Index: head-2006-04-24/drivers/xen/pciback/pciback.h
===================================================================
--- head-2006-04-24.orig/drivers/xen/pciback/pciback.h	2006-04-24 11:43:44.000000000 +0200
+++ head-2006-04-24/drivers/xen/pciback/pciback.h	2006-04-25 10:54:17.000000000 +0200
@@ -29,6 +29,7 @@ struct pciback_device {
 
 	int evtchn_irq;
 
+	struct vm_struct *sh_area;
 	struct xen_pci_sharedinfo *sh_info;
 };
 
Index: head-2006-04-24/drivers/xen/pciback/xenbus.c
===================================================================
--- head-2006-04-24.orig/drivers/xen/pciback/xenbus.c	2006-04-24 11:43:44.000000000 +0200
+++ head-2006-04-24/drivers/xen/pciback/xenbus.c	2006-04-25 10:56:32.000000000 +0200
@@ -26,6 +26,7 @@ static struct pciback_device *alloc_pdev
 
 	spin_lock_init(&pdev->dev_lock);
 
+	pdev->sh_area = NULL;
 	pdev->sh_info = NULL;
 	pdev->evtchn_irq = INVALID_EVTCHN_IRQ;
 	pdev->be_watching = 0;
@@ -48,7 +49,7 @@ static void free_pdev(struct pciback_dev
 		unbind_from_irqhandler(pdev->evtchn_irq, pdev);
 
 	if (pdev->sh_info)
-		xenbus_unmap_ring_vfree(pdev->xdev, pdev->sh_info);
+		xenbus_unmap_ring_vfree(pdev->xdev, pdev->sh_area);
 
 	pciback_release_devices(pdev);
 
@@ -63,15 +64,19 @@ static int pciback_do_attach(struct pcib
 {
 	int err = 0;
 	int evtchn;
+	struct vm_struct *area;
+
 	dev_dbg(&pdev->xdev->dev,
 		"Attaching to frontend resources - gnt_ref=%d evtchn=%d\n",
 		gnt_ref, remote_evtchn);
 
-	err =
-	    xenbus_map_ring_valloc(pdev->xdev, gnt_ref,
-				   (void **)&pdev->sh_info);
-	if (err)
+	area = xenbus_map_ring_valloc(pdev->xdev, gnt_ref);
+	if (IS_ERR(area)) {
+		err = PTR_ERR(area);
 		goto out;
+	}
+	pdev->sh_area = area;
+	pdev->sh_info = area->addr;
 
 	err = xenbus_bind_evtchn(pdev->xdev, remote_evtchn, &evtchn);
 	if (err)
Index: head-2006-04-24/drivers/xen/xenbus/xenbus_backend_client.c
===================================================================
--- head-2006-04-24.orig/drivers/xen/xenbus/xenbus_backend_client.c	2006-04-24 11:43:44.000000000 +0200
+++ head-2006-04-24/drivers/xen/xenbus/xenbus_backend_client.c	2006-04-25 12:14:56.000000000 +0200
@@ -30,21 +30,20 @@
  * IN THE SOFTWARE.
  */
 
+#include <linux/err.h>
 #include <xen/gnttab.h>
 #include <xen/xenbus.h>
 #include <xen/driver_util.h>
 
 /* Based on Rusty Russell's skeleton driver's map_page */
-int xenbus_map_ring_valloc(struct xenbus_device *dev, int gnt_ref, void **vaddr)
+struct vm_struct *xenbus_map_ring_valloc(struct xenbus_device *dev, int gnt_ref)
 {
 	struct gnttab_map_grant_ref op;
 	struct vm_struct *area;
 
-	*vaddr = NULL;
-
 	area = alloc_vm_area(PAGE_SIZE);
 	if (!area)
-		return -ENOMEM;
+		return ERR_PTR(-ENOMEM);
 
 	gnttab_set_map_op(&op, (unsigned long)area->addr, GNTMAP_host_map,
 			  gnt_ref, dev->otherend_id);
@@ -58,14 +57,14 @@ int xenbus_map_ring_valloc(struct xenbus
 		xenbus_dev_fatal(dev, op.status,
 				 "mapping in shared page %d from domain %d",
 				 gnt_ref, dev->otherend_id);
-		return op.status;
+		BUG_ON(!IS_ERR(ERR_PTR(op.status)));
+		return ERR_PTR(op.status);
 	}
 
 	/* Stuff the handle in an unused field */
 	area->phys_addr = (unsigned long)op.handle;
 
-	*vaddr = area->addr;
-	return 0;
+	return area;
 }
 EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc);
 
@@ -92,30 +91,10 @@ EXPORT_SYMBOL_GPL(xenbus_map_ring);
 
 
 /* Based on Rusty Russell's skeleton driver's unmap_page */
-int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr)
+int xenbus_unmap_ring_vfree(struct xenbus_device *dev, struct vm_struct *area)
 {
-	struct vm_struct *area;
 	struct gnttab_unmap_grant_ref op;
 
-	/* It'd be nice if linux/vmalloc.h provided a find_vm_area(void *addr)
-	 * method so that we don't have to muck with vmalloc internals here.
-	 * We could force the user to hang on to their struct vm_struct from
-	 * xenbus_map_ring_valloc, but these 6 lines considerably simplify
-	 * this API.
-	 */
-	read_lock(&vmlist_lock);
-	for (area = vmlist; area != NULL; area = area->next) {
-		if (area->addr == vaddr)
-			break;
-	}
-	read_unlock(&vmlist_lock);
-
-	if (!area) {
-		xenbus_dev_error(dev, -ENOENT,
-				 "can't find mapped virtual address %p", vaddr);
-		return GNTST_bad_virt_addr;
-	}
-
 	gnttab_set_unmap_op(&op, (unsigned long)vaddr, GNTMAP_host_map,
 			    (grant_handle_t)area->phys_addr);
 
Index: head-2006-04-24/include/xen/xenbus.h
===================================================================
--- head-2006-04-24.orig/include/xen/xenbus.h	2006-04-24 11:43:43.000000000 +0200
+++ head-2006-04-24/include/xen/xenbus.h	2006-04-25 10:43:47.000000000 +0200
@@ -228,8 +228,8 @@ int xenbus_grant_ring(struct xenbus_devi
  * or -ENOMEM on error. If an error is returned, device will switch to
  * XenbusStateClosing and the error message will be saved in XenStore.
  */
-int xenbus_map_ring_valloc(struct xenbus_device *dev,
-			   int gnt_ref, void **vaddr);
+struct vm_struct *xenbus_map_ring_valloc(struct xenbus_device *dev,
+					 int gnt_ref);
 int xenbus_map_ring(struct xenbus_device *dev, int gnt_ref,
 			   grant_handle_t *handle, void *vaddr);
 
@@ -241,7 +241,7 @@ int xenbus_map_ring(struct xenbus_device
  * Returns 0 on success and returns GNTST_* on error
  * (see xen/include/interface/grant_table.h).
  */
-int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr);
+int xenbus_unmap_ring_vfree(struct xenbus_device *dev, struct vm_struct *);
 int xenbus_unmap_ring(struct xenbus_device *dev,
 		      grant_handle_t handle, void *vaddr);