevel *hl, struct hpsb_host *host,
-			    struct hpsb_address_ops *ops, u64 start, u64 end);
+			    const struct hpsb_address_ops *ops,
+			    u64 start, u64 end);
 int hpsb_unregister_addrspace(struct hpsb_highlevel *hl, struct hpsb_host *host,
 			      u64 start);
 
diff --git a/drivers/ieee1394/hosts.c b/drivers/ieee1394/hosts.c
index 237d0c9d69c6..e947d8ffac85 100644
--- a/drivers/ieee1394/hosts.c
+++ b/drivers/ieee1394/hosts.c
@@ -34,18 +34,18 @@ static void delayed_reset_bus(struct work_struct *work)
 {
 	struct hpsb_host *host =
 		container_of(work, struct hpsb_host, delayed_reset.work);
-	int generation = host->csr.generation + 1;
+	u8 generation = host->csr.generation + 1;
 
 	/* The generation field rolls over to 2 rather than 0 per IEEE
 	 * 1394a-2000. */
 	if (generation > 0xf || generation < 2)
 		generation = 2;
 
-	CSR_SET_BUS_INFO_GENERATION(host->csr.rom, generation);
+	csr_set_bus_info_generation(host->csr.rom, generation);
 	if (csr1212_generate_csr_image(host->csr.rom) != CSR1212_SUCCESS) {
 		/* CSR image creation failed.
 		 * Reset generation field and do not issue a bus reset. */
-		CSR_SET_BUS_INFO_GENERATION(host->csr.rom,
+		csr_set_bus_info_generation(host->csr.rom,
 					    host->csr.generation);
 		return;
 	}
diff --git a/drivers/ieee1394/hosts.h b/drivers/ieee1394/hosts.h
index dd229950acca..49c359022c54 100644
--- a/drivers/ieee1394/hosts.h
+++ b/drivers/ieee1394/hosts.h
@@ -154,7 +154,7 @@ struct hpsb_host_driver {
 	 * to set the hardware ConfigROM if the hardware supports handling
 	 * reads to the ConfigROM on its own. */
 	void (*set_hw_config_rom)(struct hpsb_host *host,
-				  quadlet_t *config_rom);
+				  __be32 *config_rom);
 
 	/* This function shall implement packet transmission based on
 	 * packet->type.  It shall CRC both parts of the packet (unless
diff --git a/drivers/ieee1394/ieee1394.h b/drivers/ieee1394/ieee1394.h
index 40492074c013..e0ae0d3d747f 100644
--- a/drivers/ieee1394/ieee1394.h
+++ b/drivers/ieee1394/ieee1394.h
@@ -121,6 +121,9 @@ extern const char *hpsb_speedto_str[];
 
 #include <asm/byteorder.h>
 
+/* '1' '3' '9' '4' in ASCII */
+#define IEEE1394_BUSID_MAGIC	cpu_to_be32(0x31333934)
+
 #ifdef __BIG_ENDIAN_BITFIELD
 
 struct selfid {
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index dcdb71a7718d..9ee0a97329bf 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -1314,6 +1314,7 @@ EXPORT_SYMBOL(hpsb_make_lock64packet);
 EXPORT_SYMBOL(hpsb_make_phypacket);
 EXPORT_SYMBOL(hpsb_read);
 EXPORT_SYMBOL(hpsb_write);
+EXPORT_SYMBOL(hpsb_lock);
 EXPORT_SYMBOL(hpsb_packet_success);
 
 /** highlevel.c **/
diff --git a/drivers/ieee1394/ieee1394_transactions.c b/drivers/ieee1394/ieee1394_transactions.c
index 10c3d9f8c038..24021d2f0a75 100644
--- a/drivers/ieee1394/ieee1394_transactions.c
+++ b/drivers/ieee1394/ieee1394_transactions.c
@@ -570,3 +570,32 @@ int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
 
 	return retval;
 }
+
+int hpsb_lock(struct hpsb_host *host, nodeid_t node, unsigned int generation,
+	      u64 addr, int extcode, quadlet_t *data, quadlet_t arg)
+{
+	struct hpsb_packet *packet;
+	int retval = 0;
+
+	BUG_ON(in_interrupt());
+
+	packet = hpsb_make_lockpacket(host, node, addr, extcode, data, arg);
+	if (!packet)
+		return -ENOMEM;
+
+	packet->generation = generation;
+	retval = hpsb_send_packet_and_wait(packet);
+	if (retval < 0)
+		goto hpsb_lock_fail;
+
+	retval = hpsb_packet_success(packet);
+
+	if (retval == 0)
+		*data = packet->data[0];
+
+hpsb_lock_fail:
+	hpsb_free_tlabel(packet);
+	hpsb_free_packet(packet);
+
+	return retval;
+}
diff --git a/drivers/ieee1394/ieee1394_transactions.h b/drivers/ieee1394/ieee1394_transactions.h
index d2d5bc3546d7..20b693be14b2 100644
--- a/drivers/ieee1394/ieee1394_transactions.h
+++ b/drivers/ieee1394/ieee1394_transactions.h
@@ -30,6 +30,8 @@ int hpsb_read(struct hpsb_host *host, nodeid_t node, unsigned int generation,
 	      u64 addr, quadlet_t *buffer, size_t length);
 int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
 	       u64 addr, quadlet_t *buffer, size_t length);
+int hpsb_lock(struct hpsb_host *host, nodeid_t node, unsigned int generation,
+	      u64 addr, int extcode, quadlet_t *data, quadlet_t arg);
 
 #ifdef HPSB_DEBUG_TLABELS
 extern spinlock_t hpsb_tlabel_lock;
diff --git a/drivers/ieee1394/iso.h b/drivers/ieee1394/iso.h
index b5de5f21ef78..c2089c093aa7 100644
--- a/drivers/ieee1394/iso.h
+++ b/drivers/ieee1394/iso.h
@@ -13,6 +13,7 @@
 #define IEEE1394_ISO_H
 
 #include <linux/spinlock_types.h>
+#include <linux/wait.h>
 #include <asm/atomic.h>
 #include <asm/types.h>
 
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index 79ef5fd928ae..53aada5bbe1e 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -67,7 +67,7 @@ static int nodemgr_check_speed(struct nodemgr_csr_info *ci, u64 addr,
 	for (i = IEEE1394_SPEED_100; i <= old_speed; i++) {
 		*speed = i;
 		error = hpsb_read(ci->host, ci->nodeid, ci->generation, addr,
-				  &q, sizeof(quadlet_t));
+				  &q, 4);
 		if (error)
 			break;
 		*buffer = q;
@@ -85,7 +85,7 @@ static int nodemgr_check_speed(struct nodemgr_csr_info *ci, u64 addr,
 	return error;
 }
 
-static int nodemgr_bus_read(struct csr1212_csr *csr, u64 addr, u16 length,
+static int nodemgr_bus_read(struct csr1212_csr *csr, u64 addr,
 			    void *buffer, void *__ci)
 {
 	struct nodemgr_csr_info *ci = (struct nodemgr_csr_info*)__ci;
@@ -93,7 +93,7 @@ static int nodemgr_bus_read(struct csr1212_csr *csr, u64 addr, u16 length,
 
 	for (i = 1; ; i++) {
 		error = hpsb_read(ci->host, ci->nodeid, ci->generation, addr,
-				  buffer, length);
+				  buffer, 4);
 		if (!error) {
 			ci->speed_unverified = 0;
 			break;
@@ -104,7 +104,7 @@ static int nodemgr_bus_read(struct csr1212_csr *csr, u64 addr, u16 length,
 
 		/* The ieee1394_core guessed the node's speed capability from
 		 * the self ID.  Check whether a lower speed works. */
-		if (ci->speed_unverified && length == sizeof(quadlet_t)) {
+		if (ci->speed_unverified) {
 			error = nodemgr_check_speed(ci, addr, buffer);
 			if (!error)
 				break;
@@ -115,20 +115,8 @@ static int nodemgr_bus_read(struct csr1212_csr *csr, u64 addr, u16 length,
 	return error;
 }
 
-#define OUI_FREECOM_TECHNOLOGIES_GMBH 0x0001db
-
-static int nodemgr_get_max_rom(quadlet_t *bus_info_data, void *__ci)
-{
-	/* Freecom FireWire Hard Drive firmware bug */
-	if (be32_to_cpu(bus_info_data[3]) >> 8 == OUI_FREECOM_TECHNOLOGIES_GMBH)
-		return 0;
-
-	return (be32_to_cpu(bus_info_data[2]) >> 8) & 0x3;
-}
-
 static struct csr1212_bus_ops nodemgr_csr_ops = {
 	.bus_read =	nodemgr_bus_read,
-	.get_max_rom =	nodemgr_get_max_rom
 };
 
 
@@ -983,6 +971,9 @@ static struct unit_directory *nodemgr_process_unit_directory
 	ud->ud_kv = ud_kv;
 	ud->id = (*id)++;
 
+	/* inherit vendor_id from root directory if none exists in unit dir */
+	ud->vendor_id = ne->vendor_id;
+
 	csr1212_for_each_dir_entry(ne->csr, kv, ud_kv, dentry) {
 		switch (kv->key.id) {
 		case CSR1212_KV_ID_VENDOR:
@@ -1277,7 +1268,8 @@ static void nodemgr_update_node(struct node_entry *ne, struct csr1212_csr *csr,
 		csr1212_destroy_csr(csr);
 	}
 
-	/* Mark the node current */
+	/* Finally, mark the node current */
+	smp_wmb();
 	ne->generation = generation;
 
 	if (ne->in_limbo) {
@@ -1810,7 +1802,7 @@ void hpsb_node_fill_packet(struct node_entry *ne, struct hpsb_packet *packet)
 {
 	packet->host = ne->host;
 	packet->generation = ne->generation;
-	barrier();
+	smp_rmb();
 	packet->node_id = ne->nodeid;
 }
 
@@ -1819,7 +1811,7 @@ int hpsb_node_write(struct node_entry *ne, u64 addr,
 {
 	unsigned int generation = ne->generation;
 
-	barrier();
+	smp_rmb();
 	return hpsb_write(ne->host, ne->nodeid, generation,
 			  addr, buffer, length);
 }
diff --git a/drivers/ieee1394/nodemgr.h b/drivers/ieee1394/nodemgr.h
index 4f287a3561ba..ee5acdbd114a 100644
--- a/drivers/ieee1394/nodemgr.h
+++ b/drivers/ieee1394/nodemgr.h
@@ -21,9 +21,11 @@
 #define _IEEE1394_NODEMGR_H
 
 #include <linux/device.h>
+#include <asm/system.h>
 #include <asm/types.h>
 
 #include "ieee1394_core.h"
+#include "ieee1394_transactions.h"
 #include "ieee1394_types.h"
 
 struct csr1212_csr;
@@ -31,9 +33,6 @@ struct csr1212_keyval;
 struct hpsb_host;
 struct ieee1394_device_id;
 
-/* '1' '3' '9' '4' in ASCII */
-#define IEEE1394_BUSID_MAGIC	__constant_cpu_to_be32(0x31333934)
-
 /* This is the start of a Node entry structure. It should be a stable API
  * for which to gather info from the Node Manager about devices attached
  * to the bus.  */
@@ -157,6 +156,22 @@ static inline int hpsb_node_entry_valid(struct node_entry *ne)
 void hpsb_node_fill_packet(struct node_entry *ne, struct hpsb_packet *packet);
 int hpsb_node_write(struct node_entry *ne, u64 addr,
 		    quadlet_t *buffer, size_t length);
+static inline int hpsb_node_read(struct node_entry *ne, u64 addr,
+				 quadlet_t *buffer, size_t length)
+{
+	unsigned int g = ne->generation;
+
+	smp_rmb();
+	return hpsb_read(ne->host, ne->nodeid, g, addr, buffer, length);
+}
+static inline int hpsb_node_lock(struct node_entry *ne, u64 addr, int extcode,
+				 quadlet_t *buffer, quadlet_t arg)
+{
+	unsigned int g = ne->generation;
+
+	smp_rmb();
+	return hpsb_lock(ne->host, ne->nodeid, g, addr, extcode, buffer, arg);
+}
 int nodemgr_for_each_host(void *data, int (*cb)(struct hpsb_host *, void *));
 
 int init_ieee1394_nodemgr(void);
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index e509e13cb7a7..65c1429e4129 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -2973,7 +2973,7 @@ alloc_dma_trm_ctx(struct ti_ohci *ohci, struct dma_trm_ctx *d,
 	return 0;
 }
 
-static void ohci_set_hw_config_rom(struct hpsb_host *host, quadlet_t *config_rom)
+static void ohci_set_hw_config_rom(struct hpsb_host *host, __be32 *config_rom)
 {
 	struct ti_ohci *ohci = host->hostdata;
 
@@ -3199,15 +3199,16 @@ static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
 	/* Now enable LPS, which we need in order to start accessing
 	 * most of the registers.  In fact, on some cards (ALI M5251),
 	 * accessing registers in the SClk domain without LPS enabled
-	 * will lock up the machine.  Wait 50msec to make sure we have
-	 * full link enabled.  */
+	 * will lock up the machine. */
 	reg_write(ohci, OHCI1394_HCControlSet, OHCI1394_HCControl_LPS);
 
 	/* Disable and clear interrupts */
 	reg_write(ohci, OHCI1394_IntEventClear, 0xffffffff);
 	reg_write(ohci, OHCI1394_IntMaskClear, 0xffffffff);
 
-	mdelay(50);
+	/* Flush MMIO writes and wait to make sure we have full link enabled. */
+	reg_read(ohci, OHCI1394_Version);
+	msleep(50);
 
 	/* Determine the number of available IR and IT contexts. */
 	ohci->nb_iso_rcv_ctx =
@@ -3233,8 +3234,9 @@ static int __devinit ohci1394_pci_probe(struct pci_dev *dev,
 	 * we need to get to that "no event", so enough should be initialized
 	 * by that point.
 	 */
-	if (request_irq(dev->irq, ohci_irq_handler, IRQF_SHARED,
-			 OHCI1394_DRIVER_NAME, ohci)) {
+	err = request_irq(dev->irq, ohci_irq_handler, IRQF_SHARED,
+			  OHCI1394_DRIVER_NAME, ohci);
+	if (err) {
 		PRINT_G(KERN_ERR, "Failed to allocate interrupt %d", dev->irq);
 		goto err;
 	}
@@ -3381,6 +3383,7 @@ static int ohci1394_pci_suspend(struct pci_dev *dev, pm_message_t state)
 	ohci_devctl(ohci->host, RESET_BUS, LONG_RESET_NO_FORCE_ROOT);
 	ohci_soft_reset(ohci);
 
+	free_irq(dev->irq, ohci);
 	err = pci_save_state(dev);
 	if (err) {
 		PRINT(KERN_ERR, "pci_save_state failed with %d", err);
@@ -3420,7 +3423,16 @@ static int ohci1394_pci_resume(struct pci_dev *dev)
 	reg_write(ohci, OHCI1394_HCControlSet, OHCI1394_HCControl_LPS);
 	reg_write(ohci, OHCI1394_IntEventClear, 0xffffffff);
 	reg_write(ohci, OHCI1394_IntMaskClear, 0xffffffff);
-	mdelay(50);
+	reg_read(ohci, OHCI1394_Version);
+	msleep(50);
+
+	err = request_irq(dev->irq, ohci_irq_handler, IRQF_SHARED,
+			  OHCI1394_DRIVER_NAME, ohci);
+	if (err) {
+		PRINT_G(KERN_ERR, "Failed to allocate interrupt %d", dev->irq);
+		return err;
+	}
+
 	ohci_initialize(ohci);
 
 	hpsb_resume_host(ohci->host);
diff --git a/drivers/ieee1394/pcilynx.c b/drivers/ieee1394/pcilynx.c
index 7aee1ac97c80..dc15cadb06ef 100644
--- a/drivers/ieee1394/pcilynx.c
+++ b/drivers/ieee1394/pcilynx.c
@@ -1463,7 +1463,7 @@ static int __devinit add_card(struct pci_dev *dev,
 
                                 /* info_length, crc_length and 1394 magic number to check, if it is really a bus info block */
 				if (((be32_to_cpu(lynx->bus_info_block[0]) & 0xffff0000) == 0x04040000) &&
-				    (lynx->bus_info_block[1] == __constant_cpu_to_be32(0x31333934)))
+				    (lynx->bus_info_block[1] == IEEE1394_BUSID_MAGIC))
                                 {
                                         PRINT(KERN_DEBUG, lynx->id, "read a valid bus info block from");
                                 } else {
diff --git a/drivers/ieee1394/pcilynx.h b/drivers/ieee1394/pcilynx.h
index ec27321f6724..693a169acea3 100644
--- a/drivers/ieee1394/pcilynx.h
+++ b/drivers/ieee1394/pcilynx.h
@@ -52,7 +52,7 @@ struct ti_lynx {
         void __iomem *local_rom;
         void __iomem *local_ram;
         void __iomem *aux_port;
-	quadlet_t bus_info_block[5];
+	__be32 bus_info_block[5];
 
         /*
          * use local RAM of LOCALRAM_SIZE bytes for PCLs, which allows for
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
index bf7e761c12b1..bad66c65b0d6 100644
--- a/drivers/ieee1394/raw1394.c
+++ b/drivers/ieee1394/raw1394.c
@@ -90,7 +90,7 @@ static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
 		      u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
 		      u16 flags);
-static struct hpsb_address_ops arm_ops = {
+const static struct hpsb_address_ops arm_ops = {
 	.read = arm_read,
 	.write = arm_write,
 	.lock = arm_lock,
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index a373c18cf7b8..ab1034ccb7fb 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -265,7 +265,7 @@ static struct hpsb_highlevel sbp2_highlevel = {
 	.host_reset	= sbp2_host_reset,
 };
 
-static struct hpsb_address_ops sbp2_ops = {
+const static struct hpsb_address_ops sbp2_ops = {
 	.write		= sbp2_handle_status_write
 };
 
@@ -275,7 +275,7 @@ static int sbp2_handle_physdma_write(struct hpsb_host *, int, int, quadlet_t *,
 static int sbp2_handle_physdma_read(struct hpsb_host *, int, quadlet_t *, u64,
 				    size_t, u16);
 
-static struct hpsb_address_ops sbp2_physdma_ops = {
+const static struct hpsb_address_ops sbp2_physdma_ops = {
 	.read		= sbp2_handle_physdma_read,
 	.write		= sbp2_handle_physdma_write,
 };
diff --git a/drivers/media/dvb/Kconfig b/drivers/media/dvb/Kconfig
index 40ebde53b3ce..8a2d5f9713de 100644
--- a/drivers/media/dvb/Kconfig
+++ b/drivers/media/dvb/Kconfig
@@ -51,6 +51,8 @@ comment "Supported SDMC DM1105 Adapters"
 	depends on DVB_CORE && PCI && I2C
 source "drivers/media/dvb/dm1105/Kconfig"
 
+source "drivers/media/dvb/firesat/Kconfig"
+
 comment "Supported DVB Frontends"
 	depends on DVB_CORE
 source "drivers/media/dvb/frontends/Kconfig"
diff --git a/drivers/media/dvb/Makefile b/drivers/media/dvb/Makefile
index f91e9eb15e52..cb765816f76c 100644
--- a/drivers/media/dvb/Makefile
+++ b/drivers/media/dvb/Makefile
@@ -3,3 +3,5 @@
 #
 
 obj-y        := dvb-core/ frontends/ ttpci/ ttusb-dec/ ttusb-budget/ b2c2/ bt8xx/ dvb-usb/ pluto2/ siano/ dm1105/
+
+obj-$(CONFIG_DVB_FIREDTV)	+= firesat/
diff --git a/drivers/media/dvb/firesat/Kconfig b/drivers/media/dvb/firesat/Kconfig
new file mode 100644
index 000000000000..6aa5dce8040c
--- /dev/null
+++ b/drivers/media/dvb/firesat/Kconfig
@@ -0,0 +1,12 @@
+config DVB_FIREDTV
+	tristate "FireDTV (FireWire attached DVB receivers)"
+	depends on DVB_CORE && IEEE1394
+	help
+	  Support for DVB receivers from Digital Everywhere, known as FireDTV
+	  and FloppyDTV, which are connected via IEEE 1394 (FireWire).
+
+	  These devices don't have an MPEG decoder built in, so you need
+	  an external software decoder to watch TV.
+
+	  To compile this driver as a module, say M here: the module will be
+	  called firedtv.
diff --git a/drivers/media/dvb/firesat/Makefile b/drivers/media/dvb/firesat/Makefile
new file mode 100644
index 000000000000..9e49edc7c49d
--- /dev/null
+++ b/drivers/media/dvb/firesat/Makefile
@@ -0,0 +1,13 @@
+firedtv-objs := firesat_1394.o	\
+		firesat_dvb.o	\
+		firesat_fe.o	\
+		firesat_iso.o	\
+		avc_api.o	\
+		cmp.o		\
+		firesat-rc.o	\
+		firesat-ci.o
+
+obj-$(CONFIG_DVB_FIREDTV) += firedtv.o
+
+EXTRA_CFLAGS := -Idrivers/ieee1394
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
diff --git a/drivers/media/dvb/firesat/avc_api.c b/drivers/media/dvb/firesat/avc_api.c
new file mode 100644
index 000000000000..3a4da73f0798
--- /dev/null
+++ b/drivers/media/dvb/firesat/avc_api.c
@@ -0,0 +1,1051 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Ben Backx <ben@bbackx.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#include <linux/bug.h>
+#include <linux/crc32.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/moduleparam.h>
+#include <linux/mutex.h>
+#include <linux/string.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
+#include <ieee1394_transactions.h>
+#include <nodemgr.h>
+
+#include "avc_api.h"
+#include "firesat.h"
+#include "firesat-rc.h"
+
+#define FCP_COMMAND_REGISTER	0xfffff0000b00ULL
+
+static int __avc_write(struct firesat *firesat,
+		       const AVCCmdFrm *CmdFrm, AVCRspFrm *RspFrm)
+{
+	int err, retry;
+
+	if (RspFrm)
+		firesat->avc_reply_received = false;
+
+	for (retry = 0; retry < 6; retry++) {
+		err = hpsb_node_write(firesat->ud->ne, FCP_COMMAND_REGISTER,
+				      (quadlet_t *)CmdFrm, CmdFrm->length);
+		if (err) {
+			firesat->avc_reply_received = true;
+			dev_err(&firesat->ud->device,
+				"FCP command write failed\n");
+			return err;
+		}
+
+		if (!RspFrm)
+			return 0;
+
+		/*
+		 * AV/C specs say that answers should be sent within 150 ms.
+		 * Time out after 200 ms.
+		 */
+		if (wait_event_timeout(firesat->avc_wait,
+				       firesat->avc_reply_received,
+				       HZ / 5) != 0) {
+			memcpy(RspFrm, firesat->respfrm, firesat->resp_length);
+			RspFrm->length = firesat->resp_length;
+
+			return 0;
+		}
+	}
+	dev_err(&firesat->ud->device, "FCP response timed out\n");
+	return -ETIMEDOUT;
+}
+
+static int avc_write(struct firesat *firesat,
+		     const AVCCmdFrm *CmdFrm, AVCRspFrm *RspFrm)
+{
+	int ret;
+
+	if (mutex_lock_interruptible(&firesat->avc_mutex))
+		return -EINTR;
+
+	ret = __avc_write(firesat, CmdFrm, RspFrm);
+
+	mutex_unlock(&firesat->avc_mutex);
+	return ret;
+}
+
+int avc_recv(struct firesat *firesat, u8 *data, size_t length)
+{
+	AVCRspFrm *RspFrm = (AVCRspFrm *)data;
+
+	if (length >= 8 &&
+	    RspFrm->operand[0] == SFE_VENDOR_DE_COMPANYID_0 &&
+	    RspFrm->operand[1] == SFE_VENDOR_DE_COMPANYID_1 &&
+	    RspFrm->operand[2] == SFE_VENDOR_DE_COMPANYID_2 &&
+	    RspFrm->operand[3] == SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL) {
+		if (RspFrm->resp == CHANGED) {
+			firesat_handle_rc(firesat,
+			    RspFrm->operand[4] << 8 | RspFrm->operand[5]);
+			schedule_work(&firesat->remote_ctrl_work);
+		} else if (RspFrm->resp != INTERIM) {
+			dev_info(&firesat->ud->device,
+				 "remote control result = %d\n", RspFrm->resp);
+		}
+		return 0;
+	}
+
+	if (firesat->avc_reply_received) {
+		dev_err(&firesat->ud->device,
+			"received out-of-order AVC response, ignored\n");
+		return -EIO;
+	}
+
+	memcpy(firesat->respfrm, data, length);
+	firesat->resp_length = length;
+
+	firesat->avc_reply_received = true;
+	wake_up(&firesat->avc_wait);
+
+	return 0;
+}
+
+/*
+ * tuning command for setting the relative LNB frequency
+ * (not supported by the AVC standard)
+ */
+static void avc_tuner_tuneqpsk(struct firesat *firesat,
+		struct dvb_frontend_parameters *params, AVCCmdFrm *CmdFrm)
+{
+	CmdFrm->opcode = VENDOR;
+
+	CmdFrm->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
+
+	CmdFrm->operand[4] = (params->frequency >> 24) & 0xff;
+	CmdFrm->operand[5] = (params->frequency >> 16) & 0xff;
+	CmdFrm->operand[6] = (params->frequency >> 8) & 0xff;
+	CmdFrm->operand[7] = params->frequency & 0xff;
+
+	CmdFrm->operand[8] = ((params->u.qpsk.symbol_rate / 1000) >> 8) & 0xff;
+	CmdFrm->operand[9] = (params->u.qpsk.symbol_rate / 1000) & 0xff;
+
+	switch(params->u.qpsk.fec_inner) {
+	case FEC_1_2:
+		CmdFrm->operand[10] = 0x1; break;
+	case FEC_2_3:
+		CmdFrm->operand[10] = 0x2; break;
+	case FEC_3_4:
+		CmdFrm->operand[10] = 0x3; break;
+	case FEC_5_6:
+		CmdFrm->operand[10] = 0x4; break;
+	case FEC_7_8:
+		CmdFrm->operand[10] = 0x5; break;
+	case FEC_4_5:
+	case FEC_8_9:
+	case FEC_AUTO:
+	default:
+		CmdFrm->operand[10] = 0x0;
+	}
+
+	if (firesat->voltage == 0xff)
+		CmdFrm->operand[11] = 0xff;
+	else if (firesat->voltage == SEC_VOLTAGE_18) /* polarisation */
+		CmdFrm->operand[11] = 0;
+	else
+		CmdFrm->operand[11] = 1;
+
+	if (firesat->tone == 0xff)
+		CmdFrm->operand[12] = 0xff;
+	else if (firesat->tone == SEC_TONE_ON) /* band */
+		CmdFrm->operand[12] = 1;
+	else
+		CmdFrm->operand[12] = 0;
+
+	if (firesat->type == FireSAT_DVB_S2) {
+		CmdFrm->operand[13] = 0x1;
+		CmdFrm->operand[14] = 0xff;
+		CmdFrm->operand[15] = 0xff;
+		CmdFrm->length = 20;
+	} else {
+		CmdFrm->length = 16;
+	}
+}
+
+static void avc_tuner_dsd_dvb_c(struct dvb_frontend_parameters *params,
+		AVCCmdFrm *CmdFrm)
+{
+	M_VALID_FLAGS flags;
+
+	flags.Bits.Modulation = params->u.qam.modulation != QAM_AUTO;
+	flags.Bits.FEC_inner = params->u.qam.fec_inner != FEC_AUTO;
+	flags.Bits.FEC_outer = 0;
+	flags.Bits.Symbol_Rate = 1;
+	flags.Bits.Frequency = 1;
+	flags.Bits.Orbital_Pos = 0;
+	flags.Bits.Polarisation = 0;
+	flags.Bits.reserved_fields = 0;
+	flags.Bits.reserved1 = 0;
+	flags.Bits.Network_ID = 0;
+
+	CmdFrm->opcode	= DSD;
+
+	CmdFrm->operand[0]  = 0;    /* source plug */
+	CmdFrm->operand[1]  = 0xd2; /* subfunction replace */
+	CmdFrm->operand[2]  = 0x20; /* system id = DVB */
+	CmdFrm->operand[3]  = 0x00; /* antenna number */
+	/* system_specific_multiplex selection_length */
+	CmdFrm->operand[4]  = 0x11;
+	CmdFrm->operand[5]  = flags.Valid_Word.ByteHi; /* valid_flags [0] */
+	CmdFrm->operand[6]  = flags.Valid_Word.ByteLo; /* valid_flags [1] */
+	CmdFrm->operand[7]  = 0x00;
+	CmdFrm->operand[8]  = 0x00;
+	CmdFrm->operand[9]  = 0x00;
+	CmdFrm->operand[10] = 0x00;
+
+	CmdFrm->operand[11] =
+		(((params->frequency / 4000) >> 16) & 0xff) | (2 << 6);
+	CmdFrm->operand[12] =
+		((params->frequency / 4000) >> 8) & 0xff;
+	CmdFrm->operand[13] = (params->frequency / 4000) & 0xff;
+	CmdFrm->operand[14] =
+		((params->u.qpsk.symbol_rate / 1000) >> 12) & 0xff;
+	CmdFrm->operand[15] =
+		((params->u.qpsk.symbol_rate / 1000) >> 4) & 0xff;
+	CmdFrm->operand[16] =
+		((params->u.qpsk.symbol_rate / 1000) << 4) & 0xf0;
+	CmdFrm->operand[17] = 0x00;
+
+	switch (params->u.qpsk.fec_inner) {
+	case FEC_1_2:
+		CmdFrm->operand[18] = 0x1; break;
+	case FEC_2_3:
+		CmdFrm->operand[18] = 0x2; break;
+	case FEC_3_4:
+		CmdFrm->operand[18] = 0x3; break;
+	case FEC_5_6:
+		CmdFrm->operand[18] = 0x4; break;
+	case FEC_7_8:
+		CmdFrm->operand[18] = 0x5; break;
+	case FEC_8_9:
+		CmdFrm->operand[18] = 0x6; break;
+	case FEC_4_5:
+		CmdFrm->operand[18] = 0x8; break;
+	case FEC_AUTO:
+	default:
+		CmdFrm->operand[18] = 0x0;
+	}
+	switch (params->u.qam.modulation) {
+	case QAM_16:
+		CmdFrm->operand[19] = 0x08; break;
+	case QAM_32:
+		CmdFrm->operand[19] = 0x10; break;
+	case QAM_64:
+		CmdFrm->operand[19] = 0x18; break;
+	case QAM_128:
+		CmdFrm->operand[19] = 0x20; break;
+	case QAM_256:
+		CmdFrm->operand[19] = 0x28; break;
+	case QAM_AUTO:
+	default:
+		CmdFrm->operand[19] = 0x00;
+	}
+	CmdFrm->operand[20] = 0x00;
+	CmdFrm->operand[21] = 0x00;
+	/* Nr_of_dsd_sel_specs = 0 -> no PIDs are transmitted */
+	CmdFrm->operand[22] = 0x00;
+
+	CmdFrm->length = 28;
+}
+
+static void avc_tuner_dsd_dvb_t(struct dvb_frontend_parameters *params,
+		AVCCmdFrm *CmdFrm)
+{
+	M_VALID_FLAGS flags;
+
+	flags.Bits_T.GuardInterval =
+		params->u.ofdm.guard_interval != GUARD_INTERVAL_AUTO;
+	flags.Bits_T.CodeRateLPStream =
+		params->u.ofdm.code_rate_LP != FEC_AUTO;
+	flags.Bits_T.CodeRateHPStream =
+		params->u.ofdm.code_rate_HP != FEC_AUTO;
+	flags.Bits_T.HierarchyInfo =
+		params->u.ofdm.hierarchy_information != HIERARCHY_AUTO;
+	flags.Bits_T.Constellation =
+		params->u.ofdm.constellation != QAM_AUTO;
+	flags.Bits_T.Bandwidth =
+		params->u.ofdm.bandwidth != BANDWIDTH_AUTO;
+	flags.Bits_T.CenterFrequency = 1;
+	flags.Bits_T.reserved1 = 0;
+	flags.Bits_T.reserved2 = 0;
+	flags.Bits_T.OtherFrequencyFlag = 0;
+	flags.Bits_T.TransmissionMode =
+		params->u.ofdm.transmission_mode != TRANSMISSION_MODE_AUTO;
+	flags.Bits_T.NetworkId = 0;
+
+	CmdFrm->opcode	= DSD;
+
+	CmdFrm->operand[0]  = 0;    /* source plug */
+	CmdFrm->operand[1]  = 0xd2; /* subfunction replace */
+	CmdFrm->operand[2]  = 0x20; /* system id = DVB */
+	CmdFrm->operand[3]  = 0x00; /* antenna number */
+	/* system_specific_multiplex selection_length */
+	CmdFrm->operand[4]  = 0x0c;
+	CmdFrm->operand[5]  = flags.Valid_Word.ByteHi; /* valid_flags [0] */
+	CmdFrm->operand[6]  = flags.Valid_Word.ByteLo; /* valid_flags [1] */
+	CmdFrm->operand[7]  = 0x0;
+	CmdFrm->operand[8]  = (params->frequency / 10) >> 24;
+	CmdFrm->operand[9]  = ((params->frequency / 10) >> 16) & 0xff;
+	CmdFrm->operand[10] = ((params->frequency / 10) >>  8) & 0xff;
+	CmdFrm->operand[11] = (params->frequency / 10) & 0xff;
+
+	switch (params->u.ofdm.bandwidth) {
+	case BANDWIDTH_7_MHZ:
+		CmdFrm->operand[12] = 0x20; break;
+	case BANDWIDTH_8_MHZ:
+	case BANDWIDTH_6_MHZ: /* not defined by AVC spec */
+	case BANDWIDTH_AUTO:
+	default:
+		CmdFrm->operand[12] = 0x00;
+	}
+	switch (params->u.ofdm.constellation) {
+	case QAM_16:
+		CmdFrm->operand[13] = 1 << 6; break;
+	case QAM_64:
+		CmdFrm->operand[13] = 2 << 6; break;
+	case QPSK:
+	default:
+		CmdFrm->operand[13] = 0x00;
+	}
+	switch (params->u.ofdm.hierarchy_information) {
+	case HIERARCHY_1:
+		CmdFrm->operand[13] |= 1 << 3; break;
+	case HIERARCHY_2:
+		CmdFrm->operand[13] |= 2 << 3; break;
+	case HIERARCHY_4:
+		CmdFrm->operand[13] |= 3 << 3; break;
+	case HIERARCHY_AUTO:
+	case HIERARCHY_NONE:
+	default:
+		break;
+	}
+	switch (params->u.ofdm.code_rate_HP) {
+	case FEC_2_3:
+		CmdFrm->operand[13] |= 1; break;
+	case FEC_3_4:
+		CmdFrm->operand[13] |= 2; break;
+	case FEC_5_6:
+		CmdFrm->operand[13] |= 3; break;
+	case FEC_7_8:
+		CmdFrm->operand[13] |= 4; break;
+	case FEC_1_2:
+	default:
+		break;
+	}
+	switch (params->u.ofdm.code_rate_LP) {
+	case FEC_2_3:
+		CmdFrm->operand[14] = 1 << 5; break;
+	case FEC_3_4:
+		CmdFrm->operand[14] = 2 << 5; break;
+	case FEC_5_6:
+		CmdFrm->operand[14] = 3 << 5; break;
+	case FEC_7_8:
+		CmdFrm->operand[14] = 4 << 5; break;
+	case FEC_1_2:
+	default:
+		CmdFrm->operand[14] = 0x00; break;
+	}
+	switch (params->u.ofdm.guard_interval) {
+	case GUARD_INTERVAL_1_16:
+		CmdFrm->operand[14] |= 1 << 3; break;
+	case GUARD_INTERVAL_1_8:
+		CmdFrm->operand[14] |= 2 << 3; break;
+	case GUARD_INTERVAL_1_4:
+		CmdFrm->operand[14] |= 3 << 3; break;
+	case GUARD_INTERVAL_1_32:
+	case GUARD_INTERVAL_AUTO:
+	default:
+		break;
+	}
+	switch (params->u.ofdm.transmission_mode) {
+	case TRANSMISSION_MODE_8K:
+		CmdFrm->operand[14] |= 1 << 1; break;
+	case TRANSMISSION_MODE_2K:
+	case TRANSMISSION_MODE_AUTO:
+	default:
+		break;
+	}
+
+	CmdFrm->operand[15] = 0x00; /* network_ID[0] */
+	CmdFrm->operand[16] = 0x00; /* network_ID[1] */
+	/* Nr_of_dsd_sel_specs = 0 -> no PIDs are transmitted */
+	CmdFrm->operand[17] = 0x00;
+
+	CmdFrm->length = 24;
+}
+
+int avc_tuner_dsd(struct firesat *firesat,
+		  struct dvb_frontend_parameters *params)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+
+	CmdFrm.cts	= AVC;
+	CmdFrm.ctype	= CONTROL;
+	CmdFrm.sutyp	= 0x5;
+	CmdFrm.suid	= firesat->subunit;
+
+	switch (firesat->type) {
+	case FireSAT_DVB_S:
+	case FireSAT_DVB_S2:
+		avc_tuner_tuneqpsk(firesat, params, &CmdFrm); break;
+	case FireSAT_DVB_C:
+		avc_tuner_dsd_dvb_c(params, &CmdFrm); break;
+	case FireSAT_DVB_T:
+		avc_tuner_dsd_dvb_t(params, &CmdFrm); break;
+	default:
+		BUG();
+	}
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	msleep(500);
+#if 0
+	/* FIXME: */
+	/* u8 *status was an out-parameter of avc_tuner_dsd, unused by caller */
+	if(status)
+		*status=RspFrm.operand[2];
+#endif
+	return 0;
+}
+
+int avc_tuner_set_pids(struct firesat *firesat, unsigned char pidc, u16 pid[])
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+	int pos, k;
+
+	if (pidc > 16 && pidc != 0xff)
+		return -EINVAL;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+
+	CmdFrm.cts	= AVC;
+	CmdFrm.ctype	= CONTROL;
+	CmdFrm.sutyp	= 0x5;
+	CmdFrm.suid	= firesat->subunit;
+	CmdFrm.opcode	= DSD;
+
+	CmdFrm.operand[0]  = 0; // source plug
+	CmdFrm.operand[1]  = 0xD2; // subfunction replace
+	CmdFrm.operand[2]  = 0x20; // system id = DVB
+	CmdFrm.operand[3]  = 0x00; // antenna number
+	CmdFrm.operand[4]  = 0x00; // system_specific_multiplex selection_length
+	CmdFrm.operand[5]  = pidc; // Nr_of_dsd_sel_specs
+
+	pos = 6;
+	if (pidc != 0xff)
+		for (k = 0; k < pidc; k++) {
+			CmdFrm.operand[pos++] = 0x13; // flowfunction relay
+			CmdFrm.operand[pos++] = 0x80; // dsd_sel_spec_valid_flags -> PID
+			CmdFrm.operand[pos++] = (pid[k] >> 8) & 0x1F;
+			CmdFrm.operand[pos++] = pid[k] & 0xFF;
+			CmdFrm.operand[pos++] = 0x00; // tableID
+			CmdFrm.operand[pos++] = 0x00; // filter_length
+		}
+
+	CmdFrm.length = ALIGN(3 + pos, 4);
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	msleep(50);
+	return 0;
+}
+
+int avc_tuner_get_ts(struct firesat *firesat)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+
+	CmdFrm.cts		= AVC;
+	CmdFrm.ctype	= CONTROL;
+	CmdFrm.sutyp	= 0x5;
+	CmdFrm.suid		= firesat->subunit;
+	CmdFrm.opcode	= DSIT;
+
+	CmdFrm.operand[0]  = 0; // source plug
+	CmdFrm.operand[1]  = 0xD2; // subfunction replace
+	CmdFrm.operand[2]  = 0xFF; //status
+	CmdFrm.operand[3]  = 0x20; // system id = DVB
+	CmdFrm.operand[4]  = 0x00; // antenna number
+	CmdFrm.operand[5]  = 0x0;  // system_specific_search_flags
+	CmdFrm.operand[6]  = (firesat->type == FireSAT_DVB_T)?0x0c:0x11; // system_specific_multiplex selection_length
+	CmdFrm.operand[7]  = 0x00; // valid_flags [0]
+	CmdFrm.operand[8]  = 0x00; // valid_flags [1]
+	CmdFrm.operand[7 + (firesat->type == FireSAT_DVB_T)?0x0c:0x11] = 0x00; // nr_of_dsit_sel_specs (always 0)
+
+	CmdFrm.length = (firesat->type == FireSAT_DVB_T)?24:28;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	msleep(250);
+	return 0;
+}
+
+int avc_identify_subunit(struct firesat *firesat)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+
+	memset(&CmdFrm,0,sizeof(AVCCmdFrm));
+
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = CONTROL;
+	CmdFrm.sutyp = 0x5; // tuner
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = READ_DESCRIPTOR;
+
+	CmdFrm.operand[0]=DESCRIPTOR_SUBUNIT_IDENTIFIER;
+	CmdFrm.operand[1]=0xff;
+	CmdFrm.operand[2]=0x00;
+	CmdFrm.operand[3]=0x00; // length highbyte
+	CmdFrm.operand[4]=0x08; // length lowbyte
+	CmdFrm.operand[5]=0x00; // offset highbyte
+	CmdFrm.operand[6]=0x0d; // offset lowbyte
+
+	CmdFrm.length=12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	if ((RspFrm.resp != STABLE && RspFrm.resp != ACCEPTED) ||
+	    (RspFrm.operand[3] << 8) + RspFrm.operand[4] != 8) {
+		dev_err(&firesat->ud->device,
+			"cannot read subunit identifier\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int avc_tuner_status(struct firesat *firesat,
+		     ANTENNA_INPUT_INFO *antenna_input_info)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+	int length;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+
+	CmdFrm.cts=AVC;
+	CmdFrm.ctype=CONTROL;
+	CmdFrm.sutyp=0x05; // tuner
+	CmdFrm.suid=firesat->subunit;
+	CmdFrm.opcode=READ_DESCRIPTOR;
+
+	CmdFrm.operand[0]=DESCRIPTOR_TUNER_STATUS;
+	CmdFrm.operand[1]=0xff; //read_result_status
+	CmdFrm.operand[2]=0x00; // reserver
+	CmdFrm.operand[3]=0;//sizeof(ANTENNA_INPUT_INFO) >> 8;
+	CmdFrm.operand[4]=0;//sizeof(ANTENNA_INPUT_INFO) & 0xFF;
+	CmdFrm.operand[5]=0x00;
+	CmdFrm.operand[6]=0x00;
+	CmdFrm.length=12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	if (RspFrm.resp != STABLE && RspFrm.resp != ACCEPTED) {
+		dev_err(&firesat->ud->device, "cannot read tuner status\n");
+		return -EINVAL;
+	}
+
+	length = RspFrm.operand[9];
+	if (RspFrm.operand[1] != 0x10 || length != sizeof(ANTENNA_INPUT_INFO)) {
+		dev_err(&firesat->ud->device, "got invalid tuner status\n");
+		return -EINVAL;
+	}
+
+	memcpy(antenna_input_info, &RspFrm.operand[10], length);
+	return 0;
+}
+
+int avc_lnb_control(struct firesat *firesat, char voltage, char burst,
+		    char conttone, char nrdiseq,
+		    struct dvb_diseqc_master_cmd *diseqcmd)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+	int i, j, k;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+
+	CmdFrm.cts=AVC;
+	CmdFrm.ctype=CONTROL;
+	CmdFrm.sutyp=0x05;
+	CmdFrm.suid=firesat->subunit;
+	CmdFrm.opcode=VENDOR;
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_LNB_CONTROL;
+
+	CmdFrm.operand[4]=voltage;
+	CmdFrm.operand[5]=nrdiseq;
+
+	i=6;
+
+	for (j = 0; j < nrdiseq; j++) {
+		CmdFrm.operand[i++] = diseqcmd[j].msg_len;
+
+		for (k = 0; k < diseqcmd[j].msg_len; k++)
+			CmdFrm.operand[i++] = diseqcmd[j].msg[k];
+	}
+
+	CmdFrm.operand[i++]=burst;
+	CmdFrm.operand[i++]=conttone;
+
+	CmdFrm.length = ALIGN(3 + i, 4);
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	if (RspFrm.resp != ACCEPTED) {
+		dev_err(&firesat->ud->device, "LNB control failed\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int avc_register_remote_control(struct firesat *firesat)
+{
+	AVCCmdFrm CmdFrm;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = NOTIFY;
+	CmdFrm.sutyp = 0x1f;
+	CmdFrm.suid = 0x7;
+	CmdFrm.opcode = VENDOR;
+
+	CmdFrm.operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3] = SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL;
+
+	CmdFrm.length = 8;
+
+	return avc_write(firesat, &CmdFrm, NULL);
+}
+
+void avc_remote_ctrl_work(struct work_struct *work)
+{
+	struct firesat *firesat =
+			container_of(work, struct firesat, remote_ctrl_work);
+
+	/* Should it be rescheduled in failure cases? */
+	avc_register_remote_control(firesat);
+}
+
+#if 0 /* FIXME: unused */
+int avc_tuner_host2ca(struct firesat *firesat)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = CONTROL;
+	CmdFrm.sutyp = 0x5;
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = VENDOR;
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_HOST2CA;
+	CmdFrm.operand[4] = 0; // slot
+	CmdFrm.operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; // ca tag
+	CmdFrm.operand[6] = 0; // more/last
+	CmdFrm.operand[7] = 0; // length
+	CmdFrm.length = 12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	return 0;
+}
+#endif
+
+static int get_ca_object_pos(AVCRspFrm *RspFrm)
+{
+	int length = 1;
+
+	/* Check length of length field */
+	if (RspFrm->operand[7] & 0x80)
+		length = (RspFrm->operand[7] & 0x7f) + 1;
+	return length + 7;
+}
+
+static int get_ca_object_length(AVCRspFrm *RspFrm)
+{
+#if 0 /* FIXME: unused */
+	int size = 0;
+	int i;
+
+	if (RspFrm->operand[7] & 0x80)
+		for (i = 0; i < (RspFrm->operand[7] & 0x7f); i++) {
+			size <<= 8;
+			size += RspFrm->operand[8 + i];
+		}
+#endif
+	return RspFrm->operand[7];
+}
+
+int avc_ca_app_info(struct firesat *firesat, char *app_info, unsigned int *len)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+	int pos;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = STATUS;
+	CmdFrm.sutyp = 0x5;
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = VENDOR;
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_CA2HOST;
+	CmdFrm.operand[4] = 0; // slot
+	CmdFrm.operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; // ca tag
+	CmdFrm.length = 12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	/* FIXME: check response code and validate response data */
+
+	pos = get_ca_object_pos(&RspFrm);
+	app_info[0] = (TAG_APP_INFO >> 16) & 0xFF;
+	app_info[1] = (TAG_APP_INFO >> 8) & 0xFF;
+	app_info[2] = (TAG_APP_INFO >> 0) & 0xFF;
+	app_info[3] = 6 + RspFrm.operand[pos + 4];
+	app_info[4] = 0x01;
+	memcpy(&app_info[5], &RspFrm.operand[pos], 5 + RspFrm.operand[pos + 4]);
+	*len = app_info[3] + 4;
+
+	return 0;
+}
+
+int avc_ca_info(struct firesat *firesat, char *app_info, unsigned int *len)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+	int pos;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = STATUS;
+	CmdFrm.sutyp = 0x5;
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = VENDOR;
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_CA2HOST;
+	CmdFrm.operand[4] = 0; // slot
+	CmdFrm.operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; // ca tag
+	CmdFrm.length = 12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	pos = get_ca_object_pos(&RspFrm);
+	app_info[0] = (TAG_CA_INFO >> 16) & 0xFF;
+	app_info[1] = (TAG_CA_INFO >> 8) & 0xFF;
+	app_info[2] = (TAG_CA_INFO >> 0) & 0xFF;
+	app_info[3] = 2;
+	app_info[4] = RspFrm.operand[pos + 0];
+	app_info[5] = RspFrm.operand[pos + 1];
+	*len = app_info[3] + 4;
+
+	return 0;
+}
+
+int avc_ca_reset(struct firesat *firesat)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = CONTROL;
+	CmdFrm.sutyp = 0x5;
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = VENDOR;
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_HOST2CA;
+	CmdFrm.operand[4] = 0; // slot
+	CmdFrm.operand[5] = SFE_VENDOR_TAG_CA_RESET; // ca tag
+	CmdFrm.operand[6] = 0; // more/last
+	CmdFrm.operand[7] = 1; // length
+	CmdFrm.operand[8] = 0; // force hardware reset
+	CmdFrm.length = 12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	return 0;
+}
+
+int avc_ca_pmt(struct firesat *firesat, char *msg, int length)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+	int list_management;
+	int program_info_length;
+	int pmt_cmd_id;
+	int read_pos;
+	int write_pos;
+	int es_info_length;
+	int crc32_csum;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = CONTROL;
+	CmdFrm.sutyp = 0x5;
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = VENDOR;
+
+	if (msg[0] != LIST_MANAGEMENT_ONLY) {
+		dev_info(&firesat->ud->device,
+			 "forcing list_management to ONLY\n");
+		msg[0] = LIST_MANAGEMENT_ONLY;
+	}
+	// We take the cmd_id from the programme level only!
+	list_management = msg[0];
+	program_info_length = ((msg[4] & 0x0F) << 8) + msg[5];
+	if (program_info_length > 0)
+		program_info_length--; // Remove pmt_cmd_id
+	pmt_cmd_id = msg[6];
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_HOST2CA;
+	CmdFrm.operand[4] = 0; // slot
+	CmdFrm.operand[5] = SFE_VENDOR_TAG_CA_PMT; // ca tag
+	CmdFrm.operand[6] = 0; // more/last
+	//CmdFrm.operand[7] = XXXprogram_info_length + 17; // length
+	CmdFrm.operand[8] = list_management;
+	CmdFrm.operand[9] = 0x01; // pmt_cmd=OK_descramble
+
+	// TS program map table
+
+	// Table id=2
+	CmdFrm.operand[10] = 0x02;
+	// Section syntax + length
+	CmdFrm.operand[11] = 0x80;
+	//CmdFrm.operand[12] = XXXprogram_info_length + 12;
+	// Program number
+	CmdFrm.operand[13] = msg[1];
+	CmdFrm.operand[14] = msg[2];
+	// Version number=0 + current/next=1
+	CmdFrm.operand[15] = 0x01;
+	// Section number=0
+	CmdFrm.operand[16] = 0x00;
+	// Last section number=0
+	CmdFrm.operand[17] = 0x00;
+	// PCR_PID=1FFF
+	CmdFrm.operand[18] = 0x1F;
+	CmdFrm.operand[19] = 0xFF;
+	// Program info length
+	CmdFrm.operand[20] = (program_info_length >> 8);
+	CmdFrm.operand[21] = (program_info_length & 0xFF);
+	// CA descriptors at programme level
+	read_pos = 6;
+	write_pos = 22;
+	if (program_info_length > 0) {
+		pmt_cmd_id = msg[read_pos++];
+		if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+			dev_err(&firesat->ud->device,
+				"invalid pmt_cmd_id %d\n", pmt_cmd_id);
+
+		memcpy(&CmdFrm.operand[write_pos], &msg[read_pos],
+		       program_info_length);
+		read_pos += program_info_length;
+		write_pos += program_info_length;
+	}
+	while (read_pos < length) {
+		CmdFrm.operand[write_pos++] = msg[read_pos++];
+		CmdFrm.operand[write_pos++] = msg[read_pos++];
+		CmdFrm.operand[write_pos++] = msg[read_pos++];
+		es_info_length =
+			((msg[read_pos] & 0x0F) << 8) + msg[read_pos + 1];
+		read_pos += 2;
+		if (es_info_length > 0)
+			es_info_length--; // Remove pmt_cmd_id
+		CmdFrm.operand[write_pos++] = es_info_length >> 8;
+		CmdFrm.operand[write_pos++] = es_info_length & 0xFF;
+		if (es_info_length > 0) {
+			pmt_cmd_id = msg[read_pos++];
+			if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+				dev_err(&firesat->ud->device,
+					"invalid pmt_cmd_id %d "
+					"at stream level\n", pmt_cmd_id);
+
+			memcpy(&CmdFrm.operand[write_pos], &msg[read_pos],
+			       es_info_length);
+			read_pos += es_info_length;
+			write_pos += es_info_length;
+		}
+	}
+
+	// CRC
+	CmdFrm.operand[write_pos++] = 0x00;
+	CmdFrm.operand[write_pos++] = 0x00;
+	CmdFrm.operand[write_pos++] = 0x00;
+	CmdFrm.operand[write_pos++] = 0x00;
+
+	CmdFrm.operand[7] = write_pos - 8;
+	CmdFrm.operand[12] = write_pos - 13;
+
+	crc32_csum = crc32_be(0, &CmdFrm.operand[10],
+			   CmdFrm.operand[12] - 1);
+	CmdFrm.operand[write_pos - 4] = (crc32_csum >> 24) & 0xFF;
+	CmdFrm.operand[write_pos - 3] = (crc32_csum >> 16) & 0xFF;
+	CmdFrm.operand[write_pos - 2] = (crc32_csum >>  8) & 0xFF;
+	CmdFrm.operand[write_pos - 1] = (crc32_csum >>  0) & 0xFF;
+
+	CmdFrm.length = ALIGN(3 + write_pos, 4);
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	if (RspFrm.resp != ACCEPTED) {
+		dev_err(&firesat->ud->device,
+			"CA PMT failed with response 0x%x\n", RspFrm.resp);
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+int avc_ca_get_time_date(struct firesat *firesat, int *interval)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = STATUS;
+	CmdFrm.sutyp = 0x5;
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = VENDOR;
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_CA2HOST;
+	CmdFrm.operand[4] = 0; // slot
+	CmdFrm.operand[5] = SFE_VENDOR_TAG_CA_DATE_TIME; // ca tag
+	CmdFrm.operand[6] = 0; // more/last
+	CmdFrm.operand[7] = 0; // length
+	CmdFrm.length = 12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	/* FIXME: check response code and validate response data */
+
+	*interval = RspFrm.operand[get_ca_object_pos(&RspFrm)];
+
+	return 0;
+}
+
+int avc_ca_enter_menu(struct firesat *firesat)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = STATUS;
+	CmdFrm.sutyp = 0x5;
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = VENDOR;
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_HOST2CA;
+	CmdFrm.operand[4] = 0; // slot
+	CmdFrm.operand[5] = SFE_VENDOR_TAG_CA_ENTER_MENU;
+	CmdFrm.operand[6] = 0; // more/last
+	CmdFrm.operand[7] = 0; // length
+	CmdFrm.length = 12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	return 0;
+}
+
+int avc_ca_get_mmi(struct firesat *firesat, char *mmi_object, unsigned int *len)
+{
+	AVCCmdFrm CmdFrm;
+	AVCRspFrm RspFrm;
+
+	memset(&CmdFrm, 0, sizeof(AVCCmdFrm));
+	CmdFrm.cts = AVC;
+	CmdFrm.ctype = STATUS;
+	CmdFrm.sutyp = 0x5;
+	CmdFrm.suid = firesat->subunit;
+	CmdFrm.opcode = VENDOR;
+
+	CmdFrm.operand[0]=SFE_VENDOR_DE_COMPANYID_0;
+	CmdFrm.operand[1]=SFE_VENDOR_DE_COMPANYID_1;
+	CmdFrm.operand[2]=SFE_VENDOR_DE_COMPANYID_2;
+	CmdFrm.operand[3]=SFE_VENDOR_OPCODE_CA2HOST;
+	CmdFrm.operand[4] = 0; // slot
+	CmdFrm.operand[5] = SFE_VENDOR_TAG_CA_MMI;
+	CmdFrm.operand[6] = 0; // more/last
+	CmdFrm.operand[7] = 0; // length
+	CmdFrm.length = 12;
+
+	if (avc_write(firesat, &CmdFrm, &RspFrm) < 0)
+		return -EIO;
+
+	/* FIXME: check response code and validate response data */
+
+	*len = get_ca_object_length(&RspFrm);
+	memcpy(mmi_object, &RspFrm.operand[get_ca_object_pos(&RspFrm)], *len);
+
+	return 0;
+}
diff --git a/drivers/media/dvb/firesat/avc_api.h b/drivers/media/dvb/firesat/avc_api.h
new file mode 100644
index 000000000000..9d2efd8ff17b
--- /dev/null
+++ b/drivers/media/dvb/firesat/avc_api.h
@@ -0,0 +1,432 @@
+/*
+ * AV/C API
+ *
+ * Copyright (C) 2000 Manfred Weihs
+ * Copyright (C) 2003 Philipp Gutgsell <0014guph@edu.fh-kaernten.ac.at>
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Ben Backx <ben@bbackx.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ * This is based on code written by Peter Halwachs, Thomas Groiss and
+ * Andreas Monitzer.
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#ifndef _AVC_API_H
+#define _AVC_API_H
+
+#include <linux/types.h>
+
+/*************************************************************
+	Constants from EN510221
+**************************************************************/
+#define LIST_MANAGEMENT_ONLY 0x03
+
+/************************************************************
+	definition of structures
+*************************************************************/
+typedef struct {
+	   int           Nr_SourcePlugs;
+	   int 	         Nr_DestinationPlugs;
+} TunerInfo;
+
+
+/***********************************************
+
+         supported cts
+
+************************************************/
+
+#define AVC  0x0
+
+// FCP command frame with ctype = 0x0 is AVC command frame
+
+#ifdef __LITTLE_ENDIAN
+
+// Definition FCP Command Frame
+typedef struct _AVCCmdFrm
+{
+		// AV/C command frame
+	__u8 ctype  : 4 ;   // command type
+	__u8 cts    : 4 ;   // always 0x0 for AVC
+	__u8 suid   : 3 ;   // subunit ID
+	__u8 sutyp  : 5 ;   // subunit_typ
+	__u8 opcode : 8 ;   // opcode
+	__u8 operand[509] ; // array of operands [1-507]
+	int length;         //length of the command frame
+} AVCCmdFrm ;
+
+// Definition FCP Response Frame
+typedef struct _AVCRspFrm
+{
+        // AV/C response frame
+	__u8 resp		: 4 ;   // response type
+	__u8 cts		: 4 ;   // always 0x0 for AVC
+	__u8 suid		: 3 ;   // subunit ID
+	__u8 sutyp	: 5 ;   // subunit_typ
+	__u8 opcode	: 8 ;   // opcode
+	__u8 operand[509] ; // array of operands [1-507]
+	int length;         //length of the response frame
+} AVCRspFrm ;
+
+#else
+
+typedef struct _AVCCmdFrm
+{
+	__u8 cts:4;
+	__u8 ctype:4;
+	__u8 sutyp:5;
+	__u8 suid:3;
+	__u8 opcode;
+	__u8 operand[509];
+	int length;
+} AVCCmdFrm;
+
+typedef struct _AVCRspFrm
+{
+	__u8 cts:4;
+	__u8 resp:4;
+	__u8 sutyp:5;
+	__u8 suid:3;
+	__u8 opcode;
+	__u8 operand[509];
+	int length;
+} AVCRspFrm;
+
+#endif
+
+/*************************************************************
+	AVC command types (ctype)
+**************************************************************///
+#define CONTROL    0x00
+#define STATUS     0x01
+#define INQUIRY    0x02
+#define NOTIFY     0x03
+
+/*************************************************************
+	AVC respond types
+**************************************************************///
+#define NOT_IMPLEMENTED 0x8
+#define ACCEPTED        0x9
+#define REJECTED        0xA
+#define STABLE          0xC
+#define CHANGED         0xD
+#define INTERIM         0xF
+
+/*************************************************************
+	AVC opcodes
+**************************************************************///
+#define CONNECT			0x24
+#define DISCONNECT		0x25
+#define UNIT_INFO		0x30
+#define SUBUNIT_Info		0x31
+#define VENDOR			0x00
+
+#define PLUG_INFO		0x02
+#define OPEN_DESCRIPTOR		0x08
+#define READ_DESCRIPTOR		0x09
+#define OBJECT_NUMBER_SELECT	0x0D
+
+/*************************************************************
+	AVCTuner opcodes
+**************************************************************/
+
+#define DSIT				0xC8
+#define DSD				0xCB
+#define DESCRIPTOR_TUNER_STATUS 	0x80
+#define DESCRIPTOR_SUBUNIT_IDENTIFIER	0x00
+
+/*************************************************************
+	AVCTuner list types
+**************************************************************/
+#define Multiplex_List   0x80
+#define Service_List     0x82
+
+/*************************************************************
+	AVCTuner object entries
+**************************************************************/
+#define Multiplex	 			0x80
+#define Service 	 			0x82
+#define Service_with_specified_components	0x83
+#define Preferred_components			0x90
+#define Component				0x84
+
+/*************************************************************
+	Vendor-specific commands
+**************************************************************/
+
+// digital everywhere vendor ID
+#define SFE_VENDOR_DE_COMPANYID_0			0x00
+#define SFE_VENDOR_DE_COMPANYID_1			0x12
+#define SFE_VENDOR_DE_COMPANYID_2			0x87
+
+#define SFE_VENDOR_MAX_NR_COMPONENTS		0x4
+#define SFE_VENDOR_MAX_NR_SERVICES			0x3
+#define SFE_VENDOR_MAX_NR_DSD_ELEMENTS		0x10
+
+// vendor commands
+#define SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL	0x0A
+#define SFE_VENDOR_OPCODE_LNB_CONTROL		0x52
+#define SFE_VENDOR_OPCODE_TUNE_QPSK			0x58	// QPSK command for DVB-S
+
+// TODO: following vendor specific commands needs to be implemented
+#define SFE_VENDOR_OPCODE_GET_FIRMWARE_VERSION	0x00
+#define SFE_VENDOR_OPCODE_HOST2CA				0x56
+#define SFE_VENDOR_OPCODE_CA2HOST				0x57
+#define SFE_VENDOR_OPCODE_CISTATUS				0x59
+#define SFE_VENDOR_OPCODE_TUNE_QPSK2			0x60 // QPSK command for DVB-S2 devices
+
+// CA Tags
+#define SFE_VENDOR_TAG_CA_RESET			0x00
+#define SFE_VENDOR_TAG_CA_APPLICATION_INFO	0x01
+#define SFE_VENDOR_TAG_CA_PMT			0x02
+#define SFE_VENDOR_TAG_CA_DATE_TIME		0x04
+#define SFE_VENDOR_TAG_CA_MMI			0x05
+#define SFE_VENDOR_TAG_CA_ENTER_MENU		0x07
+
+
+//AVCTuner DVB identifier service_ID
+#define DVB 0x20
+
+/*************************************************************
+						AVC descriptor types
+**************************************************************/
+
+#define Subunit_Identifier_Descriptor		 0x00
+#define Tuner_Status_Descriptor				 0x80
+
+typedef struct {
+	__u8          Subunit_Type;
+	__u8          Max_Subunit_ID;
+} SUBUNIT_INFO;
+
+/*************************************************************
+
+		AVCTuner DVB object IDs are 6 byte long
+
+**************************************************************/
+
+typedef struct {
+	__u8  Byte0;
+	__u8  Byte1;
+	__u8  Byte2;
+	__u8  Byte3;
+	__u8  Byte4;
+	__u8  Byte5;
+}OBJECT_ID;
+
+/*************************************************************
+						MULIPLEX Structs
+**************************************************************/
+typedef struct
+{
+#ifdef __LITTLE_ENDIAN
+	__u8       RF_frequency_hByte:6;
+	__u8       raster_Frequency:2;//Bit7,6 raster frequency
+#else
+	__u8 raster_Frequency:2;
+	__u8 RF_frequency_hByte:6;
+#endif
+	__u8       RF_frequency_mByte;
+	__u8       RF_frequency_lByte;
+
+}FREQUENCY;
+
+#ifdef __LITTLE_ENDIAN
+
+typedef struct
+{
+		 __u8        Modulation	    :1;
+		 __u8        FEC_inner	    :1;
+		 __u8        FEC_outer	    :1;
+		 __u8        Symbol_Rate    :1;
+		 __u8        Frequency	    :1;
+		 __u8        Orbital_Pos	:1;
+		 __u8        Polarisation	:1;
+		 __u8        reserved_fields :1;
+		 __u8        reserved1		:7;
+		 __u8        Network_ID	:1;
+
+}MULTIPLEX_VALID_FLAGS;
+
+typedef struct
+{
+	__u8	GuardInterval:1;
+	__u8	CodeRateLPStream:1;
+	__u8	CodeRateHPStream:1;
+	__u8	HierarchyInfo:1;
+	__u8	Constellation:1;
+	__u8	Bandwidth:1;
+	__u8	CenterFrequency:1;
+	__u8	reserved1:1;
+	__u8	reserved2:5;
+	__u8	OtherFrequencyFlag:1;
+	__u8	TransmissionMode:1;
+	__u8	NetworkId:1;
+}MULTIPLEX_VALID_FLAGS_DVBT;
+
+#else
+
+typedef struct {
+	__u8 reserved_fields:1;
+	__u8 Polarisation:1;
+	__u8 Orbital_Pos:1;
+	__u8 Frequency:1;
+	__u8 Symbol_Rate:1;
+	__u8 FEC_outer:1;
+	__u8 FEC_inner:1;
+	__u8 Modulation:1;
+	__u8 Network_ID:1;
+	__u8 reserved1:7;
+}MULTIPLEX_VALID_FLAGS;
+
+typedef struct {
+	__u8 reserved1:1;
+	__u8 CenterFrequency:1;
+	__u8 Bandwidth:1;
+	__u8 Constellation:1;
+	__u8 HierarchyInfo:1;
+	__u8 CodeRateHPStream:1;
+	__u8 CodeRateLPStream:1;
+	__u8 GuardInterval:1;
+	__u8 NetworkId:1;
+	__u8 TransmissionMode:1;
+	__u8 OtherFrequencyFlag:1;
+	__u8 reserved2:5;
+}MULTIPLEX_VALID_FLAGS_DVBT;
+
+#endif
+
+typedef union {
+	MULTIPLEX_VALID_FLAGS Bits;
+	MULTIPLEX_VALID_FLAGS_DVBT Bits_T;
+	struct {
+		__u8	ByteHi;
+		__u8	ByteLo;
+	} Valid_Word;
+} M_VALID_FLAGS;
+
+typedef struct
+{
+#ifdef __LITTLE_ENDIAN
+  __u8      ActiveSystem;
+  __u8      reserved:5;
+  __u8      NoRF:1;
+  __u8      Moving:1;
+  __u8      Searching:1;
+
+  __u8      SelectedAntenna:7;
+  __u8      Input:1;
+
+  __u8      BER[4];
+
+  __u8      SignalStrength;
+  FREQUENCY Frequency;
+
+  __u8      ManDepInfoLength;
+
+  __u8 PowerSupply:1;
+  __u8 FrontEndPowerStatus:1;
+  __u8 reserved3:1;
+  __u8 AntennaError:1;
+  __u8 FrontEndError:1;
+  __u8 reserved2:3;
+
+  __u8 CarrierNoiseRatio[2];
+  __u8 reserved4[2];
+  __u8 PowerSupplyVoltage;
+  __u8 AntennaVoltage;
+  __u8 FirewireBusVoltage;
+
+  __u8 CaMmi:1;
+  __u8 reserved5:7;
+
+  __u8 reserved6:1;
+  __u8 CaInitializationStatus:1;
+  __u8 CaErrorFlag:1;
+  __u8 CaDvbFlag:1;
+  __u8 CaModulePresentStatus:1;
+  __u8 CaApplicationInfo:1;
+  __u8 CaDateTimeRequest:1;
+  __u8 CaPmtReply:1;
+
+#else
+  __u8 ActiveSystem;
+  __u8 Searching:1;
+  __u8 Moving:1;
+  __u8 NoRF:1;
+  __u8 reserved:5;
+
+  __u8 Input:1;
+  __u8 SelectedAntenna:7;
+
+  __u8 BER[4];
+
+  __u8 SignalStrength;
+  FREQUENCY Frequency;
+
+  __u8 ManDepInfoLength;
+
+  __u8 reserved2:3;
+  __u8 FrontEndError:1;
+  __u8 AntennaError:1;
+  __u8 reserved3:1;
+  __u8 FrontEndPowerStatus:1;
+  __u8 PowerSupply:1;
+
+  __u8 CarrierNoiseRatio[2];
+  __u8 reserved4[2];
+  __u8 PowerSupplyVoltage;
+  __u8 AntennaVoltage;
+  __u8 FirewireBusVoltage;
+
+  __u8 reserved5:7;
+  __u8 CaMmi:1;
+  __u8 CaPmtReply:1;
+  __u8 CaDateTimeRequest:1;
+  __u8 CaApplicationInfo:1;
+  __u8 CaModulePresentStatus:1;
+  __u8 CaDvbFlag:1;
+  __u8 CaErrorFlag:1;
+  __u8 CaInitializationStatus:1;
+  __u8 reserved6:1;
+
+#endif
+} ANTENNA_INPUT_INFO; // 22 Byte
+
+#define LNBCONTROL_DONTCARE 0xff
+
+struct dvb_diseqc_master_cmd;
+struct dvb_frontend_parameters;
+struct firesat;
+
+int avc_recv(struct firesat *firesat, u8 *data, size_t length);
+
+int AVCTuner_DSIT(struct firesat *firesat, int Source_Plug,
+		struct dvb_frontend_parameters *params, __u8 *status);
+
+int avc_tuner_status(struct firesat *firesat,
+		ANTENNA_INPUT_INFO *antenna_input_info);
+int avc_tuner_dsd(struct firesat *firesat,
+		struct dvb_frontend_parameters *params);
+int avc_tuner_set_pids(struct firesat *firesat, unsigned char pidc, u16 pid[]);
+int avc_tuner_get_ts(struct firesat *firesat);
+int avc_identify_subunit(struct firesat *firesat);
+int avc_lnb_control(struct firesat *firesat, char voltage, char burst,
+		char conttone, char nrdiseq,
+		struct dvb_diseqc_master_cmd *diseqcmd);
+void avc_remote_ctrl_work(struct work_struct *work);
+int avc_register_remote_control(struct firesat *firesat);
+int avc_ca_app_info(struct firesat *firesat, char *app_info, unsigned int *len);
+int avc_ca_info(struct firesat *firesat, char *app_info, unsigned int *len);
+int avc_ca_reset(struct firesat *firesat);
+int avc_ca_pmt(struct firesat *firesat, char *app_info, int length);
+int avc_ca_get_time_date(struct firesat *firesat, int *interval);
+int avc_ca_enter_menu(struct firesat *firesat);
+int avc_ca_get_mmi(struct firesat *firesat, char *mmi_object, unsigned int *len);
+
+#endif /* _AVC_API_H */
diff --git a/drivers/media/dvb/firesat/cmp.c b/drivers/media/dvb/firesat/cmp.c
new file mode 100644
index 000000000000..8e98b814e430
--- /dev/null
+++ b/drivers/media/dvb/firesat/cmp.c
@@ -0,0 +1,171 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/mutex.h>
+#include <linux/types.h>
+
+#include <asm/byteorder.h>
+
+#include <ieee1394.h>
+#include <nodemgr.h>
+
+#include "avc_api.h"
+#include "cmp.h"
+#include "firesat.h"
+
+#define CMP_OUTPUT_PLUG_CONTROL_REG_0	0xfffff0000904ULL
+
+static int cmp_read(struct firesat *firesat, void *buf, u64 addr, size_t len)
+{
+	int ret;
+
+	if (mutex_lock_interruptible(&firesat->avc_mutex))
+		return -EINTR;
+
+	ret = hpsb_node_read(firesat->ud->ne, addr, buf, len);
+	if (ret < 0)
+		dev_err(&firesat->ud->device, "CMP: read I/O error\n");
+
+	mutex_unlock(&firesat->avc_mutex);
+	return ret;
+}
+
+static int cmp_lock(struct firesat *firesat, void *data, u64 addr, __be32 arg,
+		    int ext_tcode)
+{
+	int ret;
+
+	if (mutex_lock_interruptible(&firesat->avc_mutex))
+		return -EINTR;
+
+	ret = hpsb_node_lock(firesat->ud->ne, addr, ext_tcode, data,
+			     (__force quadlet_t)arg);
+	if (ret < 0)
+		dev_err(&firesat->ud->device, "CMP: lock I/O error\n");
+
+	mutex_unlock(&firesat->avc_mutex);
+	return ret;
+}
+
+static inline u32 get_opcr(__be32 opcr, u32 mask, u32 shift)
+{
+	return (be32_to_cpu(opcr) >> shift) & mask;
+}
+
+static inline void set_opcr(__be32 *opcr, u32 value, u32 mask, u32 shift)
+{
+	*opcr &= ~cpu_to_be32(mask << shift);
+	*opcr |= cpu_to_be32((value & mask) << shift);
+}
+
+#define get_opcr_online(v)		get_opcr((v), 0x1, 31)
+#define get_opcr_p2p_connections(v)	get_opcr((v), 0x3f, 24)
+#define get_opcr_channel(v)		get_opcr((v), 0x3f, 16)
+
+#define set_opcr_p2p_connections(p, v)	set_opcr((p), (v), 0x3f, 24)
+#define set_opcr_channel(p, v)		set_opcr((p), (v), 0x3f, 16)
+#define set_opcr_data_rate(p, v)	set_opcr((p), (v), 0x3, 14)
+#define set_opcr_overhead_id(p, v)	set_opcr((p), (v), 0xf, 10)
+
+int cmp_establish_pp_connection(struct firesat *firesat, int plug, int channel)
+{
+	__be32 old_opcr, opcr;
+	u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
+	int attempts = 0;
+	int ret;
+
+	ret = cmp_read(firesat, &opcr, opcr_address, 4);
+	if (ret < 0)
+		return ret;
+
+repeat:
+	if (!get_opcr_online(opcr)) {
+		dev_err(&firesat->ud->device, "CMP: output offline\n");
+		return -EBUSY;
+	}
+
+	old_opcr = opcr;
+
+	if (get_opcr_p2p_connections(opcr)) {
+		if (get_opcr_channel(opcr) != channel) {
+			dev_err(&firesat->ud->device,
+				"CMP: cannot change channel\n");
+			return -EBUSY;
+		}
+		dev_info(&firesat->ud->device,
+			 "CMP: overlaying existing connection\n");
+
+		/* We don't allocate isochronous resources. */
+	} else {
+		set_opcr_channel(&opcr, channel);
+		set_opcr_data_rate(&opcr, IEEE1394_SPEED_400);
+
+		/* FIXME: this is for the worst case - optimize */
+		set_opcr_overhead_id(&opcr, 0);
+
+		/* FIXME: allocate isochronous channel and bandwidth at IRM */
+	}
+
+	set_opcr_p2p_connections(&opcr, get_opcr_p2p_connections(opcr) + 1);
+
+	ret = cmp_lock(firesat, &opcr, opcr_address, old_opcr, 2);
+	if (ret < 0)
+		return ret;
+
+	if (old_opcr != opcr) {
+		/*
+		 * FIXME: if old_opcr.P2P_Connections > 0,
+		 * deallocate isochronous channel and bandwidth at IRM
+		 */
+
+		if (++attempts < 6) /* arbitrary limit */
+			goto repeat;
+		return -EBUSY;
+	}
+
+	return 0;
+}
+
+void cmp_break_pp_connection(struct firesat *firesat, int plug, int channel)
+{
+	__be32 old_opcr, opcr;
+	u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
+	int attempts = 0;
+
+	if (cmp_read(firesat, &opcr, opcr_address, 4) < 0)
+		return;
+
+repeat:
+	if (!get_opcr_online(opcr) || !get_opcr_p2p_connections(opcr) ||
+	    get_opcr_channel(opcr) != channel) {
+		dev_err(&firesat->ud->device, "CMP: no connection to break\n");
+		return;
+	}
+
+	old_opcr = opcr;
+	set_opcr_p2p_connections(&opcr, get_opcr_p2p_connections(opcr) - 1);
+
+	if (cmp_lock(firesat, &opcr, opcr_address, old_opcr, 2) < 0)
+		return;
+
+	if (old_opcr != opcr) {
+		/*
+		 * FIXME: if old_opcr.P2P_Connections == 1, i.e. we were last
+		 * owner, deallocate isochronous channel and bandwidth at IRM
+		 */
+
+		if (++attempts < 6) /* arbitrary limit */
+			goto repeat;
+	}
+}
diff --git a/drivers/media/dvb/firesat/cmp.h b/drivers/media/dvb/firesat/cmp.h
new file mode 100644
index 000000000000..d92f6c7fb5d5
--- /dev/null
+++ b/drivers/media/dvb/firesat/cmp.h
@@ -0,0 +1,9 @@
+#ifndef _CMP_H
+#define _CMP_H
+
+struct firesat;
+
+int cmp_establish_pp_connection(struct firesat *firesat, int plug, int channel);
+void cmp_break_pp_connection(struct firesat *firesat, int plug, int channel);
+
+#endif /* _CMP_H */
diff --git a/drivers/media/dvb/firesat/firesat-ci.c b/drivers/media/dvb/firesat/firesat-ci.c
new file mode 100644
index 000000000000..783ed2000102
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat-ci.c
@@ -0,0 +1,261 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#include <linux/dvb/ca.h>
+#include <linux/fs.h>
+#include <linux/module.h>
+
+#include <dvbdev.h>
+
+#include "avc_api.h"
+#include "firesat.h"
+#include "firesat-ci.h"
+
+static int firesat_ca_ready(ANTENNA_INPUT_INFO *info)
+{
+	return info->CaInitializationStatus == 1 &&
+	       info->CaErrorFlag == 0 &&
+	       info->CaDvbFlag == 1 &&
+	       info->CaModulePresentStatus == 1;
+}
+
+static int firesat_get_ca_flags(ANTENNA_INPUT_INFO *info)
+{
+	int flags = 0;
+
+	if (info->CaModulePresentStatus == 1)
+		flags |= CA_CI_MODULE_PRESENT;
+	if (info->CaInitializationStatus == 1 &&
+	    info->CaErrorFlag == 0 &&
+	    info->CaDvbFlag == 1)
+		flags |= CA_CI_MODULE_READY;
+	return flags;
+}
+
+static int firesat_ca_reset(struct firesat *firesat)
+{
+	return avc_ca_reset(firesat) ? -EFAULT : 0;
+}
+
+static int firesat_ca_get_caps(void *arg)
+{
+	struct ca_caps *cap = arg;
+
+	cap->slot_num = 1;
+	cap->slot_type = CA_CI;
+	cap->descr_num = 1;
+	cap->descr_type = CA_ECD;
+	return 0;
+}
+
+static int firesat_ca_get_slot_info(struct firesat *firesat, void *arg)
+{
+	ANTENNA_INPUT_INFO info;
+	struct ca_slot_info *slot = arg;
+
+	if (avc_tuner_status(firesat, &info))
+		return -EFAULT;
+
+	if (slot->num != 0)
+		return -EFAULT;
+
+	slot->type = CA_CI;
+	slot->flags = firesat_get_ca_flags(&info);
+	return 0;
+}
+
+static int firesat_ca_app_info(struct firesat *firesat, void *arg)
+{
+	struct ca_msg *reply = arg;
+
+	return
+	    avc_ca_app_info(firesat, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int firesat_ca_info(struct firesat *firesat, void *arg)
+{
+	struct ca_msg *reply = arg;
+
+	return avc_ca_info(firesat, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int firesat_ca_get_mmi(struct firesat *firesat, void *arg)
+{
+	struct ca_msg *reply = arg;
+
+	return
+	    avc_ca_get_mmi(firesat, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int firesat_ca_get_msg(struct firesat *firesat, void *arg)
+{
+	ANTENNA_INPUT_INFO info;
+	int err;
+
+	switch (firesat->ca_last_command) {
+	case TAG_APP_INFO_ENQUIRY:
+		err = firesat_ca_app_info(firesat, arg);
+		break;
+	case TAG_CA_INFO_ENQUIRY:
+		err = firesat_ca_info(firesat, arg);
+		break;
+	default:
+		if (avc_tuner_status(firesat, &info))
+			err = -EFAULT;
+		else if (info.CaMmi == 1)
+			err = firesat_ca_get_mmi(firesat, arg);
+		else {
+			printk(KERN_INFO "%s: Unhandled message 0x%08X\n",
+			       __func__, firesat->ca_last_command);
+			err = -EFAULT;
+		}
+	}
+	firesat->ca_last_command = 0;
+	return err;
+}
+
+static int firesat_ca_pmt(struct firesat *firesat, void *arg)
+{
+	struct ca_msg *msg = arg;
+	int data_pos;
+	int data_length;
+	int i;
+
+	data_pos = 4;
+	if (msg->msg[3] & 0x80) {
+		data_length = 0;
+		for (i = 0; i < (msg->msg[3] & 0x7F); i++)
+			data_length = (data_length << 8) + msg->msg[data_pos++];
+	} else {
+		data_length = msg->msg[3];
+	}
+
+	return avc_ca_pmt(firesat, &msg->msg[data_pos], data_length) ?
+	       -EFAULT : 0;
+}
+
+static int firesat_ca_send_msg(struct firesat *firesat, void *arg)
+{
+	struct ca_msg *msg = arg;
+	int err;
+
+	/* Do we need a semaphore for this? */
+	firesat->ca_last_command =
+		(msg->msg[0] << 16) + (msg->msg[1] << 8) + msg->msg[2];
+	switch (firesat->ca_last_command) {
+	case TAG_CA_PMT:
+		err = firesat_ca_pmt(firesat, arg);
+		break;
+	case TAG_APP_INFO_ENQUIRY:
+		/* handled in ca_get_msg */
+		err = 0;
+		break;
+	case TAG_CA_INFO_ENQUIRY:
+		/* handled in ca_get_msg */
+		err = 0;
+		break;
+	case TAG_ENTER_MENU:
+		err = avc_ca_enter_menu(firesat);
+		break;
+	default:
+		printk(KERN_ERR "%s: Unhandled unknown message 0x%08X\n",
+		       __func__, firesat->ca_last_command);
+		err = -EFAULT;
+	}
+	return err;
+}
+
+static int firesat_ca_ioctl(struct inode *inode, struct file *file,
+			    unsigned int cmd, void *arg)
+{
+	struct dvb_device *dvbdev = file->private_data;
+	struct firesat *firesat = dvbdev->priv;
+	ANTENNA_INPUT_INFO info;
+	int err;
+
+	switch(cmd) {
+	case CA_RESET:
+		err = firesat_ca_reset(firesat);
+		break;
+	case CA_GET_CAP:
+		err = firesat_ca_get_caps(arg);
+		break;
+	case CA_GET_SLOT_INFO:
+		err = firesat_ca_get_slot_info(firesat, arg);
+		break;
+	case CA_GET_MSG:
+		err = firesat_ca_get_msg(firesat, arg);
+		break;
+	case CA_SEND_MSG:
+		err = firesat_ca_send_msg(firesat, arg);
+		break;
+	default:
+		printk(KERN_INFO "%s: Unhandled ioctl, command: %u\n",__func__,
+		       cmd);
+		err = -EOPNOTSUPP;
+	}
+
+	/* FIXME Is this necessary? */
+	avc_tuner_status(firesat, &info);
+
+	return err;
+}
+
+static unsigned int firesat_ca_io_poll(struct file *file, poll_table *wait)
+{
+	return POLLIN;
+}
+
+static struct file_operations firesat_ca_fops = {
+	.owner		= THIS_MODULE,
+	.ioctl		= dvb_generic_ioctl,
+	.open		= dvb_generic_open,
+	.release	= dvb_generic_release,
+	.poll		= firesat_ca_io_poll,
+};
+
+static struct dvb_device firesat_ca = {
+	.users		= 1,
+	.readers	= 1,
+	.writers	= 1,
+	.fops		= &firesat_ca_fops,
+	.kernel_ioctl	= firesat_ca_ioctl,
+};
+
+int firesat_ca_register(struct firesat *firesat)
+{
+	ANTENNA_INPUT_INFO info;
+	int err;
+
+	if (avc_tuner_status(firesat, &info))
+		return -EINVAL;
+
+	if (!firesat_ca_ready(&info))
+		return -EFAULT;
+
+	err = dvb_register_device(&firesat->adapter, &firesat->cadev,
+				  &firesat_ca, firesat, DVB_DEVICE_CA);
+
+	if (info.CaApplicationInfo == 0)
+		printk(KERN_ERR "%s: CaApplicationInfo is not set.\n",
+		       __func__);
+	if (info.CaDateTimeRequest == 1)
+		avc_ca_get_time_date(firesat, &firesat->ca_time_interval);
+
+	return err;
+}
+
+void firesat_ca_release(struct firesat *firesat)
+{
+	if (firesat->cadev)
+		dvb_unregister_device(firesat->cadev);
+}
diff --git a/drivers/media/dvb/firesat/firesat-ci.h b/drivers/media/dvb/firesat/firesat-ci.h
new file mode 100644
index 000000000000..9c68cd2246a7
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat-ci.h
@@ -0,0 +1,9 @@
+#ifndef _FIREDTV_CI_H
+#define _FIREDTV_CI_H
+
+struct firesat;
+
+int firesat_ca_register(struct firesat *firesat);
+void firesat_ca_release(struct firesat *firesat);
+
+#endif /* _FIREDTV_CI_H */
diff --git a/drivers/media/dvb/firesat/firesat-rc.c b/drivers/media/dvb/firesat/firesat-rc.c
new file mode 100644
index 000000000000..5f9de142ee3e
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat-rc.c
@@ -0,0 +1,191 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#include <linux/bitops.h>
+#include <linux/input.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/types.h>
+
+#include "firesat-rc.h"
+#include "firesat.h"
+
+/* fixed table with older keycodes, geared towards MythTV */
+const static u16 oldtable[] = {
+
+	/* code from device: 0x4501...0x451f */
+
+	KEY_ESC,
+	KEY_F9,
+	KEY_1,
+	KEY_2,
+	KEY_3,
+	KEY_4,
+	KEY_5,
+	KEY_6,
+	KEY_7,
+	KEY_8,
+	KEY_9,
+	KEY_I,
+	KEY_0,
+	KEY_ENTER,
+	KEY_RED,
+	KEY_UP,
+	KEY_GREEN,
+	KEY_F10,
+	KEY_SPACE,
+	KEY_F11,
+	KEY_YELLOW,
+	KEY_DOWN,
+	KEY_BLUE,
+	KEY_Z,
+	KEY_P,
+	KEY_PAGEDOWN,
+	KEY_LEFT,
+	KEY_W,
+	KEY_RIGHT,
+	KEY_P,
+	KEY_M,
+
+	/* code from device: 0x4540...0x4542 */
+
+	KEY_R,
+	KEY_V,
+	KEY_C,
+};
+
+/* user-modifiable table for a remote as sold in 2008 */
+const static u16 keytable[] = {
+
+	/* code from device: 0x0300...0x031f */
+
+	[0x00] = KEY_POWER,
+	[0x01] = KEY_SLEEP,
+	[0x02] = KEY_STOP,
+	[0x03] = KEY_OK,
+	[0x04] = KEY_RIGHT,
+	[0x05] = KEY_1,
+	[0x06] = KEY_2,
+	[0x07] = KEY_3,
+	[0x08] = KEY_LEFT,
+	[0x09] = KEY_4,
+	[0x0a] = KEY_5,
+	[0x0b] = KEY_6,
+	[0x0c] = KEY_UP,
+	[0x0d] = KEY_7,
+	[0x0e] = KEY_8,
+	[0x0f] = KEY_9,
+	[0x10] = KEY_DOWN,
+	[0x11] = KEY_TITLE,	/* "OSD" - fixme */
+	[0x12] = KEY_0,
+	[0x13] = KEY_F20,	/* "16:9" - fixme */
+	[0x14] = KEY_SCREEN,	/* "FULL" - fixme */
+	[0x15] = KEY_MUTE,
+	[0x16] = KEY_SUBTITLE,
+	[0x17] = KEY_RECORD,
+	[0x18] = KEY_TEXT,
+	[0x19] = KEY_AUDIO,
+	[0x1a] = KEY_RED,
+	[0x1b] = KEY_PREVIOUS,
+	[0x1c] = KEY_REWIND,
+	[0x1d] = KEY_PLAYPAUSE,
+	[0x1e] = KEY_NEXT,
+	[0x1f] = KEY_VOLUMEUP,
+
+	/* code from device: 0x0340...0x0354 */
+
+	[0x20] = KEY_CHANNELUP,
+	[0x21] = KEY_F21,	/* "4:3" - fixme */
+	[0x22] = KEY_TV,
+	[0x23] = KEY_DVD,
+	[0x24] = KEY_VCR,
+	[0x25] = KEY_AUX,
+	[0x26] = KEY_GREEN,
+	[0x27] = KEY_YELLOW,
+	[0x28] = KEY_BLUE,
+	[0x29] = KEY_CHANNEL,	/* "CH.LIST" */
+	[0x2a] = KEY_VENDOR,	/* "CI" - fixme */
+	[0x2b] = KEY_VOLUMEDOWN,
+	[0x2c] = KEY_CHANNELDOWN,
+	[0x2d] = KEY_LAST,
+	[0x2e] = KEY_INFO,
+	[0x2f] = KEY_FORWARD,
+	[0x30] = KEY_LIST,
+	[0x31] = KEY_FAVORITES,
+	[0x32] = KEY_MENU,
+	[0x33] = KEY_EPG,
+	[0x34] = KEY_EXIT,
+};
+
+int firesat_register_rc(struct firesat *firesat, struct device *dev)
+{
+	struct input_dev *idev;
+	int i, err;
+
+	idev = input_allocate_device();
+	if (!idev)
+		return -ENOMEM;
+
+	firesat->remote_ctrl_dev = idev;
+	idev->name = "FireDTV remote control";
+	idev->dev.parent = dev;
+	idev->evbit[0] = BIT_MASK(EV_KEY);
+	idev->keycode = kmemdup(keytable, sizeof(keytable), GFP_KERNEL);
+	if (!idev->keycode) {
+		err = -ENOMEM;
+		goto fail;
+	}
+	idev->keycodesize = sizeof(keytable[0]);
+	idev->keycodemax = ARRAY_SIZE(keytable);
+
+	for (i = 0; i < ARRAY_SIZE(keytable); i++)
+		set_bit(keytable[i], idev->keybit);
+
+	err = input_register_device(idev);
+	if (err)
+		goto fail_free_keymap;
+
+	return 0;
+
+fail_free_keymap:
+	kfree(idev->keycode);
+fail:
+	input_free_device(idev);
+	return err;
+}
+
+void firesat_unregister_rc(struct firesat *firesat)
+{
+	kfree(firesat->remote_ctrl_dev->keycode);
+	input_unregister_device(firesat->remote_ctrl_dev);
+}
+
+void firesat_handle_rc(struct firesat *firesat, unsigned int code)
+{
+	u16 *keycode = firesat->remote_ctrl_dev->keycode;
+
+	if (code >= 0x0300 && code <= 0x031f)
+		code = keycode[code - 0x0300];
+	else if (code >= 0x0340 && code <= 0x0354)
+		code = keycode[code - 0x0320];
+	else if (code >= 0x4501 && code <= 0x451f)
+		code = oldtable[code - 0x4501];
+	else if (code >= 0x4540 && code <= 0x4542)
+		code = oldtable[code - 0x4521];
+	else {
+		printk(KERN_DEBUG "firedtv: invalid key code 0x%04x "
+		       "from remote control\n", code);
+		return;
+	}
+
+	input_report_key(firesat->remote_ctrl_dev, code, 1);
+	input_report_key(firesat->remote_ctrl_dev, code, 0);
+}
diff --git a/drivers/media/dvb/firesat/firesat-rc.h b/drivers/media/dvb/firesat/firesat-rc.h
new file mode 100644
index 000000000000..12c1c5c28b36
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat-rc.h
@@ -0,0 +1,11 @@
+#ifndef _FIREDTV_RC_H
+#define _FIREDTV_RC_H
+
+struct firesat;
+struct device;
+
+int firesat_register_rc(struct firesat *firesat, struct device *dev);
+void firesat_unregister_rc(struct firesat *firesat);
+void firesat_handle_rc(struct firesat *firesat, unsigned int code);
+
+#endif /* _FIREDTV_RC_H */
diff --git a/drivers/media/dvb/firesat/firesat.h b/drivers/media/dvb/firesat/firesat.h
new file mode 100644
index 000000000000..51f64c0afcdb
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat.h
@@ -0,0 +1,227 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#ifndef _FIREDTV_H
+#define _FIREDTV_H
+
+#include <linux/dvb/dmx.h>
+#include <linux/dvb/frontend.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/spinlock_types.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
+#include <demux.h>
+#include <dmxdev.h>
+#include <dvb_demux.h>
+#include <dvb_frontend.h>
+#include <dvb_net.h>
+#include <dvbdev.h>
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 25)
+#define DVB_REGISTER_ADAPTER(x, y, z, w, v) dvb_register_adapter(x, y, z, w, v)
+#else
+#define DVB_REGISTER_ADAPTER(x, y, z, w, v) dvb_register_adapter(x, y, z, w)
+#define DVB_DEFINE_MOD_OPT_ADAPTER_NR(x)
+#endif
+
+/*****************************************************************
+ * CA message command constants from en50221_app_tags.h of libdvb
+ *****************************************************************/
+/*	Resource Manager		*/
+#define TAG_PROFILE_ENQUIRY		0x9f8010
+#define TAG_PROFILE			0x9f8011
+#define TAG_PROFILE_CHANGE		0x9f8012
+
+/*	Application Info		*/
+#define TAG_APP_INFO_ENQUIRY		0x9f8020
+#define TAG_APP_INFO			0x9f8021
+#define TAG_ENTER_MENU			0x9f8022
+
+/*	CA Support			*/
+#define TAG_CA_INFO_ENQUIRY		0x9f8030
+#define TAG_CA_INFO			0x9f8031
+#define TAG_CA_PMT			0x9f8032
+#define TAG_CA_PMT_REPLY		0x9f8033
+
+/*	Host Control			*/
+#define TAG_TUNE			0x9f8400
+#define TAG_REPLACE			0x9f8401
+#define TAG_CLEAR_REPLACE		0x9f8402
+#define TAG_ASK_RELEASE			0x9f8403
+
+/*	Date and Time			*/
+#define TAG_DATE_TIME_ENQUIRY		0x9f8440
+#define TAG_DATE_TIME			0x9f8441
+
+/*	Man Machine Interface (MMI)	*/
+#define TAG_CLOSE_MMI			0x9f8800
+#define TAG_DISPLAY_CONTROL		0x9f8801
+#define TAG_DISPLAY_REPLY		0x9f8802
+#define TAG_TEXT_LAST			0x9f8803
+#define TAG_TEXT_MORE			0x9f8804
+#define TAG_KEYPAD_CONTROL		0x9f8805
+#define TAG_KEYPRESS			0x9f8806
+#define TAG_ENQUIRY			0x9f8807
+#define TAG_ANSWER			0x9f8808
+#define TAG_MENU_LAST			0x9f8809
+#define TAG_MENU_MORE			0x9f880a
+#define TAG_MENU_ANSWER			0x9f880b
+#define TAG_LIST_LAST			0x9f880c
+#define TAG_LIST_MORE			0x9f880d
+#define TAG_SUBTITLE_SEGMENT_LAST	0x9f880e
+#define TAG_SUBTITLE_SEGMENT_MORE	0x9f880f
+#define TAG_DISPLAY_MESSAGE		0x9f8810
+#define TAG_SCENE_END_MARK		0x9f8811
+#define TAG_SCENE_DONE			0x9f8812
+#define TAG_SCENE_CONTROL		0x9f8813
+#define TAG_SUBTITLE_DOWNLOAD_LAST	0x9f8814
+#define TAG_SUBTITLE_DOWNLOAD_MORE	0x9f8815
+#define TAG_FLUSH_DOWNLOAD		0x9f8816
+#define TAG_DOWNLOAD_REPLY		0x9f8817
+
+/*	Low Speed Communications	*/
+#define TAG_COMMS_COMMAND		0x9f8c00
+#define TAG_CONNECTION_DESCRIPTOR	0x9f8c01
+#define TAG_COMMS_REPLY			0x9f8c02
+#define TAG_COMMS_SEND_LAST		0x9f8c03
+#define TAG_COMMS_SEND_MORE		0x9f8c04
+#define TAG_COMMS_RECV_LAST		0x9f8c05
+#define TAG_COMMS_RECV_MORE		0x9f8c06
+
+/* Authentication */
+#define TAG_AUTH_REQ			0x9f8200
+#define TAG_AUTH_RESP			0x9f8201
+
+/* Teletext */
+#define TAG_TELETEXT_EBU		0x9f9000
+
+/* Smartcard */
+#define TAG_SMARTCARD_COMMAND		0x9f8e00
+#define TAG_SMARTCARD_REPLY		0x9f8e01
+#define TAG_SMARTCARD_SEND		0x9f8e02
+#define TAG_SMARTCARD_RCV		0x9f8e03
+
+/* EPG */
+#define TAG_EPG_ENQUIRY         	0x9f8f00
+#define TAG_EPG_REPLY           	0x9f8f01
+
+
+enum model_type {
+	FireSAT_UNKNOWN = 0,
+	FireSAT_DVB_S   = 1,
+	FireSAT_DVB_C   = 2,
+	FireSAT_DVB_T   = 3,
+	FireSAT_DVB_S2  = 4,
+};
+
+struct input_dev;
+struct hpsb_iso;
+struct unit_directory;
+
+struct firesat {
+	struct dvb_adapter	adapter;
+	struct dmxdev		dmxdev;
+	struct dvb_demux	demux;
+	struct dmx_frontend	frontend;
+	struct dvb_net		dvbnet;
+	struct dvb_frontend	fe;
+
+	struct dvb_device	*cadev;
+	int			ca_last_command;
+	int			ca_time_interval;
+
+	struct mutex		avc_mutex;
+	wait_queue_head_t	avc_wait;
+	bool			avc_reply_received;
+	struct work_struct	remote_ctrl_work;
+	struct input_dev	*remote_ctrl_dev;
+
+	struct firesat_channel {
+		bool active;
+		int pid;
+	} channel[16];
+	struct mutex demux_mutex;
+
+	struct unit_directory *ud;
+
+	enum model_type type;
+	char subunit;
+	fe_sec_voltage_t voltage;
+	fe_sec_tone_mode_t tone;
+
+	int isochannel;
+	struct hpsb_iso *iso_handle;
+
+	struct list_head list;
+
+	/* needed by avc_api */
+	int resp_length;
+	u8 respfrm[512];
+};
+
+struct firewireheader {
+	union {
+		struct {
+			__u8 tcode:4;
+			__u8 sy:4;
+			__u8 tag:2;
+			__u8 channel:6;
+
+			__u8 length_l;
+			__u8 length_h;
+		} hdr;
+		__u32 val;
+	};
+};
+
+struct CIPHeader {
+	union {
+		struct {
+			__u8 syncbits:2;
+			__u8 sid:6;
+			__u8 dbs;
+			__u8 fn:2;
+			__u8 qpc:3;
+			__u8 sph:1;
+			__u8 rsv:2;
+			__u8 dbc;
+			__u8 syncbits2:2;
+			__u8 fmt:6;
+			__u32 fdf:24;
+		} cip;
+		__u64 val;
+	};
+};
+
+extern const char *firedtv_model_names[];
+extern struct list_head firesat_list;
+extern spinlock_t firesat_list_lock;
+
+struct device;
+
+/* firesat_dvb.c */
+int firesat_start_feed(struct dvb_demux_feed *dvbdmxfeed);
+int firesat_stop_feed(struct dvb_demux_feed *dvbdmxfeed);
+int firesat_dvbdev_init(struct firesat *firesat, struct device *dev);
+
+/* firesat_fe.c */
+void firesat_frontend_init(struct firesat *firesat);
+
+/* firesat_iso.c */
+int setup_iso_channel(struct firesat *firesat);
+void tear_down_iso_channel(struct firesat *firesat);
+
+#endif /* _FIREDTV_H */
diff --git a/drivers/media/dvb/firesat/firesat_1394.c b/drivers/media/dvb/firesat/firesat_1394.c
new file mode 100644
index 000000000000..11db62730256
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat_1394.c
@@ -0,0 +1,291 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2007-2008 Ben Backx <ben@bbackx.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+#include <linux/types.h>
+
+#include <dmxdev.h>
+#include <dvb_demux.h>
+#include <dvb_frontend.h>
+#include <dvbdev.h>
+
+#include <csr1212.h>
+#include <highlevel.h>
+#include <hosts.h>
+#include <ieee1394_hotplug.h>
+#include <nodemgr.h>
+
+#include "avc_api.h"
+#include "cmp.h"
+#include "firesat.h"
+#include "firesat-ci.h"
+#include "firesat-rc.h"
+
+#define MATCH_FLAGS	IEEE1394_MATCH_VENDOR_ID | IEEE1394_MATCH_MODEL_ID | \
+			IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION
+#define DIGITAL_EVERYWHERE_OUI   0x001287
+
+static struct ieee1394_device_id firesat_id_table[] = {
+
+	{
+		/* FloppyDTV S/CI and FloppyDTV S2 */
+		.match_flags	= MATCH_FLAGS,
+		.vendor_id	= DIGITAL_EVERYWHERE_OUI,
+		.model_id	= 0x000024,
+		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY,
+		.version	= AVC_SW_VERSION_ENTRY,
+	},{
+		/* FloppyDTV T/CI */
+		.match_flags	= MATCH_FLAGS,
+		.vendor_id	= DIGITAL_EVERYWHERE_OUI,
+		.model_id	= 0x000025,
+		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY,
+		.version	= AVC_SW_VERSION_ENTRY,
+	},{
+		/* FloppyDTV C/CI */
+		.match_flags	= MATCH_FLAGS,
+		.vendor_id	= DIGITAL_EVERYWHERE_OUI,
+		.model_id	= 0x000026,
+		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY,
+		.version	= AVC_SW_VERSION_ENTRY,
+	},{
+		/* FireDTV S/CI and FloppyDTV S2 */
+		.match_flags	= MATCH_FLAGS,
+		.vendor_id	= DIGITAL_EVERYWHERE_OUI,
+		.model_id	= 0x000034,
+		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY,
+		.version	= AVC_SW_VERSION_ENTRY,
+	},{
+		/* FireDTV T/CI */
+		.match_flags	= MATCH_FLAGS,
+		.vendor_id	= DIGITAL_EVERYWHERE_OUI,
+		.model_id	= 0x000035,
+		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY,
+		.version	= AVC_SW_VERSION_ENTRY,
+	},{
+		/* FireDTV C/CI */
+		.match_flags	= MATCH_FLAGS,
+		.vendor_id	= DIGITAL_EVERYWHERE_OUI,
+		.model_id	= 0x000036,
+		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY,
+		.version	= AVC_SW_VERSION_ENTRY,
+	}, { }
+};
+
+MODULE_DEVICE_TABLE(ieee1394, firesat_id_table);
+
+/* list of all firesat devices */
+LIST_HEAD(firesat_list);
+DEFINE_SPINLOCK(firesat_list_lock);
+
+static void fcp_request(struct hpsb_host *host,
+			int nodeid,
+			int direction,
+			int cts,
+			u8 *data,
+			size_t length)
+{
+	struct firesat *firesat = NULL;
+	struct firesat *firesat_entry;
+	unsigned long flags;
+
+	if (length > 0 && ((data[0] & 0xf0) >> 4) == 0) {
+
+		spin_lock_irqsave(&firesat_list_lock, flags);
+		list_for_each_entry(firesat_entry,&firesat_list,list) {
+			if (firesat_entry->ud->ne->host == host &&
+			    firesat_entry->ud->ne->nodeid == nodeid &&
+			    (firesat_entry->subunit == (data[1]&0x7) ||
+			     (firesat_entry->subunit == 0 &&
+			      (data[1]&0x7) == 0x7))) {
+				firesat=firesat_entry;
+				break;
+			}
+		}
+		spin_unlock_irqrestore(&firesat_list_lock, flags);
+
+		if (firesat)
+			avc_recv(firesat, data, length);
+	}
+}
+
+const char *firedtv_model_names[] = {
+	[FireSAT_UNKNOWN] = "unknown type",
+	[FireSAT_DVB_S]   = "FireDTV S/CI",
+	[FireSAT_DVB_C]   = "FireDTV C/CI",
+	[FireSAT_DVB_T]   = "FireDTV T/CI",
+	[FireSAT_DVB_S2]  = "FireDTV S2  ",
+};
+
+static int firesat_probe(struct device *dev)
+{
+	struct unit_directory *ud =
+			container_of(dev, struct unit_directory, device);
+	struct firesat *firesat;
+	unsigned long flags;
+	int kv_len;
+	void *kv_str;
+	int i;
+	int err = -ENOMEM;
+
+	firesat = kzalloc(sizeof(*firesat), GFP_KERNEL);
+	if (!firesat)
+		return -ENOMEM;
+
+	dev->driver_data = firesat;
+	firesat->ud		= ud;
+	firesat->subunit	= 0;
+	firesat->isochannel	= -1;
+	firesat->tone		= 0xff;
+	firesat->voltage	= 0xff;
+
+	mutex_init(&firesat->avc_mutex);
+	init_waitqueue_head(&firesat->avc_wait);
+	firesat->avc_reply_received = true;
+	mutex_init(&firesat->demux_mutex);
+	INIT_WORK(&firesat->remote_ctrl_work, avc_remote_ctrl_work);
+
+	/* Reading device model from ROM */
+	kv_len = (ud->model_name_kv->value.leaf.len - 2) * sizeof(quadlet_t);
+	kv_str = CSR1212_TEXTUAL_DESCRIPTOR_LEAF_DATA(ud->model_name_kv);
+	for (i = ARRAY_SIZE(firedtv_model_names); --i;)
+		if (strlen(firedtv_model_names[i]) <= kv_len &&
+		    strncmp(kv_str, firedtv_model_names[i], kv_len) == 0)
+			break;
+	firesat->type = i;
+
+	/*
+	 * Work around a bug in udev's path_id script:  Use the fw-host's dev
+	 * instead of the unit directory's dev as parent of the input device.
+	 */
+	err = firesat_register_rc(firesat, dev->parent->parent);
+	if (err)
+		goto fail_free;
+
+	INIT_LIST_HEAD(&firesat->list);
+	spin_lock_irqsave(&firesat_list_lock, flags);
+	list_add_tail(&firesat->list, &firesat_list);
+	spin_unlock_irqrestore(&firesat_list_lock, flags);
+
+	err = avc_identify_subunit(firesat);
+	if (err)
+		goto fail;
+
+	err = firesat_dvbdev_init(firesat, dev);
+	if (err)
+		goto fail;
+
+	avc_register_remote_control(firesat);
+	return 0;
+
+fail:
+	spin_lock_irqsave(&firesat_list_lock, flags);
+	list_del(&firesat->list);
+	spin_unlock_irqrestore(&firesat_list_lock, flags);
+	firesat_unregister_rc(firesat);
+fail_free:
+	kfree(firesat);
+	return err;
+}
+
+static int firesat_remove(struct device *dev)
+{
+	struct firesat *firesat = dev->driver_data;
+	unsigned long flags;
+
+	firesat_ca_release(firesat);
+	dvb_unregister_frontend(&firesat->fe);
+	dvb_net_release(&firesat->dvbnet);
+	firesat->demux.dmx.close(&firesat->demux.dmx);
+	firesat->demux.dmx.remove_frontend(&firesat->demux.dmx,
+					   &firesat->frontend);
+	dvb_dmxdev_release(&firesat->dmxdev);
+	dvb_dmx_release(&firesat->demux);
+	dvb_unregister_adapter(&firesat->adapter);
+
+	spin_lock_irqsave(&firesat_list_lock, flags);
+	list_del(&firesat->list);
+	spin_unlock_irqrestore(&firesat_list_lock, flags);
+
+	cancel_work_sync(&firesat->remote_ctrl_work);
+	firesat_unregister_rc(firesat);
+
+	kfree(firesat);
+	return 0;
+}
+
+static int firesat_update(struct unit_directory *ud)
+{
+	struct firesat *firesat = ud->device.driver_data;
+
+	if (firesat->isochannel >= 0)
+		cmp_establish_pp_connection(firesat, firesat->subunit,
+					    firesat->isochannel);
+	return 0;
+}
+
+static struct hpsb_protocol_driver firesat_driver = {
+
+	.name		= "firedtv",
+	.id_table	= firesat_id_table,
+	.update		= firesat_update,
+
+	.driver         = {
+		//.name and .bus are filled in for us in more recent linux versions
+		//.name	= "FireSAT",
+		//.bus	= &ieee1394_bus_type,
+		.probe  = firesat_probe,
+		.remove = firesat_remove,
+	},
+};
+
+static struct hpsb_highlevel firesat_highlevel = {
+	.name		= "firedtv",
+	.fcp_request	= fcp_request,
+};
+
+static int __init firesat_init(void)
+{
+	int ret;
+
+	hpsb_register_highlevel(&firesat_highlevel);
+	ret = hpsb_register_protocol(&firesat_driver);
+	if (ret) {
+		printk(KERN_ERR "firedtv: failed to register protocol\n");
+		hpsb_unregister_highlevel(&firesat_highlevel);
+	}
+	return ret;
+}
+
+static void __exit firesat_exit(void)
+{
+	hpsb_unregister_protocol(&firesat_driver);
+	hpsb_unregister_highlevel(&firesat_highlevel);
+}
+
+module_init(firesat_init);
+module_exit(firesat_exit);
+
+MODULE_AUTHOR("Andreas Monitzer <andy@monitzer.com>");
+MODULE_AUTHOR("Ben Backx <ben@bbackx.com>");
+MODULE_DESCRIPTION("FireDTV DVB Driver");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("FireDTV DVB");
diff --git a/drivers/media/dvb/firesat/firesat_dvb.c b/drivers/media/dvb/firesat/firesat_dvb.c
new file mode 100644
index 000000000000..cb36c0310199
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat_dvb.c
@@ -0,0 +1,276 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/mutex.h>
+#include <linux/types.h>
+
+#include <dvb_demux.h>
+#include <dvb_frontend.h>
+#include <dvbdev.h>
+
+#include "avc_api.h"
+#include "firesat.h"
+#include "firesat-ci.h"
+
+DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+static struct firesat_channel *firesat_channel_allocate(struct firesat *firesat)
+{
+	struct firesat_channel *c = NULL;
+	int k;
+
+	if (mutex_lock_interruptible(&firesat->demux_mutex))
+		return NULL;
+
+	for (k = 0; k < 16; k++)
+		if (!firesat->channel[k].active) {
+			firesat->channel[k].active = true;
+			c = &firesat->channel[k];
+			break;
+		}
+
+	mutex_unlock(&firesat->demux_mutex);
+	return c;
+}
+
+static int firesat_channel_collect(struct firesat *firesat, int *pidc, u16 pid[])
+{
+	int k, l = 0;
+
+	if (mutex_lock_interruptible(&firesat->demux_mutex))
+		return -EINTR;
+
+	for (k = 0; k < 16; k++)
+		if (firesat->channel[k].active)
+			pid[l++] = firesat->channel[k].pid;
+
+	mutex_unlock(&firesat->demux_mutex);
+
+	*pidc = l;
+
+	return 0;
+}
+
+static int firesat_channel_release(struct firesat *firesat,
+				   struct firesat_channel *channel)
+{
+	if (mutex_lock_interruptible(&firesat->demux_mutex))
+		return -EINTR;
+
+	channel->active = false;
+
+	mutex_unlock(&firesat->demux_mutex);
+	return 0;
+}
+
+int firesat_start_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+	struct firesat *firesat = (struct firesat*)dvbdmxfeed->demux->priv;
+	struct firesat_channel *channel;
+	int pidc,k;
+	u16 pids[16];
+
+	switch (dvbdmxfeed->type) {
+	case DMX_TYPE_TS:
+	case DMX_TYPE_SEC:
+		break;
+	default:
+		printk(KERN_ERR "%s: invalid type %u\n",
+		       __func__, dvbdmxfeed->type);
+		return -EINVAL;
+	}
+
+	if (dvbdmxfeed->type == DMX_TYPE_TS) {
+		switch (dvbdmxfeed->pes_type) {
+		case DMX_TS_PES_VIDEO:
+		case DMX_TS_PES_AUDIO:
+		case DMX_TS_PES_TELETEXT:
+		case DMX_TS_PES_PCR:
+		case DMX_TS_PES_OTHER:
+			//Dirty fix to keep firesat->channel pid-list up to date
+			for(k=0;k<16;k++){
+				if (!firesat->channel[k].active)
+					firesat->channel[k].pid =
+						dvbdmxfeed->pid;
+					break;
+			}
+			channel = firesat_channel_allocate(firesat);
+			break;
+		default:
+			printk(KERN_ERR "%s: invalid pes type %u\n",
+			       __func__, dvbdmxfeed->pes_type);
+			return -EINVAL;
+		}
+	} else {
+		channel = firesat_channel_allocate(firesat);
+	}
+
+	if (!channel) {
+		printk(KERN_ERR "%s: busy!\n", __func__);
+		return -EBUSY;
+	}
+
+	dvbdmxfeed->priv = channel;
+	channel->pid = dvbdmxfeed->pid;
+
+	if (firesat_channel_collect(firesat, &pidc, pids)) {
+		firesat_channel_release(firesat, channel);
+		printk(KERN_ERR "%s: could not collect pids!\n", __func__);
+		return -EINTR;
+	}
+
+	if (dvbdmxfeed->pid == 8192) {
+		k = avc_tuner_get_ts(firesat);
+		if (k) {
+			firesat_channel_release(firesat, channel);
+			printk("%s: AVCTuner_GetTS failed with error %d\n",
+			       __func__, k);
+			return k;
+		}
+	} else {
+		k = avc_tuner_set_pids(firesat, pidc, pids);
+		if (k) {
+			firesat_channel_release(firesat, channel);
+			printk("%s: AVCTuner_SetPIDs failed with error %d\n",
+			       __func__, k);
+			return k;
+		}
+	}
+
+	return 0;
+}
+
+int firesat_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+	struct dvb_demux *demux = dvbdmxfeed->demux;
+	struct firesat *firesat = (struct firesat*)demux->priv;
+	struct firesat_channel *c = dvbdmxfeed->priv;
+	int k, l;
+	u16 pids[16];
+
+	if (dvbdmxfeed->type == DMX_TYPE_TS && !((dvbdmxfeed->ts_type & TS_PACKET) &&
+				(demux->dmx.frontend->source != DMX_MEMORY_FE))) {
+
+		if (dvbdmxfeed->ts_type & TS_DECODER) {
+
+			if (dvbdmxfeed->pes_type >= DMX_TS_PES_OTHER ||
+				!demux->pesfilter[dvbdmxfeed->pes_type])
+
+				return -EINVAL;
+
+			demux->pids[dvbdmxfeed->pes_type] |= 0x8000;
+			demux->pesfilter[dvbdmxfeed->pes_type] = NULL;
+		}
+
+		if (!(dvbdmxfeed->ts_type & TS_DECODER &&
+			dvbdmxfeed->pes_type < DMX_TS_PES_OTHER))
+
+			return 0;
+	}
+
+	if (mutex_lock_interruptible(&firesat->demux_mutex))
+		return -EINTR;
+
+	/* list except channel to be removed */
+	for (k = 0, l = 0; k < 16; k++)
+		if (firesat->channel[k].active) {
+			if (&firesat->channel[k] != c)
+				pids[l++] = firesat->channel[k].pid;
+			else
+				firesat->channel[k].active = false;
+		}
+
+	k = avc_tuner_set_pids(firesat, l, pids);
+	if (!k)
+		c->active = false;
+
+	mutex_unlock(&firesat->demux_mutex);
+	return k;
+}
+
+int firesat_dvbdev_init(struct firesat *firesat, struct device *dev)
+{
+	int err;
+
+	err = DVB_REGISTER_ADAPTER(&firesat->adapter,
+				   firedtv_model_names[firesat->type],
+				   THIS_MODULE, dev, adapter_nr);
+	if (err < 0)
+		goto fail_log;
+
+	/*DMX_TS_FILTERING | DMX_SECTION_FILTERING*/
+	firesat->demux.dmx.capabilities = 0;
+
+	firesat->demux.priv		= (void *)firesat;
+	firesat->demux.filternum	= 16;
+	firesat->demux.feednum		= 16;
+	firesat->demux.start_feed	= firesat_start_feed;
+	firesat->demux.stop_feed	= firesat_stop_feed;
+	firesat->demux.write_to_decoder	= NULL;
+
+	err = dvb_dmx_init(&firesat->demux);
+	if (err)
+		goto fail_unreg_adapter;
+
+	firesat->dmxdev.filternum	= 16;
+	firesat->dmxdev.demux		= &firesat->demux.dmx;
+	firesat->dmxdev.capabilities	= 0;
+
+	err = dvb_dmxdev_init(&firesat->dmxdev, &firesat->adapter);
+	if (err)
+		goto fail_dmx_release;
+
+	firesat->frontend.source = DMX_FRONTEND_0;
+
+	err = firesat->demux.dmx.add_frontend(&firesat->demux.dmx,
+					      &firesat->frontend);
+	if (err)
+		goto fail_dmxdev_release;
+
+	err = firesat->demux.dmx.connect_frontend(&firesat->demux.dmx,
+						  &firesat->frontend);
+	if (err)
+		goto fail_rem_frontend;
+
+	dvb_net_init(&firesat->adapter, &firesat->dvbnet, &firesat->demux.dmx);
+
+	firesat_frontend_init(firesat);
+	err = dvb_register_frontend(&firesat->adapter, &firesat->fe);
+	if (err)
+		goto fail_net_release;
+
+	err = firesat_ca_register(firesat);
+	if (err)
+		dev_info(dev, "Conditional Access Module not enabled\n");
+
+	return 0;
+
+fail_net_release:
+	dvb_net_release(&firesat->dvbnet);
+	firesat->demux.dmx.close(&firesat->demux.dmx);
+fail_rem_frontend:
+	firesat->demux.dmx.remove_frontend(&firesat->demux.dmx,
+					   &firesat->frontend);
+fail_dmxdev_release:
+	dvb_dmxdev_release(&firesat->dmxdev);
+fail_dmx_release:
+	dvb_dmx_release(&firesat->demux);
+fail_unreg_adapter:
+	dvb_unregister_adapter(&firesat->adapter);
+fail_log:
+	dev_err(dev, "DVB initialization failed\n");
+	return err;
+}
+
+
diff --git a/drivers/media/dvb/firesat/firesat_fe.c b/drivers/media/dvb/firesat/firesat_fe.c
new file mode 100644
index 000000000000..1ed972b79573
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat_fe.c
@@ -0,0 +1,245 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/types.h>
+
+#include <dvb_frontend.h>
+
+#include "avc_api.h"
+#include "cmp.h"
+#include "firesat.h"
+
+static int firesat_dvb_init(struct dvb_frontend *fe)
+{
+	struct firesat *firesat = fe->sec_priv;
+	int err;
+
+	/* FIXME - allocate free channel at IRM */
+	firesat->isochannel = firesat->adapter.num;
+
+	err = cmp_establish_pp_connection(firesat, firesat->subunit,
+					  firesat->isochannel);
+	if (err) {
+		printk(KERN_ERR "Could not establish point to point "
+		       "connection.\n");
+		return err;
+	}
+
+	return setup_iso_channel(firesat);
+}
+
+static int firesat_sleep(struct dvb_frontend *fe)
+{
+	struct firesat *firesat = fe->sec_priv;
+
+	tear_down_iso_channel(firesat);
+	cmp_break_pp_connection(firesat, firesat->subunit, firesat->isochannel);
+	firesat->isochannel = -1;
+	return 0;
+}
+
+static int firesat_diseqc_send_master_cmd(struct dvb_frontend *fe,
+					  struct dvb_diseqc_master_cmd *cmd)
+{
+	struct firesat *firesat = fe->sec_priv;
+
+	return avc_lnb_control(firesat, LNBCONTROL_DONTCARE,
+			LNBCONTROL_DONTCARE, LNBCONTROL_DONTCARE, 1, cmd);
+}
+
+static int firesat_diseqc_send_burst(struct dvb_frontend *fe,
+				     fe_sec_mini_cmd_t minicmd)
+{
+	return 0;
+}
+
+static int firesat_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
+{
+	struct firesat *firesat = fe->sec_priv;
+
+	firesat->tone = tone;
+	return 0;
+}
+
+static int firesat_set_voltage(struct dvb_frontend *fe,
+			       fe_sec_voltage_t voltage)
+{
+	struct firesat *firesat = fe->sec_priv;
+
+	firesat->voltage = voltage;
+	return 0;
+}
+
+static int firesat_read_status(struct dvb_frontend *fe, fe_status_t *status)
+{
+	struct firesat *firesat = fe->sec_priv;
+	ANTENNA_INPUT_INFO info;
+
+	if (avc_tuner_status(firesat, &info))
+		return -EINVAL;
+
+	if (info.NoRF)
+		*status = 0;
+	else
+		*status = FE_HAS_SIGNAL | FE_HAS_VITERBI | FE_HAS_SYNC |
+			  FE_HAS_CARRIER | FE_HAS_LOCK;
+	return 0;
+}
+
+static int firesat_read_ber(struct dvb_frontend *fe, u32 *ber)
+{
+	struct firesat *firesat = fe->sec_priv;
+	ANTENNA_INPUT_INFO info;
+
+	if (avc_tuner_status(firesat, &info))
+		return -EINVAL;
+
+	*ber = info.BER[0] << 24 | info.BER[1] << 16 |
+	       info.BER[2] << 8 | info.BER[3];
+	return 0;
+}
+
+static int firesat_read_signal_strength (struct dvb_frontend *fe, u16 *strength)
+{
+	struct firesat *firesat = fe->sec_priv;
+	ANTENNA_INPUT_INFO info;
+
+	if (avc_tuner_status(firesat, &info))
+		return -EINVAL;
+
+	*strength = info.SignalStrength << 8;
+	return 0;
+}
+
+static int firesat_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+	struct firesat *firesat = fe->sec_priv;
+	ANTENNA_INPUT_INFO info;
+
+	if (avc_tuner_status(firesat, &info))
+		return -EINVAL;
+
+	/* C/N[dB] = -10 * log10(snr / 65535) */
+	*snr = (info.CarrierNoiseRatio[0] << 8) + info.CarrierNoiseRatio[1];
+	*snr *= 257;
+	return 0;
+}
+
+static int firesat_read_uncorrected_blocks(struct dvb_frontend *fe, u32 *ucblocks)
+{
+	return -EOPNOTSUPP;
+}
+
+static int firesat_set_frontend(struct dvb_frontend *fe,
+				struct dvb_frontend_parameters *params)
+{
+	struct firesat *firesat = fe->sec_priv;
+
+	/* FIXME: avc_tuner_dsd never returns ACCEPTED. Check status? */
+	if (avc_tuner_dsd(firesat, params) != ACCEPTED)
+		return -EINVAL;
+	else
+		return 0; /* not sure of this... */
+}
+
+static int firesat_get_frontend(struct dvb_frontend *fe,
+				struct dvb_frontend_parameters *params)
+{
+	return -EOPNOTSUPP;
+}
+
+void firesat_frontend_init(struct firesat *firesat)
+{
+	struct dvb_frontend_ops *ops = &firesat->fe.ops;
+	struct dvb_frontend_info *fi = &ops->info;
+
+	ops->init			= firesat_dvb_init;
+	ops->sleep			= firesat_sleep;
+
+	ops->set_frontend		= firesat_set_frontend;
+	ops->get_frontend		= firesat_get_frontend;
+
+	ops->read_status		= firesat_read_status;
+	ops->read_ber			= firesat_read_ber;
+	ops->read_signal_strength	= firesat_read_signal_strength;
+	ops->read_snr			= firesat_read_snr;
+	ops->read_ucblocks		= firesat_read_uncorrected_blocks;
+
+	ops->diseqc_send_master_cmd 	= firesat_diseqc_send_master_cmd;
+	ops->diseqc_send_burst		= firesat_diseqc_send_burst;
+	ops->set_tone			= firesat_set_tone;
+	ops->set_voltage		= firesat_set_voltage;
+
+	switch (firesat->type) {
+	case FireSAT_DVB_S:
+		fi->type		= FE_QPSK;
+
+		fi->frequency_min	= 950000;
+		fi->frequency_max	= 2150000;
+		fi->frequency_stepsize	= 125;
+		fi->symbol_rate_min	= 1000000;
+		fi->symbol_rate_max	= 40000000;
+
+		fi->caps 		= FE_CAN_INVERSION_AUTO	|
+					  FE_CAN_FEC_1_2	|
+					  FE_CAN_FEC_2_3	|
+					  FE_CAN_FEC_3_4	|
+					  FE_CAN_FEC_5_6	|
+					  FE_CAN_FEC_7_8	|
+					  FE_CAN_FEC_AUTO	|
+					  FE_CAN_QPSK;
+		break;
+
+	case FireSAT_DVB_C:
+		fi->type		= FE_QAM;
+
+		fi->frequency_min	= 47000000;
+		fi->frequency_max	= 866000000;
+		fi->frequency_stepsize	= 62500;
+		fi->symbol_rate_min	= 870000;
+		fi->symbol_rate_max	= 6900000;
+
+		fi->caps 		= FE_CAN_INVERSION_AUTO |
+					  FE_CAN_QAM_16		|
+					  FE_CAN_QAM_32		|
+					  FE_CAN_QAM_64		|
+					  FE_CAN_QAM_128	|
+					  FE_CAN_QAM_256	|
+					  FE_CAN_QAM_AUTO;
+		break;
+
+	case FireSAT_DVB_T:
+		fi->type		= FE_OFDM;
+
+		fi->frequency_min	= 49000000;
+		fi->frequency_max	= 861000000;
+		fi->frequency_stepsize	= 62500;
+
+		fi->caps 		= FE_CAN_INVERSION_AUTO		|
+					  FE_CAN_FEC_2_3		|
+					  FE_CAN_TRANSMISSION_MODE_AUTO |
+					  FE_CAN_GUARD_INTERVAL_AUTO	|
+					  FE_CAN_HIERARCHY_AUTO;
+		break;
+
+	default:
+		printk(KERN_ERR "FireDTV: no frontend for model type %d\n",
+		       firesat->type);
+	}
+	strcpy(fi->name, firedtv_model_names[firesat->type]);
+
+	firesat->fe.dvb = &firesat->adapter;
+	firesat->fe.sec_priv = firesat;
+}
diff --git a/drivers/media/dvb/firesat/firesat_iso.c b/drivers/media/dvb/firesat/firesat_iso.c
new file mode 100644
index 000000000000..b3c61f95fa94
--- /dev/null
+++ b/drivers/media/dvb/firesat/firesat_iso.c
@@ -0,0 +1,111 @@
+/*
+ * FireSAT DVB driver
+ *
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+
+#include <dvb_demux.h>
+
+#include <dma.h>
+#include <iso.h>
+#include <nodemgr.h>
+
+#include "firesat.h"
+
+static void rawiso_activity_cb(struct hpsb_iso *iso);
+
+void tear_down_iso_channel(struct firesat *firesat)
+{
+	if (firesat->iso_handle != NULL) {
+		hpsb_iso_stop(firesat->iso_handle);
+		hpsb_iso_shutdown(firesat->iso_handle);
+	}
+	firesat->iso_handle = NULL;
+}
+
+int setup_iso_channel(struct firesat *firesat)
+{
+	int result;
+	firesat->iso_handle =
+		hpsb_iso_recv_init(firesat->ud->ne->host,
+				   256 * 200, //data_buf_size,
+				   256, //buf_packets,
+				   firesat->isochannel,
+				   HPSB_ISO_DMA_DEFAULT, //dma_mode,
+				   -1, //stat.config.irq_interval,
+				   rawiso_activity_cb);
+	if (firesat->iso_handle == NULL) {
+		printk(KERN_ERR "Cannot initialize iso receive.\n");
+		return -EINVAL;
+	}
+	result = hpsb_iso_recv_start(firesat->iso_handle, -1, -1, 0);
+	if (result != 0) {
+		printk(KERN_ERR "Cannot start iso receive.\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static void rawiso_activity_cb(struct hpsb_iso *iso)
+{
+	unsigned int num;
+	unsigned int i;
+	unsigned int packet;
+	unsigned long flags;
+	struct firesat *firesat = NULL;
+	struct firesat *firesat_iterator;
+
+	spin_lock_irqsave(&firesat_list_lock, flags);
+	list_for_each_entry(firesat_iterator, &firesat_list, list) {
+		if(firesat_iterator->iso_handle == iso) {
+			firesat = firesat_iterator;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&firesat_list_lock, flags);
+
+	if (firesat) {
+		packet = iso->first_packet;
+		num = hpsb_iso_n_ready(iso);
+		for (i = 0; i < num; i++,
+			     packet = (packet + 1) % iso->buf_packets) {
+			unsigned char *buf =
+				dma_region_i(&iso->data_buf, unsigned char,
+					     iso->infos[packet].offset +
+					     sizeof(struct CIPHeader));
+			int count = (iso->infos[packet].len -
+				     sizeof(struct CIPHeader)) /
+				(188 + sizeof(struct firewireheader));
+			if (iso->infos[packet].len <= sizeof(struct CIPHeader))
+				continue; // ignore empty packet
+
+			while (count --) {
+				if (buf[sizeof(struct firewireheader)] == 0x47)
+					dvb_dmx_swfilter_packets(&firesat->demux,
+								 &buf[sizeof(struct firewireheader)], 1);
+				else
+					printk("%s: invalid packet, skipping\n", __func__);
+				buf += 188 + sizeof(struct firewireheader);
+
+			}
+
+		}
+		hpsb_iso_recv_release_packets(iso, num);
+	}
+	else {
+		printk("%s: packets for unknown iso channel, skipping\n",
+		       __func__);
+		hpsb_iso_recv_release_packets(iso, hpsb_iso_n_ready(iso));
+	}
+}
+
diff --git a/include/linux/firewire-cdev.h b/include/linux/firewire-cdev.h
index 4d078e99c017..899ef279f5be 100644
--- a/include/linux/firewire-cdev.h
+++ b/include/linux/firewire-cdev.h
@@ -229,7 +229,7 @@ struct fw_cdev_get_info {
  * Send a request to the device.  This ioctl implements all outgoing requests.
  * Both quadlet and block request specify the payload as a pointer to the data
  * in the @data field.  Once the transaction completes, the kernel writes an
- * &fw_cdev_event_request event back.  The @closure field is passed back to
+ * &fw_cdev_event_response event back.  The @closure field is passed back to
  * user space in the response event.
  */
 struct fw_cdev_send_request {