--- build-32-unstable-13401/linux-2.6-xen-sparse/drivers/xen/fbfront/xenfb.c.abi	2007-01-18 17:43:07.000000000 +0100
+++ build-32-unstable-13401/linux-2.6-xen-sparse/drivers/xen/fbfront/xenfb.c	2007-01-18 17:46:29.000000000 +0100
@@ -58,7 +58,7 @@
 
 	int			irq;
 	struct xenfb_page	*page;
-	unsigned long 		*mfns;
+	u64                     *mfns;
 	int			update_wanted; /* XENFB_TYPE_UPDATE wanted */
 
 	struct xenbus_device	*xbdev;
@@ -474,12 +474,12 @@
 	if (info->pages == NULL)
 		goto error_nomem;
 
-	info->mfns = vmalloc(sizeof(unsigned long) * info->nr_pages);
+	info->mfns = vmalloc(sizeof(u64) * info->nr_pages);
 	if (!info->mfns)
 		goto error_nomem;
 
 	/* set up shared page */
-	info->page = (void *)__get_free_page(GFP_KERNEL);
+	info->page = (void *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
 	if (!info->page)
 		goto error_nomem;
 
@@ -600,6 +600,7 @@
 	for (i = 0; i < info->nr_pages; i++)
 		info->mfns[i] = vmalloc_to_mfn(info->fb + i * PAGE_SIZE);
 
+	info->page->protocol = 1;
 	info->page->pd[0] = vmalloc_to_mfn(info->mfns);
 	info->page->pd[1] = 0;
 	info->page->width = XENFB_WIDTH;
--- build-32-unstable-13401/tools/xenfb/xenfb.c.abi	2007-01-18 17:48:57.000000000 +0100
+++ build-32-unstable-13401/tools/xenfb/xenfb.c	2007-01-18 17:50:40.000000000 +0100
@@ -329,12 +329,20 @@
 	struct xenfb_page *page = xenfb->fb.page;
 	int n_fbmfns;
 	int n_fbdirs;
+	unsigned long pgmfns[2];
 	unsigned long *fbmfns;
+	uint64_t *ptr64;
+	int i;
+
+	ptr64 = page->pd;
 
 	n_fbmfns = (xenfb->fb_len + (XC_PAGE_SIZE - 1)) / XC_PAGE_SIZE;
-	n_fbdirs = n_fbmfns * sizeof(unsigned long);
+	n_fbdirs = n_fbmfns * sizeof(uint64_t);
 	n_fbdirs = (n_fbdirs + (XC_PAGE_SIZE - 1)) / XC_PAGE_SIZE;
 
+	for (i = 0; i < n_fbdirs; i++)
+		pgmfns[i] = ptr64[i];
+
 	/*
 	 * Bug alert: xc_map_foreign_batch() can fail partly and
 	 * return a non-null value.  This is a design flaw.  When it
@@ -342,18 +350,23 @@
 	 * access.
 	 */
 	fbmfns = xc_map_foreign_batch(xenfb->xc, domid,
-			PROT_READ, page->pd, n_fbdirs);
+			PROT_READ, pgmfns, n_fbdirs);
 	if (fbmfns == NULL)
 		return -1;
 
+	ptr64 = (void*)fbmfns;
+	fbmfns = malloc(n_fbmfns * sizeof(*fbmfns));
+	for (i = 0; i < n_fbmfns; i++)
+		fbmfns[i] = ptr64[i];
+	munmap(ptr64, n_fbdirs * XC_PAGE_SIZE);
+
 	xenfb->pub.pixels = xc_map_foreign_batch(xenfb->xc, domid,
 				PROT_READ | PROT_WRITE, fbmfns, n_fbmfns);
-	if (xenfb->pub.pixels == NULL) {
-		munmap(fbmfns, n_fbdirs * XC_PAGE_SIZE);
+	if (xenfb->pub.pixels == NULL)
 		return -1;
-	}
 
-	return munmap(fbmfns, n_fbdirs * XC_PAGE_SIZE);
+	free(fbmfns);
+	return 0;
 }
 
 static int xenfb_bind(struct xenfb_device *dev)
--- build-32-unstable-13401/xen/include/public/io/fbif.h.abi	2007-01-18 17:34:49.000000000 +0100
+++ build-32-unstable-13401/xen/include/public/io/fbif.h	2007-01-18 17:38:39.000000000 +0100
@@ -102,6 +102,8 @@
     uint32_t line_length;   /* the length of a row of pixels (in bytes) */
     uint32_t mem_length;    /* the length of the framebuffer (in bytes) */
     uint8_t depth;          /* the depth of a pixel (in bits) */
+    uint8_t protocol;       /* protocol version, will bump when we switch to grant tables */
+    uint8_t pad[6];         /* align next field to 64bit */
 
     /*
      * Framebuffer page directory
@@ -109,10 +111,10 @@
      * Each directory page holds PAGE_SIZE / sizeof(*pd)
      * framebuffer pages, and can thus map up to PAGE_SIZE *
      * PAGE_SIZE / sizeof(*pd) bytes.  With PAGE_SIZE == 4096 and
-     * sizeof(unsigned long) == 4, that's 4 Megs.  Two directory
+     * sizeof(uint64_t) == 8, that's 2 Megs.  Four directory
      * pages should be enough for a while.
      */
-    unsigned long pd[2];
+    uint64_t pd[4];
 };
 
 /*